)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":12,"context_line":"If a backend is compromised by an attacker they can easily get the credentials"},{"line_number":13,"context_line":"for any user.  Also, anyone within an organization can look at the credentials"},{"line_number":14,"context_line":"in the backend bypassing any security access controls offered by Keystone."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"bab6814e_9d78362d","line":15,"updated":"2016-05-19 20:12:20.000000000","message":"Most security standards have requirements for \"Encryption at rest\"","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":12,"context_line":"If a backend is compromised by an attacker they can easily get the credentials"},{"line_number":13,"context_line":"for any user.  Also, anyone within an organization can look at the credentials"},{"line_number":14,"context_line":"in the backend bypassing any security access controls offered by Keystone."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"bab6814e_b197218f","line":15,"in_reply_to":"bab6814e_9d78362d","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"accessible to anyone with access to the backend.  If a backend is compromised"},{"line_number":12,"context_line":"by an attacker they can easily get the credentials for any user.  Also, anyone"},{"line_number":13,"context_line":"within an organization can look at the credentials in the backend bypassing any"},{"line_number":14,"context_line":"security access controls offered by Keystone."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"bab6814e_2bad5984","line":14,"updated":"2016-05-26 13:01:30.000000000","message":"bp credential-encryption","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":11,"context_line":"accessible to anyone with access to the backend.  If a backend is compromised"},{"line_number":12,"context_line":"by an attacker they can easily get the credentials for any user.  Also, anyone"},{"line_number":13,"context_line":"within an organization can look at the credentials in the backend bypassing any"},{"line_number":14,"context_line":"security access controls offered by Keystone."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"bab6814e_c92c80ae","line":14,"in_reply_to":"bab6814e_2bad5984","updated":"2016-05-26 20:53:20.000000000","message":"Done","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Support encryption of credentials in Keystone"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Most security standards have requirements for \"Encryption at rest\"."},{"line_number":10,"context_line":"Credentials in Keystone are currently being stored in the backend and are"},{"line_number":11,"context_line":"accessible to anyone with access to the backend.  If a backend is compromised"},{"line_number":12,"context_line":"by an attacker they can easily get the credentials for any user.  Also, anyone"},{"line_number":13,"context_line":"within an organization can look at the credentials in the backend bypassing any"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"3aaa91ec_576054cf","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":73},"updated":"2016-06-29 17:11:24.000000000","message":"(nit) These lines should be wrapped at 72 characters: https://wiki.openstack.org/wiki/GitCommitMessages#Summary_of_Git_commit_message_structure","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Support encryption of credentials in Keystone"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Most security standards have requirements for \"Encryption at rest\"."},{"line_number":10,"context_line":"Credentials in Keystone are currently being stored in the backend and are"},{"line_number":11,"context_line":"accessible to anyone with access to the backend.  If a backend is compromised"},{"line_number":12,"context_line":"by an attacker they can easily get the credentials for any user.  Also, anyone"},{"line_number":13,"context_line":"within an organization can look at the credentials in the backend bypassing any"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"3aaa91ec_cb001c69","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":73},"in_reply_to":"3aaa91ec_576054cf","updated":"2016-06-29 19:57:21.000000000","message":"Done","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d3e795a1c8b40c07f563e3668f03909b30e6fa56","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2016-08-17 17:12:43 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Implement encryption of credentials at rest"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Co-Authored-By: Werner Mendizabal \u003cnonameentername@gmail.com\u003e"},{"line_number":10,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":33,"id":"3ac371cc_88642cb9","line":8,"updated":"2016-08-18 05:00:55.000000000","message":"beef this up a bit","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5ff3d588e5b2693398d8179f9aac07c83f84b8a4","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2016-08-17 17:12:43 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Implement encryption of credentials at rest"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Co-Authored-By: Werner Mendizabal \u003cnonameentername@gmail.com\u003e"},{"line_number":10,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":33,"id":"1ac06dbe_de1cd779","line":8,"in_reply_to":"3ac371cc_794d0bc4","updated":"2016-08-19 14:39:08.000000000","message":"I was going to point out that you\u0027re missing \"bp credential-encryption\" on this one.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dcfd47854361ade0d2892ab552c2610bb12301f8","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2016-08-17 17:12:43 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Implement encryption of credentials at rest"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Co-Authored-By: Werner Mendizabal \u003cnonameentername@gmail.com\u003e"},{"line_number":10,"context_line":"Change-Id: Id7c6be07b7665a5f8e5372fc2d2ea8c27cb9524a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":33,"id":"3ac371cc_794d0bc4","line":8,"in_reply_to":"3ac371cc_88642cb9","updated":"2016-08-18 18:59:32.000000000","message":"Will do - I\u0027m going to collapse this into https://review.openstack.org/#/c/355618/7 since there are things in that commit that need things from this one.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"}],"doc/source/credential-encryption.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Credential Encryption"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":19,"context_line":"    - Add new fernet-key to encryption_keys on all keystone nodes."},{"line_number":20,"context_line":"    - Update the active key on all keystone nodes."}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_f30e9f8a","line":17,"updated":"2016-05-31 21:59:50.000000000","message":"It might also be worth explaining why Fernet token keys cannot be used here, or why they\u0027re not as viable an option as having dedicated encryption keys. We\u0027re inevitably going to get a bug report or something asking to combine them.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Credential Encryption"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":19,"context_line":"    - Add new fernet-key to encryption_keys on all keystone nodes."},{"line_number":20,"context_line":"    - Update the active key on all keystone nodes."}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_e84e8039","line":17,"in_reply_to":"9abb7d3a_f30e9f8a","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":19,"context_line":"    - Add new fernet-key to encryption_keys on all keystone nodes."},{"line_number":20,"context_line":"    - Update the active key on all keystone nodes."},{"line_number":21,"context_line":"    - Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_537e8b19","line":19,"updated":"2016-05-31 21:59:50.000000000","message":"nit: these don\u0027t need to be indented... the indentation is being rendered that way:\n\n  http://docs-draft.openstack.org/69/317169/11/check/gate-keystone-docs/1fc5f35//doc/build/html/credential-encryption.html","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":19,"context_line":"    - Add new fernet-key to encryption_keys on all keystone nodes."},{"line_number":20,"context_line":"    - Update the active key on all keystone nodes."},{"line_number":21,"context_line":"    - Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_b5aa1183","line":19,"in_reply_to":"9abb7d3a_537e8b19","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":27,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":28,"context_line":"adding the list of fernet encryption_keys and the index for the current"},{"line_number":29,"context_line":"active_key.  The active_key is used for encrypting credentials when adding and"},{"line_number":30,"context_line":"updating them.  All encryption_keys are used for decryption of credentials."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_f337bf4a","line":30,"updated":"2016-05-31 21:59:50.000000000","message":"``encryption_keys``","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":27,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":28,"context_line":"adding the list of fernet encryption_keys and the index for the current"},{"line_number":29,"context_line":"active_key.  The active_key is used for encrypting credentials when adding and"},{"line_number":30,"context_line":"updating them.  All encryption_keys are used for decryption of credentials."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_7592694d","line":30,"in_reply_to":"9abb7d3a_f337bf4a","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":34,"context_line":"credentials instead of throwing an error.  allow_plaintext should be set to"},{"line_number":35,"context_line":"false after all credentials are migrated using ``keystone_manage db_encrypt``"},{"line_number":36,"context_line":"to catch encryption errors due to misconfiguration."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_73ed8fb6","line":34,"updated":"2016-05-31 21:59:50.000000000","message":"``allow_plaintext``","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":34,"context_line":"credentials instead of throwing an error.  allow_plaintext should be set to"},{"line_number":35,"context_line":"false after all credentials are migrated using ``keystone_manage db_encrypt``"},{"line_number":36,"context_line":"to catch encryption errors due to misconfiguration."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_f5cdb966","line":34,"in_reply_to":"9abb7d3a_73ed8fb6","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":34,"context_line":"credentials instead of throwing an error.  allow_plaintext should be set to"},{"line_number":35,"context_line":"false after all credentials are migrated using ``keystone_manage db_encrypt``"},{"line_number":36,"context_line":"to catch encryption errors due to misconfiguration."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Example configuration:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_33f7878c","line":35,"updated":"2016-05-31 21:59:50.000000000","message":"nit: ``false``","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":33,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":34,"context_line":"credentials instead of throwing an error.  allow_plaintext should be set to"},{"line_number":35,"context_line":"false after all credentials are migrated using ``keystone_manage db_encrypt``"},{"line_number":36,"context_line":"to catch encryption errors due to misconfiguration."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Example configuration:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_95e9cdb9","line":35,"in_reply_to":"9abb7d3a_33f7878c","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    [Credential]"},{"line_number":43,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":44,"context_line":"    active_key \u003d 1"},{"line_number":45,"context_line":"    allow_plaintext \u003d True"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Credential Migration"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_b30a5788","line":44,"updated":"2016-05-31 21:59:50.000000000","message":"It\u0027s not clear to me which key this is referencing... is it intended to be zero indexed? Can we not just use the first key that appears in the list as the active key, by convention? If you want db_encrypt to migrate to something else, you should make that the first key in the list.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    [Credential]"},{"line_number":43,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":44,"context_line":"    active_key \u003d 1"},{"line_number":45,"context_line":"    allow_plaintext \u003d True"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Credential Migration"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_f5fbf976","line":44,"in_reply_to":"9abb7d3a_b30a5788","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"All keystone nodes that access the backend should have the same configuration"},{"line_number":51,"context_line":"with the encryption_keys value set before running the credential migration."},{"line_number":52,"context_line":"Once all keystone nodes are configured the credentials can be migrated with"},{"line_number":53,"context_line":"the following command:"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_1397e33a","line":51,"updated":"2016-05-31 21:59:50.000000000","message":"nit: ``encryption_keys``","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"All keystone nodes that access the backend should have the same configuration"},{"line_number":51,"context_line":"with the encryption_keys value set before running the credential migration."},{"line_number":52,"context_line":"Once all keystone nodes are configured the credentials can be migrated with"},{"line_number":53,"context_line":"the following command:"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_3558e155","line":51,"in_reply_to":"9abb7d3a_1397e33a","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Fernet token keys are not a viable option as dedicated encryption keys for"},{"line_number":19,"context_line":"credential encryption.  Token keys need to be rotated more often since tokens"},{"line_number":20,"context_line":"are not persisted and are given to the user.  Credential encryption keys do not"},{"line_number":21,"context_line":"need to be rotated as often since the encrypted credentials is not exposed to"},{"line_number":22,"context_line":"the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_8f121657","line":21,"updated":"2016-06-02 16:13:42.000000000","message":"nit: s/since/because/ s/is/are/","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Fernet token keys are not a viable option as dedicated encryption keys for"},{"line_number":19,"context_line":"credential encryption.  Token keys need to be rotated more often since tokens"},{"line_number":20,"context_line":"are not persisted and are given to the user.  Credential encryption keys do not"},{"line_number":21,"context_line":"need to be rotated as often since the encrypted credentials is not exposed to"},{"line_number":22,"context_line":"the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_be129c56","line":21,"in_reply_to":"9abb7d3a_8f121657","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet encryption_keys.  The ``active_key`` is the first key"},{"line_number":35,"context_line":"in the list of encryption_keys.  The active_key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_2f720aae","line":34,"updated":"2016-06-02 16:13:42.000000000","message":"Because this is no longer referring to a literal configuration variable:\n\n   ``active_key``\n\n... you can just write it normally throughout:\n\n   active key","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet encryption_keys.  The ``active_key`` is the first key"},{"line_number":35,"context_line":"in the list of encryption_keys.  The active_key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_fe4a6454","line":34,"in_reply_to":"9abb7d3a_2f720aae","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet encryption_keys.  The ``active_key`` is the first key"},{"line_number":35,"context_line":"in the list of encryption_keys.  The active_key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_8f95f689","line":35,"updated":"2016-06-02 16:13:42.000000000","message":"nit: use double backticks around literals consistently!","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet encryption_keys.  The ``active_key`` is the first key"},{"line_number":35,"context_line":"in the list of encryption_keys.  The active_key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"9abb7d3a_9e64f8e5","line":35,"in_reply_to":"9abb7d3a_8f95f689","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":22,"context_line":"to the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":25,"context_line":"- Add new fernet-key to ``encryption_keys`` on all keystone nodes."},{"line_number":26,"context_line":"- Update the active key on all keystone nodes."},{"line_number":27,"context_line":"- Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_2a9f7304","line":25,"range":{"start_line":25,"start_character":10,"end_line":25,"end_character":20},"updated":"2016-06-28 19:58:44.000000000","message":"fernet keys*","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":22,"context_line":"to the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":25,"context_line":"- Add new fernet-key to ``encryption_keys`` on all keystone nodes."},{"line_number":26,"context_line":"- Update the active key on all keystone nodes."},{"line_number":27,"context_line":"- Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_b21d4d64","line":25,"range":{"start_line":25,"start_character":10,"end_line":25,"end_character":20},"in_reply_to":"3aaa91ec_2a9f7304","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":25,"context_line":"- Add new fernet-key to ``encryption_keys`` on all keystone nodes."},{"line_number":26,"context_line":"- Update the active key on all keystone nodes."},{"line_number":27,"context_line":"- Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Configuring Encryption"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_aae523a9","line":27,"range":{"start_line":27,"start_character":6,"end_line":27,"end_character":32},"updated":"2016-06-28 19:58:44.000000000","message":"backticks","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Key rotation should be handled by doing the following:"},{"line_number":25,"context_line":"- Add new fernet-key to ``encryption_keys`` on all keystone nodes."},{"line_number":26,"context_line":"- Update the active key on all keystone nodes."},{"line_number":27,"context_line":"- Use keystone-manage db_encrypt to re-encrypt existing credentials."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Configuring Encryption"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_b2542dfe","line":27,"range":{"start_line":27,"start_character":6,"end_line":27,"end_character":32},"in_reply_to":"3aaa91ec_aae523a9","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":29,"context_line":"Configuring Encryption"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet ``encryption_keys``.  The active key is the first key"},{"line_number":35,"context_line":"in the list of ``encryption_keys``.  The active key is used for encrypting"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_ea628b15","line":32,"range":{"start_line":32,"start_character":0,"end_line":32,"end_character":61},"updated":"2016-06-28 19:58:44.000000000","message":"Credentials will not be encrypted by default.","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":29,"context_line":"Configuring Encryption"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet ``encryption_keys``.  The active key is the first key"},{"line_number":35,"context_line":"in the list of ``encryption_keys``.  The active key is used for encrypting"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_d26619ec","line":32,"range":{"start_line":32,"start_character":0,"end_line":32,"end_character":61},"in_reply_to":"3aaa91ec_ea628b15","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet ``encryption_keys``.  The active key is the first key"},{"line_number":35,"context_line":"in the list of ``encryption_keys``.  The active key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_0a70b7db","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":6},"updated":"2016-06-28 19:58:44.000000000","message":"add*","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Credential encryption will not encrypt credentials by default."},{"line_number":33,"context_line":"To enable encryption update the ``[credential]`` section in ``keystone.conf``"},{"line_number":34,"context_line":"adding the list of fernet ``encryption_keys``.  The active key is the first key"},{"line_number":35,"context_line":"in the list of ``encryption_keys``.  The active key is used for encrypting"},{"line_number":36,"context_line":"credentials when adding and updating them.  All ``encryption_keys`` are used"},{"line_number":37,"context_line":"for decryption of credentials."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_b2a26dfa","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":6},"in_reply_to":"3aaa91ec_0a70b7db","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":37,"context_line":"for decryption of credentials."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":40,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":41,"context_line":"credentials instead of throwing an error.  ``allow_plaintext`` should be set to"},{"line_number":42,"context_line":"``false`` after all credentials are migrated using"},{"line_number":43,"context_line":"``keystone_manage db_encrypt`` to catch encryption errors due to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_6a54db53","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":15},"updated":"2016-06-28 19:58:44.000000000","message":"backticks here ``","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":37,"context_line":"for decryption of credentials."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":40,"context_line":"allow_plaintext can be set to true to allow decryption to return non-encrypted"},{"line_number":41,"context_line":"credentials instead of throwing an error.  ``allow_plaintext`` should be set to"},{"line_number":42,"context_line":"``false`` after all credentials are migrated using"},{"line_number":43,"context_line":"``keystone_manage db_encrypt`` to catch encryption errors due to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_d294598c","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":15},"in_reply_to":"3aaa91ec_6a54db53","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":".. code-block:: ini"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    [Credential]"},{"line_number":51,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":52,"context_line":"    allow_plaintext \u003d True"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_0a29d737","line":50,"range":{"start_line":50,"start_character":5,"end_line":50,"end_character":15},"updated":"2016-06-28 19:58:44.000000000","message":"lower case","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":".. code-block:: ini"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    [Credential]"},{"line_number":51,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":52,"context_line":"    allow_plaintext \u003d True"},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_b2f0adfe","line":50,"range":{"start_line":50,"start_character":5,"end_line":50,"end_character":15},"in_reply_to":"3aaa91ec_0a29d737","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Once all keystone nodes are configured the credentials can be migrated with"},{"line_number":60,"context_line":"the following command:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: ini"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    keystone-manage db_encrypt"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_8d2fa187","line":62,"range":{"start_line":62,"start_character":16,"end_line":62,"end_character":19},"updated":"2016-06-28 19:58:44.000000000","message":"bash*","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Once all keystone nodes are configured the credentials can be migrated with"},{"line_number":60,"context_line":"the following command:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: ini"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    keystone-manage db_encrypt"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_32531de4","line":62,"range":{"start_line":62,"start_character":16,"end_line":62,"end_character":19},"in_reply_to":"3aaa91ec_8d2fa187","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b88e53e34e9fcebb6f2a57de418c3ec6061be15","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: ini"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    keystone-manage db_encrypt"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The above command will retrieve all credentials and re-encrypt them using the"},{"line_number":67,"context_line":"current active key."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_ed4c6578","line":64,"range":{"start_line":64,"start_character":4,"end_line":64,"end_character":30},"updated":"2016-06-28 19:58:44.000000000","message":"add a $ before the command to show it is run in a shell","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"aeb7b285b5b7b78551b6d249d7d12eb8ee22a6bf","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: ini"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    keystone-manage db_encrypt"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The above command will retrieve all credentials and re-encrypt them using the"},{"line_number":67,"context_line":"current active key."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3aaa91ec_520b49d6","line":64,"range":{"start_line":64,"start_character":4,"end_line":64,"end_character":30},"in_reply_to":"3aaa91ec_ed4c6578","updated":"2016-06-29 15:21:40.000000000","message":"Done","commit_id":"4b6a14800874ad3bd41bc89740283867378d4868"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Credential Encryption"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Fernet token keys are not a viable option as dedicated encryption keys for"},{"line_number":19,"context_line":"credential encryption.  Token keys need to be rotated more often since tokens"},{"line_number":20,"context_line":"are not persisted and are given to the user.  Credential encryption keys do not"},{"line_number":21,"context_line":"need to be rotated as often because the encrypted credentials are not exposed"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3aaa91ec_776470b8","line":18,"updated":"2016-06-29 17:11:24.000000000","message":"I expected this to be a description of what \u0027Credential Encryption\u0027 actually means. I\u0027m not sure what Fernet token keys has to do with it.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Credential Encryption"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Fernet token keys are not a viable option as dedicated encryption keys for"},{"line_number":19,"context_line":"credential encryption.  Token keys need to be rotated more often since tokens"},{"line_number":20,"context_line":"are not persisted and are given to the user.  Credential encryption keys do not"},{"line_number":21,"context_line":"need to be rotated as often because the encrypted credentials are not exposed"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3aaa91ec_cb5c9c7f","line":18,"in_reply_to":"3aaa91ec_776470b8","updated":"2016-06-29 19:57:21.000000000","message":"Done","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"3aaa91ec_a20b3823","line":68,"updated":"2016-06-29 17:11:24.000000000","message":"What is the process for rotating the keys?","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"ef4744ccbc06fd8983bd89ba0fa76f0f3b52d22d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"3aaa91ec_e406e51a","line":68,"in_reply_to":"3aaa91ec_29c6089a","updated":"2016-06-29 20:32:10.000000000","message":"I\u0027ll update the docs.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6c86c64e30f1c99c44fde60faf530ce5cd1e2135","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"3aaa91ec_29c6089a","line":68,"in_reply_to":"3aaa91ec_2e272ecb","updated":"2016-06-29 20:14:01.000000000","message":"We should put this in the docs too","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"0977001e4bcd2d6d0cc6f549f073007178a5ec14","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"3aaa91ec_2e272ecb","line":68,"in_reply_to":"3aaa91ec_a20b3823","updated":"2016-06-29 20:05:43.000000000","message":"To allow having no downtime:\n\nUpdate encryption_keys adding a new encryption_key to all nodes.  This should be at the end of the list.\nExecute keystone-manage db_encrypt.\nUpdate encryption_keys to set active encryption_key to the new key.  Move the new key to the beginning of the list.\n\nThis is done to only use the active key for encryption once all nodes have the key.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":3,"context_line":"      not use this file except in compliance with the License. You may obtain"},{"line_number":4,"context_line":"      a copy of the License at"}],"source_content_type":"text/x-rst","patch_set":21,"id":"1aa78d24_f66f9628","line":1,"updated":"2016-07-12 19:27:38.000000000","message":"I think that there is a good amount of work to be done here to reflect the on-disk key storage.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":3,"context_line":"      not use this file except in compliance with the License. You may obtain"},{"line_number":4,"context_line":"      a copy of the License at"}],"source_content_type":"text/x-rst","patch_set":21,"id":"1aa78d24_a58668b6","line":1,"in_reply_to":"1aa78d24_f66f9628","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":55,"context_line":".. code-block:: ini"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    [credential]"},{"line_number":58,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":59,"context_line":"    allow_plaintext \u003d True"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Credential Migration"}],"source_content_type":"text/x-rst","patch_set":21,"id":"1aa78d24_96e8d2b4","line":58,"updated":"2016-07-12 18:02:35.000000000","message":"Is this still the approach we are going with? According to the configuration, it looks like there is going to be file-backed keys stored on disk, not in config?","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":55,"context_line":".. code-block:: ini"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    [credential]"},{"line_number":58,"context_line":"    encryption_keys \u003d \u003cfernet_key\u003e,\u003cfernet_key\u003e"},{"line_number":59,"context_line":"    allow_plaintext \u003d True"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Credential Migration"}],"source_content_type":"text/x-rst","patch_set":21,"id":"1aa78d24_65b76085","line":58,"in_reply_to":"1aa78d24_96e8d2b4","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Credentials will not be encrypted by default."},{"line_number":32,"context_line":"To enable encryption run the command ``keystone-manage credetnail_setup``.  The"},{"line_number":33,"context_line":"generated keys should be distributed on all nodes running keystone."},{"line_number":34,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":35,"context_line":"``allow_plaintext`` can be set to true to allow decryption to return"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1aa78d24_f8fe2f68","line":32,"updated":"2016-07-13 15:32:03.000000000","message":"credential*","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Credentials will not be encrypted by default."},{"line_number":32,"context_line":"To enable encryption run the command ``keystone-manage credetnail_setup``.  The"},{"line_number":33,"context_line":"generated keys should be distributed on all nodes running keystone."},{"line_number":34,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":35,"context_line":"``allow_plaintext`` can be set to true to allow decryption to return"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1aa78d24_14e2da01","line":32,"in_reply_to":"1aa78d24_f8fe2f68","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Credentials will not be encrypted by default."},{"line_number":32,"context_line":"To enable encryption run the command ``keystone-manage credetnail_setup``.  The"},{"line_number":33,"context_line":"generated keys should be distributed on all nodes running keystone."},{"line_number":34,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":35,"context_line":"``allow_plaintext`` can be set to true to allow decryption to return"},{"line_number":36,"context_line":"non-encrypted credentials instead of throwing an error.  ``allow_plaintext``"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1aa78d24_d82c1304","line":33,"updated":"2016-07-13 15:32:03.000000000","message":"s/should/will need to/","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Credentials will not be encrypted by default."},{"line_number":32,"context_line":"To enable encryption run the command ``keystone-manage credetnail_setup``.  The"},{"line_number":33,"context_line":"generated keys should be distributed on all nodes running keystone."},{"line_number":34,"context_line":"To support credentials that were previously created without encryption,"},{"line_number":35,"context_line":"``allow_plaintext`` can be set to true to allow decryption to return"},{"line_number":36,"context_line":"non-encrypted credentials instead of throwing an error.  ``allow_plaintext``"}],"source_content_type":"text/x-rst","patch_set":22,"id":"1aa78d24_54ec62f3","line":33,"in_reply_to":"1aa78d24_d82c1304","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"etc/keystone.conf.sample":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":512,"context_line":""},{"line_number":513,"context_line":"# credential encryption and decryption keys.  Encryption key is used for both"},{"line_number":514,"context_line":"# encryption and decryption"},{"line_number":515,"context_line":"#encryption_key \u003d"},{"line_number":516,"context_line":"#decryption_key \u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_20e121d1","line":515,"updated":"2016-05-19 20:12:20.000000000","message":"With this design it is impossible to rotate keys","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":512,"context_line":""},{"line_number":513,"context_line":"# credential encryption and decryption keys.  Encryption key is used for both"},{"line_number":514,"context_line":"# encryption and decryption"},{"line_number":515,"context_line":"#encryption_key \u003d"},{"line_number":516,"context_line":"#decryption_key \u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_3224a1c3","line":515,"in_reply_to":"bab6814e_20e121d1","updated":"2016-05-20 18:42:16.000000000","message":"Yes, I updated the config to make it more clear.\n\nencryption_keys \u003d key1,key2\nactive_key \u003d 0\n\nencryption_keys will contain the keys to use for encryption and active_key the index to the current active key for encryption.\n\nTo rotate keys an operator would add a new encryption_key to all nodes and then update active_key on all nodes to n+1","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6fd81dcd8be49f27f5ace1daaf3bf327092fa718","unresolved":false,"context_lines":[{"line_number":512,"context_line":""},{"line_number":513,"context_line":"# credential encryption and decryption keys.  Encryption key is used for both"},{"line_number":514,"context_line":"# encryption and decryption"},{"line_number":515,"context_line":"#encryption_key \u003d"},{"line_number":516,"context_line":"#decryption_key \u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_f1d97423","line":515,"in_reply_to":"bab6814e_3224a1c3","updated":"2016-05-20 18:58:52.000000000","message":"It seems to me that a better model may be to just follow the approach that fernet tokens uses.","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":513,"context_line":"# credential encryption and decryption keys.  Encryption key is used for both"},{"line_number":514,"context_line":"# encryption and decryption"},{"line_number":515,"context_line":"#encryption_key \u003d"},{"line_number":516,"context_line":"#decryption_key \u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_ddc0fe2c","line":516,"updated":"2016-05-19 20:12:20.000000000","message":"What is this for?","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":513,"context_line":"# credential encryption and decryption keys.  Encryption key is used for both"},{"line_number":514,"context_line":"# encryption and decryption"},{"line_number":515,"context_line":"#encryption_key \u003d"},{"line_number":516,"context_line":"#decryption_key \u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_922d8daa","line":516,"in_reply_to":"bab6814e_ddc0fe2c","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":511,"context_line":"#provider \u003d fernet"},{"line_number":512,"context_line":""},{"line_number":513,"context_line":"# credential encryption and decryption keys."},{"line_number":514,"context_line":"#encryption_keys \u003d"},{"line_number":515,"context_line":"# Index to the current active credential for encryption defaults to 0"},{"line_number":516,"context_line":"#active_key \u003d 0"},{"line_number":517,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"bab6814e_0b005565","line":514,"updated":"2016-05-26 13:01:30.000000000","message":"it\u0027s weird don\u0027t see any default value here, is it right? if this doesn\u0027t have default value, please make this  \u0027\u003d \u003cNone\u003e\u0027","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":511,"context_line":"#provider \u003d fernet"},{"line_number":512,"context_line":""},{"line_number":513,"context_line":"# credential encryption and decryption keys."},{"line_number":514,"context_line":"#encryption_keys \u003d"},{"line_number":515,"context_line":"# Index to the current active credential for encryption defaults to 0"},{"line_number":516,"context_line":"#active_key \u003d 0"},{"line_number":517,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":8,"id":"bab6814e_a9001c03","line":514,"in_reply_to":"bab6814e_0b005565","updated":"2016-05-26 20:53:20.000000000","message":"Done","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":516,"context_line":"#active_key \u003d 0"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."},{"line_number":520,"context_line":"#allow_plaintext \u003d True"},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"[database]"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"9abb7d3a_f385ffce","line":519,"updated":"2016-05-31 21:59:50.000000000","message":"s/migrated/encrypted/ makes more sense in this context to me","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":516,"context_line":"#active_key \u003d 0"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."},{"line_number":520,"context_line":"#allow_plaintext \u003d True"},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"[database]"}],"source_content_type":"application/octet-stream","patch_set":11,"id":"9abb7d3a_08eca4f1","line":519,"in_reply_to":"9abb7d3a_f385ffce","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."},{"line_number":520,"context_line":"#allow_plaintext \u003d True"},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"[database]"},{"line_number":523,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":11,"id":"9abb7d3a_937593fb","line":520,"updated":"2016-05-31 21:59:50.000000000","message":"Did you use tox -e genconfig to generate this file? I\u0027ve never seen it produce a capitalized \"True\" in an ini file before. Either way, the help text is out of date, and the config needs to be regenerated anyway.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":517,"context_line":""},{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend."},{"line_number":519,"context_line":"# This should be disabled once credentials have been migrated."},{"line_number":520,"context_line":"#allow_plaintext \u003d True"},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"[database]"},{"line_number":523,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":11,"id":"9abb7d3a_489b4c18","line":520,"in_reply_to":"9abb7d3a_937593fb","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a3b62cb8ae98a3c373015393371292536d4af0fa","unresolved":false,"context_lines":[{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":519,"context_line":"# should be disabled once credentials have been encrypted using the keystone-"},{"line_number":520,"context_line":"# manage db_encrypt command. (boolean value)"},{"line_number":521,"context_line":"#allow_plaintext \u003d true"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":""},{"line_number":524,"context_line":"[database]"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"7aa08908_fc50c00c","line":521,"updated":"2016-06-09 16:53:03.000000000","message":"Isn\u0027t this generated automatically? Looks like it is: \n\nhttps://review.openstack.org/#/c/321781/","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"e3c5eb2b6bf1cffb7b9a0ac1f5e00ca305f98b64","unresolved":false,"context_lines":[{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":519,"context_line":"# should be disabled once credentials have been encrypted using the keystone-"},{"line_number":520,"context_line":"# manage db_encrypt command. (boolean value)"},{"line_number":521,"context_line":"#allow_plaintext \u003d true"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":""},{"line_number":524,"context_line":"[database]"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"7aa08908_a514179f","line":521,"in_reply_to":"7aa08908_e1d00cfa","updated":"2016-06-10 18:11:04.000000000","message":"I used the process to update it, but only added my changes.  There are deprecation warnings that would have been overridden that I didn\u0027t want to replace.","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"22a0eff92f3937d72bc318fd6277522badc5f621","unresolved":false,"context_lines":[{"line_number":518,"context_line":"# Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":519,"context_line":"# should be disabled once credentials have been encrypted using the keystone-"},{"line_number":520,"context_line":"# manage db_encrypt command. (boolean value)"},{"line_number":521,"context_line":"#allow_plaintext \u003d true"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":""},{"line_number":524,"context_line":"[database]"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"7aa08908_e1d00cfa","line":521,"in_reply_to":"7aa08908_fc50c00c","updated":"2016-06-09 19:55:49.000000000","message":"As long as you update it using the same process so as to not cause a merge conflict, you *can* update it. Or, which I think Lance prefers, you can just exclude the file from your commit and let the bot provide the update, which is guaranteed to be safe.","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"}],"keystone/cmd/cli.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from keystone.common import sql"},{"line_number":32,"context_line":"from keystone.common.sql import migration_helpers"},{"line_number":33,"context_line":"from keystone.common import utils"},{"line_number":34,"context_line":"from keystone.credential.controllers import CredentialV3"},{"line_number":35,"context_line":"from keystone import exception"},{"line_number":36,"context_line":"from keystone.federation import idp"},{"line_number":37,"context_line":"from keystone.federation import utils as mapping_engine"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_3d2caa01","line":34,"updated":"2016-05-19 20:12:20.000000000","message":"Only import modules","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from keystone.common import sql"},{"line_number":32,"context_line":"from keystone.common.sql import migration_helpers"},{"line_number":33,"context_line":"from keystone.common import utils"},{"line_number":34,"context_line":"from keystone.credential.controllers import CredentialV3"},{"line_number":35,"context_line":"from keystone import exception"},{"line_number":36,"context_line":"from keystone.federation import idp"},{"line_number":37,"context_line":"from keystone.federation import utils as mapping_engine"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_8d60d2d0","line":34,"in_reply_to":"bab6814e_3d2caa01","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":372,"context_line":"        migration_helpers.sync_database_to_version(extension, version)"},{"line_number":373,"context_line":""},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"class DbEncrypt(BaseApp):"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":378,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_209f61b5","line":375,"updated":"2016-05-19 20:12:20.000000000","message":"What is this for? Needs some documentation","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":372,"context_line":"        migration_helpers.sync_database_to_version(extension, version)"},{"line_number":373,"context_line":""},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"class DbEncrypt(BaseApp):"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":378,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_eda19e47","line":375,"in_reply_to":"bab6814e_209f61b5","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":391,"context_line":""},{"line_number":392,"context_line":"    def do_encrypt(self):"},{"line_number":393,"context_line":"        refs \u003d self.credential_api.list_credentials()"},{"line_number":394,"context_line":"        refs \u003d [self.credential_controller._blob_to_json(r) for r in refs]"},{"line_number":395,"context_line":"        refs \u003d [self.credential_controller._decrypt_blob(r) for r in refs]"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"        for ref in refs:"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_7d8472d3","line":394,"updated":"2016-05-19 20:12:20.000000000","message":"We shouldn\u0027t be using protected methods. There are a couple of occurrences in this method.","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":391,"context_line":""},{"line_number":392,"context_line":"    def do_encrypt(self):"},{"line_number":393,"context_line":"        refs \u003d self.credential_api.list_credentials()"},{"line_number":394,"context_line":"        refs \u003d [self.credential_controller._blob_to_json(r) for r in refs]"},{"line_number":395,"context_line":"        refs \u003d [self.credential_controller._decrypt_blob(r) for r in refs]"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"        for ref in refs:"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_6818fc75","line":394,"in_reply_to":"bab6814e_7d8472d3","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":373,"context_line":""},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"class DbEncrypt(BaseApp):"},{"line_number":376,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key.\"\"\""},{"line_number":377,"context_line":""},{"line_number":378,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":379,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_11f51856","line":376,"updated":"2016-05-20 19:16:41.000000000","message":"This requires some coordination that should be documented. The first step is to add the new key to the keystone configs and make it the active one. Once this is the case this can be run to re-encrypt the data. A optional (but i think recommended) last step would be to remove the old key from the config.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":373,"context_line":""},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"class DbEncrypt(BaseApp):"},{"line_number":376,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key.\"\"\""},{"line_number":377,"context_line":""},{"line_number":378,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":379,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_b972e3ae","line":376,"in_reply_to":"bab6814e_11f51856","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":391,"context_line":"        klass.do_encrypt()"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"    def do_encrypt(self):"},{"line_number":394,"context_line":"        refs \u003d self.credential_api.list_credentials()"},{"line_number":395,"context_line":"        refs \u003d [self.credential_controller.decrypt_credential(r) for r in refs]"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"        for ref in refs:"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_51a2004c","line":394,"updated":"2016-05-20 19:16:41.000000000","message":"We probably can\u0027t do them all like this and would have to page through the data if we have lots of credentials.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":391,"context_line":"        klass.do_encrypt()"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"    def do_encrypt(self):"},{"line_number":394,"context_line":"        refs \u003d self.credential_api.list_credentials()"},{"line_number":395,"context_line":"        refs \u003d [self.credential_controller.decrypt_credential(r) for r in refs]"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"        for ref in refs:"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_f96c6bd2","line":394,"in_reply_to":"bab6814e_51a2004c","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    this should be set to false to catch encryption errors due to invalid keys."},{"line_number":385,"context_line":"    \"\"\""},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"    def __init__(self):"},{"line_number":390,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_ab74a9fd","line":387,"updated":"2016-05-26 13:01:30.000000000","message":"if this is a constraint, please make this uppercase, if don\u0027t why not include it the __init__?","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    this should be set to false to catch encryption errors due to invalid keys."},{"line_number":385,"context_line":"    \"\"\""},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"    def __init__(self):"},{"line_number":390,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_44a235fd","line":387,"in_reply_to":"bab6814e_ab74a9fd","updated":"2016-05-26 20:53:20.000000000","message":"All the other classes in the cli use lowercase name for the command name.","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":376,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key."},{"line_number":377,"context_line":""},{"line_number":378,"context_line":"    keystone.conf needs to be updated before running this script:"},{"line_number":379,"context_line":"    encryption_keys should have a valid fernet key and"},{"line_number":380,"context_line":"    active_key should also be set to the index of active encryption_key"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    allow_plaintext should be set to true the first time running the script."}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_5327abc9","line":379,"updated":"2016-05-31 21:59:50.000000000","message":"Mention which config [section] these are referring to, as you can have the same config names in different sections.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":376,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key."},{"line_number":377,"context_line":""},{"line_number":378,"context_line":"    keystone.conf needs to be updated before running this script:"},{"line_number":379,"context_line":"    encryption_keys should have a valid fernet key and"},{"line_number":380,"context_line":"    active_key should also be set to the index of active encryption_key"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"    allow_plaintext should be set to true the first time running the script."}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_ab40f207","line":379,"in_reply_to":"9abb7d3a_5327abc9","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    this should be set to false to catch encryption errors due to invalid keys."},{"line_number":385,"context_line":"    \"\"\""},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"    def __init__(self):"},{"line_number":390,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_f314df4d","line":387,"updated":"2016-05-31 21:59:50.000000000","message":"Is this the best command name, given that the implementation is entirely focused on credentials? Will we ever extend this to encrypt anything else in the backend?","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    this should be set to false to catch encryption errors due to invalid keys."},{"line_number":385,"context_line":"    \"\"\""},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"    def __init__(self):"},{"line_number":390,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_2b1a4217","line":387,"in_reply_to":"9abb7d3a_f314df4d","updated":"2016-06-01 20:52:44.000000000","message":"I gave it a general name to be able to extend it to encrypt other fields in the future.  I can name this something else.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":378,"context_line":"    keystone.conf [credential] section needs to be updated before running"},{"line_number":379,"context_line":"    this script:"},{"line_number":380,"context_line":"    encryption_keys should contain a list of valid fernet keys.  The first key"},{"line_number":381,"context_line":"    is used as the active_key for encryption."},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    allow_plaintext should be set to true the first time running the script."},{"line_number":384,"context_line":"    This allows migration of credentials that are not encrypted.  Once"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_6b808547","line":381,"updated":"2016-06-02 16:13:42.000000000","message":"docstrings should use RST syntax, as well, as they end up being rendered as part of our sphinx docs.","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":378,"context_line":"    keystone.conf [credential] section needs to be updated before running"},{"line_number":379,"context_line":"    this script:"},{"line_number":380,"context_line":"    encryption_keys should contain a list of valid fernet keys.  The first key"},{"line_number":381,"context_line":"    is used as the active_key for encryption."},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    allow_plaintext should be set to true the first time running the script."},{"line_number":384,"context_line":"    This allows migration of credentials that are not encrypted.  Once"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_7e59548e","line":381,"in_reply_to":"9abb7d3a_6b808547","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":393,"context_line":"class DbEncrypt(BaseApp):"},{"line_number":394,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key."},{"line_number":395,"context_line":""},{"line_number":396,"context_line":"    ``keystone.conf`` [credential] section needs to be updated before running"},{"line_number":397,"context_line":"    this script:"},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"    ``encryption_keys`` should contain a list of valid fernet keys.  The first"},{"line_number":400,"context_line":"    key is used as the active_key for encryption."},{"line_number":401,"context_line":""},{"line_number":402,"context_line":"    ``allow_plaintext`` should be set to true the first time running the script"},{"line_number":403,"context_line":"    This allows migration of credentials that are not encrypted.  Once"},{"line_number":404,"context_line":"    encrypted this should be set to false to catch encryption errors due to"},{"line_number":405,"context_line":"    invalid keys."},{"line_number":406,"context_line":"    \"\"\""},{"line_number":407,"context_line":""},{"line_number":408,"context_line":"    name \u003d \u0027db_encrypt\u0027"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_5a5350e2","line":405,"range":{"start_line":396,"start_character":4,"end_line":405,"end_character":17},"updated":"2016-06-29 21:38:33.000000000","message":"maybe print this out and prompt the user if they want to continue or include a --force? this sounds like it could go really bad if done in a wrong sequence.\n\ncan we check if it\u0027s already been run? and look to see if allow_plaintext is set to true?","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":405,"context_line":"    invalid keys."},{"line_number":406,"context_line":"    \"\"\""},{"line_number":407,"context_line":""},{"line_number":408,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"    def __init__(self):"},{"line_number":411,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_1a3c28c7","line":408,"range":{"start_line":408,"start_character":12,"end_line":408,"end_character":22},"updated":"2016-06-29 21:38:33.000000000","message":"call it credentials_encrypt? we\u0027re only doing one db. unless there are plans to do more dbs?","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a56e3f5c2538fb9b2b98e9fab03d9f2ed1faa75","unresolved":false,"context_lines":[{"line_number":405,"context_line":"    invalid keys."},{"line_number":406,"context_line":"    \"\"\""},{"line_number":407,"context_line":""},{"line_number":408,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"    def __init__(self):"},{"line_number":411,"context_line":"        self.limit \u003d 100"}],"source_content_type":"text/x-python","patch_set":17,"id":"1aa78d24_4571a0a7","line":408,"range":{"start_line":408,"start_character":12,"end_line":408,"end_character":22},"in_reply_to":"3aaa91ec_1a3c28c7","updated":"2016-07-06 17:56:54.000000000","message":"Done","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":408,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"    def __init__(self):"},{"line_number":411,"context_line":"        self.limit \u003d 100"},{"line_number":412,"context_line":"        self.offset \u003d 0"},{"line_number":413,"context_line":""},{"line_number":414,"context_line":"    def load_backends(self):"},{"line_number":415,"context_line":"        drivers \u003d backends.load_backends()"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_5a1b5073","line":412,"range":{"start_line":411,"start_character":8,"end_line":412,"end_character":23},"updated":"2016-06-29 21:38:33.000000000","message":"these should be argparse arguments, with 100 and 0 as defaults, don\u0027t hardcode them","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"8ffbd45a91e2e3ce241a4e389ad870f827a19f3f","unresolved":false,"context_lines":[{"line_number":408,"context_line":"    name \u003d \u0027db_encrypt\u0027"},{"line_number":409,"context_line":""},{"line_number":410,"context_line":"    def __init__(self):"},{"line_number":411,"context_line":"        self.limit \u003d 100"},{"line_number":412,"context_line":"        self.offset \u003d 0"},{"line_number":413,"context_line":""},{"line_number":414,"context_line":"    def load_backends(self):"},{"line_number":415,"context_line":"        drivers \u003d backends.load_backends()"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_b16eaffd","line":412,"range":{"start_line":411,"start_character":8,"end_line":412,"end_character":23},"in_reply_to":"3aaa91ec_5a1b5073","updated":"2016-06-30 15:40:48.000000000","message":"0 has to be hardcoded since it\u0027s the internal state. We could rename it to _offset to make that clearer.","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":432,"context_line":"        refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"        while refs:"},{"line_number":435,"context_line":"            refs \u003d [self.credential_controller.decrypt_credential(r)"},{"line_number":436,"context_line":"                    for r in refs]"},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"            for ref in refs:"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_7f69def8","line":435,"range":{"start_line":435,"start_character":12,"end_line":435,"end_character":16},"updated":"2016-06-29 21:38:33.000000000","message":"name this something different than refs? since we\u0027re already using it above","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"8ffbd45a91e2e3ce241a4e389ad870f827a19f3f","unresolved":false,"context_lines":[{"line_number":432,"context_line":"        refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"        while refs:"},{"line_number":435,"context_line":"            refs \u003d [self.credential_controller.decrypt_credential(r)"},{"line_number":436,"context_line":"                    for r in refs]"},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"            for ref in refs:"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_d1425b67","line":435,"range":{"start_line":435,"start_character":12,"end_line":435,"end_character":16},"in_reply_to":"3aaa91ec_7f69def8","updated":"2016-06-30 15:40:48.000000000","message":"++","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a56e3f5c2538fb9b2b98e9fab03d9f2ed1faa75","unresolved":false,"context_lines":[{"line_number":432,"context_line":"        refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":"        while refs:"},{"line_number":435,"context_line":"            refs \u003d [self.credential_controller.decrypt_credential(r)"},{"line_number":436,"context_line":"                    for r in refs]"},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"            for ref in refs:"}],"source_content_type":"text/x-python","patch_set":17,"id":"1aa78d24_a53cc4c8","line":435,"range":{"start_line":435,"start_character":12,"end_line":435,"end_character":16},"in_reply_to":"3aaa91ec_d1425b67","updated":"2016-07-06 17:56:54.000000000","message":"The name should be the same.  It should behave as a do-while loop.","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":438,"context_line":"            for ref in refs:"},{"line_number":439,"context_line":"                ref \u003d self.credential_controller.encrypt_credential(ref)"},{"line_number":440,"context_line":"                self.credential_api.update_credential(ref[\u0027id\u0027], ref)"},{"line_number":441,"context_line":"            refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":442,"context_line":""},{"line_number":443,"context_line":""},{"line_number":444,"context_line":"class DbVersion(BaseApp):"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_7f371eff","line":441,"range":{"start_line":441,"start_character":12,"end_line":441,"end_character":73},"updated":"2016-06-29 21:38:33.000000000","message":"what\u0027s the point of this? we\u0027re not returning anything here","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"38dd16464c003224a9e982f4f5a3fcd56ad1e5a1","unresolved":false,"context_lines":[{"line_number":438,"context_line":"            for ref in refs:"},{"line_number":439,"context_line":"                ref \u003d self.credential_controller.encrypt_credential(ref)"},{"line_number":440,"context_line":"                self.credential_api.update_credential(ref[\u0027id\u0027], ref)"},{"line_number":441,"context_line":"            refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":442,"context_line":""},{"line_number":443,"context_line":""},{"line_number":444,"context_line":"class DbVersion(BaseApp):"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_3ea44e49","line":441,"range":{"start_line":441,"start_character":12,"end_line":441,"end_character":73},"in_reply_to":"3aaa91ec_7f371eff","updated":"2016-06-30 15:24:20.000000000","message":"It\u0027s or the while loop. So that he can iterate through all the records","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":426,"context_line":"        return hints"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"    def do_encrypt(self):"},{"line_number":429,"context_line":"        refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        while refs:"},{"line_number":432,"context_line":"            decrypted_refs \u003d [self.credential_controller.decrypt_credential(r)"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_16dfc2d6","line":429,"updated":"2016-07-12 18:02:35.000000000","message":"nit: s/refs/credentials/\n\nJust to have the name more accurately reflect what is being stored.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":426,"context_line":"        return hints"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"    def do_encrypt(self):"},{"line_number":429,"context_line":"        refs \u003d self.credential_api.list_credentials(self.get_hints())"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        while refs:"},{"line_number":432,"context_line":"            decrypted_refs \u003d [self.credential_controller.decrypt_credential(r)"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_85108c5a","line":429,"in_reply_to":"1aa78d24_16dfc2d6","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":543,"context_line":""},{"line_number":544,"context_line":"    @classmethod"},{"line_number":545,"context_line":"    def main(cls):"},{"line_number":546,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":547,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_7f21bc4c","line":546,"updated":"2016-07-12 19:27:38.000000000","message":"Generally speaking we only import modules and not individual objects.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":543,"context_line":""},{"line_number":544,"context_line":"    @classmethod"},{"line_number":545,"context_line":"    def main(cls):"},{"line_number":546,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":547,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_e8168547","line":546,"in_reply_to":"1aa78d24_7f21bc4c","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":544,"context_line":"    @classmethod"},{"line_number":545,"context_line":"    def main(cls):"},{"line_number":546,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":547,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":550,"context_line":"        fernet.create_key_directory(keystone_user_id, keystone_group_id)"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_d651ba63","line":547,"updated":"2016-07-12 18:02:35.000000000","message":"We typically only import modules, not classes. \n\n    from keystone.token.providers.fernet import utils as fernet_utils\n    fernet \u003d fernet_utils.FernetUtils()","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":575,"context_line":""},{"line_number":576,"context_line":"    @classmethod"},{"line_number":577,"context_line":"    def main(cls):"},{"line_number":578,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":579,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_bf17a4ec","line":578,"updated":"2016-07-12 19:27:38.000000000","message":"Same","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":575,"context_line":""},{"line_number":576,"context_line":"    @classmethod"},{"line_number":577,"context_line":"    def main(cls):"},{"line_number":578,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":579,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_282b6d83","line":578,"in_reply_to":"1aa78d24_bf17a4ec","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":576,"context_line":"    @classmethod"},{"line_number":577,"context_line":"    def main(cls):"},{"line_number":578,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":579,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":582,"context_line":"        if fernet.validate_key_repository(requires_write\u003dTrue):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_965bb285","line":579,"updated":"2016-07-12 18:02:35.000000000","message":"We typically only import modules, not classes. \n\n    from keystone.token.providers.fernet import utils as fernet_utils\n    fernet \u003d fernet_utils.FernetUtils()","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":576,"context_line":"    @classmethod"},{"line_number":577,"context_line":"    def main(cls):"},{"line_number":578,"context_line":"        from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":579,"context_line":"        fernet \u003d FernetUtils()"},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":582,"context_line":"        if fernet.validate_key_repository(requires_write\u003dTrue):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_6821f59d","line":579,"in_reply_to":"1aa78d24_965bb285","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":596,"context_line":""},{"line_number":597,"context_line":"    @classmethod"},{"line_number":598,"context_line":"    def main(cls):"},{"line_number":599,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":600,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":601,"context_line":""},{"line_number":602,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_ffd3ec35","line":599,"updated":"2016-07-12 19:27:38.000000000","message":"Same","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":596,"context_line":""},{"line_number":597,"context_line":"    @classmethod"},{"line_number":598,"context_line":"    def main(cls):"},{"line_number":599,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":600,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":601,"context_line":""},{"line_number":602,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_1671820c","line":599,"updated":"2016-07-12 18:02:35.000000000","message":"We typically only import modules, not classes. \n\n    from keystone.token.providers.fernet import utils as fernet_utils\n    utils \u003d fernet_utils.CredentialUtils()","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":596,"context_line":""},{"line_number":597,"context_line":"    @classmethod"},{"line_number":598,"context_line":"    def main(cls):"},{"line_number":599,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":600,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":601,"context_line":""},{"line_number":602,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_a83e3db5","line":599,"in_reply_to":"1aa78d24_ffd3ec35","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":620,"context_line":"    primary key."},{"line_number":621,"context_line":""},{"line_number":622,"context_line":"    Rotating keys too frequently, or with [credential_tokens] max_active_keys"},{"line_number":623,"context_line":"    set too low, will cause tokens to become invalid prior to their expiration."},{"line_number":624,"context_line":""},{"line_number":625,"context_line":"    \"\"\""},{"line_number":626,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_569aea14","line":623,"updated":"2016-07-12 18:02:35.000000000","message":"Credentials can\u0027t expire can they?","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":620,"context_line":"    primary key."},{"line_number":621,"context_line":""},{"line_number":622,"context_line":"    Rotating keys too frequently, or with [credential_tokens] max_active_keys"},{"line_number":623,"context_line":"    set too low, will cause tokens to become invalid prior to their expiration."},{"line_number":624,"context_line":""},{"line_number":625,"context_line":"    \"\"\""},{"line_number":626,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_886c21d1","line":623,"in_reply_to":"1aa78d24_569aea14","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":628,"context_line":""},{"line_number":629,"context_line":"    @classmethod"},{"line_number":630,"context_line":"    def main(cls):"},{"line_number":631,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":632,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_56794a92","line":631,"updated":"2016-07-12 19:27:38.000000000","message":"Same","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":628,"context_line":""},{"line_number":629,"context_line":"    @classmethod"},{"line_number":630,"context_line":"    def main(cls):"},{"line_number":631,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":632,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_968452d3","line":631,"updated":"2016-07-12 18:02:35.000000000","message":"We typically only import modules, not classes. \n\n    from keystone.token.providers.fernet import utils as fernet_utils\n    utils \u003d fernet_utils.CredentialUtils()","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":628,"context_line":""},{"line_number":629,"context_line":"    @classmethod"},{"line_number":630,"context_line":"    def main(cls):"},{"line_number":631,"context_line":"        from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":632,"context_line":"        utils \u003d CredentialUtils()"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_a8659de1","line":631,"in_reply_to":"1aa78d24_56794a92","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":396,"context_line":"    This assumes you have already run keystone-manage credential_setup and"},{"line_number":397,"context_line":"    keystone-manage credential_rotate"},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"    ``allow_plaintext`` should be set to true the first time running the script"},{"line_number":400,"context_line":"    This allows migration of credentials that are not encrypted.  Once"},{"line_number":401,"context_line":"    encrypted this should be set to false to catch encryption errors due to"},{"line_number":402,"context_line":"    invalid keys."}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_386a771a","line":399,"updated":"2016-07-13 15:32:03.000000000","message":"missing period at the end of this sentence.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":396,"context_line":"    This assumes you have already run keystone-manage credential_setup and"},{"line_number":397,"context_line":"    keystone-manage credential_rotate"},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"    ``allow_plaintext`` should be set to true the first time running the script"},{"line_number":400,"context_line":"    This allows migration of credentials that are not encrypted.  Once"},{"line_number":401,"context_line":"    encrypted this should be set to false to catch encryption errors due to"},{"line_number":402,"context_line":"    invalid keys."}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_54710244","line":399,"in_reply_to":"1aa78d24_386a771a","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":586,"context_line":""},{"line_number":587,"context_line":""},{"line_number":588,"context_line":"class CredentialSetup(BasePermissionsSetup):"},{"line_number":589,"context_line":"    \"\"\"Setup a key repository for Credential tokens."},{"line_number":590,"context_line":""},{"line_number":591,"context_line":"    This also creates a primary key used for both creating and validating"},{"line_number":592,"context_line":"    Credential tokens. To improve security, you should rotate your keys (using"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_f83bcfe7","line":589,"updated":"2016-07-13 15:32:03.000000000","message":"I\u0027m wondering if we should be using the word \u0027token\u0027 here. Maybe just using: \n\n  Setup a key repository for encrypted credentials.\n\nwould be more straight-forward? I want to be really careful to make sure people understand the difference between what we\u0027re doing here and what we do with fernet - even though they both use the same model/tooling.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":586,"context_line":""},{"line_number":587,"context_line":""},{"line_number":588,"context_line":"class CredentialSetup(BasePermissionsSetup):"},{"line_number":589,"context_line":"    \"\"\"Setup a key repository for Credential tokens."},{"line_number":590,"context_line":""},{"line_number":591,"context_line":"    This also creates a primary key used for both creating and validating"},{"line_number":592,"context_line":"    Credential tokens. To improve security, you should rotate your keys (using"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_74f07e92","line":589,"in_reply_to":"1aa78d24_f83bcfe7","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":615,"context_line":""},{"line_number":616,"context_line":"    A new primary key is placed into rotation, which is used for new tokens."},{"line_number":617,"context_line":"    The old primary key is demoted to secondary, which can then still be used"},{"line_number":618,"context_line":"    for validating tokens. Excess secondary keys (beyond [credential_tokens]"},{"line_number":619,"context_line":"    max_active_keys) are revoked. Revoked keys are permanently deleted. A new"},{"line_number":620,"context_line":"    staged key will be created and used to validate tokens. The next time key"},{"line_number":621,"context_line":"    rotation takes place, the staged key will be put into rotation as the"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_433798e2","line":618,"updated":"2016-07-13 15:32:03.000000000","message":"Is there a need to ever have more than one secondary key? Once everything is re-encrypted with the new key, shouldn\u0027t we only need two keys?","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":615,"context_line":""},{"line_number":616,"context_line":"    A new primary key is placed into rotation, which is used for new tokens."},{"line_number":617,"context_line":"    The old primary key is demoted to secondary, which can then still be used"},{"line_number":618,"context_line":"    for validating tokens. Excess secondary keys (beyond [credential_tokens]"},{"line_number":619,"context_line":"    max_active_keys) are revoked. Revoked keys are permanently deleted. A new"},{"line_number":620,"context_line":"    staged key will be created and used to validate tokens. The next time key"},{"line_number":621,"context_line":"    rotation takes place, the staged key will be put into rotation as the"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_54f74259","line":618,"in_reply_to":"1aa78d24_433798e2","updated":"2016-07-14 18:35:08.000000000","message":"I think it\u0027s safer to have multiple keys.  There is less of a chance of losing data by an ops mistake.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        while credentials:"},{"line_number":432,"context_line":"            decrypted_credentials \u003d ["},{"line_number":433,"context_line":"                self.credential_controller.decrypt_credential(c)"},{"line_number":434,"context_line":"                for c in credentials]"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"            for cred in decrypted_credentials:"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_51d103fb","line":433,"range":{"start_line":433,"start_character":43,"end_line":433,"end_character":61},"updated":"2016-07-15 18:14:06.000000000","message":"why decrypt first? shouldn\u0027t encrypt_credential() be idempotent?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":436,"context_line":"            for cred in decrypted_credentials:"},{"line_number":437,"context_line":"                cred \u003d self.credential_controller.encrypt_credential(cred)"},{"line_number":438,"context_line":"                self.credential_api.update_credential(cred[\u0027id\u0027], cred)"},{"line_number":439,"context_line":"            credentials \u003d self.credential_api.list_credentials("},{"line_number":440,"context_line":"                self.get_hints())"},{"line_number":441,"context_line":""},{"line_number":442,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_31d8cfef","line":439,"range":{"start_line":439,"start_character":46,"end_line":439,"end_character":62},"updated":"2016-07-15 18:14:06.000000000","message":"this means encrypt credential must be executed while Keystone is offline? Pagination is known to be unreliable depending on backend.","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":594,"context_line":""},{"line_number":595,"context_line":"    \"\"\""},{"line_number":596,"context_line":""},{"line_number":597,"context_line":"    name \u003d \u0027credential_setup\u0027"},{"line_number":598,"context_line":""},{"line_number":599,"context_line":"    @classmethod"},{"line_number":600,"context_line":"    def main(cls):"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_343efdb8","line":597,"range":{"start_line":597,"start_character":12,"end_line":597,"end_character":28},"updated":"2016-07-15 18:14:06.000000000","message":"credential_encryption_key_setup?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":599,"context_line":"    @classmethod"},{"line_number":600,"context_line":"    def main(cls):"},{"line_number":601,"context_line":"        import keystone.token.providers.fernet.utils as credential_utils"},{"line_number":602,"context_line":"        utils \u003d credential_utils.CredentialUtils()"},{"line_number":603,"context_line":""},{"line_number":604,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":605,"context_line":"        utils.create_key_directory(keystone_user_id, keystone_group_id)"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_1409392d","line":602,"updated":"2016-07-15 18:14:06.000000000","message":"I was under the impression we are going to use Castellan key manager for this. Maybe a follow-on patch?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6240015a4b7f018a701bbe8a1adeee310174768b","unresolved":false,"context_lines":[{"line_number":599,"context_line":"    @classmethod"},{"line_number":600,"context_line":"    def main(cls):"},{"line_number":601,"context_line":"        import keystone.token.providers.fernet.utils as credential_utils"},{"line_number":602,"context_line":"        utils \u003d credential_utils.CredentialUtils()"},{"line_number":603,"context_line":""},{"line_number":604,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":605,"context_line":"        utils.create_key_directory(keystone_user_id, keystone_group_id)"}],"source_content_type":"text/x-python","patch_set":24,"id":"9ad45d7e_9cc2d0e7","line":602,"in_reply_to":"fad55976_1409392d","updated":"2016-08-10 22:51:11.000000000","message":"I proposed that as a spec to the keystone backlog:\n\nhttps://github.com/openstack/keystone-specs/blob/master/specs/keystone/backlog/fernet-key-store.rst","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":623,"context_line":""},{"line_number":624,"context_line":"    \"\"\""},{"line_number":625,"context_line":""},{"line_number":626,"context_line":"    name \u003d \u0027credential_rotate\u0027"},{"line_number":627,"context_line":""},{"line_number":628,"context_line":"    @classmethod"},{"line_number":629,"context_line":"    def main(cls):"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_943409df","line":626,"range":{"start_line":626,"start_character":12,"end_line":626,"end_character":29},"updated":"2016-07-15 18:14:06.000000000","message":"shouldn\u0027t this be named credential_encryption_key_rotate?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bf9445ed6421e0945efac741ef3fff93e2b316ce","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":""},{"line_number":421,"context_line":"class CredentialEncrypt(BaseApp):"},{"line_number":422,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key."},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    This assumes you have already run keystone-manage credential_setup and"},{"line_number":425,"context_line":"    keystone-manage credential_rotate"}],"source_content_type":"text/x-python","patch_set":27,"id":"9ad45d7e_091d8966","line":422,"range":{"start_line":422,"start_character":4,"end_line":422,"end_character":7},"updated":"2016-08-12 17:38:49.000000000","message":"IIRC this first line is the help, so it should be sufficient to understand what this does:\n\n  \"Encrypt existing credentials\"","commit_id":"48cb865869681db87a974cb7ba79400f26f10807"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bf9445ed6421e0945efac741ef3fff93e2b316ce","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":""},{"line_number":421,"context_line":"class CredentialEncrypt(BaseApp):"},{"line_number":422,"context_line":"    \"\"\"Provides ability to migrate credentials to new encryption_key."},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"    This assumes you have already run keystone-manage credential_setup and"},{"line_number":425,"context_line":"    keystone-manage credential_rotate"}],"source_content_type":"text/x-python","patch_set":27,"id":"9ad45d7e_a65aac4e","line":422,"range":{"start_line":422,"start_character":54,"end_line":422,"end_character":68},"updated":"2016-08-12 17:38:49.000000000","message":"what\u0027s an encryption_key?","commit_id":"48cb865869681db87a974cb7ba79400f26f10807"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c52e3e9ba0ca801f35a503a278e584766fb72506","unresolved":false,"context_lines":[{"line_number":584,"context_line":"    @classmethod"},{"line_number":585,"context_line":"    def main(cls):"},{"line_number":586,"context_line":"        from keystone.common import fernet_utils as utils"},{"line_number":587,"context_line":"        fernet_utils \u003d utils.FernetUtils(CONF.credential.key_repository, 3)"},{"line_number":588,"context_line":""},{"line_number":589,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":590,"context_line":"        fernet_utils.create_key_directory(keystone_user_id, keystone_group_id)"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_f4666f4f","line":587,"updated":"2016-08-17 19:24:12.000000000","message":"There\u0027s that magic number again.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"961f1aed5d25b5464ba4fe0f7aa41cf35c0c9493","unresolved":false,"context_lines":[{"line_number":584,"context_line":"    @classmethod"},{"line_number":585,"context_line":"    def main(cls):"},{"line_number":586,"context_line":"        from keystone.common import fernet_utils as utils"},{"line_number":587,"context_line":"        fernet_utils \u003d utils.FernetUtils(CONF.credential.key_repository, 3)"},{"line_number":588,"context_line":""},{"line_number":589,"context_line":"        keystone_user_id, keystone_group_id \u003d cls.get_user_group()"},{"line_number":590,"context_line":"        fernet_utils.create_key_directory(keystone_user_id, keystone_group_id)"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_c59d7f67","line":587,"in_reply_to":"3ac371cc_f4666f4f","updated":"2016-08-17 20:31:13.000000000","message":"Will fix.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c52e3e9ba0ca801f35a503a278e584766fb72506","unresolved":false,"context_lines":[{"line_number":601,"context_line":"    A new primary key is placed into rotation, which is used for new tokens."},{"line_number":602,"context_line":"    The old primary key is demoted to secondary, which can then still be used"},{"line_number":603,"context_line":"    for validating tokens. Excess secondary keys (beyond [credential_tokens]"},{"line_number":604,"context_line":"    max_active_keys) are revoked. Revoked keys are permanently deleted. A new"},{"line_number":605,"context_line":"    staged key will be created and used to validate tokens. The next time key"},{"line_number":606,"context_line":"    rotation takes place, the staged key will be put into rotation as the"},{"line_number":607,"context_line":"    primary key."}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_14c98b26","line":604,"updated":"2016-08-17 19:24:12.000000000","message":"But, that\u0027s not an option. Copy pasta!","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"961f1aed5d25b5464ba4fe0f7aa41cf35c0c9493","unresolved":false,"context_lines":[{"line_number":601,"context_line":"    A new primary key is placed into rotation, which is used for new tokens."},{"line_number":602,"context_line":"    The old primary key is demoted to secondary, which can then still be used"},{"line_number":603,"context_line":"    for validating tokens. Excess secondary keys (beyond [credential_tokens]"},{"line_number":604,"context_line":"    max_active_keys) are revoked. Revoked keys are permanently deleted. A new"},{"line_number":605,"context_line":"    staged key will be created and used to validate tokens. The next time key"},{"line_number":606,"context_line":"    rotation takes place, the staged key will be put into rotation as the"},{"line_number":607,"context_line":"    primary key."}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_058af71a","line":604,"in_reply_to":"3ac371cc_14c98b26","updated":"2016-08-17 20:31:13.000000000","message":"Yep - this is left over from the original implementation. I will refactor.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c52e3e9ba0ca801f35a503a278e584766fb72506","unresolved":false,"context_lines":[{"line_number":632,"context_line":"                       \u0027with the primary key using `keystone-manage \u0027"},{"line_number":633,"context_line":"                       \u0027credential_migrate`.\u0027)"},{"line_number":634,"context_line":"                print (_(msg))"},{"line_number":635,"context_line":"                raise SystemExit"},{"line_number":636,"context_line":""},{"line_number":637,"context_line":"    @classmethod"},{"line_number":638,"context_line":"    def main(cls):"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_34ebe779","line":635,"updated":"2016-08-17 19:24:12.000000000","message":"Raise an instance of the exception, not the class itself. You should also be able to pass it the _(msg) instead of manually printing it.","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6906644fa4d8156e376c2a1df2098a16c7a6609a","unresolved":false,"context_lines":[{"line_number":632,"context_line":"                       \u0027with the primary key using `keystone-manage \u0027"},{"line_number":633,"context_line":"                       \u0027credential_migrate`.\u0027)"},{"line_number":634,"context_line":"                print (_(msg))"},{"line_number":635,"context_line":"                raise SystemExit"},{"line_number":636,"context_line":""},{"line_number":637,"context_line":"    @classmethod"},{"line_number":638,"context_line":"    def main(cls):"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_8e487cce","line":635,"in_reply_to":"3ac371cc_34ebe779","updated":"2016-08-19 20:59:50.000000000","message":"Done","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c52e3e9ba0ca801f35a503a278e584766fb72506","unresolved":false,"context_lines":[{"line_number":641,"context_line":"            msg \u003d (\u0027`[credential] encrypt` is not enabled in your keystone \u0027"},{"line_number":642,"context_line":"                   \u0027configuration.\u0027)"},{"line_number":643,"context_line":"            print (_(msg))"},{"line_number":644,"context_line":"            raise SystemExit"},{"line_number":645,"context_line":""},{"line_number":646,"context_line":"        from keystone.common import fernet_utils as utils"},{"line_number":647,"context_line":"        fernet_utils \u003d utils.FernetUtils(CONF.credential.key_repository, 3)"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_d4fa5342","line":644,"updated":"2016-08-17 19:24:12.000000000","message":"Same","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6906644fa4d8156e376c2a1df2098a16c7a6609a","unresolved":false,"context_lines":[{"line_number":641,"context_line":"            msg \u003d (\u0027`[credential] encrypt` is not enabled in your keystone \u0027"},{"line_number":642,"context_line":"                   \u0027configuration.\u0027)"},{"line_number":643,"context_line":"            print (_(msg))"},{"line_number":644,"context_line":"            raise SystemExit"},{"line_number":645,"context_line":""},{"line_number":646,"context_line":"        from keystone.common import fernet_utils as utils"},{"line_number":647,"context_line":"        fernet_utils \u003d utils.FernetUtils(CONF.credential.key_repository, 3)"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_6e4540b2","line":644,"in_reply_to":"3ac371cc_d4fa5342","updated":"2016-08-19 20:59:50.000000000","message":"Done","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"c52e3e9ba0ca801f35a503a278e584766fb72506","unresolved":false,"context_lines":[{"line_number":660,"context_line":"    You can use ``keystone-manage credential_setup`` to create one."},{"line_number":661,"context_line":""},{"line_number":662,"context_line":"    Running ``keystone-manage credential_migrate`` should only be run after"},{"line_number":663,"context_line":"    `[credential] encrypt` has been set to `True`."},{"line_number":664,"context_line":"    \"\"\""},{"line_number":665,"context_line":""},{"line_number":666,"context_line":"    name \u003d \u0027credential_migrate\u0027"}],"source_content_type":"text/x-python","patch_set":33,"id":"3ac371cc_54b4a380","line":663,"updated":"2016-08-17 19:24:12.000000000","message":"As mentioned in a previous review: `true` (`True` is Python\u0027s syntax).","commit_id":"0bf1c947d463c42fb511252b22b4dd4520a52c11"}],"keystone/common/config.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":510,"context_line":"                        \u0027keystone.credential.provider namespace. Core \u0027"},{"line_number":511,"context_line":"                        \u0027provider is [fernet].\u0027),"},{"line_number":512,"context_line":"        cfg.ListOpt(\u0027encryption_keys\u0027, secret\u003dTrue, default\u003d[],"},{"line_number":513,"context_line":"                    help\u003d\u0027credential encryption and decryption keys.\u0027),"},{"line_number":514,"context_line":"        cfg.BoolOpt(\u0027allow_plaintext\u0027, default\u003dTrue,"},{"line_number":515,"context_line":"                    help\u003d\u0027Allow fields to not be encrypted when retrieving \u0027"},{"line_number":516,"context_line":"                         \u0027them from backend.  This should be disabled once \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_ab6eed93","line":513,"updated":"2016-06-02 16:13:42.000000000","message":"Use complete sentences :) This should explain when the configuration value should be set, with what, and why.","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":510,"context_line":"                        \u0027keystone.credential.provider namespace. Core \u0027"},{"line_number":511,"context_line":"                        \u0027provider is [fernet].\u0027),"},{"line_number":512,"context_line":"        cfg.ListOpt(\u0027encryption_keys\u0027, secret\u003dTrue, default\u003d[],"},{"line_number":513,"context_line":"                    help\u003d\u0027credential encryption and decryption keys.\u0027),"},{"line_number":514,"context_line":"        cfg.BoolOpt(\u0027allow_plaintext\u0027, default\u003dTrue,"},{"line_number":515,"context_line":"                    help\u003d\u0027Allow fields to not be encrypted when retrieving \u0027"},{"line_number":516,"context_line":"                         \u0027them from backend.  This should be disabled once \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_1ee128d1","line":513,"in_reply_to":"9abb7d3a_ab6eed93","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":514,"context_line":"        cfg.BoolOpt(\u0027allow_plaintext\u0027, default\u003dTrue,"},{"line_number":515,"context_line":"                    help\u003d\u0027Allow fields to not be encrypted when retrieving \u0027"},{"line_number":516,"context_line":"                         \u0027them from backend.  This should be disabled once \u0027"},{"line_number":517,"context_line":"                         \u0027credentials have been encrypted.\u0027),"},{"line_number":518,"context_line":"    ],"},{"line_number":519,"context_line":"    \u0027oauth1\u0027: ["},{"line_number":520,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_cb1ff107","line":517,"updated":"2016-06-02 16:13:42.000000000","message":"Nice addition. I\u0027d amend further with \"... using the keystone-manage db_encrypt command.\"","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":514,"context_line":"        cfg.BoolOpt(\u0027allow_plaintext\u0027, default\u003dTrue,"},{"line_number":515,"context_line":"                    help\u003d\u0027Allow fields to not be encrypted when retrieving \u0027"},{"line_number":516,"context_line":"                         \u0027them from backend.  This should be disabled once \u0027"},{"line_number":517,"context_line":"                         \u0027credentials have been encrypted.\u0027),"},{"line_number":518,"context_line":"    ],"},{"line_number":519,"context_line":"    \u0027oauth1\u0027: ["},{"line_number":520,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_7e0b147e","line":517,"in_reply_to":"9abb7d3a_cb1ff107","updated":"2016-06-02 21:06:28.000000000","message":"Done","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"99e05e7ac44dbb2d19c9ec013ceb0ffe1f9129f2","unresolved":false,"context_lines":[{"line_number":513,"context_line":"                    help\u003d\u0027List of fernet keys used for credential encryption. \u0027"},{"line_number":514,"context_line":"                         \u0027The first key is the active key used for encryption \u0027"},{"line_number":515,"context_line":"                         \u0027and all fernet keys are used for decryption.  When \u0027"},{"line_number":516,"context_line":"                         \u0027this value is not set encryption is not used.\u0027),"},{"line_number":517,"context_line":"        cfg.BoolOpt(\u0027allow_plaintext\u0027, default\u003dTrue,"},{"line_number":518,"context_line":"                    help\u003d\u0027Allow fields to not be encrypted when retrieving \u0027"},{"line_number":519,"context_line":"                         \u0027them from backend.  This should be disabled once \u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"7aa08908_99f8aec6","line":516,"updated":"2016-06-09 16:44:01.000000000","message":"+1","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"}],"keystone/common/driver_hints.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        # A limit is set, so ask for one more entry than we need"},{"line_number":45,"context_line":"        list_limit \u003d hints.limit[\u0027limit\u0027]"},{"line_number":46,"context_line":"        list_offset \u003d hints.limit[\u0027offset\u0027]"},{"line_number":47,"context_line":"        hints.set_limit(list_limit + 1, offset\u003dlist_offset)"},{"line_number":48,"context_line":"        ref_list \u003d f(self, hints, *args, **kwargs)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"        # If we got more than the original limit then trim back the list and"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_c39f08b2","line":47,"updated":"2016-07-13 15:32:03.000000000","message":"Is this implementing paging support for the credential api?","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        # A limit is set, so ask for one more entry than we need"},{"line_number":45,"context_line":"        list_limit \u003d hints.limit[\u0027limit\u0027]"},{"line_number":46,"context_line":"        list_offset \u003d hints.limit[\u0027offset\u0027]"},{"line_number":47,"context_line":"        hints.set_limit(list_limit + 1, offset\u003dlist_offset)"},{"line_number":48,"context_line":"        ref_list \u003d f(self, hints, *args, **kwargs)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"        # If we got more than the original limit then trim back the list and"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_345c364c","line":47,"in_reply_to":"1aa78d24_c39f08b2","updated":"2016-07-14 18:35:08.000000000","message":"This does not implement paging.  This allows setting the offset of a search, that can then be used to implement paging.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        # A limit is set, so ask for one more entry than we need"},{"line_number":45,"context_line":"        list_limit \u003d hints.limit[\u0027limit\u0027]"},{"line_number":46,"context_line":"        list_offset \u003d hints.limit[\u0027offset\u0027]"},{"line_number":47,"context_line":"        hints.set_limit(list_limit + 1, offset\u003dlist_offset)"},{"line_number":48,"context_line":"        ref_list \u003d f(self, hints, *args, **kwargs)"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"        # If we got more than the original limit then trim back the list and"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_0581014b","line":47,"range":{"start_line":47,"start_character":58,"end_line":47,"end_character":59},"updated":"2016-07-15 18:14:06.000000000","message":"we need a separate patch for this change as it is not specific to credentials","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/common/sql/core.py":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"87b6aecdcb130e1f8eca0038f27cb458614ab424","unresolved":false,"context_lines":[{"line_number":377,"context_line":"            hints.limit[\u0027truncated\u0027] \u003d True"},{"line_number":378,"context_line":"            query \u003d limit_query"},{"line_number":379,"context_line":""},{"line_number":380,"context_line":"        if hints.limit.get(\u0027offset\u0027) is not None:"},{"line_number":381,"context_line":"            query \u003d query.offset(hints.limit[\u0027offset\u0027])"},{"line_number":382,"context_line":"    return query"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_4538803d","line":381,"range":{"start_line":380,"start_character":0,"end_line":381,"end_character":55},"updated":"2016-07-06 18:04:46.000000000","message":"oh wow. This introduces pagination to keystone. Why do you need it for ecnrypting credentials? This definitely should go to another patch.","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"6df222a35117a4b33920109b502cf74b07256dc6","unresolved":false,"context_lines":[{"line_number":377,"context_line":"            hints.limit[\u0027truncated\u0027] \u003d True"},{"line_number":378,"context_line":"            query \u003d limit_query"},{"line_number":379,"context_line":""},{"line_number":380,"context_line":"        if hints.limit.get(\u0027offset\u0027) is not None:"},{"line_number":381,"context_line":"            query \u003d query.offset(hints.limit[\u0027offset\u0027])"},{"line_number":382,"context_line":"    return query"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_5a06c4ce","line":381,"range":{"start_line":380,"start_character":0,"end_line":381,"end_character":55},"in_reply_to":"1aa78d24_4538803d","updated":"2016-07-11 20:57:16.000000000","message":"There is a script included in the patch that encrypts existing credentials.  Pagination was added to avoid having to load all credentials to memory.","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":379,"context_line":"            query \u003d limit_query"},{"line_number":380,"context_line":""},{"line_number":381,"context_line":"        if hints.limit.get(\u0027offset\u0027) is not None:"},{"line_number":382,"context_line":"            query \u003d query.offset(hints.limit[\u0027offset\u0027])"},{"line_number":383,"context_line":"    return query"},{"line_number":384,"context_line":""},{"line_number":385,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_65dd5d70","line":382,"updated":"2016-07-15 18:14:06.000000000","message":"this need to be separate patch","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/conf/credential.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Core provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"encryption_keys \u003d cfg.ListOpt("}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_77959031","line":31,"updated":"2016-06-29 17:11:24.000000000","message":"Core? What does that mean?","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Core provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"encryption_keys \u003d cfg.ListOpt("}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_abef9085","line":31,"in_reply_to":"3aaa91ec_77959031","updated":"2016-06-29 19:57:21.000000000","message":"Done","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    \u0027provider\u0027,"},{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Default provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_7a0bacd6","line":30,"range":{"start_line":30,"start_character":62,"end_line":30,"end_character":72},"updated":"2016-06-29 21:38:33.000000000","message":"Entry point*\n\nyes, line 22 is incorrect","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"66cabd01560944e54a8f91b2d838d2b538651e12","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    \u0027provider\u0027,"},{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Default provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_9e9d82be","line":30,"range":{"start_line":30,"start_character":62,"end_line":30,"end_character":72},"in_reply_to":"3aaa91ec_7a0bacd6","updated":"2016-06-30 15:40:10.000000000","message":"Done","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Default provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"encryption_keys \u003d cfg.ListOpt("}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_1afb88c2","line":31,"range":{"start_line":31,"start_character":4,"end_line":31,"end_character":32},"updated":"2016-06-29 21:38:33.000000000","message":"backticks around this","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"66cabd01560944e54a8f91b2d838d2b538651e12","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":29,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":30,"context_line":"Controls the credential encryption and decryption operations. Entrypoint in"},{"line_number":31,"context_line":"the keystone.credential.provider namespace. Default provider is [fernet]."},{"line_number":32,"context_line":"\"\"\"))"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"encryption_keys \u003d cfg.ListOpt("}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_7ea096f4","line":31,"range":{"start_line":31,"start_character":4,"end_line":31,"end_character":32},"in_reply_to":"3aaa91ec_1afb88c2","updated":"2016-06-30 15:40:10.000000000","message":"Done","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46856c11fba5e5511dcbb385f788e4258c240daa","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":49,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":50,"context_line":"keystone-manage db_encrypt command."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"GROUP_NAME \u003d __name__.split(\u0027.\u0027)[-1]"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_9a0658cc","line":50,"range":{"start_line":50,"start_character":0,"end_line":50,"end_character":26},"updated":"2016-06-29 21:38:33.000000000","message":"backticks around this","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"66cabd01560944e54a8f91b2d838d2b538651e12","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":49,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":50,"context_line":"keystone-manage db_encrypt command."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"GROUP_NAME \u003d __name__.split(\u0027.\u0027)[-1]"}],"source_content_type":"text/x-python","patch_set":17,"id":"3aaa91ec_bea67e0c","line":50,"range":{"start_line":50,"start_character":0,"end_line":50,"end_character":26},"in_reply_to":"3aaa91ec_9a0658cc","updated":"2016-06-30 15:40:10.000000000","message":"Done","commit_id":"97106cb31df4b88deeb1d8d7195263ed91eb875b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    \u0027key_repository\u0027,"},{"line_number":46,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Directory containing Fernet token keys."},{"line_number":49,"context_line":"\"\"\"))"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"max_active_keys \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_96ac52a0","line":48,"updated":"2016-07-12 18:02:35.000000000","message":"This should be sure to explain that these keys are used for encrypting credentials and have no relationship to the fernet-keys used for tokens.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    \u0027key_repository\u0027,"},{"line_number":46,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Directory containing Fernet token keys."},{"line_number":49,"context_line":"\"\"\"))"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"max_active_keys \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_a893dda1","line":48,"in_reply_to":"1aa78d24_96ac52a0","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    default\u003d3,"},{"line_number":54,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":55,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":56,"context_line":"fernet_rotate before they are discarded. The default value of 3 means that"},{"line_number":57,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":58,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":59,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_16fd02b1","line":56,"updated":"2016-07-12 19:27:38.000000000","message":"Not fernet_rotate","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    default\u003d3,"},{"line_number":54,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":55,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":56,"context_line":"fernet_rotate before they are discarded. The default value of 3 means that"},{"line_number":57,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":58,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":59,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_e8896570","line":56,"in_reply_to":"1aa78d24_16fd02b1","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dedd1478939246cff89f7fe5f23d43a23b827fed","unresolved":false,"context_lines":[{"line_number":56,"context_line":"fernet_rotate before they are discarded. The default value of 3 means that"},{"line_number":57,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":58,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":59,"context_line":"rotation."},{"line_number":60,"context_line":"\"\"\"))"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_568dca2f","line":59,"updated":"2016-07-12 18:02:35.000000000","message":"Isn\u0027t all this handled by config? It seems that way according to the documentation.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":56,"context_line":"fernet_rotate before they are discarded. The default value of 3 means that"},{"line_number":57,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":58,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":59,"context_line":"rotation."},{"line_number":60,"context_line":"\"\"\"))"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_48eb5913","line":59,"in_reply_to":"1aa78d24_568dca2f","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command."},{"line_number":42,"context_line":"\"\"\"))"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"key_repository \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_43231805","line":41,"updated":"2016-07-13 15:32:03.000000000","message":"The way this is phrased makes it seem like this option only exists to migrate/encrypt credentials. Is it possible for someone to maintain the existing credential-at-rest behavior with this option?","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command."},{"line_number":42,"context_line":"\"\"\"))"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"key_repository \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_54010206","line":41,"in_reply_to":"1aa78d24_43231805","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    \u0027key_repository\u0027,"},{"line_number":46,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Directory containing Credential token keys.  Credential token keys have no"},{"line_number":49,"context_line":"relationship to Fernet token keys."},{"line_number":50,"context_line":"\"\"\"))"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_a3bc7c06","line":48,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here about the use of \u0027token\u0027.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    \u0027key_repository\u0027,"},{"line_number":46,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":47,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":48,"context_line":"Directory containing Credential token keys.  Credential token keys have no"},{"line_number":49,"context_line":"relationship to Fernet token keys."},{"line_number":50,"context_line":"\"\"\"))"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_1f0e7332","line":48,"in_reply_to":"1aa78d24_a3bc7c06","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    default\u003d3,"},{"line_number":55,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":56,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":57,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"},{"line_number":58,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":59,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":60,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_831980d3","line":57,"updated":"2016-07-13 15:32:03.000000000","message":"I\u0027m wondering if we ever need this to be more than 3. Technically - people wouldn\u0027t need more than 3 keys in order to rotate keys for credentials. Do we want to expose the ability for them to have more?\n\nAlso, if we absolutely need 3 keys to do this successfully, we should add a min_value.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    default\u003d3,"},{"line_number":55,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":56,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":57,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"},{"line_number":58,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":59,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":60,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_1f35d3da","line":57,"in_reply_to":"1aa78d24_831980d3","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Controls the credential encryption and decryption operations. Entry point in"},{"line_number":32,"context_line":"the ``keystone.credential.provider`` namespace. Default provider is [fernet]."},{"line_number":33,"context_line":"\"\"\"))"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"allow_plaintext \u003d cfg.BoolOpt("}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_bc7c90ec","line":32,"range":{"start_line":32,"start_character":68,"end_line":32,"end_character":76},"updated":"2016-07-24 11:22:23.000000000","message":"list?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command.  This can also be used to"},{"line_number":42,"context_line":"allow storing non-encrypted credentials."},{"line_number":43,"context_line":"\"\"\"))"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"key_repository \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_a503d5b7","line":42,"updated":"2016-07-15 18:14:06.000000000","message":"What\u0027s this option going to buy us? We either need to encrypt them all offline or we don\u0027t encrypt them at all. I don\u0027t see a scenario where only some credential are encrypted while others are not.","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":55,"context_line":"    default\u003d2,"},{"line_number":56,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":57,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":58,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_85ee91ea","line":55,"range":{"start_line":55,"start_character":12,"end_line":55,"end_character":14},"updated":"2016-07-15 18:14:06.000000000","message":"3?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    default\u003d2,"},{"line_number":56,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":57,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":58,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"},{"line_number":59,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":60,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":61,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_45cbf972","line":58,"range":{"start_line":58,"start_character":66,"end_line":58,"end_character":68},"updated":"2016-07-15 18:14:06.000000000","message":"2 or 3?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/credential/controllers.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                                     trust_id)"},{"line_number":69,"context_line":"        ref \u003d self._encrypt_blob(ref)"},{"line_number":70,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":71,"context_line":"        ref \u003d self._decrypt_blob(ref)"},{"line_number":72,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def _encrypt_blob(self, ref):"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_c0de556c","line":71,"updated":"2016-05-19 20:12:20.000000000","message":"Why are we doing this? Instead do you really want to do something like \"encrypted_ref \u003d self._encrypt_blob(ref)\"?","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                                     trust_id)"},{"line_number":69,"context_line":"        ref \u003d self._encrypt_blob(ref)"},{"line_number":70,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":71,"context_line":"        ref \u003d self._decrypt_blob(ref)"},{"line_number":72,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def _encrypt_blob(self, ref):"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_28e6f414","line":71,"in_reply_to":"bab6814e_c0de556c","updated":"2016-05-20 18:42:16.000000000","message":"return value from create_credentials is required.  I\u0027ll update code to store blob instead of using decrypt","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        ref \u003d self._encrypt_blob(credential)"},{"line_number":122,"context_line":"        ref \u003d self.credential_api.update_credential(credential_id, ref)"},{"line_number":123,"context_line":"        ref \u003d self._decrypt_blob(ref)"},{"line_number":124,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @controller.protected()"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_6045e915","line":123,"updated":"2016-05-19 20:12:20.000000000","message":"Why are we doing this?","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        ref \u003d self._encrypt_blob(credential)"},{"line_number":122,"context_line":"        ref \u003d self.credential_api.update_credential(credential_id, ref)"},{"line_number":123,"context_line":"        ref \u003d self._decrypt_blob(ref)"},{"line_number":124,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @controller.protected()"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_e8b6acf7","line":123,"in_reply_to":"bab6814e_6045e915","updated":"2016-05-20 18:42:16.000000000","message":"Done","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        trust_id \u003d self._get_trust_id_for_request(context)"},{"line_number":67,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(credential),"},{"line_number":68,"context_line":"                                     trust_id)"},{"line_number":69,"context_line":"        blob \u003d ref.get(\u0027blob\u0027)"},{"line_number":70,"context_line":"        ref \u003d self.encrypt_credential(ref)"},{"line_number":71,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":72,"context_line":"        ref[\u0027blob\u0027] \u003d blob"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_3133fc15","line":69,"updated":"2016-05-20 19:16:41.000000000","message":"I still like my suggestion in the previous review. encrypt_credential() is already making a copy and returning the copy. Just give it a different name like \u0027encrypted_ref\u0027 and pass that to the backend. Then you can remove line 72.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        trust_id \u003d self._get_trust_id_for_request(context)"},{"line_number":67,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(credential),"},{"line_number":68,"context_line":"                                     trust_id)"},{"line_number":69,"context_line":"        blob \u003d ref.get(\u0027blob\u0027)"},{"line_number":70,"context_line":"        ref \u003d self.encrypt_credential(ref)"},{"line_number":71,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":72,"context_line":"        ref[\u0027blob\u0027] \u003d blob"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_7954fbc9","line":69,"in_reply_to":"bab6814e_3133fc15","updated":"2016-05-23 20:52:05.000000000","message":"In the original code the ref is returned to the client.  The suggested code changes would not work for default values that are not specified by the client.  They would not be returned in the response after being created.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        blob \u003d credential.get(\u0027blob\u0027)"},{"line_number":118,"context_line":"        ref \u003d self.encrypt_credential(credential)"},{"line_number":119,"context_line":"        ref \u003d self.credential_api.update_credential(credential_id, ref)"},{"line_number":120,"context_line":"        ref[\u0027blob\u0027] \u003d blob"},{"line_number":121,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    @controller.protected()"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_4b87fdb4","line":120,"updated":"2016-05-26 13:01:30.000000000","message":"if can just do:\nref[\u0027blob\u0027] \u003d credential.get(\u0027blob\u0027)","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        blob \u003d credential.get(\u0027blob\u0027)"},{"line_number":118,"context_line":"        ref \u003d self.encrypt_credential(credential)"},{"line_number":119,"context_line":"        ref \u003d self.credential_api.update_credential(credential_id, ref)"},{"line_number":120,"context_line":"        ref[\u0027blob\u0027] \u003d blob"},{"line_number":121,"context_line":"        return CredentialV3.wrap_member(context, ref)"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    @controller.protected()"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_e4eec920","line":120,"in_reply_to":"bab6814e_4b87fdb4","updated":"2016-05-26 20:53:20.000000000","message":"Done","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        trust_id \u003d self._get_trust_id_for_request(context)"},{"line_number":68,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(credential),"},{"line_number":69,"context_line":"                                     trust_id)"},{"line_number":70,"context_line":"        blob \u003d ref.get(\u0027blob\u0027)"},{"line_number":71,"context_line":"        ref \u003d self.encrypt_credential(ref)"},{"line_number":72,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":73,"context_line":"        ref[\u0027blob\u0027] \u003d blob"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_ae882e72","line":70,"updated":"2016-05-31 21:59:50.000000000","message":"nit: s/blob/plaintext_blob/ would make it a bit more clear why you need to make a copy of it - I didn\u0027t realize what was going on until I got to the end of the method.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        trust_id \u003d self._get_trust_id_for_request(context)"},{"line_number":68,"context_line":"        ref \u003d self._assign_unique_id(self._normalize_dict(credential),"},{"line_number":69,"context_line":"                                     trust_id)"},{"line_number":70,"context_line":"        blob \u003d ref.get(\u0027blob\u0027)"},{"line_number":71,"context_line":"        ref \u003d self.encrypt_credential(ref)"},{"line_number":72,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":73,"context_line":"        ref[\u0027blob\u0027] \u003d blob"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_2bc88273","line":70,"in_reply_to":"9abb7d3a_ae882e72","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        plaintext_blob \u003d ref.get(\u0027blob\u0027)"},{"line_number":70,"context_line":"        ref \u003d self.encrypt_credential(ref)"},{"line_number":71,"context_line":"        ref \u003d self.credential_api.create_credential(ref[\u0027id\u0027], ref)"},{"line_number":72,"context_line":"        ref[\u0027blob\u0027] \u003d plaintext_blob"},{"line_number":73,"context_line":"        return CredentialV3.wrap_member(request.context_dict, ref)"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def encrypt_credential(self, ref):"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_97017409","line":72,"range":{"start_line":72,"start_character":8,"end_line":72,"end_character":11},"updated":"2016-07-24 11:22:23.000000000","message":"suggest to use a different variable other than ref here, maybe ret_ref? too many ref here :)","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/credential/provider.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from keystone.common import manager"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"CONF \u003d cfg.CONF"},{"line_number":21,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_5115e046","line":20,"updated":"2016-05-20 19:16:41.000000000","message":"Why are these here it they are not used?","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from keystone.common import manager"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"CONF \u003d cfg.CONF"},{"line_number":21,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_591657f2","line":20,"in_reply_to":"bab6814e_5115e046","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":10,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from oslo_config import cfg"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.common import dependency"},{"line_number":16,"context_line":"from keystone.common import manager"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_16d502e4","line":13,"updated":"2016-07-12 19:27:38.000000000","message":"This should be using keystone.conf now.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":10,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from oslo_config import cfg"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.common import dependency"},{"line_number":16,"context_line":"from keystone.common import manager"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_c8c62999","line":13,"in_reply_to":"1aa78d24_16d502e4","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"}],"keystone/credential/providers/core.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c57472c62c658d73df201c2d418e1aae2c36c104","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import abc"},{"line_number":14,"context_line":"import six"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from keystone.common import dependency"},{"line_number":17,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_c0fad5bc","line":14,"updated":"2016-05-19 20:12:20.000000000","message":"six is a third party package.","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"4a41ba1de30d0ac2da7571f4bab0328db43e9656","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import abc"},{"line_number":14,"context_line":"import six"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from keystone.common import dependency"},{"line_number":17,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_c8b768d6","line":14,"in_reply_to":"bab6814e_c0fad5bc","updated":"2016-05-20 18:42:16.000000000","message":"what is required for third party packages?","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6fd81dcd8be49f27f5ace1daaf3bf327092fa718","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import abc"},{"line_number":14,"context_line":"import six"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from keystone.common import dependency"},{"line_number":17,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_1132385f","line":14,"in_reply_to":"bab6814e_c8b768d6","updated":"2016-05-20 18:58:52.000000000","message":"A separate import section: http://docs.openstack.org/developer/hacking/#imports","commit_id":"ec0f6e149cf2424b26209c39883ff3a0ac0da875"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import abc"},{"line_number":14,"context_line":"import six"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from keystone.common import dependency"},{"line_number":17,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_910bc829","line":14,"updated":"2016-05-20 19:16:41.000000000","message":"third-party lib: http://docs.openstack.org/developer/hacking/#imports","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import abc"},{"line_number":14,"context_line":"import six"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from keystone.common import dependency"},{"line_number":17,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_79c7db64","line":14,"in_reply_to":"bab6814e_910bc829","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"}],"keystone/credential/providers/fernet.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from cryptography.fernet import Fernet"},{"line_number":14,"context_line":"from cryptography.fernet import InvalidToken"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from oslo_config import cfg"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_545aee2a","line":15,"updated":"2016-05-20 19:16:41.000000000","message":"remove the newline","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from cryptography.fernet import Fernet"},{"line_number":14,"context_line":"from cryptography.fernet import InvalidToken"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from oslo_config import cfg"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_79c35b39","line":15,"in_reply_to":"bab6814e_545aee2a","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"            f \u003d Fernet(self._get_active_key())"},{"line_number":41,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":42,"context_line":"        except Exception:"},{"line_number":43,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":44,"context_line":"                return data"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def decrypt(self, token):"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_143ea68b","line":43,"updated":"2016-05-20 19:16:41.000000000","message":"This doesn\u0027t make sense. Only check if it should be encrypted if encryption fails? If encryption fails for a legit reason (like bad or missing key) then this wouldn\u0027t be properly caught and this method would return with None.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":40,"context_line":"            f \u003d Fernet(self._get_active_key())"},{"line_number":41,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":42,"context_line":"        except Exception:"},{"line_number":43,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":44,"context_line":"                return data"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def decrypt(self, token):"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_f9810bc5","line":43,"in_reply_to":"bab6814e_143ea68b","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":53,"context_line":"            except InvalidToken:"},{"line_number":54,"context_line":"                pass"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":57,"context_line":"            return token"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"        raise Exception(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_b4987ac1","line":56,"updated":"2016-05-20 19:16:41.000000000","message":"What is the point of allowing plaintext? Just to make upgrades easier? And speaking of that how will we know if the data is encrypted when this is first turned on? Why not do this first before all of the slow encrption?","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":53,"context_line":"            except InvalidToken:"},{"line_number":54,"context_line":"                pass"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":57,"context_line":"            return token"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"        raise Exception(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_598f77cc","line":56,"in_reply_to":"bab6814e_b4987ac1","updated":"2016-05-23 20:52:05.000000000","message":"This is to allow running Keystone without any downtime.\nallow_plaintext should only be enabled when first starting keystone.  Once the credentials are migrated then allow_plaintext should be set to false in order to catch any errors due to encryption.\n\nI can remove this flag if we are fine with keystone downtime.","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1c07793c19e75e585d26a71caa87928ad87f929c","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":57,"context_line":"            return token"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"        raise Exception(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_946736e8","line":59,"updated":"2016-05-20 19:16:41.000000000","message":"We probably need to log this as an error since it would require an operator to fix","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"b5ceee0df8443db3212926f3dc49b3cf5fc9d232","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":57,"context_line":"            return token"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"        raise Exception(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bab6814e_79051b13","line":59,"in_reply_to":"bab6814e_946736e8","updated":"2016-05-23 20:52:05.000000000","message":"Done","commit_id":"2aa4c273af56d58c0097be83fafe5a753cf913e5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        try:"},{"line_number":41,"context_line":"            f \u003d Fernet(self._get_active_key())"},{"line_number":42,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":43,"context_line":"        except Exception:"},{"line_number":44,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":45,"context_line":"                return data"},{"line_number":46,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_eb4a3182","line":43,"range":{"start_line":43,"start_character":15,"end_line":43,"end_character":24},"updated":"2016-05-26 13:01:30.000000000","message":"We really need catch every exception here?","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        try:"},{"line_number":41,"context_line":"            f \u003d Fernet(self._get_active_key())"},{"line_number":42,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":43,"context_line":"        except Exception:"},{"line_number":44,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":45,"context_line":"                return data"},{"line_number":46,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_c47e25ae","line":43,"range":{"start_line":43,"start_character":15,"end_line":43,"end_character":24},"in_reply_to":"bab6814e_eb4a3182","updated":"2016-05-26 20:53:20.000000000","message":"Done","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2f4cacff5e3927fcbe563addba3a5547d958e24c","unresolved":false,"context_lines":[{"line_number":56,"context_line":"                f \u003d Fernet(key)"},{"line_number":57,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":58,"context_line":"            except InvalidToken:"},{"line_number":59,"context_line":"                pass"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":62,"context_line":"            return token"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_6b2641cf","line":59,"range":{"start_line":59,"start_character":16,"end_line":59,"end_character":20},"updated":"2016-05-26 13:01:30.000000000","message":"why just pass with a invalid token?\n\nplease at least a note explaining the reason.","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"52e2f172c065fa600b7e5c3164fda05a0079670b","unresolved":false,"context_lines":[{"line_number":56,"context_line":"                f \u003d Fernet(key)"},{"line_number":57,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":58,"context_line":"            except InvalidToken:"},{"line_number":59,"context_line":"                pass"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"        if CONF.credential.allow_plaintext:"},{"line_number":62,"context_line":"            return token"}],"source_content_type":"text/x-python","patch_set":8,"id":"bab6814e_3f545afc","line":59,"range":{"start_line":59,"start_character":16,"end_line":59,"end_character":20},"in_reply_to":"bab6814e_6b2641cf","updated":"2016-05-26 20:53:20.000000000","message":"Done","commit_id":"37d6ed8e178a9bafba1e97f804808ba2e09b34c5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":48,"context_line":"                LOG.error(msg)"},{"line_number":49,"context_line":"                raise exception.Error(msg)"},{"line_number":50,"context_line":"        except Exception as e:"},{"line_number":51,"context_line":"            raise e"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    def decrypt(self, token):"},{"line_number":54,"context_line":"        keys \u003d self._get_encryption_keys()"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_ce5f72e3","line":51,"updated":"2016-05-31 21:59:50.000000000","message":"there\u0027s no need to catch this if you\u0027re not going to do anything with it - just remove L50 \u0026 L51","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":48,"context_line":"                LOG.error(msg)"},{"line_number":49,"context_line":"                raise exception.Error(msg)"},{"line_number":50,"context_line":"        except Exception as e:"},{"line_number":51,"context_line":"            raise e"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    def decrypt(self, token):"},{"line_number":54,"context_line":"        keys \u003d self._get_encryption_keys()"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_2b76c23d","line":51,"in_reply_to":"9abb7d3a_ce5f72e3","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    def decrypt(self, token):"},{"line_number":54,"context_line":"        keys \u003d self._get_encryption_keys()"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        for key in keys:"},{"line_number":57,"context_line":"            try:"},{"line_number":58,"context_line":"                f \u003d Fernet(key)"},{"line_number":59,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_2e1f1e09","line":56,"updated":"2016-05-31 21:59:50.000000000","message":"Use MutliFernet for this, and let cryptography do the iteration... or add an inline comment explaining why that won\u0027t work.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    def decrypt(self, token):"},{"line_number":54,"context_line":"        keys \u003d self._get_encryption_keys()"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"        for key in keys:"},{"line_number":57,"context_line":"            try:"},{"line_number":58,"context_line":"                f \u003d Fernet(key)"},{"line_number":59,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_132fb03f","line":56,"in_reply_to":"9abb7d3a_2e1f1e09","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            try:"},{"line_number":58,"context_line":"                f \u003d Fernet(key)"},{"line_number":59,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":60,"context_line":"            except InvalidToken:"},{"line_number":61,"context_line":"                continue"},{"line_number":62,"context_line":"            except TypeError:"},{"line_number":63,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_2e71de76","line":60,"updated":"2016-05-31 21:59:50.000000000","message":"nit: except (InvalidToken, TypeError):","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            try:"},{"line_number":58,"context_line":"                f \u003d Fernet(key)"},{"line_number":59,"context_line":"                return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":60,"context_line":"            except InvalidToken:"},{"line_number":61,"context_line":"                continue"},{"line_number":62,"context_line":"            except TypeError:"},{"line_number":63,"context_line":"                continue"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_0ba81e76","line":60,"in_reply_to":"9abb7d3a_2e71de76","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"375f25956cfc9fedb050e3c91ce9a54403cce180","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"},{"line_number":59,"context_line":"                LOG.error(msg)"},{"line_number":60,"context_line":"                raise exception.Error(msg)"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_0bc4593e","line":60,"updated":"2016-06-02 16:13:42.000000000","message":"Nice improvements in this file.","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"19068ce6524539b9ed2f32076c7c8bb1af6381c7","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"},{"line_number":59,"context_line":"                LOG.error(msg)"},{"line_number":60,"context_line":"                raise exception.Error(msg)"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_fe1f04b5","line":60,"in_reply_to":"9abb7d3a_0bc4593e","updated":"2016-06-02 21:06:28.000000000","message":"Thanks!","commit_id":"7803a6eca9cb9d010b1eab5ff447c7e7b24d3a41"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"class Provider(core.Provider):"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    def _get_encryption_keys(self):"},{"line_number":29,"context_line":"        return CONF.credential.encryption_keys"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def _get_active_key(self):"},{"line_number":32,"context_line":"        encryption_keys \u003d self._get_encryption_keys()"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_f73d002c","line":29,"updated":"2016-06-29 17:11:24.000000000","message":"Do we really want to change the config file every time we rotate keys?","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":26,"context_line":"class Provider(core.Provider):"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    def _get_encryption_keys(self):"},{"line_number":29,"context_line":"        return CONF.credential.encryption_keys"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def _get_active_key(self):"},{"line_number":32,"context_line":"        encryption_keys \u003d self._get_encryption_keys()"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_2b79e0c8","line":29,"in_reply_to":"3aaa91ec_f73d002c","updated":"2016-06-29 19:57:21.000000000","message":"I discussed this with Dolph and he was ok with it.  Credential encryption keys do not need to be rotated as often as fernet keys.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            f \u003d fernet.Fernet(self._get_active_key())"},{"line_number":40,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":41,"context_line":"        except (fernet.InvalidToken, TypeError, AttributeError):"},{"line_number":42,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":43,"context_line":"                return data"},{"line_number":44,"context_line":"            else:"},{"line_number":45,"context_line":"                msg \u003d _(\u0027Could not encrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_b78538d0","line":42,"updated":"2016-06-29 17:11:24.000000000","message":"Which one of the exceptions is raised when this happens? We probably don\u0027t need to catch all three.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":39,"context_line":"            f \u003d fernet.Fernet(self._get_active_key())"},{"line_number":40,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":41,"context_line":"        except (fernet.InvalidToken, TypeError, AttributeError):"},{"line_number":42,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":43,"context_line":"                return data"},{"line_number":44,"context_line":"            else:"},{"line_number":45,"context_line":"                msg \u003d _(\u0027Could not encrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_ee3ec689","line":42,"in_reply_to":"3aaa91ec_b78538d0","updated":"2016-06-29 19:57:21.000000000","message":"I think invalidToken can be removed but the other two are still required.\nAttributeError: The fernet key is not defined.\nTypeError: The provided fernet key is not valid.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":52,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":53,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":55,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":56,"context_line":"                return token"},{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_b7d378d4","line":55,"updated":"2016-06-29 17:11:24.000000000","message":"Same here as above","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3f041cda00b918e969a91da3c22ee19084d47ac5","unresolved":false,"context_lines":[{"line_number":52,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":53,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":55,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":56,"context_line":"                return token"},{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_a975d898","line":55,"in_reply_to":"3aaa91ec_0e94f240","updated":"2016-06-29 20:09:18.000000000","message":"Why wouldn\u0027t we catch these individually are make the error message specific to what is happening? I would imagine that we\u0027d only want the allow plaintext logic on the InvalidToken right?","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"ef4744ccbc06fd8983bd89ba0fa76f0f3b52d22d","unresolved":false,"context_lines":[{"line_number":52,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":53,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":55,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":56,"context_line":"                return token"},{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_090b4c2b","line":55,"in_reply_to":"3aaa91ec_a975d898","updated":"2016-06-29 20:32:10.000000000","message":"This is setup this way to allow having both encrypted and unencrypted credentials for a period of time.   This will be refactored in a future release to only allow encrypted credentials and have a proper failure.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":52,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":53,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":55,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":56,"context_line":"                return token"},{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_0e94f240","line":55,"in_reply_to":"3aaa91ec_b7d378d4","updated":"2016-06-29 19:57:21.000000000","message":"All exceptions are valid reasons for failure:\n\nInvalidToken:  the token could not be decrypted\nValueError: No fernet keys where provided.\nTypeError: The provided fernet key is not valid","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from cryptography import fernet"},{"line_number":14,"context_line":"from oslo_config import cfg"},{"line_number":15,"context_line":"from oslo_log import log"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.credential.providers import core"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_f6d31602","line":14,"updated":"2016-07-12 19:27:38.000000000","message":"This should be using keystone.conf now.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from cryptography import fernet"},{"line_number":14,"context_line":"from oslo_config import cfg"},{"line_number":15,"context_line":"from oslo_log import log"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.credential.providers import core"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_883f0186","line":14,"in_reply_to":"1aa78d24_f6d31602","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from keystone.credential.providers import core"},{"line_number":18,"context_line":"from keystone import exception"},{"line_number":19,"context_line":"from keystone.i18n import _"},{"line_number":20,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_9eab9374","line":20,"updated":"2016-07-13 15:32:03.000000000","message":"The OpenStack projects typically do not import classes. \n\nAlso - maybe this is a sign that the fernet utils needs to be pulled into a more generic place. Instead of having the credential provider have a dependency on a specific token provider.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from keystone.credential.providers import core"},{"line_number":18,"context_line":"from keystone import exception"},{"line_number":19,"context_line":"from keystone.i18n import _"},{"line_number":20,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_d93cd0c1","line":20,"in_reply_to":"1aa78d24_9eab9374","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    def encrypt(self, data):"},{"line_number":36,"context_line":"        try:"},{"line_number":37,"context_line":"            keys \u003d [fernet.Fernet(key) for key in self._get_encryption_keys()]"},{"line_number":38,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":39,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":40,"context_line":"        except (TypeError, ValueError):"},{"line_number":41,"context_line":"            if CONF.credential.allow_plaintext:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_fe0c5794","line":38,"updated":"2016-07-13 15:32:03.000000000","message":"The fernet token approach does this using a @crypto property. This would make it so that we don\u0027t have duplicate code loading the keys between encrypt and decrypt.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    def encrypt(self, data):"},{"line_number":36,"context_line":"        try:"},{"line_number":37,"context_line":"            keys \u003d [fernet.Fernet(key) for key in self._get_encryption_keys()]"},{"line_number":38,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":39,"context_line":"            return f.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":40,"context_line":"        except (TypeError, ValueError):"},{"line_number":41,"context_line":"            if CONF.credential.allow_plaintext:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_1947784c","line":38,"in_reply_to":"1aa78d24_fe0c5794","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":43,"context_line":"            else:"},{"line_number":44,"context_line":"                msg \u003d _(\u0027Could not encrypt credentials\u0027)"},{"line_number":45,"context_line":"                LOG.error(msg)"},{"line_number":46,"context_line":"                raise exception.Error(msg)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    def decrypt(self, token):"},{"line_number":49,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_9e7553fb","line":46,"updated":"2016-07-13 15:32:03.000000000","message":"This should be a more specific Error. We\u0027ll probably have to create a new one in keystone/exception.py.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":43,"context_line":"            else:"},{"line_number":44,"context_line":"                msg \u003d _(\u0027Could not encrypt credentials\u0027)"},{"line_number":45,"context_line":"                LOG.error(msg)"},{"line_number":46,"context_line":"                raise exception.Error(msg)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    def decrypt(self, token):"},{"line_number":49,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b90d84ea","line":46,"in_reply_to":"1aa78d24_9e7553fb","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"            keys \u003d [fernet.Fernet(key) for key in self._get_encryption_keys()]"},{"line_number":51,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":52,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":53,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":54,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":55,"context_line":"                return token"},{"line_number":56,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_9ee393a3","line":53,"updated":"2016-07-13 15:32:03.000000000","message":"These could be broken into multiple except statements, which would make it easier to explain the reason for excepting each error and handing them in specific ways if needed.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":50,"context_line":"            keys \u003d [fernet.Fernet(key) for key in self._get_encryption_keys()]"},{"line_number":51,"context_line":"            f \u003d fernet.MultiFernet(keys)"},{"line_number":52,"context_line":"            return f.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":53,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":54,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":55,"context_line":"                return token"},{"line_number":56,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_99e088fc","line":53,"in_reply_to":"1aa78d24_9ee393a3","updated":"2016-07-14 18:35:08.000000000","message":"They are included in the same block to avoid duplicating code.  They should be handled the same way.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":56,"context_line":"            else:"},{"line_number":57,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"},{"line_number":58,"context_line":"                LOG.error(msg)"},{"line_number":59,"context_line":"                raise exception.Error(msg)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_7e706708","line":59,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":56,"context_line":"            else:"},{"line_number":57,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"},{"line_number":58,"context_line":"                LOG.error(msg)"},{"line_number":59,"context_line":"                raise exception.Error(msg)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b9dbc44e","line":59,"in_reply_to":"1aa78d24_7e706708","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    def _get_encryption_keys(self):"},{"line_number":38,"context_line":"        return self.utils.load_keys()"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def encrypt(self, data):"},{"line_number":41,"context_line":"        try:"},{"line_number":42,"context_line":"            return self.crypto.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":43,"context_line":"        except (TypeError, ValueError):"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_45adb930","line":40,"range":{"start_line":40,"start_character":22,"end_line":40,"end_character":27},"updated":"2016-07-15 18:14:06.000000000","message":"credentail?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":41,"context_line":"        try:"},{"line_number":42,"context_line":"            return self.crypto.encrypt(data.encode(\u0027utf-8\u0027))"},{"line_number":43,"context_line":"        except (TypeError, ValueError):"},{"line_number":44,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":45,"context_line":"                return data"},{"line_number":46,"context_line":"            else:"},{"line_number":47,"context_line":"                msg \u003d _(\u0027Could not encrypt credentials\u0027)"},{"line_number":48,"context_line":"                LOG.error(msg)"},{"line_number":49,"context_line":"                raise exception.CredentialEncryptionError(msg)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    def decrypt(self, token):"},{"line_number":52,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_173e24da","line":49,"range":{"start_line":44,"start_character":0,"end_line":49,"end_character":62},"updated":"2016-07-24 11:22:23.000000000","message":"If `allow_plaintext` is True, the encryption will never fail?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":48,"context_line":"                LOG.error(msg)"},{"line_number":49,"context_line":"                raise exception.CredentialEncryptionError(msg)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    def decrypt(self, token):"},{"line_number":52,"context_line":"        try:"},{"line_number":53,"context_line":"            return self.crypto.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_c5c089e3","line":51,"range":{"start_line":51,"start_character":22,"end_line":51,"end_character":27},"updated":"2016-07-15 18:14:06.000000000","message":"encrypted_cred right?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"                LOG.error(msg)"},{"line_number":49,"context_line":"                raise exception.CredentialEncryptionError(msg)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    def decrypt(self, token):"},{"line_number":52,"context_line":"        try:"},{"line_number":53,"context_line":"            return self.crypto.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_5c947443","line":51,"range":{"start_line":51,"start_character":22,"end_line":51,"end_character":27},"in_reply_to":"fad55976_c5c089e3","updated":"2016-07-24 11:22:23.000000000","message":"++","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        try:"},{"line_number":53,"context_line":"            return self.crypto.decrypt(bytes(token)).decode(\u0027utf-8\u0027)"},{"line_number":54,"context_line":"        except (fernet.InvalidToken, TypeError, ValueError):"},{"line_number":55,"context_line":"            if CONF.credential.allow_plaintext:"},{"line_number":56,"context_line":"                return token"},{"line_number":57,"context_line":"            else:"},{"line_number":58,"context_line":"                msg \u003d _(\u0027Could not decrypt credentials\u0027)"},{"line_number":59,"context_line":"                LOG.error(msg)"},{"line_number":60,"context_line":"                raise exception.CredentialEncryptionError(msg)"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_97721410","line":60,"range":{"start_line":55,"start_character":0,"end_line":60,"end_character":62},"updated":"2016-07-24 11:22:23.000000000","message":"If allow plaintext the decryption will never fail?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/exception.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":548,"context_line":"    debug_message_format \u003d _(\u0027%(driver)s is not supported driver version\u0027)"},{"line_number":549,"context_line":""},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"class CredentialEncryptionError(Exception):"},{"line_number":552,"context_line":"    message_format \u003d _(\"An unexpected error prevented the server \""},{"line_number":553,"context_line":"                       \"from accessing encrypted credentials.\")"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_770cc042","line":551,"range":{"start_line":551,"start_character":32,"end_line":551,"end_character":41},"updated":"2016-07-24 11:22:23.000000000","message":"If the parent is UnexpectedError, the error code returned is 500 (Internal Server Error), what will we have if hit this exception?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":550,"context_line":""},{"line_number":551,"context_line":"class CredentialEncryptionError(Exception):"},{"line_number":552,"context_line":"    message_format \u003d _(\"An unexpected error prevented the server \""},{"line_number":553,"context_line":"                       \"from accessing encrypted credentials.\")"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_57209cb0","line":553,"range":{"start_line":553,"start_character":24,"end_line":553,"end_character":60},"updated":"2016-07-24 11:22:23.000000000","message":"... when encrypt or decrypt credentials","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/server/backends.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"        token_api\u003dtoken.persistence.Manager(),"},{"line_number":73,"context_line":"        trust_api\u003dtrust.Manager(),"},{"line_number":74,"context_line":"        token_provider_api\u003dtoken.provider.Manager(),"},{"line_number":75,"context_line":"        credential_provider_api\u003dcredential.provider.Manager())"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    auth.controllers.load_auth_methods()"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_9a187977","line":75,"range":{"start_line":75,"start_character":8,"end_line":75,"end_character":62},"updated":"2016-07-24 11:22:23.000000000","message":"Pls move this to line 60, alphabetical.","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/tests/unit/credential/test_controllers.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2016 IBM Corp."},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_eedfd637","line":1,"updated":"2016-05-31 21:59:50.000000000","message":"Have something you\u0027d like to share? ;)","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2016 IBM Corp."},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":4,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_93ea80d9","line":1,"in_reply_to":"9abb7d3a_eedfd637","updated":"2016-06-01 20:52:44.000000000","message":"I didn\u0027t notice this, I copy pasted from a different file.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6800677ab76c2547638cff83e1d0e618096f3e9d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"CONF \u003d cfg.CONF"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class TestCredentialEncryption(unit.TestCase):"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    def setUp(self):"},{"line_number":29,"context_line":"        self.useFixture(database.Database())"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_d79c4410","line":26,"updated":"2016-06-29 17:11:24.000000000","message":"Are there any tests for the plaintext cases?","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"7aad211815d3e05a2aae3a3108487ca2de57ef92","unresolved":false,"context_lines":[{"line_number":23,"context_line":"CONF \u003d cfg.CONF"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class TestCredentialEncryption(unit.TestCase):"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    def setUp(self):"},{"line_number":29,"context_line":"        self.useFixture(database.Database())"}],"source_content_type":"text/x-python","patch_set":15,"id":"3aaa91ec_6e749635","line":26,"in_reply_to":"3aaa91ec_d79c4410","updated":"2016-06-29 19:57:21.000000000","message":"Yes, all previously existing test use plaintext.","commit_id":"974c3dfbd24527cfaee8951d0d2acc77b84ba3be"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import uuid"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from oslo_config import cfg"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.credential import controllers"},{"line_number":18,"context_line":"from keystone.tests import unit"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_5665ca42","line":15,"updated":"2016-07-12 19:27:38.000000000","message":"This should be using keystone.conf now.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import uuid"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from oslo_config import cfg"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.credential import controllers"},{"line_number":18,"context_line":"from keystone.tests import unit"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_c84d893f","line":15,"in_reply_to":"1aa78d24_5665ca42","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        self.utils.initialize_key_repository()"},{"line_number":39,"context_line":"        self.utils.rotate_keys()"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    def config_overrides(self):"},{"line_number":42,"context_line":"        super(TestCredentialEncryption, self).config_overrides()"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    def config_files(self):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_164862b2","line":41,"updated":"2016-07-12 19:27:38.000000000","message":"Is this needed?","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        self.utils.initialize_key_repository()"},{"line_number":39,"context_line":"        self.utils.rotate_keys()"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    def config_overrides(self):"},{"line_number":42,"context_line":"        super(TestCredentialEncryption, self).config_overrides()"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"    def config_files(self):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_a848fd2d","line":41,"in_reply_to":"1aa78d24_164862b2","updated":"2016-07-13 01:10:31.000000000","message":"Done","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def config_files(self):"},{"line_number":41,"context_line":"        config_files \u003d super(TestCredentialEncryption, self).config_files()"},{"line_number":42,"context_line":"        config_files.append(unit.dirs.tests_conf(\u0027backend_sql.conf\u0027))"},{"line_number":43,"context_line":"        return config_files"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    def test_create_credential_is_encrypted(self):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_7e51872f","line":42,"updated":"2016-07-13 15:32:03.000000000","message":"Interesting, do the credential tests not use sql by default?","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def config_files(self):"},{"line_number":41,"context_line":"        config_files \u003d super(TestCredentialEncryption, self).config_files()"},{"line_number":42,"context_line":"        config_files.append(unit.dirs.tests_conf(\u0027backend_sql.conf\u0027))"},{"line_number":43,"context_line":"        return config_files"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    def test_create_credential_is_encrypted(self):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b9e584dd","line":42,"in_reply_to":"1aa78d24_7e51872f","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        self.assertNotEqual(updated[\u0027credential\u0027][\u0027blob\u0027], encrypted[\u0027blob\u0027])"},{"line_number":77,"context_line":"        self.assertEqual(updated, retrieved)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    def test_list_credentials_is_decrypted(self):"},{"line_number":80,"context_line":"        credential \u003d unit.new_credential_ref(user_id\u003duuid.uuid4().hex)"},{"line_number":81,"context_line":"        created \u003d self.credential_controller.create_credential("},{"line_number":82,"context_line":"            self.make_request(is_admin\u003dTrue), credential)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_f2576bfe","line":79,"updated":"2016-07-13 15:32:03.000000000","message":"We should also make sure we have a test that ensure we aren\u0027t returning encrypted text to the user whenever they create or update a credential.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        self.assertNotEqual(updated[\u0027credential\u0027][\u0027blob\u0027], encrypted[\u0027blob\u0027])"},{"line_number":77,"context_line":"        self.assertEqual(updated, retrieved)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    def test_list_credentials_is_decrypted(self):"},{"line_number":80,"context_line":"        credential \u003d unit.new_credential_ref(user_id\u003duuid.uuid4().hex)"},{"line_number":81,"context_line":"        created \u003d self.credential_controller.create_credential("},{"line_number":82,"context_line":"            self.make_request(is_admin\u003dTrue), credential)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_f9aeec2d","line":79,"in_reply_to":"1aa78d24_f2576bfe","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        retrieved \u003d self.credential_controller.get_credential("},{"line_number":50,"context_line":"            self.make_request(is_admin\u003dTrue), credential_id)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        self.assertNotEqual(created[\u0027credential\u0027][\u0027blob\u0027], encrypted[\u0027blob\u0027])"},{"line_number":53,"context_line":"        self.assertEqual(created, retrieved)"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    def test_update_credential_is_encrypted(self):"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_37440873","line":52,"range":{"start_line":52,"start_character":8,"end_line":52,"end_character":77},"updated":"2016-07-24 11:22:23.000000000","message":"How do we know it is correctly encrypted?\npossible to assertEqual(encrypt(created[\u0027credential\u0027][\u0027blob\u0027]), encrypted[\u0027blob\u0027])?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        retrieved \u003d self.credential_controller.get_credential("},{"line_number":69,"context_line":"            self.make_request(is_admin\u003dTrue), credential_id)"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        self.assertNotEqual(updated[\u0027credential\u0027][\u0027blob\u0027], encrypted[\u0027blob\u0027])"},{"line_number":72,"context_line":"        self.assertEqual(updated, retrieved)"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def test_list_credentials_is_decrypted(self):"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_5759bc5a","line":71,"range":{"start_line":71,"start_character":8,"end_line":71,"end_character":77},"updated":"2016-07-24 11:22:23.000000000","message":"same here?","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"keystone/tests/unit/credential/test_fernet_provider.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"        self.config_fixture.config(group\u003d\u0027credential\u0027, max_active_keys\u003d3)"},{"line_number":32,"context_line":"        self.useFixture(database.Database())"},{"line_number":33,"context_line":"        self.useFixture(ksfixtures.CredentialRepository(self.config_fixture))"},{"line_number":34,"context_line":"        shutil.rmtree(self.provider.utils.key_repository)"},{"line_number":35,"context_line":"        os.mkdir(self.provider.utils.key_repository)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    def config_overrides(self):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_56f30a73","line":34,"updated":"2016-07-12 19:27:38.000000000","message":"Doesn\u0027t the fixture do what we need it to do here?","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[{"line_number":31,"context_line":"        self.config_fixture.config(group\u003d\u0027credential\u0027, max_active_keys\u003d3)"},{"line_number":32,"context_line":"        self.useFixture(database.Database())"},{"line_number":33,"context_line":"        self.useFixture(ksfixtures.CredentialRepository(self.config_fixture))"},{"line_number":34,"context_line":"        shutil.rmtree(self.provider.utils.key_repository)"},{"line_number":35,"context_line":"        os.mkdir(self.provider.utils.key_repository)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    def config_overrides(self):"}],"source_content_type":"text/x-python","patch_set":21,"id":"1aa78d24_e865e5ae","line":34,"in_reply_to":"1aa78d24_56f30a73","updated":"2016-07-13 01:10:31.000000000","message":"The fixture reuses the key_repository","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":13,"context_line":"import os"},{"line_number":14,"context_line":"import shutil"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from cryptography.fernet import Fernet"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from keystone.credential.providers import fernet"},{"line_number":19,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b2784390","line":16,"updated":"2016-07-13 15:32:03.000000000","message":"The OpenStack projects typically don\u0027t import classes.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":13,"context_line":"import os"},{"line_number":14,"context_line":"import shutil"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from cryptography.fernet import Fernet"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from keystone.credential.providers import fernet"},{"line_number":19,"context_line":"from keystone import exception"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_79483c8b","line":16,"in_reply_to":"1aa78d24_b2784390","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":20,"context_line":"from keystone.tests import unit"},{"line_number":21,"context_line":"from keystone.tests.unit import ksfixtures"},{"line_number":22,"context_line":"from keystone.tests.unit.ksfixtures import database"},{"line_number":23,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class TestFernetCredentialProvider(unit.TestCase):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_126cb7ce","line":23,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment as above.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":20,"context_line":"from keystone.tests import unit"},{"line_number":21,"context_line":"from keystone.tests.unit import ksfixtures"},{"line_number":22,"context_line":"from keystone.tests.unit.ksfixtures import database"},{"line_number":23,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class TestFernetCredentialProvider(unit.TestCase):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_1954981f","line":23,"in_reply_to":"1aa78d24_126cb7ce","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        self.assertNotEqual(blob, token)"},{"line_number":50,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def test_encrypt_with_invalid_key_raises_exception(self):"},{"line_number":53,"context_line":"        self.config_fixture.config("},{"line_number":54,"context_line":"            group\u003d\u0027credential\u0027,"},{"line_number":55,"context_line":"            allow_plaintext\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_f2412b0b","line":52,"updated":"2016-07-13 15:32:03.000000000","message":"As in an invalid fernet key? If that\u0027s the case we should make sure we are raising an Error that is specific to that case.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        self.assertNotEqual(blob, token)"},{"line_number":50,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def test_encrypt_with_invalid_key_raises_exception(self):"},{"line_number":53,"context_line":"        self.config_fixture.config("},{"line_number":54,"context_line":"            group\u003d\u0027credential\u0027,"},{"line_number":55,"context_line":"            allow_plaintext\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_d92050b3","line":52,"in_reply_to":"1aa78d24_f2412b0b","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        self.assertRaises(exception.Error, self.provider.encrypt, \u0027blob\u0027)"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def test_encrypt_with_invalid_key_returns_data(self):"},{"line_number":60,"context_line":"        blob \u003d \u0027blob\u0027"},{"line_number":61,"context_line":"        self.config_fixture.config("},{"line_number":62,"context_line":"            group\u003d\u0027credential\u0027,"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_72137b01","line":59,"updated":"2016-07-13 15:32:03.000000000","message":"The name of this test seems to contradict the name of the previous one. Maybe we should include in the name the fact that one of them allows plain text and the other doesn\u0027t (since that seems to be the distinguishing difference between the two tests).","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        self.assertRaises(exception.Error, self.provider.encrypt, \u0027blob\u0027)"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def test_encrypt_with_invalid_key_returns_data(self):"},{"line_number":60,"context_line":"        blob \u003d \u0027blob\u0027"},{"line_number":61,"context_line":"        self.config_fixture.config("},{"line_number":62,"context_line":"            group\u003d\u0027credential\u0027,"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_747203b2","line":59,"in_reply_to":"1aa78d24_72137b01","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        token \u003d self.provider.encrypt(blob)"},{"line_number":66,"context_line":"        self.assertEqual(blob, token)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    def test_decrypt_with_invalid_key_raises_exception(self):"},{"line_number":69,"context_line":"        self.config_fixture.config("},{"line_number":70,"context_line":"            group\u003d\u0027credential\u0027,"},{"line_number":71,"context_line":"            allow_plaintext\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_f2992b6e","line":68,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here as above.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        token \u003d self.provider.encrypt(blob)"},{"line_number":66,"context_line":"        self.assertEqual(blob, token)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    def test_decrypt_with_invalid_key_raises_exception(self):"},{"line_number":69,"context_line":"        self.config_fixture.config("},{"line_number":70,"context_line":"            group\u003d\u0027credential\u0027,"},{"line_number":71,"context_line":"            allow_plaintext\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b47aab75","line":68,"in_reply_to":"1aa78d24_f2992b6e","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        self.assertRaises(exception.Error, self.provider.decrypt, \u0027blob\u0027)"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def test_decrypt_with_invalid_key_returns_data(self):"},{"line_number":76,"context_line":"        blob \u003d \u0027blob\u0027"},{"line_number":77,"context_line":"        self.config_fixture.config("},{"line_number":78,"context_line":"            group\u003d\u0027credential\u0027,"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_d2b7cfd5","line":75,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here as above.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"        self.assertRaises(exception.Error, self.provider.decrypt, \u0027blob\u0027)"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    def test_decrypt_with_invalid_key_returns_data(self):"},{"line_number":76,"context_line":"        blob \u003d \u0027blob\u0027"},{"line_number":77,"context_line":"        self.config_fixture.config("},{"line_number":78,"context_line":"            group\u003d\u0027credential\u0027,"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_947faf65","line":75,"in_reply_to":"1aa78d24_d2b7cfd5","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/tests/unit/ksfixtures/credential_repository.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"04300c086abc7eaa55e0676b7ccf48493cefdb7e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"1aa78d24_16f6a25c","line":32,"updated":"2016-07-12 19:27:38.000000000","message":"Is there really nothing to cleanup? Will TempDir take care of everything?","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"d6d82043af2943cb7266a9c6e267217a3d741a30","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"1aa78d24_c8fbc9bf","line":32,"in_reply_to":"1aa78d24_16f6a25c","updated":"2016-07-13 01:10:31.000000000","message":"TempDir should do cleanup.","commit_id":"d2fa40789da9a03cf27c55ad8fbf44979a58800f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import fixtures"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"class CredentialRepository(fixtures.Fixture):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_d2050f7a","line":15,"updated":"2016-07-13 15:32:03.000000000","message":"We typically don\u0027t import classes.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import fixtures"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"class CredentialRepository(fixtures.Fixture):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_4075bcca","line":15,"in_reply_to":"1aa78d24_d2050f7a","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/tests/unit/ksfixtures/key_repository.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import fixtures"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"class KeyRepository(fixtures.Fixture):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_b2084392","line":15,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here about imports.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import fixtures"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"class KeyRepository(fixtures.Fixture):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_e0b82878","line":15,"in_reply_to":"1aa78d24_b2084392","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/tests/unit/test_cli.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4b1668ea1937b51502e6ea16ea522f8e84689d88","unresolved":false,"context_lines":[{"line_number":15,"context_line":"import os"},{"line_number":16,"context_line":"import uuid"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from cryptography.fernet import Fernet"},{"line_number":19,"context_line":"import fixtures"},{"line_number":20,"context_line":"import mock"},{"line_number":21,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_3058228a","line":18,"updated":"2016-05-31 21:59:50.000000000","message":"The preferred convention is to always import modules instead of objects so that:\n\nA) It\u0027s clear which objects are local to the module.\n\nB) It\u0027s clear where imported objects were defined and imported from.\n\nC) We don\u0027t have to manage multiple object-level imports from the same module.","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"bbdf8d69b5ebb908afc8c70d7a53c2b3f02aa4c7","unresolved":false,"context_lines":[{"line_number":15,"context_line":"import os"},{"line_number":16,"context_line":"import uuid"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from cryptography.fernet import Fernet"},{"line_number":19,"context_line":"import fixtures"},{"line_number":20,"context_line":"import mock"},{"line_number":21,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_d39ec861","line":18,"in_reply_to":"9abb7d3a_3058228a","updated":"2016-06-01 20:52:44.000000000","message":"Done","commit_id":"742ef5c72adb8040be737e3150498635154d468e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from keystone.tests import unit"},{"line_number":32,"context_line":"from keystone.tests.unit import ksfixtures"},{"line_number":33,"context_line":"from keystone.tests.unit.ksfixtures import database"},{"line_number":34,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_52fabf75","line":34,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here about imports.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":31,"context_line":"from keystone.tests import unit"},{"line_number":32,"context_line":"from keystone.tests.unit import ksfixtures"},{"line_number":33,"context_line":"from keystone.tests.unit.ksfixtures import database"},{"line_number":34,"context_line":"from keystone.token.providers.fernet.utils import CredentialUtils"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_e085c8cf","line":34,"in_reply_to":"1aa78d24_52fabf75","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/tests/unit/test_v3_credential.py":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"66024396e95fbcead52ca79ea5bc28b543dea5ab","unresolved":false,"context_lines":[{"line_number":480,"context_line":"                          cred_from_credential_api[0][\u0027id\u0027])"},{"line_number":481,"context_line":""},{"line_number":482,"context_line":""},{"line_number":483,"context_line":"class CredentialEncryptionTests(CredentialBaseTestCase):"},{"line_number":484,"context_line":"    \"\"\"Test v3 credential encryption.\"\"\""},{"line_number":485,"context_line":""},{"line_number":486,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":32,"id":"1ac06dbe_b80d5c92","line":483,"updated":"2016-08-22 12:20:17.000000000","message":"think this kind of tests should be placed in \"tests/unit/credential/test_core.py\" (like what is done for other checks in the Manager layer)","commit_id":"92e2c66679258d80bd6c82cde64fdf24bc86dddd"}],"keystone/tests/unit/token/test_fernet_provider.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":30,"context_line":"from keystone.token import provider"},{"line_number":31,"context_line":"from keystone.token.providers import fernet"},{"line_number":32,"context_line":"from keystone.token.providers.fernet import token_formatters"},{"line_number":33,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"fernet_utils \u003d FernetUtils()"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_12331763","line":33,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":30,"context_line":"from keystone.token import provider"},{"line_number":31,"context_line":"from keystone.token.providers import fernet"},{"line_number":32,"context_line":"from keystone.token.providers.fernet import token_formatters"},{"line_number":33,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"fernet_utils \u003d FernetUtils()"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_000a9479","line":33,"in_reply_to":"1aa78d24_12331763","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/token/providers/fernet/token_formatters.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"from keystone import exception"},{"line_number":30,"context_line":"from keystone.i18n import _, _LI"},{"line_number":31,"context_line":"from keystone.token import provider"},{"line_number":32,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_72425bac","line":32,"updated":"2016-07-13 15:32:03.000000000","message":"Same comment here.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":29,"context_line":"from keystone import exception"},{"line_number":30,"context_line":"from keystone.i18n import _, _LI"},{"line_number":31,"context_line":"from keystone.token import provider"},{"line_number":32,"context_line":"from keystone.token.providers.fernet.utils import FernetUtils"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_407adc26","line":32,"in_reply_to":"1aa78d24_72425bac","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"}],"keystone/token/providers/fernet/utils.py":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"c528bb93365646203fe69a9e19083619d1d362db","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"        if not is_valid:"},{"line_number":43,"context_line":"            LOG.error("},{"line_number":44,"context_line":"                _LE(\u0027Either [fernet_tokens] key_repository does not exist or \u0027"},{"line_number":45,"context_line":"                    \u0027Keystone does not have sufficient permission to access \u0027"},{"line_number":46,"context_line":"                    \u0027it: %s\u0027), self.key_repository)"},{"line_number":47,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_c57c70b7","line":44,"range":{"start_line":44,"start_character":29,"end_line":44,"end_character":42},"updated":"2016-07-06 18:10:53.000000000","message":"fernet_tokens should be replaced","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"6df222a35117a4b33920109b502cf74b07256dc6","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"        if not is_valid:"},{"line_number":43,"context_line":"            LOG.error("},{"line_number":44,"context_line":"                _LE(\u0027Either [fernet_tokens] key_repository does not exist or \u0027"},{"line_number":45,"context_line":"                    \u0027Keystone does not have sufficient permission to access \u0027"},{"line_number":46,"context_line":"                    \u0027it: %s\u0027), self.key_repository)"},{"line_number":47,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_30c2fee9","line":44,"range":{"start_line":44,"start_character":29,"end_line":44,"end_character":42},"in_reply_to":"1aa78d24_c57c70b7","updated":"2016-07-11 20:57:16.000000000","message":"Done","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"c528bb93365646203fe69a9e19083619d1d362db","unresolved":false,"context_lines":[{"line_number":274,"context_line":"class FernetUtils(Utils):"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"    @property"},{"line_number":277,"context_line":"    def key_repository(self):"},{"line_number":278,"context_line":"        return CONF.fernet_tokens.key_repository"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_85af0829","line":277,"range":{"start_line":277,"start_character":4,"end_line":277,"end_character":29},"updated":"2016-07-06 18:10:53.000000000","message":"make this (and the one below) abstract in Utils","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"6df222a35117a4b33920109b502cf74b07256dc6","unresolved":false,"context_lines":[{"line_number":274,"context_line":"class FernetUtils(Utils):"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"    @property"},{"line_number":277,"context_line":"    def key_repository(self):"},{"line_number":278,"context_line":"        return CONF.fernet_tokens.key_repository"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":20,"id":"1aa78d24_309b1e1a","line":277,"range":{"start_line":277,"start_character":4,"end_line":277,"end_character":29},"in_reply_to":"1aa78d24_85af0829","updated":"2016-07-11 20:57:16.000000000","message":"Done","commit_id":"483c1cbc2b227d8638336c8e8221fdebd3e1b382"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a8ef20acd07cf61bec965e81763a2c7996558c0","unresolved":false,"context_lines":[{"line_number":27,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"class Utils(object):"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    @abc.abstractmethod"},{"line_number":33,"context_line":"    def key_repository(self):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_d2bd0f69","line":30,"updated":"2016-07-13 15:32:03.000000000","message":"A more descriptive name might be something like KeyRepositoryUtils.","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":11434,"name":"werner mendizabal","email":"nonameentername@gmail.com","username":"nonameentername"},"change_message_id":"1d8d946aab4ceb57fd664b9716e38ce4a79c3ba8","unresolved":false,"context_lines":[{"line_number":27,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"class Utils(object):"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    @abc.abstractmethod"},{"line_number":33,"context_line":"    def key_repository(self):"}],"source_content_type":"text/x-python","patch_set":22,"id":"1aa78d24_2090704e","line":30,"in_reply_to":"1aa78d24_d2bd0f69","updated":"2016-07-14 18:35:08.000000000","message":"Done","commit_id":"cc5f7928b5bf5b14178a3fc0d6d0c5f917e020f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        if not is_valid:"},{"line_number":53,"context_line":"            LOG.error("},{"line_number":54,"context_line":"                _LE(\u0027Either [tokens] key_repository does not exist or \u0027"},{"line_number":55,"context_line":"                    \u0027Keystone does not have sufficient permission to access \u0027"},{"line_number":56,"context_line":"                    \u0027it: %s\u0027), self.key_repository)"},{"line_number":57,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_2a1df40f","line":54,"range":{"start_line":54,"start_character":28,"end_line":54,"end_character":37},"updated":"2016-07-15 18:14:06.000000000","message":"may want to use something more appropriate to its subsclass as this class is now shared by both fernet token and credential encryption keys","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d9c6fdddd7050c63cc3578512b4b6d3285af7b6f","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        if not is_valid:"},{"line_number":53,"context_line":"            LOG.error("},{"line_number":54,"context_line":"                _LE(\u0027Either [tokens] key_repository does not exist or \u0027"},{"line_number":55,"context_line":"                    \u0027Keystone does not have sufficient permission to access \u0027"},{"line_number":56,"context_line":"                    \u0027it: %s\u0027), self.key_repository)"},{"line_number":57,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":24,"id":"dada55a8_7a6825bb","line":54,"range":{"start_line":54,"start_character":28,"end_line":54,"end_character":37},"in_reply_to":"fad55976_2a1df40f","updated":"2016-07-24 11:22:23.000000000","message":"++","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":92,"context_line":"                os.makedirs(self.key_repository, 0o700)"},{"line_number":93,"context_line":"            except OSError:"},{"line_number":94,"context_line":"                LOG.error(_LE("},{"line_number":95,"context_line":"                    \u0027Failed to create [fernet_tokens] key_repository: either \u0027"},{"line_number":96,"context_line":"                    \u0027it already exists or you don\\\u0027t have sufficient \u0027"},{"line_number":97,"context_line":"                    \u0027permissions to create it\u0027))"},{"line_number":98,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_aa8c4436","line":95,"range":{"start_line":95,"start_character":38,"end_line":95,"end_character":54},"updated":"2016-07-15 18:14:06.000000000","message":"same as above","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a5312aebb47fff3c45449129e6906c5cc85c2aa9","unresolved":false,"context_lines":[{"line_number":103,"context_line":"                    keystone_group_id)"},{"line_number":104,"context_line":"            elif keystone_user_id or keystone_group_id:"},{"line_number":105,"context_line":"                LOG.warning(_LW("},{"line_number":106,"context_line":"                    \u0027Unable to change the ownership of [fernet_tokens] \u0027"},{"line_number":107,"context_line":"                    \u0027key_repository without a keystone user ID and keystone \u0027"},{"line_number":108,"context_line":"                    \u0027group ID both being provided: %s\u0027) %"},{"line_number":109,"context_line":"                    self.key_repository)"}],"source_content_type":"text/x-python","patch_set":24,"id":"fad55976_8a76a03c","line":106,"range":{"start_line":106,"start_character":55,"end_line":106,"end_character":70},"updated":"2016-07-15 18:14:06.000000000","message":"same as above","commit_id":"f3976968dd00f1bb053b1a88a18889e48d450620"}],"setup.cfg":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"99e05e7ac44dbb2d19c9ec013ceb0ffe1f9129f2","unresolved":false,"context_lines":[{"line_number":28,"context_line":"       etc/keystone-paste.ini"},{"line_number":29,"context_line":"       etc/policy.json"},{"line_number":30,"context_line":"       etc/sso_callback_template.html"},{"line_number":31,"context_line":"       etc/default_catalog.templates"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"[extras]"},{"line_number":34,"context_line":"ldap \u003d"}],"source_content_type":"text/x-ttcn-cfg","patch_set":13,"id":"7aa08908_198e7e27","line":31,"updated":"2016-06-09 16:44:01.000000000","message":"Is this change necessary, or related to the rest of the patch?","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"34284835647f31afc4ab8b3ba652baadb21f074e","unresolved":false,"context_lines":[{"line_number":28,"context_line":"       etc/keystone-paste.ini"},{"line_number":29,"context_line":"       etc/policy.json"},{"line_number":30,"context_line":"       etc/sso_callback_template.html"},{"line_number":31,"context_line":"       etc/default_catalog.templates"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"[extras]"},{"line_number":34,"context_line":"ldap \u003d"}],"source_content_type":"text/x-ttcn-cfg","patch_set":13,"id":"7aa08908_19bb1e77","line":31,"in_reply_to":"7aa08908_198e7e27","updated":"2016-06-09 16:46:04.000000000","message":"Sorry, I must have been looking at a bad diff.","commit_id":"2e74617da70505a92a8ed79fd8cdb4d78c2a71fa"}]}