)]}'
{"keystone/conf/fernet_tokens.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e0e16a913b0564bc3e68bbaff9cb37371af8ec44","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    \u0027key_repository\u0027,"},{"line_number":20,"context_line":"    default\u003d\u0027/etc/keystone/fernet-keys/\u0027,"},{"line_number":21,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":22,"context_line":"Directory containing Fernet token keys. This directory must exist before using"},{"line_number":23,"context_line":"`keystone-manage fernet_setup` for the first time, must be writable by the user"},{"line_number":24,"context_line":"running `keystone-manage fernet_setup` or `keystone-manage fernet_rotate`, and"},{"line_number":25,"context_line":"of course must be readable by keystone\u0027s server process. The repository may"},{"line_number":26,"context_line":"contain keys in one of three states: a single staged key (always index 0) used"},{"line_number":27,"context_line":"for token validation, a single primary key (always the highest index) used for"},{"line_number":28,"context_line":"token creation and validation, and any number of secondary keys (all other"},{"line_number":29,"context_line":"index values) used for token validation. With multiple keystone nodes, each"},{"line_number":30,"context_line":"node must share the same key repository contents, with the exception of the"},{"line_number":31,"context_line":"staged key (index 0). It is safe to run `keystone-manage fernet_rotate` once on"},{"line_number":32,"context_line":"any one node to promote a staged key (index 0) to be the new primary"},{"line_number":33,"context_line":"(incremented from the previous highest index), and produce a new staged key (a"},{"line_number":34,"context_line":"new key with index 0); the resulting repository can then be atomically"},{"line_number":35,"context_line":"replicated to other nodes without any risk of race conditions (for example, it"},{"line_number":36,"context_line":"is safe to run `keystone-manage fernet_rotate` on host A, wait any amount of"},{"line_number":37,"context_line":"time, create a tarball of the directory on host A, unpack it on host B to a"},{"line_number":38,"context_line":"temporary location, and atomically move (`mv`) the directory into place on host"},{"line_number":39,"context_line":"B). Running `keystone-manage fernet_rotate` *twice* on a key repository without"},{"line_number":40,"context_line":"syncing other nodes will result in tokens that can not be validated by all"},{"line_number":41,"context_line":"nodes."},{"line_number":42,"context_line":"\"\"\"))"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"max_active_keys \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":1,"id":"3aaa91ec_275521fa","line":41,"range":{"start_line":22,"start_character":0,"end_line":41,"end_character":6},"updated":"2016-07-01 16:43:50.000000000","message":"great explanation!","commit_id":"b93cd2205bacea29a4a333c3c62df1497fe63ad1"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a58ad3344d9799a4e9a9a0c303b5d6ef1973e6c","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":45,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":46,"context_line":"    min\u003d2,"},{"line_number":47,"context_line":"    default\u003d3,"},{"line_number":48,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":49,"context_line":"This controls how many keys are held in rotation by `keystone-manage"}],"source_content_type":"text/x-python","patch_set":1,"id":"3aaa91ec_a7491163","line":46,"updated":"2016-07-01 16:43:56.000000000","message":"The minimum is 1 according to the code.  Also this change conflicts with this patch. May want to rebase on it.\n\nhttps://review.openstack.org/#/c/335840/","commit_id":"b93cd2205bacea29a4a333c3c62df1497fe63ad1"}]}