)]}'
{"keystone/tests/unit/ksfixtures/key_repository.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"281fd5c22dfe3b127ee807403839e63cf034ac48","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        super(KeyRepository, self).setUp()"},{"line_number":30,"context_line":"        directory \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":31,"context_line":"        self.config_fixture.config(group\u003dself.key_group,"},{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_d6273e10","line":32,"updated":"2016-08-16 18:25:46.000000000","message":"Why not add max_active_keys too?","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"254450078c722cd3e48c14c5eec9a5b8733cce7a","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        super(KeyRepository, self).setUp()"},{"line_number":30,"context_line":"        directory \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":31,"context_line":"        self.config_fixture.config(group\u003dself.key_group,"},{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_3cedd325","line":32,"in_reply_to":"3ac371cc_314e9c96","updated":"2016-08-16 18:58:32.000000000","message":"Actually - if we chose to use only 3 keys for credential encryption this would break because we wouldn\u0027t have a `[credential] max_active_keys` option.\n\nSo not including max_active_keys here makes sense.","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"303d2c05b9e1e2715a67724b226535ba74a05274","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        super(KeyRepository, self).setUp()"},{"line_number":30,"context_line":"        directory \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":31,"context_line":"        self.config_fixture.config(group\u003dself.key_group,"},{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_9ca04745","line":32,"in_reply_to":"3ac371cc_3cedd325","updated":"2016-08-16 19:09:40.000000000","message":"I we chose to use only 3 keys, then max_active_keys\u003d3, no? Sorry perhaps I am missing something","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d64b14e6ec754c89d248be1f8633f010d311569f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        super(KeyRepository, self).setUp()"},{"line_number":30,"context_line":"        directory \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":31,"context_line":"        self.config_fixture.config(group\u003dself.key_group,"},{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_cc216e4f","line":32,"in_reply_to":"3ac371cc_9ca04745","updated":"2016-08-16 20:19:21.000000000","message":"I was thinking we just wouldn\u0027t even expose it through config. That way we require 3 keys and we don\u0027t allow a deployer to change that at all.\n\nFor fernet tokens, if a deployer over rotates their keys, the worst that happens is you have to re-authenticate (which *is* bad, don\u0027t get me wrong). But in this case, if we make the deployers manage keys and rotations we making it easier for an over rotation to occur, meaning the deployer has now removed all keys used to encrypt customer credentials (that\u0027d be a terrible phone call to make if you had to explain to each customer you nuked their credentials and they need to recreate them!). \n\nHere - what I am proposing is that we fix the key count for credential encryption to be 3. In a subsequent patch I am adding a key_hash column to the credential table, so that we can store a hash of the key that was used to encrypt each credential. This means that we can write `keystone-manage credential_rotate` to make sure that all credentials have been migrated to the newest primary key. If not, then we can bail on the key rotation and tell the operator to finish migrating their credentials using `keystone-manage credential_migrate`. In this case, I don\u0027t think it makes sense to expose another variable of complexity for operators to manage when we can safe-guard it into our process using checks in keystone-manage (all made possible by storing a hash of the key in the database).","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7cb294127c391bee94ea197944c33d144ad65f1b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        super(KeyRepository, self).setUp()"},{"line_number":30,"context_line":"        directory \u003d self.useFixture(fixtures.TempDir()).path"},{"line_number":31,"context_line":"        self.config_fixture.config(group\u003dself.key_group,"},{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_314e9c96","line":32,"in_reply_to":"3ac371cc_d6273e10","updated":"2016-08-16 18:53:26.000000000","message":"Good point - I think we could add that.","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"281fd5c22dfe3b127ee807403839e63cf034ac48","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"},{"line_number":36,"context_line":"            self.max_active_keys"},{"line_number":37,"context_line":"        )"},{"line_number":38,"context_line":"        fernet_utils.create_key_directory()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_f68fdac9","line":35,"range":{"start_line":35,"start_character":12,"end_line":35,"end_character":21},"updated":"2016-08-16 18:25:46.000000000","message":"why isn\u0027t this being caught from config anymore ?","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3b72d1a98d3b57ed0c728130c51ae0634acc9f7e","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                                   key_repository\u003ddirectory)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        fernet_utils \u003d utils.FernetUtils("},{"line_number":35,"context_line":"            directory,"},{"line_number":36,"context_line":"            self.max_active_keys"},{"line_number":37,"context_line":"        )"},{"line_number":38,"context_line":"        fernet_utils.create_key_directory()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3ac371cc_d678dec6","line":35,"range":{"start_line":35,"start_character":12,"end_line":35,"end_character":21},"in_reply_to":"3ac371cc_f68fdac9","updated":"2016-08-16 18:26:47.000000000","message":"Well, key_repository\u003ddirectory anyways. ^\n\nHowever, my question above still stands.","commit_id":"250c879aff66641305b4ab0a3d6162ad5d467a09"}]}