)]}'
{"keystone/common/fernet_utils.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8a8b022ebb8beb8d4d2f21412a20606284d81163","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_431ec85f","line":28,"range":{"start_line":28,"start_character":56,"end_line":28,"end_character":68},"updated":"2016-09-07 15:42:54.000000000","message":"I\u0027d say in the backend, as it can be anything else than disk ?","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"2798971e2a92827ffde72c6d94ea84dbeaf55b3e","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_8328d0e3","line":28,"range":{"start_line":28,"start_character":56,"end_line":28,"end_character":68},"in_reply_to":"9a89bdaa_431ec85f","updated":"2016-09-07 15:49:23.000000000","message":"for now it can be only disk","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1f97e63abb2cc550c51d0c85d08e8d6ff9a8bd31","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_a6f7a289","line":28,"in_reply_to":"9a89bdaa_8328d0e3","updated":"2016-09-07 15:57:47.000000000","message":"Right - we haven\u0027t implemented a pluggable fernet backend yet.","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b9bd3e3a4d1d77acadc028d7cd4b476fb09e8806","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_ccc3e555","line":28,"in_reply_to":"9a89bdaa_a6f7a289","updated":"2016-09-07 16:24:05.000000000","message":"So we can make it valid for now and for the future. It\u0027s unlikely the person implementing will find and fix this (I think we are already working to support it, am I right?)","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8a8b022ebb8beb8d4d2f21412a20606284d81163","unresolved":false,"context_lines":[{"line_number":281,"context_line":"                    \u0027dir\u0027: self.key_repository})"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        # return the encryption_keys, sorted by key number, descending"},{"line_number":284,"context_line":"        key_list \u003d [keys[x] for x in sorted(keys.keys(), reverse\u003dTrue)]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        if use_null_key:"},{"line_number":287,"context_line":"            key_list.append(NULL_KEY)"},{"line_number":288,"context_line":""},{"line_number":289,"context_line":"        return key_list"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_23a8e48c","line":287,"range":{"start_line":284,"start_character":0,"end_line":287,"end_character":37},"updated":"2016-09-07 15:42:54.000000000","message":"does this make sense if there is a key repository set ?","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"2798971e2a92827ffde72c6d94ea84dbeaf55b3e","unresolved":false,"context_lines":[{"line_number":281,"context_line":"                    \u0027dir\u0027: self.key_repository})"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        # return the encryption_keys, sorted by key number, descending"},{"line_number":284,"context_line":"        key_list \u003d [keys[x] for x in sorted(keys.keys(), reverse\u003dTrue)]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        if use_null_key:"},{"line_number":287,"context_line":"            key_list.append(NULL_KEY)"},{"line_number":288,"context_line":""},{"line_number":289,"context_line":"        return key_list"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_c31e58ba","line":287,"range":{"start_line":284,"start_character":0,"end_line":287,"end_character":37},"in_reply_to":"9a89bdaa_23a8e48c","updated":"2016-09-07 15:49:23.000000000","message":"++","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"c06fa1ddcbc015d2f25ad2d39a02549cad557f3d","unresolved":false,"context_lines":[{"line_number":281,"context_line":"                    \u0027dir\u0027: self.key_repository})"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"        # return the encryption_keys, sorted by key number, descending"},{"line_number":284,"context_line":"        key_list \u003d [keys[x] for x in sorted(keys.keys(), reverse\u003dTrue)]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        if use_null_key:"},{"line_number":287,"context_line":"            key_list.append(NULL_KEY)"},{"line_number":288,"context_line":""},{"line_number":289,"context_line":"        return key_list"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_e6460a4e","line":287,"range":{"start_line":284,"start_character":0,"end_line":287,"end_character":37},"in_reply_to":"9a89bdaa_c31e58ba","updated":"2016-09-07 15:55:50.000000000","message":"After conversation in IRC, this probably does make sense. Because when real key repository is set up, but credentials are not yet migrated, there should be a way to decrypt them.","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1f97e63abb2cc550c51d0c85d08e8d6ff9a8bd31","unresolved":false,"context_lines":[{"line_number":284,"context_line":"        key_list \u003d [keys[x] for x in sorted(keys.keys(), reverse\u003dTrue)]"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"        if use_null_key:"},{"line_number":287,"context_line":"            key_list.append(NULL_KEY)"},{"line_number":288,"context_line":""},{"line_number":289,"context_line":"        return key_list"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_06068e85","line":287,"in_reply_to":"9a89bdaa_c31e58ba","updated":"2016-09-07 15:57:47.000000000","message":"Yes. If an operator doesn\u0027t setup a key_repository before upgrading to Newton, all credentials will be encrypted with the null key. Once they do setup a key_repository and they want to re-encrypt, they are going to need the null key and the contents of key_repository in order to successfully migrate off the null key.","commit_id":"b44cc28e4f22256027298d57046b841558d2fb56"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"e31d8fa6fe017e989008d983b71caaa2d518040b","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"},{"line_number":32,"context_line":"# encryption only and has absolutely no beneficial purpose outside of easing"},{"line_number":33,"context_line":"# upgrades."}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_d201bc07","line":30,"updated":"2016-09-07 17:19:28.000000000","message":"to gracefully upgrade","commit_id":"7acb04a64ba4aa62d2155a552894ff0a94e19286"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1361f9c178a48147e198fb1f65b70cb6fab69040","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"# NOTE(lbragstad): In the event there are no encryption keys on disk, let\u0027s use"},{"line_number":29,"context_line":"# a default one until a proper key repository is set up. This allows operators"},{"line_number":30,"context_line":"# to upgrade from Mitaka to Newton without a key repository gracefully,"},{"line_number":31,"context_line":"# especially in multi-node deployments. The NULL_KEY is specific to credential"},{"line_number":32,"context_line":"# encryption only and has absolutely no beneficial purpose outside of easing"},{"line_number":33,"context_line":"# upgrades."}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_a604fd17","line":30,"in_reply_to":"9a89bdaa_d201bc07","updated":"2016-09-07 17:54:51.000000000","message":"Done","commit_id":"7acb04a64ba4aa62d2155a552894ff0a94e19286"}],"keystone/tests/unit/credential/test_fernet_provider.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"e31d8fa6fe017e989008d983b71caaa2d518040b","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":50,"context_line":"        self.assertIsNotNone(primary_key_hash)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def test_encryption_with_null_key(self):"},{"line_number":53,"context_line":"        # remove the key repository so that we load the null key"},{"line_number":54,"context_line":"        shutil.rmtree(CONF.credential.key_repository)"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_a6607dd0","line":52,"updated":"2016-09-07 17:19:28.000000000","message":"I think this belongs in a separate test class. Maybe named TestFernetCredentialProviderWithNullKeys?\n\nThat way you can do your own setup and not have a key repository created for you.","commit_id":"7acb04a64ba4aa62d2155a552894ff0a94e19286"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"553e17ffddaa1395e7fa6790cff850db7e97a790","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":50,"context_line":"        self.assertIsNotNone(primary_key_hash)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def test_encryption_with_null_key(self):"},{"line_number":53,"context_line":"        # remove the key repository so that we load the null key"},{"line_number":54,"context_line":"        shutil.rmtree(CONF.credential.key_repository)"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_29cfde29","line":52,"in_reply_to":"9a89bdaa_a6607dd0","updated":"2016-09-07 17:51:54.000000000","message":"++ good suggestion","commit_id":"7acb04a64ba4aa62d2155a552894ff0a94e19286"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1361f9c178a48147e198fb1f65b70cb6fab69040","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":50,"context_line":"        self.assertIsNotNone(primary_key_hash)"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def test_encryption_with_null_key(self):"},{"line_number":53,"context_line":"        # remove the key repository so that we load the null key"},{"line_number":54,"context_line":"        shutil.rmtree(CONF.credential.key_repository)"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_c9b4b236","line":52,"in_reply_to":"9a89bdaa_a6607dd0","updated":"2016-09-07 17:54:51.000000000","message":"Done","commit_id":"7acb04a64ba4aa62d2155a552894ff0a94e19286"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"fe4988b6c11a288376b5d041801664ef6c368c1b","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import hashlib"},{"line_number":14,"context_line":"import shutil"},{"line_number":15,"context_line":"import uuid"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.common import fernet_utils"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a89bdaa_fce3f2d6","line":14,"updated":"2016-09-07 18:14:11.000000000","message":"This isn\u0027t used anymore.","commit_id":"1a0593e3f112c9396f6f55a8f3e71a3c19fbf21f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6f6adce134cb8250898cb60c0651c3e4191610a0","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import hashlib"},{"line_number":14,"context_line":"import shutil"},{"line_number":15,"context_line":"import uuid"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.common import fernet_utils"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a89bdaa_9f4c98c9","line":14,"in_reply_to":"9a89bdaa_7c53626b","updated":"2016-09-07 18:38:21.000000000","message":"Done","commit_id":"1a0593e3f112c9396f6f55a8f3e71a3c19fbf21f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6680e0a0f5656f9b69ea7016b8baba315d960578","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"import hashlib"},{"line_number":14,"context_line":"import shutil"},{"line_number":15,"context_line":"import uuid"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"from keystone.common import fernet_utils"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a89bdaa_7c53626b","line":14,"in_reply_to":"9a89bdaa_fce3f2d6","updated":"2016-09-07 18:17:57.000000000","message":"pep8 will fail then","commit_id":"1a0593e3f112c9396f6f55a8f3e71a3c19fbf21f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"fe4988b6c11a288376b5d041801664ef6c368c1b","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        self.provider \u003d credential_fernet.Provider()"},{"line_number":57,"context_line":"        self.useFixture(database.Database())"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def config_overrides(self):"},{"line_number":60,"context_line":"        super(TestFernetCredentialProviderWithNullKey, self).config_overrides()"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    def test_encryption_with_null_key(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a89bdaa_9cd90625","line":59,"updated":"2016-09-07 18:14:11.000000000","message":"Since this doesn\u0027t have any logic it can probably be removed.","commit_id":"1a0593e3f112c9396f6f55a8f3e71a3c19fbf21f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6f6adce134cb8250898cb60c0651c3e4191610a0","unresolved":false,"context_lines":[{"line_number":56,"context_line":"        self.provider \u003d credential_fernet.Provider()"},{"line_number":57,"context_line":"        self.useFixture(database.Database())"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def config_overrides(self):"},{"line_number":60,"context_line":"        super(TestFernetCredentialProviderWithNullKey, self).config_overrides()"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    def test_encryption_with_null_key(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a89bdaa_5f56905c","line":59,"in_reply_to":"9a89bdaa_9cd90625","updated":"2016-09-07 18:38:21.000000000","message":"Good catch.","commit_id":"1a0593e3f112c9396f6f55a8f3e71a3c19fbf21f"}]}