)]}'
{"keystone/credential/providers/fernet/core.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"13779276c04f3aa0b28e1ed94c0abd188a2df913","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        \"\"\""},{"line_number":70,"context_line":"        crypto, keys \u003d get_multi_fernet_keys()"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if keys[0] \u003d\u003d base64.urlsafe_b64encode(chr(0) * 32):"},{"line_number":73,"context_line":"            LOG.warning(_LW("},{"line_number":74,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":75,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_e3bfdca7","line":72,"range":{"start_line":72,"start_character":22,"end_line":72,"end_character":59},"updated":"2016-09-07 15:43:56.000000000","message":"it\u0027d be better to import it from fernet utils","commit_id":"2d3f7c740b72f909b6b3299e78955ccf150d9ca2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9e98d40214c78527bb0e86e8138a8e06f285580b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        \"\"\""},{"line_number":70,"context_line":"        crypto, keys \u003d get_multi_fernet_keys()"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        if keys[0] \u003d\u003d base64.urlsafe_b64encode(chr(0) * 32):"},{"line_number":73,"context_line":"            LOG.warning(_LW("},{"line_number":74,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":75,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_ac8ea176","line":72,"in_reply_to":"9a89bdaa_e3bfdca7","updated":"2016-09-07 16:20:41.000000000","message":"Done","commit_id":"2d3f7c740b72f909b6b3299e78955ccf150d9ca2"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c8c7d6cc79bf8a1fc74539bb0e942e824d20749d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_4c38b53d","line":74,"range":{"start_line":74,"start_character":17,"end_line":74,"end_character":24},"updated":"2016-09-07 16:28:20.000000000","message":"the word migrate is not adequate here I think because this is not valid if migration has been done already (as it can\u0027t be done again). should we call it \"Please properly encrypt credentials ...\"","commit_id":"27a25d4f103dd42eed5262a1126701e2cd020f20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"99f7a3f05f986acab9ff024353e9c3e1659869b6","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_cce04599","line":74,"in_reply_to":"9a89bdaa_4c38b53d","updated":"2016-09-07 16:33:18.000000000","message":"I would argue that migrate is the right word because the credentials are properly encrypted, they\u0027re just encrypted with an insecure known key.\n\nThis log is telling the operator to migrate *off* the insecure known key to a proper key repository via re-encryption. Migrations can be done whenever... they don\u0027t have to be done only once. I can migrate as much as my deployments security requirements mandate me to do so by doing: \n\n  1.) keystone-manage credential_rotate\n  2.) keystone-manage credential_migrate\n  3.) keystone-manage credential_rotate\n  4.) keystone-manage credential_migrate","commit_id":"27a25d4f103dd42eed5262a1126701e2cd020f20"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"a7f735971dc35122de07623cd4bc689aeb4e37be","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_260d4de8","line":74,"in_reply_to":"9a89bdaa_8c0b9d29","updated":"2016-09-07 17:23:10.000000000","message":"I would s/migrate/encrypt/ to avoid ambiguity with the word \u0027migrate\u0027.","commit_id":"27a25d4f103dd42eed5262a1126701e2cd020f20"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"314ca0a7e4b2b3a6fd7c9956fc1a452e09d9b987","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a89bdaa_8c0b9d29","line":74,"in_reply_to":"9a89bdaa_cce04599","updated":"2016-09-07 16:37:41.000000000","message":"I was associating that with the db migraiton that adds the columns, etc\n\nthanks for clarifying","commit_id":"27a25d4f103dd42eed5262a1126701e2cd020f20"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7eaaf4809f3557d6a1cdd57fccce77fd6a2501a8","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_a6187d1f","line":74,"updated":"2016-09-07 17:23:34.000000000","message":"I would s/migrate/encrypt/ to avoid ambiguity with the word \u0027migrate\u0027","commit_id":"9dfe6728b079f6fdd6f7447ccfab4b5a1760e259"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53ce9b693c73afa3a79c2285a87c130b8a9eb6b0","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_a656bd27","line":74,"in_reply_to":"9a89bdaa_a6187d1f","updated":"2016-09-07 17:35:38.000000000","message":"Samuel had that same comment a couple patch sets ago - does my response to him make sense?","commit_id":"9dfe6728b079f6fdd6f7447ccfab4b5a1760e259"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f03d3fe35254491a25036cfd1802302d574d0e0d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_e93896a2","line":74,"in_reply_to":"9a89bdaa_a656bd27","updated":"2016-09-07 17:43:01.000000000","message":"Yeah, but if he asked then someone else will too. Best to rephase to be less ambiguous.","commit_id":"9dfe6728b079f6fdd6f7447ccfab4b5a1760e259"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f33bca3277e555d237d21fbb4cf09b9da6180ac8","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        if keys[0] \u003d\u003d fernet_utils.NULL_KEY:"},{"line_number":72,"context_line":"            LOG.warning(_LW("},{"line_number":73,"context_line":"                \u0027Encrypting credentials with the null key. Please properly \u0027"},{"line_number":74,"context_line":"                \u0027migrate credentials using `keystone-manage credential_setup`,\u0027"},{"line_number":75,"context_line":"                \u0027 `keystone-manage credential_migrate`, and `keystone-manage \u0027"},{"line_number":76,"context_line":"                \u0027credential_rotate`\u0027))"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_29fc3e71","line":74,"in_reply_to":"9a89bdaa_e93896a2","updated":"2016-09-07 17:48:14.000000000","message":"Sounds good - I can reword.","commit_id":"9dfe6728b079f6fdd6f7447ccfab4b5a1760e259"}],"keystone/tests/unit/credential/test_fernet_provider.py":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"a909584a590fa2c9f0e638fbf4a6cd189e6df6eb","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    def test_warning_is_logged_when_encrypting_with_null_key(self):"},{"line_number":72,"context_line":"        # remove the key repository so that we load the null key"},{"line_number":73,"context_line":"        shutil.rmtree(CONF.credential.key_repository)"},{"line_number":74,"context_line":"        blob \u003d uuid.uuid4().hex"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_86dd3ee2","line":72,"range":{"start_line":72,"start_character":36,"end_line":72,"end_character":64},"updated":"2016-09-07 16:12:44.000000000","message":"this should probably be rephrased to \"so that the null key is used for encryption\", because the null key gets loaded unconditionally","commit_id":"2d3f7c740b72f909b6b3299e78955ccf150d9ca2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9e98d40214c78527bb0e86e8138a8e06f285580b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        self.assertEqual(blob, decrypted_blob)"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    def test_warning_is_logged_when_encrypting_with_null_key(self):"},{"line_number":72,"context_line":"        # remove the key repository so that we load the null key"},{"line_number":73,"context_line":"        shutil.rmtree(CONF.credential.key_repository)"},{"line_number":74,"context_line":"        blob \u003d uuid.uuid4().hex"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"9a89bdaa_acbce106","line":72,"in_reply_to":"9a89bdaa_86dd3ee2","updated":"2016-09-07 16:20:41.000000000","message":"Done","commit_id":"2d3f7c740b72f909b6b3299e78955ccf150d9ca2"}]}