)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a3650356913a5190df961055f44b96bd901ca75","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Although PKI tokens are removed, related bits have to stay:"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_b7522f33","line":11,"updated":"2016-09-27 13:31:40.000000000","message":"Can we deprecate these?","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6a6af0d54f8b17efdea33f390a9ed14711ef9df","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Although PKI tokens are removed, related bits have to stay:"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_6f66febb","line":11,"in_reply_to":"5a8bc5a2_b7522f33","updated":"2016-09-27 16:51:24.000000000","message":"we can, but we can never remove APIs :(","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a3650356913a5190df961055f44b96bd901ca75","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Although PKI tokens are removed, related bits have to stay:"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_d71a5b7c","line":12,"updated":"2016-09-27 13:31:40.000000000","message":"Can we just make it so that these don\u0027t do anything?","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6a6af0d54f8b17efdea33f390a9ed14711ef9df","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Although PKI tokens are removed, related bits have to stay:"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_2f93165c","line":12,"in_reply_to":"5a8bc5a2_d71a5b7c","updated":"2016-09-27 16:51:24.000000000","message":"the generated PKI bits are still useful for viewing revocation events / revoked tokens","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a3650356913a5190df961055f44b96bd901ca75","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_b7014e07","line":13,"updated":"2016-09-27 13:31:40.000000000","message":"I assume we can deprecate these.","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6a6af0d54f8b17efdea33f390a9ed14711ef9df","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_af8d6632","line":13,"in_reply_to":"5a8bc5a2_b7014e07","updated":"2016-09-27 16:51:24.000000000","message":"these options are used by the keystone-manage command above","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1a3650356913a5190df961055f44b96bd901ca75","unresolved":false,"context_lines":[{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We cannot remove APIs without major version change and we need"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_170be224","line":14,"updated":"2016-09-27 13:31:40.000000000","message":"Why do we need to keep the examples/pki/ directory around?","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6a6af0d54f8b17efdea33f390a9ed14711ef9df","unresolved":false,"context_lines":[{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We cannot remove APIs without major version change and we need"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_af948636","line":14,"in_reply_to":"5a8bc5a2_170be224","updated":"2016-09-27 16:51:24.000000000","message":"this should be updated, we removed the token examples from examples/pki","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"7fcf9b9be19005093112da14c5b695e705d96fbb","unresolved":false,"context_lines":[{"line_number":11,"context_line":"  - now useless APIs: /auth/tokens/OS-PKI/revoked and /OS-SIMPLE-CERT"},{"line_number":12,"context_line":"  - keystone-manage commands to generate PKI certs"},{"line_number":13,"context_line":"  - config options related to signing"},{"line_number":14,"context_line":"  - everything under examples/pki/ and gen_pki.sh"},{"line_number":15,"context_line":"  - common/openssl.py"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We cannot remove APIs without major version change and we need"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"5a8bc5a2_90b3460a","line":14,"in_reply_to":"5a8bc5a2_af948636","updated":"2016-09-28 10:06:56.000000000","message":"things under examples/pki are still used in unit tests of revocation lists","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"}],"doc/source/configuration.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"d50b2dfd9a5db9ca1b16fda6ed088d864fdea9b4","unresolved":false,"context_lines":[{"line_number":1326,"context_line":"* ``mapping_engine``: Test your federation mapping rules."},{"line_number":1327,"context_line":"* ``mapping_populate``: Prepare domain-specific LDAP backend"},{"line_number":1328,"context_line":"* ``mapping_purge``: Purge the identity mapping table."},{"line_number":1329,"context_line":"* ``pki_setup``: Initialize the certificates used to sign revocation lists."},{"line_number":1330,"context_line":"* ``saml_idp_metadata``: Generate identity provider metadata."},{"line_number":1331,"context_line":"* ``token_flush``: Purge expired tokens"},{"line_number":1332,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a8bc5a2_43cd9a5c","line":1329,"range":{"start_line":1329,"start_character":17,"end_line":1329,"end_character":75},"updated":"2016-09-27 18:24:22.000000000","message":"Please make this same change in the doc/source/man/keystone-manage.rst","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"7fcf9b9be19005093112da14c5b695e705d96fbb","unresolved":false,"context_lines":[{"line_number":1326,"context_line":"* ``mapping_engine``: Test your federation mapping rules."},{"line_number":1327,"context_line":"* ``mapping_populate``: Prepare domain-specific LDAP backend"},{"line_number":1328,"context_line":"* ``mapping_purge``: Purge the identity mapping table."},{"line_number":1329,"context_line":"* ``pki_setup``: Initialize the certificates used to sign revocation lists."},{"line_number":1330,"context_line":"* ``saml_idp_metadata``: Generate identity provider metadata."},{"line_number":1331,"context_line":"* ``token_flush``: Purge expired tokens"},{"line_number":1332,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"5a8bc5a2_90aa6684","line":1329,"range":{"start_line":1329,"start_character":17,"end_line":1329,"end_character":75},"in_reply_to":"5a8bc5a2_43cd9a5c","updated":"2016-09-28 10:06:56.000000000","message":"Done","commit_id":"14e4442c94269a23b219f8739792b9f8be857dc3"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e067b78922ac94ae7cbc5fed38e047142daf13ba","unresolved":false,"context_lines":[{"line_number":458,"context_line":"using ``keystone-manage fernet_rotate``."},{"line_number":459,"context_line":""},{"line_number":460,"context_line":".. WARNING::"},{"line_number":461,"context_line":"    UUID and Fernet tokens are all bearer tokens, meaning that they"},{"line_number":462,"context_line":"    must be protected from unnecessary disclosure to prevent unauthorized"},{"line_number":463,"context_line":"    access."},{"line_number":464,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba5da102_0e4dedc3","line":461,"updated":"2016-11-01 20:28:02.000000000","message":"all-\u003eboth","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b26f3c5283576efe737644d424f3ab1a7c4bdb69","unresolved":false,"context_lines":[{"line_number":458,"context_line":"using ``keystone-manage fernet_rotate``."},{"line_number":459,"context_line":""},{"line_number":460,"context_line":".. WARNING::"},{"line_number":461,"context_line":"    UUID and Fernet tokens are all bearer tokens, meaning that they"},{"line_number":462,"context_line":"    must be protected from unnecessary disclosure to prevent unauthorized"},{"line_number":463,"context_line":"    access."},{"line_number":464,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba5da102_a9a87bdc","line":461,"in_reply_to":"ba5da102_0e4dedc3","updated":"2016-11-01 20:36:00.000000000","message":"Done","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"}],"doc/source/man/keystone-manage.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e067b78922ac94ae7cbc5fed38e047142daf13ba","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* ``mapping_populate``: Prepare domain-specific LDAP backend."},{"line_number":54,"context_line":"* ``mapping_purge``: Purge the identity mapping table."},{"line_number":55,"context_line":"* ``mapping_engine``: Test your federation mapping rules."},{"line_number":56,"context_line":"* ``pki_setup``: Initialize the certificates used to sign revocation lists."},{"line_number":57,"context_line":"* ``saml_idp_metadata``: Generate identity provider metadata."},{"line_number":58,"context_line":"* ``token_flush``: Purge expired tokens."},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba5da102_aed401bd","line":56,"updated":"2016-11-01 20:28:02.000000000","message":"leave the **deprecated** in there","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b26f3c5283576efe737644d424f3ab1a7c4bdb69","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* ``mapping_populate``: Prepare domain-specific LDAP backend."},{"line_number":54,"context_line":"* ``mapping_purge``: Purge the identity mapping table."},{"line_number":55,"context_line":"* ``mapping_engine``: Test your federation mapping rules."},{"line_number":56,"context_line":"* ``pki_setup``: Initialize the certificates used to sign revocation lists."},{"line_number":57,"context_line":"* ``saml_idp_metadata``: Generate identity provider metadata."},{"line_number":58,"context_line":"* ``token_flush``: Purge expired tokens."},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba5da102_49eb5f13","line":56,"in_reply_to":"ba5da102_aed401bd","updated":"2016-11-01 20:36:00.000000000","message":"Done","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"}],"examples/pki/cms/revocation_list.json":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"51d9b7fccddd1ab6cd9563f134d369f44a846646","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"5a8bc5a2_36804ec0","updated":"2016-09-25 01:12:33.000000000","message":"not sure if these are used anywhere, but we\u0027re not removing the PKI support for revocation list","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"}],"examples/pki/cms/revocation_list.pem":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"51d9b7fccddd1ab6cd9563f134d369f44a846646","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"5a8bc5a2_56815ac2","updated":"2016-09-25 01:12:33.000000000","message":"same","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"}],"examples/pki/gen_pki.sh":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e067b78922ac94ae7cbc5fed38e047142daf13ba","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"ba5da102_aeeb2177","updated":"2016-11-01 20:28:02.000000000","message":"this whole file can go","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b26f3c5283576efe737644d424f3ab1a7c4bdb69","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"ba5da102_c9c68f99","in_reply_to":"ba5da102_aeeb2177","updated":"2016-11-01 20:36:00.000000000","message":"Done","commit_id":"fa9ed534bde0c9c019758c9578af52a8159ad80c"}],"keystone/cmd/cli.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a5393b9bbae5130daab368db666a112ab4c8ea5","unresolved":false,"context_lines":[{"line_number":516,"context_line":""},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"class PKISetup(BaseCertificateSetup):"},{"line_number":519,"context_line":"    \"\"\"Set up Key pairs and certificates for revocation lists signing and"},{"line_number":520,"context_line":"    verification."},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"    This is NOT intended for production use, see Keystone Configuration"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a98d1f4_9ff6fad5","line":519,"updated":"2016-09-28 20:14:47.000000000","message":"This will need to be a single line - likely summarizing the PKISetup functionality. PEP8 fails when the title line of a doc string spans multiple lines.","commit_id":"9324d185178f4c056b13b06d25b305aed5582d39"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e9a9c24093e3887e1fd94f3246e56fc9344e66a","unresolved":false,"context_lines":[{"line_number":516,"context_line":""},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"class PKISetup(BaseCertificateSetup):"},{"line_number":519,"context_line":"    \"\"\"Set up Key pairs and certificates for revocation lists signing and"},{"line_number":520,"context_line":"    verification."},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"    This is NOT intended for production use, see Keystone Configuration"}],"source_content_type":"text/x-python","patch_set":15,"id":"3a98d1f4_bfc49640","line":519,"in_reply_to":"3a98d1f4_9ff6fad5","updated":"2016-09-28 20:18:46.000000000","message":"What about - http://cdn.pasteraw.com/qu7d3fuwrswu16pu03zb7z1fhluakwa ?","commit_id":"9324d185178f4c056b13b06d25b305aed5582d39"}],"keystone/cmd/doctor/tokens.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"\"\""},{"line_number":42,"context_line":"    return ("},{"line_number":43,"context_line":"        \u0027uuid\u0027 in CONF.token.provider and CONF.max_token_size !\u003d 32"},{"line_number":44,"context_line":"        or \u0027pki\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":45,"context_line":"        or \u0027pkiz\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":46,"context_line":"        or \u0027fernet\u0027 in CONF.token.provider and CONF.max_token_size \u003e 255)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_4fcf267f","side":"PARENT","line":44,"updated":"2016-09-23 13:18:39.000000000","message":"Are all non-supported options flagged when doctor runs? Will doctor now raise an error when there is a PKI related config option?","commit_id":"c3f2862c7b96edb747d80b648eb3c957069e6e02"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de759a13de7a67180b89caddaa803c97984a4e7e","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"\"\""},{"line_number":42,"context_line":"    return ("},{"line_number":43,"context_line":"        \u0027uuid\u0027 in CONF.token.provider and CONF.max_token_size !\u003d 32"},{"line_number":44,"context_line":"        or \u0027pki\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":45,"context_line":"        or \u0027pkiz\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":46,"context_line":"        or \u0027fernet\u0027 in CONF.token.provider and CONF.max_token_size \u003e 255)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_ac7d0270","side":"PARENT","line":44,"in_reply_to":"5a8bc5a2_4fcf267f","updated":"2016-09-23 18:41:52.000000000","message":"The check only ran if pki or pkiz matched the actual token provider.","commit_id":"c3f2862c7b96edb747d80b648eb3c957069e6e02"}],"keystone/conf/default.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":86,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":87,"context_line":"    default\u003d255,"},{"line_number":88,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":89,"context_line":"Similar to `[DEFAULT] max_param_size`, but provides an exception for token"},{"line_number":90,"context_line":"values. With Fernet tokens, this can be set as low as 255. With UUID tokens,"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_62acf935","line":87,"updated":"2016-09-23 13:18:39.000000000","message":"Please add a comment that 255 is the size of the database columns used for ID fields.  This size is picked so that the tokens can be indexed in-place as opposed to be being entries in a string table.  THus, this is a performance decision.","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"e2dbc01fe7bce1b5a1c768aac498f543a177a304","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Limit the sizes of user \u0026 project ID/names."},{"line_number":83,"context_line":"\"\"\"))"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"# NOTE(breton): 255 is the size of the database columns used for ID fields."},{"line_number":86,"context_line":"# This size is picked so that the tokens can be indexed in-place as opposed to"},{"line_number":87,"context_line":"# being entries in a string table. Thus, this is a performance decision."},{"line_number":88,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":89,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":90,"context_line":"    default\u003d255,"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a98d1f4_adc0a9e1","line":87,"range":{"start_line":85,"start_character":0,"end_line":87,"end_character":72},"updated":"2016-09-29 22:55:54.000000000","message":"So I\u0027m confused by this. The default token is uuid, so I would expect 32 according to the option help below. But this note implies 255 should be used for performance reasons. So which is it? If 255 should be chosen even for UUID, then the option help should change also IMO.","commit_id":"c962429b58cad76afc8e2d35c03a97a02da3aa9f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"65b409111eb79b8a49265a3cd05461541b7a8148","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Limit the sizes of user \u0026 project ID/names."},{"line_number":83,"context_line":"\"\"\"))"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"# NOTE(breton): 255 is the size of the database columns used for ID fields."},{"line_number":86,"context_line":"# This size is picked so that the tokens can be indexed in-place as opposed to"},{"line_number":87,"context_line":"# being entries in a string table. Thus, this is a performance decision."},{"line_number":88,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":89,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":90,"context_line":"    default\u003d255,"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a95cdbc_82fe13ac","line":87,"range":{"start_line":85,"start_character":0,"end_line":87,"end_character":72},"in_reply_to":"1a95cdbc_877c65b6","updated":"2016-10-07 16:36:17.000000000","message":"Mark it as deprecated for removal (totally unused) and just set the validator to be 64 or less directly at the line you highlighted.\n\nEasiest change and eliminates a weird option (and note) that was highly pki specific.","commit_id":"c962429b58cad76afc8e2d35c03a97a02da3aa9f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34a720d5ce2a14de5b3a8b86319b9b2f3eb64320","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Limit the sizes of user \u0026 project ID/names."},{"line_number":83,"context_line":"\"\"\"))"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"# NOTE(breton): 255 is the size of the database columns used for ID fields."},{"line_number":86,"context_line":"# This size is picked so that the tokens can be indexed in-place as opposed to"},{"line_number":87,"context_line":"# being entries in a string table. Thus, this is a performance decision."},{"line_number":88,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":89,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":90,"context_line":"    default\u003d255,"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a95cdbc_877c65b6","line":87,"range":{"start_line":85,"start_character":0,"end_line":87,"end_character":72},"in_reply_to":"1a95cdbc_b1319f5c","updated":"2016-10-07 16:25:45.000000000","message":"this is the only spot it\u0027s used in: https://github.com/openstack/keystone/blob/106bc4559b4ab9351b8a9c8caaf26527d1a337cc/keystone/token/controllers.py#L173-L175\n\nWould need a release note saying we removed it, it was never deprecated. Could also deprecate and just not use it.","commit_id":"c962429b58cad76afc8e2d35c03a97a02da3aa9f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"320d1b1eceb4c1ae6eb92dee90f7c1e185fd2f3b","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Limit the sizes of user \u0026 project ID/names."},{"line_number":83,"context_line":"\"\"\"))"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"# NOTE(breton): 255 is the size of the database columns used for ID fields."},{"line_number":86,"context_line":"# This size is picked so that the tokens can be indexed in-place as opposed to"},{"line_number":87,"context_line":"# being entries in a string table. Thus, this is a performance decision."},{"line_number":88,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":89,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":90,"context_line":"    default\u003d255,"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a95cdbc_b1319f5c","line":87,"range":{"start_line":85,"start_character":0,"end_line":87,"end_character":72},"in_reply_to":"3a98d1f4_98832604","updated":"2016-10-07 15:40:05.000000000","message":"can we just drop the option? the fernet provider can check length as can the uuid provider if we need faster lookups.","commit_id":"c962429b58cad76afc8e2d35c03a97a02da3aa9f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"eb1199f1d6420fdae30ac9a102eff6851ef6050a","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Limit the sizes of user \u0026 project ID/names."},{"line_number":83,"context_line":"\"\"\"))"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"# NOTE(breton): 255 is the size of the database columns used for ID fields."},{"line_number":86,"context_line":"# This size is picked so that the tokens can be indexed in-place as opposed to"},{"line_number":87,"context_line":"# being entries in a string table. Thus, this is a performance decision."},{"line_number":88,"context_line":"max_token_size \u003d cfg.IntOpt("},{"line_number":89,"context_line":"    \u0027max_token_size\u0027,"},{"line_number":90,"context_line":"    default\u003d255,"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a98d1f4_98832604","line":87,"range":{"start_line":85,"start_character":0,"end_line":87,"end_character":72},"in_reply_to":"3a98d1f4_adc0a9e1","updated":"2016-09-30 01:13:56.000000000","message":"I would prefer this comment just go away. The ID field for tokens is size 64: https://github.com/openstack/keystone/blob/master/keystone/token/persistence/backends/sql.py#L36\n\nSo i\u0027m not sure what Adam was referring to.\n\nI do think the help is sufficient -- if you\u0027re using UUID set it to 32, otherwise set it to 255. Since that\u0027s the max size for Fernet tokens.","commit_id":"c962429b58cad76afc8e2d35c03a97a02da3aa9f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c5d9d7f6c4c3d8a8a90a7efb148b6de24b2052e7","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    default\u003d255,"},{"line_number":91,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":92,"context_line":"Similar to `[DEFAULT] max_param_size`, but provides an exception for token"},{"line_number":93,"context_line":"values. With Fernet tokens, this can be set as low as 255. With UUID tokens,"},{"line_number":94,"context_line":"this should be set to 32)."},{"line_number":95,"context_line":"\"\"\"))"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_efc35387","line":93,"range":{"start_line":93,"start_character":28,"end_line":93,"end_character":57},"updated":"2016-11-01 21:45:27.000000000","message":"I guess that now that we have only fernet + uuid, it doesn\u0027t make sense to have this higher than 255, right ? we should document that","commit_id":"95efb1495fb01ab26f76b5e30c1b12ec9e7dc4ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"405ec1d3ab1ff0837ccb7f04eea1a4d2596f1ae2","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    default\u003d255,"},{"line_number":91,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":92,"context_line":"Similar to `[DEFAULT] max_param_size`, but provides an exception for token"},{"line_number":93,"context_line":"values. With Fernet tokens, this can be set as low as 255. With UUID tokens,"},{"line_number":94,"context_line":"this should be set to 32)."},{"line_number":95,"context_line":"\"\"\"))"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_cf604f04","line":93,"in_reply_to":"ba5da102_efc35387","updated":"2016-11-01 22:09:13.000000000","message":"Yeah - documentation can be added but I\u0027d be fine doing that in a separate patch (since this one is already getting big).","commit_id":"95efb1495fb01ab26f76b5e30c1b12ec9e7dc4ee"}],"keystone/tests/unit/test_cert_setup.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de759a13de7a67180b89caddaa803c97984a4e7e","unresolved":false,"context_lines":[{"line_number":78,"context_line":"                          controller.authenticate,"},{"line_number":79,"context_line":"                          self.make_request(), body_dict)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def test_create_pki_certs(self, rebuild\u003dFalse):"},{"line_number":82,"context_line":"        pki \u003d openssl.ConfigurePKI(None, None, rebuild\u003drebuild)"},{"line_number":83,"context_line":"        pki.run()"},{"line_number":84,"context_line":"        self.assertTrue(os.path.exists(CONF.signing.certfile))"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_8c6206ac","side":"PARENT","line":81,"updated":"2016-09-23 18:41:52.000000000","message":"Do we need this anymore?","commit_id":"c3f2862c7b96edb747d80b648eb3c957069e6e02"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"67c5cdc8f4950514e66925879ecd4ceed152d3f6","unresolved":false,"context_lines":[{"line_number":78,"context_line":"                          controller.authenticate,"},{"line_number":79,"context_line":"                          self.make_request(), body_dict)"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def test_create_pki_certs(self, rebuild\u003dFalse):"},{"line_number":82,"context_line":"        pki \u003d openssl.ConfigurePKI(None, None, rebuild\u003drebuild)"},{"line_number":83,"context_line":"        pki.run()"},{"line_number":84,"context_line":"        self.assertTrue(os.path.exists(CONF.signing.certfile))"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_d3749c37","side":"PARENT","line":81,"in_reply_to":"5a8bc5a2_8c6206ac","updated":"2016-09-24 21:33:59.000000000","message":"yes. We need certificates to sign revocation lists API responses.","commit_id":"c3f2862c7b96edb747d80b648eb3c957069e6e02"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":58,"context_line":"            ca_certs\u003dca_certs,"},{"line_number":59,"context_line":"            ca_key\u003dca_key,"},{"line_number":60,"context_line":"            keyfile\u003dos.path.join(KEYDIR, \u0027signing_key.pem\u0027))"},{"line_number":61,"context_line":"        self.config_fixture.config(group\u003d\u0027token\u0027, provider\u003d\u0027uuid\u0027)"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    def test_create_pki_certs(self, rebuild\u003dFalse):"},{"line_number":64,"context_line":"        pki \u003d openssl.ConfigurePKI(None, None, rebuild\u003drebuild)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_255bdb2f","line":61,"updated":"2016-09-23 13:18:39.000000000","message":"fernet","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"}],"keystone/tests/unit/test_v2.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c5d9d7f6c4c3d8a8a90a7efb148b6de24b2052e7","unresolved":false,"context_lines":[{"line_number":1467,"context_line":"        self.skipTest(\u0027Revocation lists do not support Fernet\u0027)"},{"line_number":1468,"context_line":""},{"line_number":1469,"context_line":""},{"line_number":1470,"context_line":"class RevokeApiTestCase(V2TestCase, RestfulTestCase, CoreApiTests,"},{"line_number":1471,"context_line":"                        LegacyV2UsernameTests):"},{"line_number":1472,"context_line":"    def config_overrides(self):"},{"line_number":1473,"context_line":"        super(RevokeApiTestCase, self).config_overrides()"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_8f7ad775","side":"PARENT","line":1470,"range":{"start_line":1470,"start_character":6,"end_line":1470,"end_character":23},"updated":"2016-11-01 21:45:27.000000000","message":"isn\u0027t this test class valid yet ? perhaps we just need to update the provider in the config_overrides ?","commit_id":"748eb419040642696ac43538ba419b332f2a49ba"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"405ec1d3ab1ff0837ccb7f04eea1a4d2596f1ae2","unresolved":false,"context_lines":[{"line_number":1467,"context_line":"        self.skipTest(\u0027Revocation lists do not support Fernet\u0027)"},{"line_number":1468,"context_line":""},{"line_number":1469,"context_line":""},{"line_number":1470,"context_line":"class RevokeApiTestCase(V2TestCase, RestfulTestCase, CoreApiTests,"},{"line_number":1471,"context_line":"                        LegacyV2UsernameTests):"},{"line_number":1472,"context_line":"    def config_overrides(self):"},{"line_number":1473,"context_line":"        super(RevokeApiTestCase, self).config_overrides()"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_61b5972f","side":"PARENT","line":1470,"in_reply_to":"ba5da102_8f7ad775","updated":"2016-11-01 22:09:13.000000000","message":"I think this should be removed. This was only testing PKI functionality and the tests added here at lines 1479, 1482, and 1485 don\u0027t override tests anywhere else, which is strange because that not usually a pattern we do.\n\nThese are the only definitions I\u0027m seeing for these tests...\n\nhttp://cdn.pasteraw.com/moett1fry8hlpsr5wbnxvdss95mqj65","commit_id":"748eb419040642696ac43538ba419b332f2a49ba"}],"keystone/tests/unit/test_v3_auth.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":2587,"context_line":"        super(TestTokenRevokeById, self).config_overrides()"},{"line_number":2588,"context_line":"        self.config_fixture.config("},{"line_number":2589,"context_line":"            group\u003d\u0027token\u0027,"},{"line_number":2590,"context_line":"            provider\u003d\u0027uuid\u0027,"},{"line_number":2591,"context_line":"            revoke_by_id\u003dFalse)"},{"line_number":2592,"context_line":""},{"line_number":2593,"context_line":"    def setUp(self):"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_420d3d3d","line":2590,"updated":"2016-09-23 13:18:39.000000000","message":"Fernet","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":3343,"context_line":"        super(TestTokenRevokeApi, self).config_overrides()"},{"line_number":3344,"context_line":"        self.config_fixture.config("},{"line_number":3345,"context_line":"            group\u003d\u0027token\u0027,"},{"line_number":3346,"context_line":"            provider\u003d\u0027uuid\u0027,"},{"line_number":3347,"context_line":"            revoke_by_id\u003dFalse)"},{"line_number":3348,"context_line":""},{"line_number":3349,"context_line":"    def assertValidDeletedProjectResponse(self, events_response, project_id):"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_8207451b","line":3346,"updated":"2016-09-23 13:18:39.000000000","message":"fernet","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"}],"keystone/tests/unit/token/test_backends.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cced29fe0ce7d7da722739ec399ac02dc16e385e","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"class TokenTests(object):"},{"line_number":33,"context_line":"    def _create_token_id(self):"},{"line_number":34,"context_line":"        return uuid.uuid4().hex"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    def _assert_revoked_token_list_matches_token_persistence("},{"line_number":37,"context_line":"            self, revoked_token_id_list):"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_e5857359","line":34,"updated":"2016-09-23 13:18:39.000000000","message":"probably should be something that will work as a Fernet token, and I don\u0027t think uuid will work.","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de759a13de7a67180b89caddaa803c97984a4e7e","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"class TokenTests(object):"},{"line_number":33,"context_line":"    def _create_token_id(self):"},{"line_number":34,"context_line":"        return uuid.uuid4().hex"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    def _assert_revoked_token_list_matches_token_persistence("},{"line_number":37,"context_line":"            self, revoked_token_id_list):"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_2c0572bb","line":34,"in_reply_to":"5a8bc5a2_e5857359","updated":"2016-09-23 18:41:52.000000000","message":"These are backend specific tests - which won\u0027t work with fernet anyway since fernet doesn\u0027t use the persistence backend at all.","commit_id":"e2a671b0f43dd6c9fe9f25552c7e552635e351c3"}],"keystone/token/provider.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"c5d9d7f6c4c3d8a8a90a7efb148b6de24b2052e7","unresolved":false,"context_lines":[{"line_number":166,"context_line":"            # id."},{"line_number":167,"context_line":"            if self._needs_persistence:"},{"line_number":168,"context_line":"                token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":169,"context_line":"                # Overload the token_id variable to be a token reference #"},{"line_number":170,"context_line":"                # instead."},{"line_number":171,"context_line":"                token_id \u003d token_ref"},{"line_number":172,"context_line":"            token_ref \u003d self._validate_token(token_id)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_cf43ef40","line":169,"range":{"start_line":169,"start_character":72,"end_line":169,"end_character":74},"updated":"2016-11-01 21:45:27.000000000","message":"nit: remove this","commit_id":"95efb1495fb01ab26f76b5e30c1b12ec9e7dc4ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"405ec1d3ab1ff0837ccb7f04eea1a4d2596f1ae2","unresolved":false,"context_lines":[{"line_number":166,"context_line":"            # id."},{"line_number":167,"context_line":"            if self._needs_persistence:"},{"line_number":168,"context_line":"                token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":169,"context_line":"                # Overload the token_id variable to be a token reference #"},{"line_number":170,"context_line":"                # instead."},{"line_number":171,"context_line":"                token_id \u003d token_ref"},{"line_number":172,"context_line":"            token_ref \u003d self._validate_token(token_id)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5da102_0f05e712","line":169,"in_reply_to":"ba5da102_cf43ef40","updated":"2016-11-01 22:09:13.000000000","message":"Done","commit_id":"95efb1495fb01ab26f76b5e30c1b12ec9e7dc4ee"}],"keystone/token/utils.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"51d9b7fccddd1ab6cd9563f134d369f44a846646","unresolved":false,"context_lines":[{"line_number":10,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":11,"context_line":"# under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from keystoneclient.common import cms"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"import keystone.conf"},{"line_number":16,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"5a8bc5a2_56587a8a","side":"PARENT","line":13,"range":{"start_line":13,"start_character":5,"end_line":13,"end_character":37},"updated":"2016-09-25 01:12:33.000000000","message":"it now looks like most of keystoneclient.common.cms can be removed. unfortunately it hasn\u0027t been deprecated :(","commit_id":"c3f2862c7b96edb747d80b648eb3c957069e6e02"}]}