)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11650,"name":"Tom Cammann","email":"tom.cammann@hpe.com","username":"cammann"},"change_message_id":"7c950e8d0bdbe261a9b90add00c3c9df58ddf010","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Magnum should manage x509 objects,"},{"line_number":13,"context_line":"* To generate CA key and cert for each bay"},{"line_number":14,"context_line":"* To generate client key for magnum-conductor"},{"line_number":15,"context_line":"* To generate client key to provide end user"},{"line_number":16,"context_line":"* To sign a public key for kube-apiserver"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This patch adds these abilities to Magnum."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_69b73021","line":15,"updated":"2015-08-13 09:34:01.000000000","message":"It shouldn\u0027t be generating keys for clients, clients can get their keys signed by Magnum though. We do not want to transfer keys across the network. We will need a user accessible API for signing.","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"a8dd42b7a7a96c93d9b4ea9d99ef511e62e68920","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Magnum should manage x509 objects,"},{"line_number":13,"context_line":"* To generate CA key and cert for each bay"},{"line_number":14,"context_line":"* To generate client key for magnum-conductor"},{"line_number":15,"context_line":"* To generate client key to provide end user"},{"line_number":16,"context_line":"* To sign a public key for kube-apiserver"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This patch adds these abilities to Magnum."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_85726aaf","line":15,"in_reply_to":"1a4dcd0f_69b73021","updated":"2015-08-14 08:05:37.000000000","message":"Done","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"93d31aacdfc7235040c72863d66ac41fa195a6f5","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Magnum should manage x509 objects,"},{"line_number":13,"context_line":"* To generate CA key and cert for each bay"},{"line_number":14,"context_line":"* To generate client key for magnum-conductor"},{"line_number":15,"context_line":"* To generate client key to provide end user"},{"line_number":16,"context_line":"* To sign a public key for kube-apiserver"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This patch adds these abilities to Magnum."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_3c7cdbea","line":15,"in_reply_to":"1a4dcd0f_69b73021","updated":"2015-08-14 00:25:15.000000000","message":"Ok, so you mean magnum client should generate/manage client key and request to sign?","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":11650,"name":"Tom Cammann","email":"tom.cammann@hpe.com","username":"cammann"},"change_message_id":"7c950e8d0bdbe261a9b90add00c3c9df58ddf010","unresolved":false,"context_lines":[{"line_number":22,"context_line":"* key encoding is only supported PEM"},{"line_number":23,"context_line":"* ca key has no password"},{"line_number":24,"context_line":"* some parameters are hard coded"},{"line_number":25,"context_line":"* this doesn\u0027t use Anchor"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"I want to discuss about this."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_296368b2","line":25,"updated":"2015-08-13 09:34:01.000000000","message":"Your solution is a better solution than using it as a library.","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"a8dd42b7a7a96c93d9b4ea9d99ef511e62e68920","unresolved":false,"context_lines":[{"line_number":22,"context_line":"* key encoding is only supported PEM"},{"line_number":23,"context_line":"* ca key has no password"},{"line_number":24,"context_line":"* some parameters are hard coded"},{"line_number":25,"context_line":"* this doesn\u0027t use Anchor"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"I want to discuss about this."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_a577669e","line":25,"in_reply_to":"1a4dcd0f_296368b2","updated":"2015-08-14 08:05:37.000000000","message":"Done","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"93d31aacdfc7235040c72863d66ac41fa195a6f5","unresolved":false,"context_lines":[{"line_number":22,"context_line":"* key encoding is only supported PEM"},{"line_number":23,"context_line":"* ca key has no password"},{"line_number":24,"context_line":"* some parameters are hard coded"},{"line_number":25,"context_line":"* this doesn\u0027t use Anchor"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"I want to discuss about this."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_fc8513cf","line":25,"in_reply_to":"1a4dcd0f_296368b2","updated":"2015-08-14 00:25:15.000000000","message":"Thanks!","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"}],"etc/magnum/magnum.conf.sample":[{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"765f503f1ae32e986b135a3461857c5386f110e2","unresolved":false,"context_lines":[{"line_number":1060,"context_line":"# Signature\", \"Non Repudiation\", \"Key Encipherment\", \"Data"},{"line_number":1061,"context_line":"# Encipherment\", \"Key Agreement\", \"Certificate Sign\", \"CRL Sign\","},{"line_number":1062,"context_line":"# \"Encipher Only\", \"Decipher Only\" (list value)"},{"line_number":1063,"context_line":"#allowed_key_usage \u003d Digital Signature,Key Encipherment,Non Repudiation"},{"line_number":1064,"context_line":""},{"line_number":1065,"context_line":"# Number of days for a certificate is available. (integer value)"},{"line_number":1066,"context_line":"#term_of_validity \u003d 1825"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"fa1b9901_a78edf2b","line":1063,"updated":"2015-08-21 01:47:10.000000000","message":"not sure if use Digiatal Signature is good format for configuration values,\n\nAs I think\n\ndigitalSignature format is better. since it not container space here","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"6cedbc8bed37ef326630904e3df9c79ad88c12f7","unresolved":false,"context_lines":[{"line_number":1060,"context_line":"# Signature\", \"Non Repudiation\", \"Key Encipherment\", \"Data"},{"line_number":1061,"context_line":"# Encipherment\", \"Key Agreement\", \"Certificate Sign\", \"CRL Sign\","},{"line_number":1062,"context_line":"# \"Encipher Only\", \"Decipher Only\" (list value)"},{"line_number":1063,"context_line":"#allowed_key_usage \u003d Digital Signature,Key Encipherment,Non Repudiation"},{"line_number":1064,"context_line":""},{"line_number":1065,"context_line":"# Number of days for a certificate is available. (integer value)"},{"line_number":1066,"context_line":"#term_of_validity \u003d 1825"}],"source_content_type":"application/octet-stream","patch_set":12,"id":"fa1b9901_c74d13c5","line":1063,"in_reply_to":"fa1b9901_a78edf2b","updated":"2015-08-21 01:54:56.000000000","message":"This is a same format as Anchor project to validate.\nBut I think \"digitalSignature\" format is better to use.","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"739764e8476c85f6b271e0db1b703a16e996b752","unresolved":false,"context_lines":[{"line_number":1083,"context_line":"#allowed_key_usage \u003d Digital Signature,Key Encipherment,Non Repudiation"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"# Number of days for a certificate is available. (integer value)"},{"line_number":1086,"context_line":"#term_of_validity \u003d 1825"},{"line_number":1087,"context_line":""},{"line_number":1088,"context_line":"# Size of generated private key.  (integer value)"},{"line_number":1089,"context_line":"#rsa_key_size \u003d 2048"}],"source_content_type":"application/octet-stream","patch_set":25,"id":"da20952f_cf039db7","line":1086,"updated":"2015-08-27 08:23:01.000000000","message":"So if we have very old magnum bays, they will self destruct (be unable to communicate through the kube API when the cert expires after 5 years? This is okay with me, but I\u0027d like to have a tech-debt bug ticket opened against it that has some feature for renewing certificates, before or after they expire.","commit_id":"f40f44aeb248ef0713c57523a8e17e9390d02c1d"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"b600280026ad5bac9497a3cd27197a7e3867f705","unresolved":false,"context_lines":[{"line_number":1083,"context_line":"#allowed_key_usage \u003d Digital Signature,Key Encipherment,Non Repudiation"},{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"# Number of days for a certificate is available. (integer value)"},{"line_number":1086,"context_line":"#term_of_validity \u003d 1825"},{"line_number":1087,"context_line":""},{"line_number":1088,"context_line":"# Size of generated private key.  (integer value)"},{"line_number":1089,"context_line":"#rsa_key_size \u003d 2048"}],"source_content_type":"application/octet-stream","patch_set":25,"id":"da20952f_beb69c3b","line":1086,"in_reply_to":"da20952f_cf039db7","updated":"2015-08-27 09:00:52.000000000","message":"I reported a tech-debt ticket about this.\n\n* https://bugs.launchpad.net/magnum/+bug/1489352\n\nActually this configuration (5 years) is come from google container engine\u0027s default.","commit_id":"f40f44aeb248ef0713c57523a8e17e9390d02c1d"}],"magnum/common/x509.py":[{"author":{"_account_id":5387,"name":"Andrew Melton","email":"andrew.melton@rackspace.com","username":"andrew-melton"},"change_message_id":"6c6d3beef94fc1350991029053d5f1edaf2b449e","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    builder \u003d builder.public_key(csr.public_key())"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    for extention in csr.extensions:"},{"line_number":88,"context_line":"        builder.add_extension(extention.value, critical\u003dextention.critical)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    certificate \u003d builder.sign("},{"line_number":91,"context_line":"        private_key\u003dca_key, algorithm\u003dhashes.SHA256(),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_47d32b04","line":88,"updated":"2015-08-13 15:58:08.000000000","message":"We may not want to blindly copy extensions from the CSR into the certificate. For instance, if someone included the CA extension on the CSR, Magnum would issue the client a valid CA. Something like a whitelist of safe extensions would probably be a good idea.","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"a8dd42b7a7a96c93d9b4ea9d99ef511e62e68920","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    builder \u003d builder.public_key(csr.public_key())"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    for extention in csr.extensions:"},{"line_number":88,"context_line":"        builder.add_extension(extention.value, critical\u003dextention.critical)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    certificate \u003d builder.sign("},{"line_number":91,"context_line":"        private_key\u003dca_key, algorithm\u003dhashes.SHA256(),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_05673aeb","line":88,"in_reply_to":"1a4dcd0f_47d32b04","updated":"2015-08-14 08:05:37.000000000","message":"Done","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"93d31aacdfc7235040c72863d66ac41fa195a6f5","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    builder \u003d builder.public_key(csr.public_key())"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    for extention in csr.extensions:"},{"line_number":88,"context_line":"        builder.add_extension(extention.value, critical\u003dextention.critical)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    certificate \u003d builder.sign("},{"line_number":91,"context_line":"        private_key\u003dca_key, algorithm\u003dhashes.SHA256(),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a4dcd0f_7ce02397","line":88,"in_reply_to":"1a4dcd0f_47d32b04","updated":"2015-08-14 00:25:15.000000000","message":"Ok, I think in our use case, only subjectAltName is needed.","commit_id":"c3388866dbc64b71250ac054ce7d5470fe4fb07c"},{"author":{"_account_id":5387,"name":"Andrew Melton","email":"andrew.melton@rackspace.com","username":"andrew-melton"},"change_message_id":"446e042fb0514924b2c87ecd5309001f49838421","unresolved":false,"context_lines":[{"line_number":54,"context_line":"                                 ca_key_password\u003dca_key_password)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"def sign_as_client(csr, issuer_name, ca_key, ca_key_password\u003dNone):"},{"line_number":58,"context_line":"    return _sign(csr, _build_client_extentions(), issuer_name, ca_key,"},{"line_number":59,"context_line":"                 ca_key_password\u003dca_key_password)"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_029e5c56","line":57,"updated":"2015-08-17 18:08:05.000000000","message":"I don\u0027t think we should be making the designation of what a client vs a server certificate should be. There are a few different cases and I think building a custom signing mechanism for each is unnecessary. For instance, in the case of the swarm bay, the swarm services have different needs. The swarm-manager needs a certificate with both clientAuth and serverAuth, while the Docker daemon only needs serverAuth. I think it should be up to the client to designate what it specifically needs out of the certificate. If we\u0027ve whitelisted what they need, we sign the cert, if we haven\u0027t, we raise an exception. x509 already has something like this built in, where a client can designate a certain extension as critical or non-critical. Non-critical extensions can be ignored if they haven\u0027t been whitelisted, and critical extensions that haven\u0027t been whitelisted will cause an exception.","commit_id":"738fe158b225bac308a103b4d77fdfe4ee931b7c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"1cc378e026bd0141f8c614eb918be6f1e29f67e4","unresolved":false,"context_lines":[{"line_number":54,"context_line":"                                 ca_key_password\u003dca_key_password)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"def sign_as_client(csr, issuer_name, ca_key, ca_key_password\u003dNone):"},{"line_number":58,"context_line":"    return _sign(csr, _build_client_extentions(), issuer_name, ca_key,"},{"line_number":59,"context_line":"                 ca_key_password\u003dca_key_password)"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"fa1b9901_ebf9b54e","line":57,"in_reply_to":"fa1b9901_029e5c56","updated":"2015-08-18 02:14:48.000000000","message":"@Andrew: Thanks your comment, I\u0027ll try to list up whitelist, or should this list be configurable?","commit_id":"738fe158b225bac308a103b4d77fdfe4ee931b7c"}],"magnum/common/x509/config.py":[{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"314c6c55acb56424c5854806f0836ee004451a9b","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from magnum.i18n import _"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"x509_opts \u003d ["},{"line_number":21,"context_line":"    cfg.BoolOpt(\u0027allow_ca\u0027,"},{"line_number":22,"context_line":"                default\u003dFalse,"},{"line_number":23,"context_line":"                help\u003d_(\u0027Certificate can get the CA flag in x509 extensions.\u0027)),"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa1b9901_6764a321","line":20,"updated":"2015-08-19 14:12:25.000000000","message":"Need to re-generate the config sample","commit_id":"c2a9cbec314a9bd559ffce40f3d26d6073b60f4c"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"f471f1501114f1d472eecdeb91167111376f6103","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from magnum.i18n import _"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"x509_opts \u003d ["},{"line_number":21,"context_line":"    cfg.BoolOpt(\u0027allow_ca\u0027,"},{"line_number":22,"context_line":"                default\u003dFalse,"},{"line_number":23,"context_line":"                help\u003d_(\u0027Certificate can get the CA flag in x509 extensions.\u0027)),"}],"source_content_type":"text/x-python","patch_set":10,"id":"fa1b9901_df519e37","line":20,"in_reply_to":"fa1b9901_6764a321","updated":"2015-08-19 23:56:43.000000000","message":"Thanks, I forgot it.","commit_id":"c2a9cbec314a9bd559ffce40f3d26d6073b60f4c"},{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"765f503f1ae32e986b135a3461857c5386f110e2","unresolved":false,"context_lines":[{"line_number":44,"context_line":"               help\u003d_(\u0027Number of days for a certificate is available.\u0027)),"},{"line_number":45,"context_line":"    cfg.IntOpt(\u0027rsa_key_size\u0027,"},{"line_number":46,"context_line":"               default\u003d2048,"},{"line_number":47,"context_line":"               help\u003d_(\u0027Size of generated private key. \u0027))]"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"cfg.CONF.register_opts(x509_opts, group\u003d\u0027x509\u0027)"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_87507b0c","line":47,"updated":"2015-08-21 01:47:10.000000000","message":"space at the end is not needed","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"6cedbc8bed37ef326630904e3df9c79ad88c12f7","unresolved":false,"context_lines":[{"line_number":44,"context_line":"               help\u003d_(\u0027Number of days for a certificate is available.\u0027)),"},{"line_number":45,"context_line":"    cfg.IntOpt(\u0027rsa_key_size\u0027,"},{"line_number":46,"context_line":"               default\u003d2048,"},{"line_number":47,"context_line":"               help\u003d_(\u0027Size of generated private key. \u0027))]"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"cfg.CONF.register_opts(x509_opts, group\u003d\u0027x509\u0027)"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_e771370d","line":47,"in_reply_to":"fa1b9901_87507b0c","updated":"2015-08-21 01:54:56.000000000","message":"I\u0027ll fix this.","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":10206,"name":"Madhuri Kumari","email":"madhuri.kumari@intel.com","username":"Madhuri"},"change_message_id":"f392b08c52567ec34838078acf5cf7d204bb05ba","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    cfg.ListOpt(\u0027allowed_key_usage\u0027,"},{"line_number":35,"context_line":"                default\u003d[\u0027Digital Signature\u0027, \u0027Key Encipherment\u0027,"},{"line_number":36,"context_line":"                         \u0027Non Repudiation\u0027],"},{"line_number":37,"context_line":"                help\u003d_(\u0027List of allowed x509 key usage. Available valuses: \u0027"},{"line_number":38,"context_line":"                       \u0027\"Digital Signature\", \"Non Repudiation\", \u0027"},{"line_number":39,"context_line":"                       \u0027\"Key Encipherment\", \"Data Encipherment\", \u0027"},{"line_number":40,"context_line":"                       \u0027\"Key Agreement\", \"Certificate Sign\", \"CRL Sign\", \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"fa1b9901_ba08d492","line":37,"updated":"2015-08-24 11:09:56.000000000","message":"s/valuses/value/","commit_id":"ac9f37312a7bc0d63b8fb4bfdbf0f25c4a03ae53"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"f125a1c45411d731aa15293a81248534a3d49f44","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    cfg.ListOpt(\u0027allowed_key_usage\u0027,"},{"line_number":35,"context_line":"                default\u003d[\u0027Digital Signature\u0027, \u0027Key Encipherment\u0027,"},{"line_number":36,"context_line":"                         \u0027Non Repudiation\u0027],"},{"line_number":37,"context_line":"                help\u003d_(\u0027List of allowed x509 key usage. Available valuses: \u0027"},{"line_number":38,"context_line":"                       \u0027\"Digital Signature\", \"Non Repudiation\", \u0027"},{"line_number":39,"context_line":"                       \u0027\"Key Encipherment\", \"Data Encipherment\", \u0027"},{"line_number":40,"context_line":"                       \u0027\"Key Agreement\", \"Certificate Sign\", \"CRL Sign\", \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"fa1b9901_dbf2409a","line":37,"in_reply_to":"fa1b9901_ba08d492","updated":"2015-08-25 06:09:48.000000000","message":"Done","commit_id":"ac9f37312a7bc0d63b8fb4bfdbf0f25c4a03ae53"},{"author":{"_account_id":10206,"name":"Madhuri Kumari","email":"madhuri.kumari@intel.com","username":"Madhuri"},"change_message_id":"f392b08c52567ec34838078acf5cf7d204bb05ba","unresolved":false,"context_lines":[{"line_number":41,"context_line":"                       \u0027\"Encipher Only\", \"Decipher Only\"\u0027)),"},{"line_number":42,"context_line":"    cfg.IntOpt(\u0027term_of_validity\u0027,"},{"line_number":43,"context_line":"               default\u003d365 * 5,"},{"line_number":44,"context_line":"               help\u003d_(\u0027Number of days for a certificate is available.\u0027)),"},{"line_number":45,"context_line":"    cfg.IntOpt(\u0027rsa_key_size\u0027,"},{"line_number":46,"context_line":"               default\u003d2048, help\u003d_(\u0027Size of generated private key. \u0027))]"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"fa1b9901_fa1c0cc3","line":44,"updated":"2015-08-24 11:09:56.000000000","message":"Can you please rephrase this statement to\n\n\"Number of days for which a certificate is valid\"","commit_id":"ac9f37312a7bc0d63b8fb4bfdbf0f25c4a03ae53"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"f125a1c45411d731aa15293a81248534a3d49f44","unresolved":false,"context_lines":[{"line_number":41,"context_line":"                       \u0027\"Encipher Only\", \"Decipher Only\"\u0027)),"},{"line_number":42,"context_line":"    cfg.IntOpt(\u0027term_of_validity\u0027,"},{"line_number":43,"context_line":"               default\u003d365 * 5,"},{"line_number":44,"context_line":"               help\u003d_(\u0027Number of days for a certificate is available.\u0027)),"},{"line_number":45,"context_line":"    cfg.IntOpt(\u0027rsa_key_size\u0027,"},{"line_number":46,"context_line":"               default\u003d2048, help\u003d_(\u0027Size of generated private key. \u0027))]"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"fa1b9901_bb2e6cf8","line":44,"in_reply_to":"fa1b9901_fa1c0cc3","updated":"2015-08-25 06:09:48.000000000","message":"Thanks!!","commit_id":"ac9f37312a7bc0d63b8fb4bfdbf0f25c4a03ae53"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"739764e8476c85f6b271e0db1b703a16e996b752","unresolved":false,"context_lines":[{"line_number":40,"context_line":"                       \u0027\"Key Agreement\", \"Certificate Sign\", \"CRL Sign\", \u0027"},{"line_number":41,"context_line":"                       \u0027\"Encipher Only\", \"Decipher Only\"\u0027)),"},{"line_number":42,"context_line":"    cfg.IntOpt(\u0027term_of_validity\u0027,"},{"line_number":43,"context_line":"               default\u003d365 * 5,"},{"line_number":44,"context_line":"               help\u003d_(\u0027Number of days for which a certificate is valid.\u0027)),"},{"line_number":45,"context_line":"    cfg.IntOpt(\u0027rsa_key_size\u0027,"},{"line_number":46,"context_line":"               default\u003d2048, help\u003d_(\u0027Size of generated private key. \u0027))]"}],"source_content_type":"text/x-python","patch_set":25,"id":"da20952f_6fb931e9","line":43,"updated":"2015-08-27 08:23:01.000000000","message":"Why 5 years here? Why not longer?","commit_id":"f40f44aeb248ef0713c57523a8e17e9390d02c1d"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":22,"context_line":"                default\u003dFalse,"},{"line_number":23,"context_line":"                help\u003d_(\u0027Certificate can get the CA flag in x509 extensions.\u0027)),"},{"line_number":24,"context_line":"    cfg.ListOpt(\u0027allowed_extensions\u0027,"},{"line_number":25,"context_line":"                default\u003d[\u0027keyUsage\u0027, \u0027extendedKeyUsage\u0027, \u0027subjectAltName\u0027,"},{"line_number":26,"context_line":"                         \u0027basicConstraints\u0027, \u0027subjectKeyIdentifier\u0027],"},{"line_number":27,"context_line":"                help\u003d_(\u0027List of allowed x509 extensions. Available value: \u0027"},{"line_number":28,"context_line":"                       \u0027\"authorityKeyIdentifier\", \"subjectKeyIdentifier\", \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_49d0edc9","line":25,"updated":"2015-09-02 03:49:52.000000000","message":"It is better to replace the strings by const string variables. So we need not to hard code the strings in other places.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"e910bf1285e8e0775bec7d388f620e11cedc3474","unresolved":false,"context_lines":[{"line_number":22,"context_line":"                default\u003dFalse,"},{"line_number":23,"context_line":"                help\u003d_(\u0027Certificate can get the CA flag in x509 extensions.\u0027)),"},{"line_number":24,"context_line":"    cfg.ListOpt(\u0027allowed_extensions\u0027,"},{"line_number":25,"context_line":"                default\u003d[\u0027keyUsage\u0027, \u0027extendedKeyUsage\u0027, \u0027subjectAltName\u0027,"},{"line_number":26,"context_line":"                         \u0027basicConstraints\u0027, \u0027subjectKeyIdentifier\u0027],"},{"line_number":27,"context_line":"                help\u003d_(\u0027List of allowed x509 extensions. Available value: \u0027"},{"line_number":28,"context_line":"                       \u0027\"authorityKeyIdentifier\", \"subjectKeyIdentifier\", \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_f450b560","line":25,"in_reply_to":"da20952f_49d0edc9","updated":"2015-09-02 07:11:04.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                       \u0027\"inhibitAnyPolicy\", \"keyUsage\", \"nameConstraints\" \u0027"},{"line_number":33,"context_line":"                       \u0027\"subjectAltName\", \"issuerAltName\"\u0027)),"},{"line_number":34,"context_line":"    cfg.ListOpt(\u0027allowed_key_usage\u0027,"},{"line_number":35,"context_line":"                default\u003d[\u0027Digital Signature\u0027, \u0027Key Encipherment\u0027,"},{"line_number":36,"context_line":"                         \u0027Non Repudiation\u0027],"},{"line_number":37,"context_line":"                help\u003d_(\u0027List of allowed x509 key usage. Available valuse: \u0027"},{"line_number":38,"context_line":"                       \u0027\"Digital Signature\", \"Non Repudiation\", \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_29f6d9d7","line":35,"updated":"2015-09-02 03:49:52.000000000","message":"It is better to replace the strings by const string variables. So we need not to hard code the strings in other places.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"e910bf1285e8e0775bec7d388f620e11cedc3474","unresolved":false,"context_lines":[{"line_number":32,"context_line":"                       \u0027\"inhibitAnyPolicy\", \"keyUsage\", \"nameConstraints\" \u0027"},{"line_number":33,"context_line":"                       \u0027\"subjectAltName\", \"issuerAltName\"\u0027)),"},{"line_number":34,"context_line":"    cfg.ListOpt(\u0027allowed_key_usage\u0027,"},{"line_number":35,"context_line":"                default\u003d[\u0027Digital Signature\u0027, \u0027Key Encipherment\u0027,"},{"line_number":36,"context_line":"                         \u0027Non Repudiation\u0027],"},{"line_number":37,"context_line":"                help\u003d_(\u0027List of allowed x509 key usage. Available valuse: \u0027"},{"line_number":38,"context_line":"                       \u0027\"Digital Signature\", \"Non Repudiation\", \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_b44a3dab","line":35,"in_reply_to":"da20952f_29f6d9d7","updated":"2015-09-02 07:11:04.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":10263,"name":"Vilobh Meshram","email":"vilobhmm@yahoo-inc.com","username":"vilobhmm"},"change_message_id":"d656dc3fd55ebaeef3ff72df9bf54cd6231ace4f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from magnum.common.x509 import extensions"},{"line_number":18,"context_line":"from magnum.i18n import _"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"ALLOWD_EXTENSIONS \u003d [\u0027\"%s\"\u0027 % e.value for e in extensions.Extensions]"},{"line_number":21,"context_line":"DEFAULR_ALLOWED_EXTENSIONS \u003d ["},{"line_number":22,"context_line":"    extensions.Extensions.KEY_USAGE.value,"},{"line_number":23,"context_line":"    extensions.Extensions.EXTENDED_KEY_USAGE.value,"}],"source_content_type":"text/x-python","patch_set":32,"id":"da20952f_67730c4f","line":20,"updated":"2015-09-04 20:22:27.000000000","message":"ALLOWD_EXTENSIONS  \u003d\u003e ALLOWED_EXTENSIONS","commit_id":"ca44e26d003efbb9f5104fbdaff82d4dfa871982"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"53a1cac2387547ce2da3efd8cdc78ba668f4e3a2","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from magnum.common.x509 import extensions"},{"line_number":18,"context_line":"from magnum.i18n import _"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"ALLOWD_EXTENSIONS \u003d [\u0027\"%s\"\u0027 % e.value for e in extensions.Extensions]"},{"line_number":21,"context_line":"DEFAULR_ALLOWED_EXTENSIONS \u003d ["},{"line_number":22,"context_line":"    extensions.Extensions.KEY_USAGE.value,"},{"line_number":23,"context_line":"    extensions.Extensions.EXTENDED_KEY_USAGE.value,"}],"source_content_type":"text/x-python","patch_set":32,"id":"da20952f_019c73be","line":20,"in_reply_to":"da20952f_67730c4f","updated":"2015-09-05 07:44:08.000000000","message":"Done: https://bugs.launchpad.net/magnum/+bug/1492540","commit_id":"ca44e26d003efbb9f5104fbdaff82d4dfa871982"},{"author":{"_account_id":10263,"name":"Vilobh Meshram","email":"vilobhmm@yahoo-inc.com","username":"vilobhmm"},"change_message_id":"d656dc3fd55ebaeef3ff72df9bf54cd6231ace4f","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from magnum.i18n import _"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"ALLOWD_EXTENSIONS \u003d [\u0027\"%s\"\u0027 % e.value for e in extensions.Extensions]"},{"line_number":21,"context_line":"DEFAULR_ALLOWED_EXTENSIONS \u003d ["},{"line_number":22,"context_line":"    extensions.Extensions.KEY_USAGE.value,"},{"line_number":23,"context_line":"    extensions.Extensions.EXTENDED_KEY_USAGE.value,"},{"line_number":24,"context_line":"    extensions.Extensions.SUBJECT_ALTERNATIVE_NAME.value,"}],"source_content_type":"text/x-python","patch_set":32,"id":"da20952f_e795dc31","line":21,"updated":"2015-09-04 20:22:27.000000000","message":"DEFAULR_ALLOWED_EXTENSIONS \u003d\u003e DEFAULT_ALLOWED_EXTENSIONS","commit_id":"ca44e26d003efbb9f5104fbdaff82d4dfa871982"},{"author":{"_account_id":10263,"name":"Vilobh Meshram","email":"vilobhmm@yahoo-inc.com","username":"vilobhmm"},"change_message_id":"d656dc3fd55ebaeef3ff72df9bf54cd6231ace4f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    extensions.Extensions.SUBJECT_KEY_IDENTIFIER.value]"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"ALLOWED_KEY_USAGE \u003d [\u0027\"%s\"\u0027 % e.value[0] for e in extensions.KeyUsages]"},{"line_number":29,"context_line":"DEFAULR_ALLOWED_KEY_USAGE \u003d ["},{"line_number":30,"context_line":"    extensions.KeyUsages.DIGITAL_SIGNATURE.value[0],"},{"line_number":31,"context_line":"    extensions.KeyUsages.KEY_ENCIPHERMENT.value[0],"},{"line_number":32,"context_line":"    extensions.KeyUsages.CONTENT_COMMITMENT.value[0]]"}],"source_content_type":"text/x-python","patch_set":32,"id":"da20952f_67aa2c73","line":29,"updated":"2015-09-04 20:22:27.000000000","message":"DEFAULR_ALLOWED_KEY_USAGE \u003d\u003e \n\tDEFAULT_ALLOWED_KEY_USAGE","commit_id":"ca44e26d003efbb9f5104fbdaff82d4dfa871982"}],"magnum/common/x509/validator.py":[{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"765f503f1ae32e986b135a3461857c5386f110e2","unresolved":false,"context_lines":[{"line_number":33,"context_line":"_KEY_USAGES_MAPPING[\"Certificate Sign\"] \u003d \"key_cert_sign\""},{"line_number":34,"context_line":"_KEY_USAGES_MAPPING[\"CRL Sign\"] \u003d \"crl_sign\""},{"line_number":35,"context_line":"_KEY_USAGES_MAPPING[\"Encipher Only\"] \u003d \"encipher_only\""},{"line_number":36,"context_line":"_KEY_USAGES_MAPPING[\"Decipher Only\"] \u003d \"decipher_only\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"_CA_KEY_USAGES \u003d [\"Certificate Sign\", \"CRL Sign\"]"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_a7957f33","line":36,"updated":"2015-08-21 01:47:10.000000000","message":"could you explain why we need order dict here?","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"6cedbc8bed37ef326630904e3df9c79ad88c12f7","unresolved":false,"context_lines":[{"line_number":33,"context_line":"_KEY_USAGES_MAPPING[\"Certificate Sign\"] \u003d \"key_cert_sign\""},{"line_number":34,"context_line":"_KEY_USAGES_MAPPING[\"CRL Sign\"] \u003d \"crl_sign\""},{"line_number":35,"context_line":"_KEY_USAGES_MAPPING[\"Encipher Only\"] \u003d \"encipher_only\""},{"line_number":36,"context_line":"_KEY_USAGES_MAPPING[\"Decipher Only\"] \u003d \"decipher_only\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"_CA_KEY_USAGES \u003d [\"Certificate Sign\", \"CRL Sign\"]"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_e71a97c5","line":36,"in_reply_to":"fa1b9901_a7957f33","updated":"2015-08-21 01:54:56.000000000","message":"This is used for initialising x509.KeyUsage, so order is important.","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"765f503f1ae32e986b135a3461857c5386f110e2","unresolved":false,"context_lines":[{"line_number":87,"context_line":"            value \u003d getattr(key_usage_value, v)"},{"line_number":88,"context_line":"        except ValueError:"},{"line_number":89,"context_line":"            # ValueError is raised when encipher_only/decipher_only is"},{"line_number":90,"context_line":"            # retrieved but key_agreement is False"},{"line_number":91,"context_line":"            value \u003d False"},{"line_number":92,"context_line":"        if value:"},{"line_number":93,"context_line":"            if k not in allowed_key_usage:"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_87a4fbb9","line":90,"updated":"2015-08-21 01:47:10.000000000","message":"not quite understand how this case happened for just encipher_only and decipher_only case.","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"6cedbc8bed37ef326630904e3df9c79ad88c12f7","unresolved":false,"context_lines":[{"line_number":87,"context_line":"            value \u003d getattr(key_usage_value, v)"},{"line_number":88,"context_line":"        except ValueError:"},{"line_number":89,"context_line":"            # ValueError is raised when encipher_only/decipher_only is"},{"line_number":90,"context_line":"            # retrieved but key_agreement is False"},{"line_number":91,"context_line":"            value \u003d False"},{"line_number":92,"context_line":"        if value:"},{"line_number":93,"context_line":"            if k not in allowed_key_usage:"}],"source_content_type":"text/x-python","patch_set":12,"id":"fa1b9901_0771cb0e","line":90,"in_reply_to":"fa1b9901_87a4fbb9","updated":"2015-08-21 01:54:56.000000000","message":"This limitation is come from cryptography library. key_usage_value instance raises ValueError if this condition is.","commit_id":"a38ab8d270cb59bf2f7f364b59cbdcf95a112e63"},{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"9ef9806703b0fb36874774fc285db68142be8254","unresolved":false,"context_lines":[{"line_number":74,"context_line":"            yield ext"},{"line_number":75,"context_line":"        else:"},{"line_number":76,"context_line":"            if ext.critical:"},{"line_number":77,"context_line":"                raise ValidationError(\"Extension \u0027%s\u0027 not allowed\" % ext)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"def _merge_key_usage(key_usage, allowed_key_usage):"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_bd84de0a","line":77,"updated":"2015-08-31 01:07:07.000000000","message":"i18n","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c9f5c083b698c046e2585c77ecd7de8e680fce87","unresolved":false,"context_lines":[{"line_number":74,"context_line":"            yield ext"},{"line_number":75,"context_line":"        else:"},{"line_number":76,"context_line":"            if ext.critical:"},{"line_number":77,"context_line":"                raise ValidationError(\"Extension \u0027%s\u0027 not allowed\" % ext)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"def _merge_key_usage(key_usage, allowed_key_usage):"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_4abc96ba","line":77,"in_reply_to":"da20952f_bd84de0a","updated":"2015-09-01 07:06:20.000000000","message":"Done","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"9ef9806703b0fb36874774fc285db68142be8254","unresolved":false,"context_lines":[{"line_number":93,"context_line":"            if k not in allowed_key_usage:"},{"line_number":94,"context_line":"                if critical:"},{"line_number":95,"context_line":"                    raise ValidationError("},{"line_number":96,"context_line":"                        \"Extension \u0027%s\u0027 not allowed\" % key_usage)"},{"line_number":97,"context_line":"                else:"},{"line_number":98,"context_line":"                    value \u003d False"},{"line_number":99,"context_line":"        usages \u003d usages + [value]"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_7d7ba628","line":96,"updated":"2015-08-31 01:07:07.000000000","message":"ditto","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c9f5c083b698c046e2585c77ecd7de8e680fce87","unresolved":false,"context_lines":[{"line_number":93,"context_line":"            if k not in allowed_key_usage:"},{"line_number":94,"context_line":"                if critical:"},{"line_number":95,"context_line":"                    raise ValidationError("},{"line_number":96,"context_line":"                        \"Extension \u0027%s\u0027 not allowed\" % key_usage)"},{"line_number":97,"context_line":"                else:"},{"line_number":98,"context_line":"                    value \u003d False"},{"line_number":99,"context_line":"        usages \u003d usages + [value]"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_eaaeca7f","line":96,"in_reply_to":"da20952f_7d7ba628","updated":"2015-09-01 07:06:20.000000000","message":"Done","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":7049,"name":"Kai Qiang Wu(Kennan)","email":"wkq5325@gmail.com","username":"Kennan"},"change_message_id":"9ef9806703b0fb36874774fc285db68142be8254","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    if basic_constraints.value.ca:"},{"line_number":116,"context_line":"        if basic_constraints.critical:"},{"line_number":117,"context_line":"            raise ValidationError("},{"line_number":118,"context_line":"                \"Extension \u0027%s\u0027 not allowed\" % basic_constraints)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        bc \u003d x509.BasicConstraints(False, None)"},{"line_number":121,"context_line":"        return x509.Extension(bc.oid, False, bc)"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_1d74ea33","line":118,"updated":"2015-08-31 01:07:07.000000000","message":"ditto","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c9f5c083b698c046e2585c77ecd7de8e680fce87","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    if basic_constraints.value.ca:"},{"line_number":116,"context_line":"        if basic_constraints.critical:"},{"line_number":117,"context_line":"            raise ValidationError("},{"line_number":118,"context_line":"                \"Extension \u0027%s\u0027 not allowed\" % basic_constraints)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        bc \u003d x509.BasicConstraints(False, None)"},{"line_number":121,"context_line":"        return x509.Extension(bc.oid, False, bc)"}],"source_content_type":"text/x-python","patch_set":26,"id":"da20952f_0ab21ee5","line":118,"in_reply_to":"da20952f_1d74ea33","updated":"2015-09-01 07:06:20.000000000","message":"Done","commit_id":"812dd1a9a338f3bbfee7aab88ff04536fedc2146"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from __future__ import absolute_import"},{"line_number":16,"context_line":"from collections import OrderedDict"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from cryptography import x509"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_e97d41b2","line":15,"updated":"2015-09-02 03:49:52.000000000","message":"It is not necessary.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"e910bf1285e8e0775bec7d388f620e11cedc3474","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"# under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from __future__ import absolute_import"},{"line_number":16,"context_line":"from collections import OrderedDict"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"from cryptography import x509"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_74cb451f","line":15,"in_reply_to":"da20952f_e97d41b2","updated":"2015-09-02 07:11:04.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":11650,"name":"Tom Cammann","email":"tom.cammann@hpe.com","username":"cammann"},"change_message_id":"a716b2d0e51ee5f063b77f90d6a4007206c7743b","unresolved":false,"context_lines":[{"line_number":25,"context_line":"logger \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"_KEY_USAGES_MAPPING \u003d OrderedDict()"},{"line_number":29,"context_line":"_KEY_USAGES_MAPPING[\"Digital Signature\"] \u003d \"digital_signature\""},{"line_number":30,"context_line":"_KEY_USAGES_MAPPING[\"Non Repudiation\"] \u003d \"content_commitment\""},{"line_number":31,"context_line":"_KEY_USAGES_MAPPING[\"Key Encipherment\"] \u003d \"key_encipherment\""}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_e1e6c8af","line":28,"updated":"2015-09-01 20:54:35.000000000","message":"Don\u0027t need a dictionary as no lookups are being done, a list of tuples would be more appropriate.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":25,"context_line":"logger \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"_KEY_USAGES_MAPPING \u003d OrderedDict()"},{"line_number":29,"context_line":"_KEY_USAGES_MAPPING[\"Digital Signature\"] \u003d \"digital_signature\""},{"line_number":30,"context_line":"_KEY_USAGES_MAPPING[\"Non Repudiation\"] \u003d \"content_commitment\""},{"line_number":31,"context_line":"_KEY_USAGES_MAPPING[\"Key Encipherment\"] \u003d \"key_encipherment\""}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_44dc5446","line":28,"updated":"2015-09-02 03:49:52.000000000","message":"Why we need a OrderedDict? I think dict is enough. Can we directly set allowed_key_usage to \u0027digital_signature\u0027 instead of \u0027Digital Signature\u0027, so that the transformation is not needed.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"e910bf1285e8e0775bec7d388f620e11cedc3474","unresolved":false,"context_lines":[{"line_number":25,"context_line":"logger \u003d logging.getLogger(__name__)"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"_KEY_USAGES_MAPPING \u003d OrderedDict()"},{"line_number":29,"context_line":"_KEY_USAGES_MAPPING[\"Digital Signature\"] \u003d \"digital_signature\""},{"line_number":30,"context_line":"_KEY_USAGES_MAPPING[\"Non Repudiation\"] \u003d \"content_commitment\""},{"line_number":31,"context_line":"_KEY_USAGES_MAPPING[\"Key Encipherment\"] \u003d \"key_encipherment\""}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_14d0c9c8","line":28,"in_reply_to":"da20952f_44dc5446","updated":"2015-09-02 07:11:04.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"class ValidationError(Exception):"},{"line_number":46,"context_line":"    pass"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"def filter(extensions):"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_e419e87a","line":46,"updated":"2015-09-02 03:49:52.000000000","message":"It is better to put it into magnum.common.exception and add message to it like other exceptions.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"e910bf1285e8e0775bec7d388f620e11cedc3474","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"class ValidationError(Exception):"},{"line_number":46,"context_line":"    pass"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"def filter(extensions):"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_d4da51e9","line":46,"in_reply_to":"da20952f_e419e87a","updated":"2015-09-02 07:11:04.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    pass"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"def filter(extensions):"},{"line_number":50,"context_line":"    filtered_extensions \u003d []"},{"line_number":51,"context_line":"    allowed_key_usage \u003d set(cfg.CONF.x509.allowed_key_usage)"},{"line_number":52,"context_line":"    if not cfg.CONF.x509.allow_ca:"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_e447a849","line":49,"updated":"2015-09-02 03:49:52.000000000","message":"The function name is same as the built-in function filter. You should change it to a different name.","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c13504adec0555a78f597c737eaf5d64a74864cd","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    pass"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"def filter(extensions):"},{"line_number":50,"context_line":"    filtered_extensions \u003d []"},{"line_number":51,"context_line":"    allowed_key_usage \u003d set(cfg.CONF.x509.allowed_key_usage)"},{"line_number":52,"context_line":"    if not cfg.CONF.x509.allow_ca:"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_143a09e8","line":49,"in_reply_to":"da20952f_e447a849","updated":"2015-09-02 07:14:53.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":60,"context_line":"            if not cfg.CONF.x509.allow_ca:"},{"line_number":61,"context_line":"                ext \u003d _disallow_ca_in_basic_constraints(ext)"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        filtered_extensions \u003d filtered_extensions + [ext]"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    return filtered_extensions"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_2465a0e0","line":63,"updated":"2015-09-02 03:49:52.000000000","message":"filtered_extensions.append(ext)","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c13504adec0555a78f597c737eaf5d64a74864cd","unresolved":false,"context_lines":[{"line_number":60,"context_line":"            if not cfg.CONF.x509.allow_ca:"},{"line_number":61,"context_line":"                ext \u003d _disallow_ca_in_basic_constraints(ext)"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        filtered_extensions \u003d filtered_extensions + [ext]"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    return filtered_extensions"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_d42491c7","line":63,"in_reply_to":"da20952f_2465a0e0","updated":"2015-09-02 07:14:53.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12053,"name":"Hua Wang","email":"wanghua.humble@gmail.com","username":"humble00"},"change_message_id":"1beeac78635d8f98795eb84e9c76a45d55c180a7","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                        _(\"Extension \u0027%s\u0027 not allowed\") % key_usage)"},{"line_number":98,"context_line":"                else:"},{"line_number":99,"context_line":"                    value \u003d False"},{"line_number":100,"context_line":"        usages \u003d usages + [value]"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    rtn \u003d x509.KeyUsage(*usages)"},{"line_number":103,"context_line":"    return x509.Extension(rtn.oid, critical, rtn)"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_64807847","line":100,"updated":"2015-09-02 03:49:52.000000000","message":"usages.append(value)","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"},{"author":{"_account_id":12385,"name":"Motohiro/Yuanying Otsuka","email":"yuanying@fraction.jp","username":"yuanying"},"change_message_id":"c13504adec0555a78f597c737eaf5d64a74864cd","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                        _(\"Extension \u0027%s\u0027 not allowed\") % key_usage)"},{"line_number":98,"context_line":"                else:"},{"line_number":99,"context_line":"                    value \u003d False"},{"line_number":100,"context_line":"        usages \u003d usages + [value]"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    rtn \u003d x509.KeyUsage(*usages)"},{"line_number":103,"context_line":"    return x509.Extension(rtn.oid, critical, rtn)"}],"source_content_type":"text/x-python","patch_set":27,"id":"da20952f_54172154","line":100,"in_reply_to":"da20952f_64807847","updated":"2015-09-02 07:14:53.000000000","message":"Done","commit_id":"ab0923af36c4c44f8ed314ffa466c99a10edadfe"}]}