)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Nova Support of Glance Image Signing"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec is related to work in the Glance project which handles"},{"line_number":10,"context_line":"signed images."},{"line_number":11,"context_line":"SecurityImpact"},{"line_number":12,"context_line":"DocImpact"},{"line_number":13,"context_line":"It depends on this glance spec:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"3a29b11f_6a6caa08","line":10,"updated":"2015-10-27 00:49:20.000000000","message":"Mega nit. Blank line here please.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Nova Support of Glance Image Signing"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec is related to work in the Glance project which handles"},{"line_number":10,"context_line":"signed images."},{"line_number":11,"context_line":"SecurityImpact"},{"line_number":12,"context_line":"DocImpact"},{"line_number":13,"context_line":"It depends on this glance spec:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"1a26ad4f_bc34804a","line":10,"in_reply_to":"3a29b11f_6a6caa08","updated":"2015-10-27 13:02:09.000000000","message":"Done","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This spec is related to work in the Glance project which handles"},{"line_number":10,"context_line":"signed images."},{"line_number":11,"context_line":"SecurityImpact"},{"line_number":12,"context_line":"DocImpact"},{"line_number":13,"context_line":"It depends on this glance spec:"},{"line_number":14,"context_line":"Depends-On: I305b2ae86415c8d256c641abb2795af663bee56a"},{"line_number":15,"context_line":"Change-Id: Ia8e7fcc21d7c15e480facbe30af88cdce2d73159"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"3a29b11f_4a744ece","line":12,"updated":"2015-10-27 00:49:20.000000000","message":"Another blank line please.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This spec is related to work in the Glance project which handles"},{"line_number":10,"context_line":"signed images."},{"line_number":11,"context_line":"SecurityImpact"},{"line_number":12,"context_line":"DocImpact"},{"line_number":13,"context_line":"It depends on this glance spec:"},{"line_number":14,"context_line":"Depends-On: I305b2ae86415c8d256c641abb2795af663bee56a"},{"line_number":15,"context_line":"Change-Id: Ia8e7fcc21d7c15e480facbe30af88cdce2d73159"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"1a26ad4f_dc393c43","line":12,"in_reply_to":"3a29b11f_4a744ece","updated":"2015-10-27 13:02:09.000000000","message":"Done","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"e3350644100e638d06e1ac44b60e0efb2591e93b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"DocImpact"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"It depends on this glance spec:"},{"line_number":16,"context_line":"Depends-On: I305b2ae86415c8d256c641abb2795af663bee56a"},{"line_number":17,"context_line":"Change-Id: Ia8e7fcc21d7c15e480facbe30af88cdce2d73159"},{"line_number":18,"context_line":"Implements: blueprint nova-support-image-signing"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"fa80f949_d733bd12","line":16,"updated":"2015-11-06 12:46:34.000000000","message":"This dependency can be removed, as that spec has already been merged.","commit_id":"f3d2506969a0aacc9238b1b259394eaf4acde374"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ba99068a6433d342438d84070773c900afc1f778","unresolved":false,"context_lines":[{"line_number":13,"context_line":"DocImpact"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"It depends on this glance spec:"},{"line_number":16,"context_line":"Depends-On: I305b2ae86415c8d256c641abb2795af663bee56a"},{"line_number":17,"context_line":"Change-Id: Ia8e7fcc21d7c15e480facbe30af88cdce2d73159"},{"line_number":18,"context_line":"Implements: blueprint nova-support-image-signing"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":18,"id":"fa80f949_21d75fee","line":16,"in_reply_to":"fa80f949_d733bd12","updated":"2015-11-06 14:26:59.000000000","message":"Good catch. Done.","commit_id":"f3d2506969a0aacc9238b1b259394eaf4acde374"}],"specs/liberty/approved/encrypted-and-authenticated-image-support.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Deploying both authentication and encryption will protect image integrity and"},{"line_number":21,"context_line":"improve OpenStack\u0027s enterprise-ready posture. This proposal accompanies the"},{"line_number":22,"context_line":"Glance feature described in the following spec:"},{"line_number":23,"context_line":"https://review.openstack.org/#/c/177948/"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_cf72a3ad","line":23,"updated":"2015-06-12 12:27:11.000000000","message":"As a heads up, we can\u0027t merge this spec until the above merges.\n\nTurns out our build system has magic to do that, so I updated your git commit message to have the Depends-on: tag for the above change.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":38,"context_line":"* An encrypted image is uploaded by an end user, along with a reference to the"},{"line_number":39,"context_line":"  key needed to decrypt the image and the encryption parameters. Glance stores"},{"line_number":40,"context_line":"  the encryption metadata, which will be provided with the image when the image"},{"line_number":41,"context_line":"  is retrieved for booting."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* An image is created in Nova, and Nova signs the image at the request of the"},{"line_number":44,"context_line":"  end user. When the image is uploaded to Glance, the signature and public key"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_ef567f05","line":41,"updated":"2015-06-12 12:27:11.000000000","message":"I think this one is probably a separate specification.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c6be2bd0e8cbea3dc2e61193c4b4b060fb8b895","unresolved":false,"context_lines":[{"line_number":38,"context_line":"* An encrypted image is uploaded by an end user, along with a reference to the"},{"line_number":39,"context_line":"  key needed to decrypt the image and the encryption parameters. Glance stores"},{"line_number":40,"context_line":"  the encryption metadata, which will be provided with the image when the image"},{"line_number":41,"context_line":"  is retrieved for booting."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* An image is created in Nova, and Nova signs the image at the request of the"},{"line_number":44,"context_line":"  end user. When the image is uploaded to Glance, the signature and public key"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_5db5d0eb","line":41,"in_reply_to":"1af86dd1_ef567f05","updated":"2015-06-16 12:51:18.000000000","message":"How / where is the key associated with the image ?  Is it via an image metadata property, or some other mechanism ? If an image property what is the suggested name ? Nova has a naming convention it wants followed for image properties these days http://git.openstack.org/cgit/openstack/nova/tree/nova/objects/image_meta.py#n114\n\nSo if using an image meta property, I think it would be \u0027img_encryption_key\u0027 or something like that.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":43,"context_line":"* An image is created in Nova, and Nova signs the image at the request of the"},{"line_number":44,"context_line":"  end user. When the image is uploaded to Glance, the signature and public key"},{"line_number":45,"context_line":"  are also provided. Glance verifies the signature before storing the image,"},{"line_number":46,"context_line":"  and notifies Nova if the signature verification fails."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Project Priority"},{"line_number":49,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_af41a73b","line":46,"updated":"2015-06-12 12:27:11.000000000","message":"a really nice addition to the current md5 based checks.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":44,"context_line":"  end user. When the image is uploaded to Glance, the signature and public key"},{"line_number":45,"context_line":"  are also provided. Glance verifies the signature before storing the image,"},{"line_number":46,"context_line":"  and notifies Nova if the signature verification fails."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Project Priority"},{"line_number":49,"context_line":"-----------------"},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_4f5fd30e","line":47,"updated":"2015-06-12 12:27:11.000000000","message":"I guess you also want Nova to encrypt the image it sends to glance?","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Before booting an image, Nova will check whether an image is encrypted. If so,"},{"line_number":68,"context_line":"Nova will read a reference to a private key from the image\u0027s metadata, retrieve"},{"line_number":69,"context_line":"the key, and decrypt the image.  Then, Nova will check a flag set by the user"},{"line_number":70,"context_line":"to determine whether signature verification is desired. If so, Nova will check"},{"line_number":71,"context_line":"for the presence of image metadata that encodes the signature, a reference to"},{"line_number":72,"context_line":"a public key, and the hash method used to create the signature. Nova will then"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_eff2ff05","line":69,"updated":"2015-06-12 12:27:11.000000000","message":"please define \"flag\"\n\nI assume this is a protected property on the glance image?","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c6be2bd0e8cbea3dc2e61193c4b4b060fb8b895","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Nova will read a reference to a private key from the image\u0027s metadata, retrieve"},{"line_number":69,"context_line":"the key, and decrypt the image.  Then, Nova will check a flag set by the user"},{"line_number":70,"context_line":"to determine whether signature verification is desired. If so, Nova will check"},{"line_number":71,"context_line":"for the presence of image metadata that encodes the signature, a reference to"},{"line_number":72,"context_line":"a public key, and the hash method used to create the signature. Nova will then"},{"line_number":73,"context_line":"fetch the public key from Barbican and verify the image by performing the"},{"line_number":74,"context_line":"specified hash method on the image, decrypting the signature using the public"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_dd77a038","line":71,"updated":"2015-06-16 12:51:18.000000000","message":"Can you provide more details of the suggested image metadata properties bearing in mind the link i mentioned previously about naming conventions.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":86,"context_line":"The key references will be used to access the keys from Barbican, which will"},{"line_number":87,"context_line":"provide the key management services. These keys are added to Barbican either by"},{"line_number":88,"context_line":"the end user before an image is created, or by Nova if the user requests the"},{"line_number":89,"context_line":"creation of a signed or encrypted image without first uploading a key pair."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Alternatives"},{"line_number":92,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_0f879b62","line":89,"updated":"2015-06-12 12:27:11.000000000","message":"So I think the python-glanceclient will need this all adding.\n\nCould we just use python-glanceclient to do most of this work?","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c6be2bd0e8cbea3dc2e61193c4b4b060fb8b895","unresolved":false,"context_lines":[{"line_number":87,"context_line":"provide the key management services. These keys are added to Barbican either by"},{"line_number":88,"context_line":"the end user before an image is created, or by Nova if the user requests the"},{"line_number":89,"context_line":"creation of a signed or encrypted image without first uploading a key pair."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Alternatives"},{"line_number":92,"context_line":"------------"},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_9defd886","line":90,"updated":"2015-06-16 12:51:18.000000000","message":"IIUC, your proposal is that the user would simply AES encrypt their image and upload it to glance, and then Nova would decrypt it before launching the instance.\n\nNow nova currently has the ability to use LUKS to expose encrypted volumes to guest instances. In this way the image/volume is never decrypted by Nova - the kernel does it on the fly as needed.\n\nIf we\u0027re going to add the ability to have glance store images encrypted, then I think we want to be able to make it possible for people to upload images encrypted with the LUKS format, so that Nova can download that image from glance and directly execute it with no decryption step required.\n\nSo I think this suggests the need to have some kind of way of annotating the image with the encryption data format it uses, so Nova can intelligently decide whether it can execute directly or must decrypt.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Nova currently lacks a mechanism to validate images prior to booting them."},{"line_number":95,"context_line":"The checksum included with an image protects against accidental modifications"},{"line_number":96,"context_line":"but provides little protection against an adversary with access to Glance or"},{"line_number":97,"context_line":"to the communcation network between Nova and Glance. This feature facilitates"},{"line_number":98,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":99,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":100,"context_line":"desired image. (Note: Users presumably trust Nova or else they would not boot"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_1eb0eadc","line":97,"updated":"2015-06-12 12:27:11.000000000","message":"Now what if the man in the middle just changes the reference to the public key that is stored in the image?\n\nI think this might need a bit more thought, like maybe its better barbican holds the mapping from image-uuid to key? not really sure.","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7556e321c6e0c1ef1aa5bff34a8dae9831e458b7","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":99,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":100,"context_line":"desired image. (Note: Users presumably trust Nova or else they would not boot"},{"line_number":101,"context_line":"a VM instance.)"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Data model impact"},{"line_number":104,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_8f938ba3","line":101,"updated":"2015-06-12 12:27:11.000000000","message":"that touches on the trusted boot stuff, but lets ignore that here :)","commit_id":"34218330ac8ee3c06c3688cbd4bcf24667ee20fd"}],"specs/liberty/approved/image-verification.rst":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"2c961d81c257aa347eb07a4c637ff0aa466a78ac","unresolved":false,"context_lines":[{"line_number":34,"context_line":"* An image is created in Nova, and Nova signs the image at the request of the"},{"line_number":35,"context_line":"  end user. When the image is uploaded to Glance, the signature and public key"},{"line_number":36,"context_line":"  are also provided. Glance verifies the signature before storing the image,"},{"line_number":37,"context_line":"  and notifies Nova if the signature verification fails."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Project Priority"},{"line_number":40,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_11284432","line":37,"updated":"2015-06-24 12:51:27.000000000","message":"This is not really describing the use cases - you\u0027re just describing the implemention here.\n\nThe use cases should really be describing what security / data integrity problems you are trying to address with this change. eg things like\n\n* Nova needs to determine whether the image obtained from glance has been tampered with / corrupted since original storage in glance\n* Glance needs to determine whether the image uploaded by the user has been tampered with / corrupted during the upload process","commit_id":"db6032a901a640302258fc77c9c1721fe57ad3d4"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"2c961d81c257aa347eb07a4c637ff0aa466a78ac","unresolved":false,"context_lines":[{"line_number":66,"context_line":"The key references will be used to access the keys from Barbican, which will"},{"line_number":67,"context_line":"provide the key management services. These keys are added to Barbican either by"},{"line_number":68,"context_line":"the end user before an image is created, or by Nova if the user requests the"},{"line_number":69,"context_line":"creation of a signed or encrypted image without first uploading a key pair."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Alternatives"},{"line_number":72,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_51a7acbc","line":69,"updated":"2015-06-24 12:51:27.000000000","message":"It is unclear from the change / use cases just what security problems you attempting to address, and thus who is responsible for signing. In particular I\u0027m unclear whether the tenant user is signing their image before upload and providing the signature to glance, or whether glance is signing the image once it is uploaded and providing the signature to nova,or both, or something else.","commit_id":"db6032a901a640302258fc77c9c1721fe57ad3d4"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"2c961d81c257aa347eb07a4c637ff0aa466a78ac","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Alternatives"},{"line_number":72,"context_line":"------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":""},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_f1784080","line":73,"updated":"2015-06-24 12:51:27.000000000","message":"You seem to have truncated / deleted the rest of the spec template.","commit_id":"db6032a901a640302258fc77c9c1721fe57ad3d4"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Problem description"},{"line_number":23,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"There is no method for users to verify that a previously uploaded image has"},{"line_number":26,"context_line":"not been modified. An image could potentially be modified in transit (such as"},{"line_number":27,"context_line":"when it is uploaded to glance or transferred to nova) or Glance itself could"},{"line_number":28,"context_line":"be untrusted and modify images without a user\u0027s knowledge. An image that is"},{"line_number":29,"context_line":"modified could include malicious code. Providing support for image signatures"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_a5b7bd83","line":26,"range":{"start_line":25,"start_character":0,"end_line":26,"end_character":18},"updated":"2015-06-24 19:46:34.000000000","message":"This is not really accurate, IMHO. There is a checksum exposed from glance image-show. It\u0027s not cryptographically secure, granted, but it\u0027s a lot better than you let on here.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"b1ec1bc1ac3ad22f83722a85de22b12c52283241","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Problem description"},{"line_number":23,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"There is no method for users to verify that a previously uploaded image has"},{"line_number":26,"context_line":"not been modified. An image could potentially be modified in transit (such as"},{"line_number":27,"context_line":"when it is uploaded to glance or transferred to nova) or Glance itself could"},{"line_number":28,"context_line":"be untrusted and modify images without a user\u0027s knowledge. An image that is"},{"line_number":29,"context_line":"modified could include malicious code. Providing support for image signatures"}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba3cc151_7efc943e","line":26,"range":{"start_line":25,"start_character":0,"end_line":26,"end_character":18},"in_reply_to":"fa32b979_a5b7bd83","updated":"2015-06-29 16:25:05.000000000","message":"+1","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"There is no method for users to verify that a previously uploaded image has"},{"line_number":26,"context_line":"not been modified. An image could potentially be modified in transit (such as"},{"line_number":27,"context_line":"when it is uploaded to glance or transferred to nova) or Glance itself could"},{"line_number":28,"context_line":"be untrusted and modify images without a user\u0027s knowledge. An image that is"},{"line_number":29,"context_line":"modified could include malicious code. Providing support for image signatures"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_0ec0e54e","line":26,"in_reply_to":"fa32b979_a5b7bd83","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* A signed image is requested by Nova, and Glance provides the signature and"},{"line_number":44,"context_line":"  a reference to the public key to Nova along with the image so that Nova can"},{"line_number":45,"context_line":"  verify the signature before booting the image."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Project Priority"},{"line_number":48,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_457a71be","line":45,"updated":"2015-06-24 19:46:34.000000000","message":"As (the other) Dan pointed out a couple patchsets ago, these aren\u0027t use-cases. He even gave you examples of what to put here, which look good to me.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* A signed image is requested by Nova, and Glance provides the signature and"},{"line_number":44,"context_line":"  a reference to the public key to Nova along with the image so that Nova can"},{"line_number":45,"context_line":"  verify the signature before booting the image."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Project Priority"},{"line_number":48,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_8eccf589","line":45,"in_reply_to":"fa32b979_457a71be","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"3fb364ebc8c14bff90001e7011b93d79ed601662","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* A signed image is requested by Nova, and Glance provides the signature and"},{"line_number":44,"context_line":"  a reference to the public key to Nova along with the image so that Nova can"},{"line_number":45,"context_line":"  verify the signature before booting the image."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Project Priority"},{"line_number":48,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_da22c9b8","line":45,"in_reply_to":"fa32b979_457a71be","updated":"2015-06-25 09:24:04.000000000","message":"Yep, I really want to see the security  use cases clearly defined. t is effectively impossible to determine whether the proposed change accomplishes the desired goals, without knowing what the security goals are.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"b1ec1bc1ac3ad22f83722a85de22b12c52283241","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* A signed image is requested by Nova, and Glance provides the signature and"},{"line_number":44,"context_line":"  a reference to the public key to Nova along with the image so that Nova can"},{"line_number":45,"context_line":"  verify the signature before booting the image."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Project Priority"},{"line_number":48,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba3cc151_deffe032","line":45,"in_reply_to":"fa32b979_da22c9b8","updated":"2015-06-29 16:25:05.000000000","message":"+1","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* A signed image is requested by Nova, and Glance provides the signature and"},{"line_number":44,"context_line":"  a reference to the public key to Nova along with the image so that Nova can"},{"line_number":45,"context_line":"  verify the signature before booting the image."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Project Priority"},{"line_number":48,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_2ec7e164","line":45,"in_reply_to":"fa32b979_da22c9b8","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":64,"context_line":"used to create the signature. Nova will then fetch the public key from"},{"line_number":65,"context_line":"Barbican and verify the image by performing the specified hash method on the"},{"line_number":66,"context_line":"image, decrypting the signature using the public key, and comparing these"},{"line_number":67,"context_line":"results."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"When the user requests that Nova create an image, the user may also request"},{"line_number":70,"context_line":"that Nova sign the image. If so, Nova will perform a hash on the image and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_45611104","line":67,"updated":"2015-06-24 19:46:34.000000000","message":"I\u0027m not sure about glance, but nova\u0027s metadata storage for this is limited to keys and values of 255 characters. What does a signature look like?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":70,"context_line":"that Nova sign the image. If so, Nova will perform a hash on the image and"},{"line_number":71,"context_line":"create the signature by signing the checksum with a private key. Nova will"},{"line_number":72,"context_line":"associate metadata with the image which will list the signature, the hash"},{"line_number":73,"context_line":"method, and a reference to the public key."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The key references will be used to access the keys from Barbican, which will"},{"line_number":76,"context_line":"provide the key management services. These keys are added to Barbican either"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_6038c3d3","line":73,"updated":"2015-06-24 19:46:34.000000000","message":"So it\u0027s one key per compute host, right? We\u0027d never ask nova to use a specific key to sign a thing, right?\n\nThis becomes specifically about nova not trusting glance, right? The weird thing is, the compute nodes are the least secure component of your infrastructure. People break out of VMs onto the hosts. It happens. Aside from an initial upload of an image, this scheme seems to rely on nova (computes) being fairly trustworthy, which is really not a realistic assumption I think.\n\nWouldn\u0027t it make more sense for glance to sign what it got from nova so that you can tell if it\u0027s ever modified in cold storage? If I break out of my hypervisor and I have the key. I can silently modify and sign images for months before detection.\n\nOn the trusted boot thing, I break out of my instance and start modifying the images on the way in, bypassing the checksum check in nova, allowing modified images to be booted by users that think they\u0027re covered by this.\n\nI\u0027m having trouble understanding how this really provides much safety. What attack are we trying to mitigate here?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"b1ec1bc1ac3ad22f83722a85de22b12c52283241","unresolved":false,"context_lines":[{"line_number":70,"context_line":"that Nova sign the image. If so, Nova will perform a hash on the image and"},{"line_number":71,"context_line":"create the signature by signing the checksum with a private key. Nova will"},{"line_number":72,"context_line":"associate metadata with the image which will list the signature, the hash"},{"line_number":73,"context_line":"method, and a reference to the public key."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The key references will be used to access the keys from Barbican, which will"},{"line_number":76,"context_line":"provide the key management services. These keys are added to Barbican either"}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba3cc151_9e7e38ad","line":73,"in_reply_to":"fa32b979_6038c3d3","updated":"2015-06-29 16:25:05.000000000","message":"ah, so dan has described has articulated much better what I was trying to say, with a nice alternative approach.\n\nThis doesn\u0027t feel like its lots better than what we have today, which is my main concern.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":76,"context_line":"provide the key management services. These keys are added to Barbican either"},{"line_number":77,"context_line":"by the end user before an image is created, or by Nova if the user requests"},{"line_number":78,"context_line":"the creation of a signed or encrypted image without first uploading a key"},{"line_number":79,"context_line":"pair."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Alternatives"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_004a1755","line":79,"updated":"2015-06-24 19:46:34.000000000","message":"And there is some revocation mechanism for the above-mentioned scenario, right?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":76,"context_line":"provide the key management services. These keys are added to Barbican either"},{"line_number":77,"context_line":"by the end user before an image is created, or by Nova if the user requests"},{"line_number":78,"context_line":"the creation of a signed or encrypted image without first uploading a key"},{"line_number":79,"context_line":"pair."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Alternatives"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_ce10bd02","line":79,"in_reply_to":"fa32b979_004a1755","updated":"2015-08-07 14:43:57.000000000","message":"Can you describe what you mean by \"revocation mechanism\"?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":87,"context_line":"to the communcation network between Nova and Glance. This feature facilitates"},{"line_number":88,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":89,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":90,"context_line":"desired image. (Note: Users presumably trust Nova or else they would not boot"},{"line_number":91,"context_line":"a VM instance.)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"An alternative to using the Glance properties to store and retrieve the"},{"line_number":94,"context_line":"signature metadata would be to create an API extension support signatures."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_e0d5b342","line":91,"range":{"start_line":90,"start_character":15,"end_line":91,"end_character":15},"updated":"2015-06-24 19:46:34.000000000","message":"I think this is a faulty premise on which to base anything else. Agreed that you have to trust nova enough to boot your stuff, but I don\u0027t trust it more than glance.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Data model impact"},{"line_number":105,"context_line":"-----------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"None"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"REST API impact"},{"line_number":110,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_00bd3701","line":107,"updated":"2015-06-24 19:46:34.000000000","message":"You\u0027re going to persist new image_meta keys. That means you\u0027re going to need to modify those objects.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Data model impact"},{"line_number":105,"context_line":"-----------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"None"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"REST API impact"},{"line_number":110,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_1331ee59","line":107,"in_reply_to":"fa32b979_00bd3701","updated":"2015-08-07 14:43:57.000000000","message":"Correct. We will need to persist a new image_meta key which will indicate whether the user requires Nova to perform signature verification before booting the instance. The new spec includes this.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":109,"context_line":"REST API impact"},{"line_number":110,"context_line":"---------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Security impact"},{"line_number":115,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_800dc7e9","line":112,"updated":"2015-06-24 19:46:34.000000000","message":"Where is the REST API impact then? In glance? Do we not need to expose the signatures we calculate somewhere? Or is this all expected to be checks and balances under the covers? Surely there is some API impact if we try to boot from an image that fails the signature check, right? What do we do then?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":109,"context_line":"REST API impact"},{"line_number":110,"context_line":"---------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Security impact"},{"line_number":115,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_5300d601","line":112,"in_reply_to":"fa32b979_800dc7e9","updated":"2015-08-07 14:43:57.000000000","message":"We do not anticipate exposing or persisting the signatures in any way. Nova will read the signature from image metadata it will receive from Glance, perform the verification, and either boot the instance or not.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":130,"context_line":"---------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":133,"context_line":"from the image, and an error message will be provided for the end user."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Performance Impact"},{"line_number":136,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_000217b4","line":133,"updated":"2015-06-24 19:46:34.000000000","message":"This surely sounds like some REST API impact :)","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":130,"context_line":"---------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":133,"context_line":"from the image, and an error message will be provided for the end user."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Performance Impact"},{"line_number":136,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_ce0afd1f","line":133,"in_reply_to":"fa32b979_000217b4","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":136,"context_line":"------------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"This feature will only be used if a user requests signing an image or requests"},{"line_number":139,"context_line":"booting a signed image."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"When signature verification or signature creation occur there will be latency"},{"line_number":142,"context_line":"as a result of retrieving keys from Barbican. There will also be latency"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_20fddbb0","line":139,"updated":"2015-06-24 19:46:34.000000000","message":"How does the user request signing an image if there is no REST API impact?","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":136,"context_line":"------------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"This feature will only be used if a user requests signing an image or requests"},{"line_number":139,"context_line":"booting a signed image."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"When signature verification or signature creation occur there will be latency"},{"line_number":142,"context_line":"as a result of retrieving keys from Barbican. There will also be latency"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_8e115554","line":139,"in_reply_to":"fa32b979_20fddbb0","updated":"2015-08-07 14:43:57.000000000","message":"The newest version of this spec describes using Nova\u0027s REST API via the Nova CLI in order to set a flag indicating that an image\u0027s signature needs to be verified before booting.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"When signature verification or signature creation occur there will be latency"},{"line_number":142,"context_line":"as a result of retrieving keys from Barbican. There will also be latency"},{"line_number":143,"context_line":"associated with hashing an image."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Other deployer impact"},{"line_number":146,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_80db874e","line":143,"updated":"2015-06-24 19:46:34.000000000","message":"There will also be significant CPU overhead to calculate and verify the signatures.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"When signature verification or signature creation occur there will be latency"},{"line_number":142,"context_line":"as a result of retrieving keys from Barbican. There will also be latency"},{"line_number":143,"context_line":"associated with hashing an image."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Other deployer impact"},{"line_number":146,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_d39aa661","line":143,"in_reply_to":"fa32b979_80db874e","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":145,"context_line":"Other deployer impact"},{"line_number":146,"context_line":"---------------------"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"None"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Developer impact"},{"line_number":151,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_e0bff3cd","line":148,"updated":"2015-06-24 19:46:34.000000000","message":"You\u0027ve already hinted at deployer impact above. There will be a requirement for barbican, as well as some amount of config or provisioning of which keys to use, where, how, etc.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":145,"context_line":"Other deployer impact"},{"line_number":146,"context_line":"---------------------"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"None"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Developer impact"},{"line_number":151,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_b397da38","line":148,"in_reply_to":"fa32b979_e0bff3cd","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d1fa8da5eee28fed4e74fb4ad92e438b97f7fc75","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unit tests will be sufficient to test the functionality implemented in Nova."},{"line_number":196,"context_line":"We will need to implement Tempest tests to test the interoperability of this"},{"line_number":197,"context_line":"functionality with the accompanying functionality in Glance."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_e0a613c0","line":195,"updated":"2015-06-24 19:46:34.000000000","message":"I disagree. Functional testing of the full stack to make sure this works and sends/receives the right stuff from glance will be critical I think.","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"b1ec1bc1ac3ad22f83722a85de22b12c52283241","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unit tests will be sufficient to test the functionality implemented in Nova."},{"line_number":196,"context_line":"We will need to implement Tempest tests to test the interoperability of this"},{"line_number":197,"context_line":"functionality with the accompanying functionality in Glance."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba3cc151_fc418d3a","line":195,"in_reply_to":"fa32b979_e0a613c0","updated":"2015-06-29 16:25:05.000000000","message":"+1","commit_id":"92e95a61288a381529525cf03578f7b010361a32"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"cc69767342f20090d4602ac0abba88a08dac4d9d","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Testing"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unit tests will be sufficient to test the functionality implemented in Nova."},{"line_number":196,"context_line":"We will need to implement Tempest tests to test the interoperability of this"},{"line_number":197,"context_line":"functionality with the accompanying functionality in Glance."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_5370d63f","line":195,"in_reply_to":"fa32b979_e0a613c0","updated":"2015-08-07 14:43:57.000000000","message":"Done","commit_id":"92e95a61288a381529525cf03578f7b010361a32"}],"specs/mitaka/approved/image-verification.rst":[{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"956ead659506b27e4288ba3d748cc8fbe6472b28","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Currently, OpenStack\u0027s protection against unexpected modification of images is"},{"line_number":24,"context_line":"limited to verifying an MD5 checksum. While this may be sufficient for"},{"line_number":25,"context_line":"protecting against accidental modifications, MD5 is known to be"},{"line_number":26,"context_line":"cryptographically weak [2] and thus provides minimal protection against"},{"line_number":27,"context_line":"deliberate, malicious modification of images. An image could potentially be"},{"line_number":28,"context_line":"modified in transit, such as when it is uploaded to Glance or transferred to"},{"line_number":29,"context_line":"Nova. An image that is modified could include malicious code. Providing"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a4dcd0f_ae9f5a4f","line":26,"updated":"2015-08-08 00:32:18.000000000","message":"While we should replace MD5 for cryptographic reasons, the attack mentioned here tests MD5\u0027s second pre-image resistance, which is still kind-of OK.\n\nMD5 itself provides literally zero protection against deliberate, malicious modification of images, but that\u0027s not because it\u0027s weak; that\u0027s because it\u0027s a hash function, and authenticating things is not its job.\n\nThis is mostly just commentary; I\u0027ll leave it up to you to decide how clarified the problem should be. I\u0027m a fan of thorough threat models, but that\u0027s just me.","commit_id":"bc25865bc9cb222ab9a69391a9ee5e74b9e0075d"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"956ead659506b27e4288ba3d748cc8fbe6472b28","unresolved":false,"context_lines":[{"line_number":38,"context_line":"  have uploaded has not been accidentally or maliciously modified prior to"},{"line_number":39,"context_line":"  booting the image. This modification could be either accidental or"},{"line_number":40,"context_line":"  intentional. For example, an attacker may have compromised the cloud"},{"line_number":41,"context_line":"  provider\u0027s network and used that access to modify images in transit."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"With this proposed change, Nova will verify the signature of a signed image"},{"line_number":44,"context_line":"before booting that image. If the image signature cannot be verified, then"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a4dcd0f_4eda5619","line":41,"updated":"2015-08-08 00:32:18.000000000","message":"I\u0027m not sure this spec should cite online attacks as the main part of the threat model; wouldn\u0027t transport security address that equally well?","commit_id":"bc25865bc9cb222ab9a69391a9ee5e74b9e0075d"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"956ead659506b27e4288ba3d748cc8fbe6472b28","unresolved":false,"context_lines":[{"line_number":78,"context_line":"whether or not to perform signature verification. Alternatively, the user may"},{"line_number":79,"context_line":"elect to enforce that all images pass signature verification by setting a flag"},{"line_number":80,"context_line":"in nova.conf. If either of these flags are set, Nova will check for the"},{"line_number":81,"context_line":"presence of metadata which encodes a certificate reference, a specified hash"},{"line_number":82,"context_line":"method, and a signature. Nova will pass this metadata to the aforementioned"},{"line_number":83,"context_line":"object, which will perform signature verification and return a result. If"},{"line_number":84,"context_line":"signature verification fails, or if either flag is set and the relevant"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a4dcd0f_4e4816cd","line":81,"updated":"2015-08-08 00:32:18.000000000","message":"Is this metadata passed when the user tries to create a server?","commit_id":"bc25865bc9cb222ab9a69391a9ee5e74b9e0075d"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"956ead659506b27e4288ba3d748cc8fbe6472b28","unresolved":false,"context_lines":[{"line_number":96,"context_line":"An alternative to using Cryptography for the hashing and signing functionality"},{"line_number":97,"context_line":"is to use PyCrypto. We are electing to use Cryptography based on both the"},{"line_number":98,"context_line":"shift away from PyCrypto in OpenStack\u0027s requirements and the recommendations"},{"line_number":99,"context_line":"of cryptographers reviewing the accompanying Glance spec [1]."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"An alternative to using certificates for signing and signature verification"},{"line_number":102,"context_line":"would be to use a public key. However, this approach presents the significant"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a4dcd0f_2e082a91","line":99,"updated":"2015-08-08 00:32:18.000000000","message":"Yes! Yes! Yes! A thousand times yes :-)","commit_id":"bc25865bc9cb222ab9a69391a9ee5e74b9e0075d"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"0f76445a5155b964ee80bfe312406b45a21c4cda","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Currently, OpenStack\u0027s protection against unexpected modification of images is"},{"line_number":24,"context_line":"limited to verifying an MD5 checksum. While this may be sufficient for"},{"line_number":25,"context_line":"protecting against accidental modifications, MD5 is known to be"},{"line_number":26,"context_line":"cryptographically weak [2] and thus provides minimal protection against"},{"line_number":27,"context_line":"deliberate, malicious modification of images. An image could potentially be"},{"line_number":28,"context_line":"modified in transit, such as when it is uploaded to Glance or transferred to"},{"line_number":29,"context_line":"Nova. An image that is modified could include malicious code. Providing"}],"source_content_type":"text/x-rst","patch_set":9,"id":"da20952f_77b9b9eb","line":26,"updated":"2015-09-10 21:30:08.000000000","message":"I thought I mentioned this before, but there\u0027s some issues with this sentence. MD5 providing no protection against malicious modification isn\u0027t because it is cryptographically weak, it is because it is a hash function, not an authenticator. Therefore, the \"thus\" shouldn\u0027t be here; the non-protection isn\u0027t a consequence of cryptographic weakness.\n\nI think it would be better to say:\n\n While this may be sufficient for protecting against accidental modifications, MD5 is a hash function, not an authentication primitive, and thus provides *no* protection against ...","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"07a3559c758f7d6dc0d486997d8fad6f1ad076f2","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Currently, OpenStack\u0027s protection against unexpected modification of images is"},{"line_number":24,"context_line":"limited to verifying an MD5 checksum. While this may be sufficient for"},{"line_number":25,"context_line":"protecting against accidental modifications, MD5 is known to be"},{"line_number":26,"context_line":"cryptographically weak [2] and thus provides minimal protection against"},{"line_number":27,"context_line":"deliberate, malicious modification of images. An image could potentially be"},{"line_number":28,"context_line":"modified in transit, such as when it is uploaded to Glance or transferred to"},{"line_number":29,"context_line":"Nova. An image that is modified could include malicious code. Providing"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_370cf693","line":26,"in_reply_to":"da20952f_77b9b9eb","updated":"2015-09-14 13:51:38.000000000","message":"I\u0027ll add this clarification to the next iteration of this spec.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"0f76445a5155b964ee80bfe312406b45a21c4cda","unresolved":false,"context_lines":[{"line_number":61,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":62,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":63,"context_line":"which, when passed a certificate reference, a checksum, a specified hash"},{"line_number":64,"context_line":"method, and an image signature, will interface with Barbican to retrieve the"},{"line_number":65,"context_line":"certificate and will verify the signature using the cryptography library. More"},{"line_number":66,"context_line":"specifically, this object will use cryptography\u0027s signature verification"},{"line_number":67,"context_line":"library to verify that the image signature is equivalent to the checksum"}],"source_content_type":"text/x-rst","patch_set":9,"id":"da20952f_5784b509","line":64,"updated":"2015-09-10 21:30:08.000000000","message":"Are we requiring barbican for the first iteration here?","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"6a144b93c0745556a6df782a599f0acd267bcd71","unresolved":false,"context_lines":[{"line_number":61,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":62,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":63,"context_line":"which, when passed a certificate reference, a checksum, a specified hash"},{"line_number":64,"context_line":"method, and an image signature, will interface with Barbican to retrieve the"},{"line_number":65,"context_line":"certificate and will verify the signature using the cryptography library. More"},{"line_number":66,"context_line":"specifically, this object will use cryptography\u0027s signature verification"},{"line_number":67,"context_line":"library to verify that the image signature is equivalent to the checksum"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_af9e5f54","line":64,"in_reply_to":"ba15a1d1_b79326fa","updated":"2015-09-14 20:44:08.000000000","message":"Awesome, thanks for clarifying.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"07a3559c758f7d6dc0d486997d8fad6f1ad076f2","unresolved":false,"context_lines":[{"line_number":61,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":62,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":63,"context_line":"which, when passed a certificate reference, a checksum, a specified hash"},{"line_number":64,"context_line":"method, and an image signature, will interface with Barbican to retrieve the"},{"line_number":65,"context_line":"certificate and will verify the signature using the cryptography library. More"},{"line_number":66,"context_line":"specifically, this object will use cryptography\u0027s signature verification"},{"line_number":67,"context_line":"library to verify that the image signature is equivalent to the checksum"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_b79326fa","line":64,"in_reply_to":"da20952f_5784b509","updated":"2015-09-14 13:51:38.000000000","message":"We are using the Castellan library to interface with key managers. Since Castellan currently only supports integration with Barbican, we are indirectly requiring Barbican.\n\nIn the future, as Castellan supports integration with different key managers, we won\u0027t have to change any image-signing or verification code in order to allow this feature to also support these backends. We will simply update the Nova and Glance requirements to the newest version of Castellan.\n\nI\u0027ll try to clarify this in my next iteration of this spec.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"6a144b93c0745556a6df782a599f0acd267bcd71","unresolved":false,"context_lines":[{"line_number":74,"context_line":"will check for the presence of metadata which encodes a certificate reference,"},{"line_number":75,"context_line":"a specified hash method, and a signature. Nova will pass this metadata to the"},{"line_number":76,"context_line":"aforementioned object, which will perform signature verification and return a"},{"line_number":77,"context_line":"result. If signature verification fails, or if either flag is set and the"},{"line_number":78,"context_line":"relevant metadata is not present, Nova will not boot the image, instead"},{"line_number":79,"context_line":"throwing an exception and logging an error."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_2ffa4f43","line":77,"updated":"2015-09-14 20:44:08.000000000","message":"I think only the nova.conf flag has been mentioned so far; I think this means a flag in the form of metadata, but it might be useful to specify.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"0f76445a5155b964ee80bfe312406b45a21c4cda","unresolved":false,"context_lines":[{"line_number":76,"context_line":"aforementioned object, which will perform signature verification and return a"},{"line_number":77,"context_line":"result. If signature verification fails, or if either flag is set and the"},{"line_number":78,"context_line":"relevant metadata is not present, Nova will not boot the image, instead"},{"line_number":79,"context_line":"throwing an exception and logging an error."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The final component in this change is a modification to the Nova CLI to allow"},{"line_number":82,"context_line":"the user to set an image_meta property indicating that an image should be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"da20952f_37fd816e","line":79,"updated":"2015-09-10 21:30:08.000000000","message":"Requiring signatures when signatures are enabled in nova.conf is a good thing; it means attackers can\u0027t lie by omission. However, which key does the signing when I, the end-user, don\u0027t specify a key myself?","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"6a144b93c0745556a6df782a599f0acd267bcd71","unresolved":false,"context_lines":[{"line_number":76,"context_line":"aforementioned object, which will perform signature verification and return a"},{"line_number":77,"context_line":"result. If signature verification fails, or if either flag is set and the"},{"line_number":78,"context_line":"relevant metadata is not present, Nova will not boot the image, instead"},{"line_number":79,"context_line":"throwing an exception and logging an error."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The final component in this change is a modification to the Nova CLI to allow"},{"line_number":82,"context_line":"the user to set an image_meta property indicating that an image should be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_ef9a1714","line":79,"in_reply_to":"ba15a1d1_b706c61e","updated":"2015-09-14 20:44:08.000000000","message":"It seems like from your comment below, the nova.conf flag means all images are signed; that answers my question, because there is no case where the end user doesn\u0027t specify a signing key. My apologies :)","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"07a3559c758f7d6dc0d486997d8fad6f1ad076f2","unresolved":false,"context_lines":[{"line_number":76,"context_line":"aforementioned object, which will perform signature verification and return a"},{"line_number":77,"context_line":"result. If signature verification fails, or if either flag is set and the"},{"line_number":78,"context_line":"relevant metadata is not present, Nova will not boot the image, instead"},{"line_number":79,"context_line":"throwing an exception and logging an error."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The final component in this change is a modification to the Nova CLI to allow"},{"line_number":82,"context_line":"the user to set an image_meta property indicating that an image should be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_b706c61e","line":79,"in_reply_to":"da20952f_37fd816e","updated":"2015-09-14 13:51:38.000000000","message":"I\u0027m not sure I understand the question. Any image signed by the end user must be uploaded to Glance with the certificate uuid of the certificate used to sign it in the Glance image properties. \n\nIf the user did not specify the certificate uuid, the image could not pass signature verification in Glance or in Nova.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"0f76445a5155b964ee80bfe312406b45a21c4cda","unresolved":false,"context_lines":[{"line_number":84,"context_line":"images in their deployment, as opposed to using the configuration flag. This"},{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"da20952f_977b2df4","line":87,"updated":"2015-09-10 21:30:08.000000000","message":"This seems to talk about image management only; how do I specify when creating a server from an image that the image must be signed?","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"6a144b93c0745556a6df782a599f0acd267bcd71","unresolved":false,"context_lines":[{"line_number":84,"context_line":"images in their deployment, as opposed to using the configuration flag. This"},{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_da04af16","line":87,"in_reply_to":"ba15a1d1_1a49d931","updated":"2015-09-14 20:44:08.000000000","message":"Gotcha. To clarify previous comment:\n\nYou may want to consider adding a flag for Nova at server creation time, stating that the image from which to create the server should be signed. That way, creating an image that Nova downloads that erroneously does not have signing metadata (for example, because it\u0027s missing *all* metadata) will fail, instead of silently passing without having a signature checked.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"0d6b124a3ac0e3adfbdbaa5453ba31c3f58e52d1","unresolved":false,"context_lines":[{"line_number":84,"context_line":"images in their deployment, as opposed to using the configuration flag. This"},{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_55f710d3","line":87,"in_reply_to":"ba15a1d1_da04af16","updated":"2015-09-14 21:26:33.000000000","message":"I like this idea since it defaults to a more secure boot state.  When server images fail to boot due to lacking a signature, this would ensure those images get one.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"07a3559c758f7d6dc0d486997d8fad6f1ad076f2","unresolved":false,"context_lines":[{"line_number":84,"context_line":"images in their deployment, as opposed to using the configuration flag. This"},{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba15a1d1_1a49d931","line":87,"in_reply_to":"da20952f_977b2df4","updated":"2015-09-14 13:51:38.000000000","message":"This is meant to provide an alternative to forcing all images which are bootable by nova to be signed (which is what the nova.conf option does). The user would use the Nova CLI to set this flag for a particular image, and then select this image when booting a server. \n\nThe Nova code would then perform image signature verification before booting. If the user had specified an image for which this flag had not been set, then Nova would perform no image signature verification.","commit_id":"408ae6e24dbaf1419cd784c24732ac0d160063d2"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"c2100f4a275c3d8c1b602128662ee394363daa74","unresolved":false,"context_lines":[{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"},{"line_number":91,"context_line":"will interact with while exercising this functionality will have been added to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_f5f3b208","line":88,"updated":"2015-09-15 08:58:14.000000000","message":"You\u0027re talking about modifying Nova API to set image_meta properties, but setting those properties is actually the job of the Glance API. Nova merely reads image_meta properties received from glance.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d89df90a218f637574501d95dc3aecd930313abe","unresolved":false,"context_lines":[{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"},{"line_number":91,"context_line":"will interact with while exercising this functionality will have been added to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_25c5605a","line":88,"in_reply_to":"ba15a1d1_02313205","updated":"2015-09-15 17:43:22.000000000","message":"The Nova CLI tools talk to the Nova API. So if you\u0027re suggesting changing the Nova CLI, that would usually imply changing the Nova API. If that\u0027s not what you plan, then we need more info on what you\u0027re actually suggesting to change.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"cc02628077e0b2e05b909dc9a57d6d55f2ea5af6","unresolved":false,"context_lines":[{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"},{"line_number":91,"context_line":"will interact with while exercising this functionality will have been added to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_8b5b1d87","line":88,"in_reply_to":"ba15a1d1_8136aee5","updated":"2015-09-15 18:35:02.000000000","message":"To be clear, the novaclient specifying that it\u0027s expecting an image to be signed and what it\u0027s expecting that image to be signed by resolve that issue, but that\u0027s being pursued in a later patch, right? That\u0027s the issue my suggestion for novaclient addresses; but having signatures be mandatory for now and adding this feature in a later spec is fine too.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"bc59ece765905e43bd580488c8e3f8bba8f3321e","unresolved":false,"context_lines":[{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"},{"line_number":91,"context_line":"will interact with while exercising this functionality will have been added to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_8136aee5","line":88,"in_reply_to":"ba15a1d1_f5f3b208","updated":"2015-09-15 18:27:57.000000000","message":"@lvh: Daniel is correct that the API method I am referring to here essentially just calls out to Glance to read/write the specified metadata. Since this doesn\u0027t fit with our use case of an untrusted Glance service, we\u0027ll have to find another way to indicate that images should be signed on a per-image basis. We\u0027re scrapping this for the initial implementation and we\u0027re just going to use the nova.conf flag to indicate that all images should be signed.\n\n@daniel: I like the idea of adding a \"trusted\" flavor so that when using nova-boot, the user can specify inline that they\u0027d like Nova to check the image\u0027s signature metadata. It is likely that we will pursue this in a future spec / patch.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"124df76530c0e76027744661f1a883d1b98ae948","unresolved":false,"context_lines":[{"line_number":85,"context_line":"code will use the PUT and POST methods of the"},{"line_number":86,"context_line":"{tenant_id}/images/{image_id}/metadata resource of the Nova REST API to create"},{"line_number":87,"context_line":"and update this image_meta property."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The certificate references will be used to access the certificates from"},{"line_number":90,"context_line":"Barbican, which will provide the key management services. Any certificate Nova"},{"line_number":91,"context_line":"will interact with while exercising this functionality will have been added to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_02313205","line":88,"in_reply_to":"ba15a1d1_f5f3b208","updated":"2015-09-15 17:28:56.000000000","message":"I\u0027m not sure I understand. This part talks about modifying the *CLI*; the Nova CLI client provides plenty of ways to interact with images.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"c2100f4a275c3d8c1b602128662ee394363daa74","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_f582d2ff","line":109,"updated":"2015-09-15 08:58:14.000000000","message":"Your problem description doesn\u0027t go into very much detail about the \"certificates\" used but your last paragraph says the certificates are obtained from glance. Here you are suggesting that the attacker could place their own public keys in Barbican, but if they can do that with keys, then they can also get their own certificates in Barbican. So this claimed downside of public keys appears to apply equally to the use of certificates. \n\nIn general, based on the info in this spec, I\u0027m not really seeing any compelling reason for using certificates, instead of public key cryptography. I think it is actually more compelling if we support the use of public key signatures, since they\u0027re already widely used by the various vendors who build images, and the tools for using them are far less complex (and thus less error prone) to use than certificate tools.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"7676ad61080558edeffa0548a706ade690afea50","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_695f9ce5","line":109,"in_reply_to":"ba15a1d1_4cee8db5","updated":"2015-09-16 08:42:17.000000000","message":"I\u0027m surprised to hear that there was any code required to be merged into glance to support this. If we\u0027re to consider glance untrusted, then the only thing we can get from glance is the signature itself, which can be stored as an image meta field. So what functionality has been added to glance, and what use is Nova going to make of this.\n\nI don\u0027t think that requires out of band communication via phone/email etc is really satisfactory for a public cloud deployment. I think we need to design the system such that everything is reliably verifiable without having to go to out of band channels.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"40d49a16457895afec0f18b9c6fc1569f4eff422","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_749d1dbb","line":109,"in_reply_to":"ba15a1d1_635a492c","updated":"2015-09-16 15:20:12.000000000","message":"Can you provide more details in the spec about exactly what you\u0027re proposing to do wrt Nova/Glance communication and any image_meta involved, because reviewers who haven\u0027t looked at the existing glance implementation don\u0027t have any knowledge of what its done prior to now.   Really what I\u0027d like to see is a clear outline of the communication / API calls at each stage in the process, and what data is being used at each point and format the data is represented in.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d89df90a218f637574501d95dc3aecd930313abe","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_25d8001d","line":109,"in_reply_to":"ba15a1d1_656598df","updated":"2015-09-15 17:43:22.000000000","message":"Specifically, I\u0027m referring to ability to use PGP signatures, which are what software vendors will comonly provide alongside images that they publish. So some ability to indicate/provide to Nova what public key to use to verify the image. eg, upload the vendor\u0027s existing public key rather than generating new openstack specific keys.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"47d62d6f6e7e62845b49c966e0ae55ac517cd01f","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_635a492c","line":109,"in_reply_to":"ba15a1d1_695f9ce5","updated":"2015-09-16 14:33:04.000000000","message":"The code merged into Glance supports a different use case: the case where the user does not want to trust the network between themselves and Glance. The code in Glance allows the user to upload an image with signature metadata and receive confirmation that the signature metadata is still valid when Glance stores the image.\n\nThe code in Nova is not strictly dependent upon the code in Glance, since we can specify arbitrary image properties when uploading the image to Glance and perform some computation on them when downloading the image in Nova. But if we specify a completely different signing procedure and a completely different set of image properties for Glance and Nova signature verification, we are making both features massively unusable, since it is likely that any user who wants their image verified in Glance also wants it verified in Nova, and vice versa. \n\nI\u0027m also not specifying that out of band communication is a requirement for each signed image, I\u0027m just offering that as a possible advantage of certs over public keys. In my view, the problems of associating Openstack tenants with certificates, propagating this ownership information across multiple projects in a secure fashion, and supporting flexible yet usable trust policies for end users are huge problems which will take several cycles/specs/patches.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"124df76530c0e76027744661f1a883d1b98ae948","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_656598df","line":109,"in_reply_to":"ba15a1d1_f582d2ff","updated":"2015-09-15 17:28:56.000000000","message":"I am not sure I understand the objection. The certificates we\u0027re talking about are containers for PKI, and the signatures are already public-key signatures. When you suggest using public-key cryptography, what precisely are you suggesting, and how is that distinct from the certificates  being proposed?","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"bc59ece765905e43bd580488c8e3f8bba8f3321e","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Nova along with their signed image. Alternatively, the use of certificates"},{"line_number":107,"context_line":"provides a means of attributing such attacks to the certificate owner, and"},{"line_number":108,"context_line":"follows common cryptographic standards by placing the root of trust at the"},{"line_number":109,"context_line":"certificate authority."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Data model impact"},{"line_number":112,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_4cee8db5","line":109,"in_reply_to":"ba15a1d1_f582d2ff","updated":"2015-09-15 18:27:57.000000000","message":"The code which has been merged into Glance uses certificates, so we are at least bound to support certificates in our initial implementation. I see no reason why the signature_utils class could not be updated to support PGP signatures with public keys stored in the key manager. In fact, our initial implementation used public keys, but we had to switch to certificates in order to get the feature merged in Glance.\n\nThe point I\u0027m trying to make with this paragraph is merely that if an admin suspects that this malicious image attack is occurring, they can use an out-of-band method (email, phone, etc) to verify a certificate with a certificate authority. With public keys stored in Barbican, an admin has no such recourse.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"c2100f4a275c3d8c1b602128662ee394363daa74","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_9502760a","line":138,"updated":"2015-09-15 08:58:14.000000000","message":"I\u0027m not really seeing how we achieve any protection against compromise of glance in the proposed change. \n\nWhether or not an image is signed, is indicated by an image_meta field. IIUC, the identity of the certificate is also recorded in the image_meta. This information is trivially stripped or replaced by an untrustworthy glance, so I don\u0027t see any way for Nova to rely on that to provide any security assurance.\n\nIIUC the usage scenario is that Nova and Barbican are trustworthy, and Glance is untrustworthy.\n\nSo, Nova needs to be able to determine whether to perform verification, and what key/certificate to use to verify an image, /without/ relying on *any* information provided by Glance.\n\nThere are essentially two ways to acquire the key/certificate identity. First, Nova can be passed the required key/certificate identify via the \u0027boot\u0027 API call. Second, Nova can obtain a list of valid key/certificate identities from a 3rd party trusted source, ie Barbican. \n\nAs for determining /whether/ to perform image verification, this could either be a global nova.conf flag, or a flavour extra-spec, or an argument to the boot command / block device mapping. It specifically cannot be anything in image_meta, as that comes from untrustworthy glance.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"5dc23f6f274f4a698af7f1ac274b125369753fd1","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_d28be166","line":138,"in_reply_to":"ba15a1d1_4913b80d","updated":"2015-09-16 13:41:06.000000000","message":"What you\u0027re describing is the long-term vision: a way to identify the signature(s) that have been validated for an image.\n\nDane can correct me if I\u0027m wrong, but I think this spec is an initial step toward this goal. The actual implementation could proceed as follows:\n\n1. signature validation for images (as specified by nova.conf or trusted flavors)\n\n2. Nova API, dashboard, etc. updates to provide the end user with information about the certificate used to validate the image\n\n3. the introduction of policy that controls what signatures the user considers trusted (e.g., only boot an image where the signature is validated by a certificate owned by the user)\n\nAll that would probably be too much for a single spec / release cycle, but perhaps it would be useful to describe at a high level in the \"Proposed change\" section?","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"bc59ece765905e43bd580488c8e3f8bba8f3321e","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_99270212","line":138,"in_reply_to":"ba15a1d1_9502760a","updated":"2015-09-15 18:27:57.000000000","message":"As my previous comment says, we will no longer be checking the image metadata to indicate whether the image is signed or not. You are quite right that it isn\u0027t a secure approach. Instead we will rely on the nova.conf configuration flag. \n\nAs for the issue with the certificate reference, the assumption is that the deployers will be using a reliable CA, so it shouldn\u0027t be as easy for a malicious user to upload a cert to the key manager as it is to generate a keypair and add a public key to the key manager. However, this may be a faulty assumption for some deployments.\n\nWe could mimic the Glance implementation and require the user to specify a \"trusted\" flavor as well as the cert uuid when calling nova-boot. Does this sound reasonable?","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"124df76530c0e76027744661f1a883d1b98ae948","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_a5a970e1","line":138,"in_reply_to":"ba15a1d1_9502760a","updated":"2015-09-15 17:28:56.000000000","message":"This is why my other comment (not sure if implemented yet) suggests adding a flag to Nova that allows you to specify that you expect an image to be signed, and who you expect it to be signed by.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"cc02628077e0b2e05b909dc9a57d6d55f2ea5af6","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_cbefd585","line":138,"in_reply_to":"ba15a1d1_99270212","updated":"2015-09-15 18:35:02.000000000","message":"It seems like we\u0027re talking about the same thing in two places :)\n\nThis is why I commented asking for novaclient to be able to specify that it wants a signed image and who should do the signing *at server creation time* (but back on patchset 9). Once you have that, you no longer trust Glance. Glance may be able to lie by omission, or provide nonsense data instead, but either way Nova will reject the image.\n\nIt\u0027s fine if that\u0027s pursued in a later spec, though.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"7676ad61080558edeffa0548a706ade690afea50","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_4913b80d","line":138,"in_reply_to":"ba15a1d1_99270212","updated":"2015-09-16 08:42:17.000000000","message":"So you seem to be saying that there will be no association between and image and the identity of the signer. IOW,  it is valid for any image to be signed by any person who has managed to obtain a certificate. I think that this is not really a credible approach for public cloud, where this feature is most critically beneficial, since the overwealming majority of users will not be trusted. As such I\u0027d like to see some kind of means to have an explicit association between images and the identity(s) of the permitted signer(s).","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"d89df90a218f637574501d95dc3aecd930313abe","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_05793cf6","line":138,"in_reply_to":"ba15a1d1_a5a970e1","updated":"2015-09-15 17:43:22.000000000","message":"The section of proposed change says \" Nova will check for the presence of metadata which encodes a certificate reference\" - so its pull the certificate identify from the image metadata, which is an untrustworthy source. Later on it also talks about setting an image meta flag to indicate whether the image is signed or not, but again image meta is not trustworthy. A malicious glance could just strip the flag saying the image should be signed, causing Nova to skip all validation. So this does not provide any protection against a malcious glance, as described.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"40d49a16457895afec0f18b9c6fc1569f4eff422","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_b9565028","line":138,"in_reply_to":"ba15a1d1_d28be166","updated":"2015-09-16 15:20:12.000000000","message":"I think the spec really has to spell out the overall technical architecture, even if not all will be implemented initially, otherwise we can easily find ourselves going down a blind alley right now which will be hard to get out of later while maintaining back compat.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"47d62d6f6e7e62845b49c966e0ae55ac517cd01f","unresolved":false,"context_lines":[{"line_number":135,"context_line":"the communcation network between Nova and Glance. This feature facilitates the"},{"line_number":136,"context_line":"creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":137,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":138,"context_line":"desired image."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Although Nova will use keys to perform this task, the keys will be stored"},{"line_number":141,"context_line":"by Barbican."}],"source_content_type":"text/x-rst","patch_set":11,"id":"ba15a1d1_6344891a","line":138,"in_reply_to":"ba15a1d1_d28be166","updated":"2015-09-16 14:33:04.000000000","message":"Joel is correct that this spec and the accompanying patch are meant to be an initial implementation which will need to be continuously improved over future releases with at least the listed improvements.","commit_id":"083f7b962124a77daf1eab885fa2891b255b1dac"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"fc10cfa518304e33a44705147bb6f0482b6c97b8","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Malicious Admin - An Openstack admin with privileged access to Glance is"},{"line_number":42,"context_line":"  incorporating malware into the image files stored in Glance. This admin is"},{"line_number":43,"context_line":"  also potentially adding maliciously generated certificates to the key "},{"line_number":44,"context_line":"  manager and using these certificates to re-sign the corrupted images."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a29b11f_b2d5bee5","line":43,"updated":"2015-10-22 13:45:05.000000000","message":"Trailing whitespace","commit_id":"65431df068612a4edce213fdc8633f4406c5703f"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"fc10cfa518304e33a44705147bb6f0482b6c97b8","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* A user wants a high degree of assurance that a customized image"},{"line_number":64,"context_line":"  which they have uploaded to Glance has not been accidentally or"},{"line_number":65,"context_line":"  maliciously modified prior to booting the image. "},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"With this proposed change, Nova will verify the signature of a signed image"},{"line_number":68,"context_line":"while downloading that image. If the image signature cannot be verified, then"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a29b11f_52078a81","line":65,"updated":"2015-10-22 13:45:05.000000000","message":"ditto","commit_id":"65431df068612a4edce213fdc8633f4406c5703f"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"fc10cfa518304e33a44705147bb6f0482b6c97b8","unresolved":false,"context_lines":[{"line_number":86,"context_line":"* signature_certificate_uuid - A string encoding the certificate uuid used to"},{"line_number":87,"context_line":"  retrieve the certificate from the key manager."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Additionally, there are optional image signature metadata which the user can specify:"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"* mask_gen_algorithm - A string designating the mask generation algorithm for"},{"line_number":92,"context_line":"  RSA-PSS. Currently, the only supported value is \u0027MGF1\u0027."}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a29b11f_d2fb9a77","line":89,"updated":"2015-10-22 13:45:05.000000000","message":"This line needs to be wrapped.","commit_id":"65431df068612a4edce213fdc8633f4406c5703f"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"fc10cfa518304e33a44705147bb6f0482b6c97b8","unresolved":false,"context_lines":[{"line_number":303,"context_line":"* Add functionality to the signature_utils class which fetches certificate"},{"line_number":304,"context_line":"  chains. Incorporate this method, along with the pyca/cryptography library\u0027s"},{"line_number":305,"context_line":"  certificate validation functionality into the signature_utils class\u0027s"},{"line_number":306,"context_line":"  functionality for verifying image signatures. "},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"* Amend the initial implementation in Nova to utilize this change by allowing"},{"line_number":309,"context_line":"  Nova to fetch its root certificate and pass it to the image signature"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a29b11f_522eaafb","line":306,"updated":"2015-10-22 13:45:05.000000000","message":"trailing whitespace","commit_id":"65431df068612a4edce213fdc8633f4406c5703f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":33,"context_line":"future API change. This feature will secure OpenStack against the following"},{"line_number":34,"context_line":"attack scenarios:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* Man in the Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_bb0d68ea","line":36,"updated":"2015-10-23 17:07:56.000000000","message":"nit: Man-in-the-Middle should be hyphenated","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":33,"context_line":"future API change. This feature will secure OpenStack against the following"},{"line_number":34,"context_line":"attack scenarios:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* Man in the Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_3ec3863a","line":36,"in_reply_to":"3a29b11f_bb0d68ea","updated":"2015-10-23 18:03:22.000000000","message":"Done","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":101,"context_line":"signature is not valid or the metadata is incomplete, this API method will"},{"line_number":102,"context_line":"return a 400 error status and refuse to store the image. Note that, if the"},{"line_number":103,"context_line":"signature metadata is simply not present, the image will be stored as it would"},{"line_number":104,"context_line":"normally."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"The user would then create an instance from this image using the Nova API\u0027s"},{"line_number":107,"context_line":"boot method. If the verify_glance_signatures flag in nova.conf is set to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_dbae2498","line":104,"updated":"2015-10-23 17:07:56.000000000","message":"The final note here seems like it should be emphasized more. As written, it feels easy to miss.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":115,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":116,"context_line":"information about the signing certificate."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Project Priority"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_3bacf88b","line":116,"updated":"2015-10-23 17:07:56.000000000","message":"If verify_glance_signatures is set to False, but image signature is still present, I assume Nova will just ignore it and boot the image anyway. This seems wrong. Or was there a prior concern for denial-of-service on images?","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":115,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":116,"context_line":"information about the signing certificate."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Project Priority"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_be0a3678","line":116,"in_reply_to":"3a29b11f_3bacf88b","updated":"2015-10-23 18:03:22.000000000","message":"Since signature validation will introduce some significant computational overhead (hashing the image data, fetching certificates, etc), I didn\u0027t want to allow a malicious entity to \"piggyback\" a denial-of-service onto valid boot requests by adding bogus image signature metadata to Glance images.\n\nAlso, from an implementation perspective, why call out to Glance for an image\u0027s properties if they aren\u0027t needed? The normal control flow for booting images does not require Nova to call out to Glance for the properties.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":128,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":129,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":130,"context_line":"which, when passed a reference to the signing certificate, a checksum, a"},{"line_number":131,"context_line":"specified hash method, and an image signature, will interface with Castellan"},{"line_number":132,"context_line":"to retrieve the certificate and will verify the signature using the"},{"line_number":133,"context_line":"cryptography library. More specifically, this object will use cryptography\u0027s"},{"line_number":134,"context_line":"signature verification functionality to verify that the image signature is"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_7bc9105a","line":131,"updated":"2015-10-23 17:07:56.000000000","message":"Is Castellan integrated with Nova yet?","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":128,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":129,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":130,"context_line":"which, when passed a reference to the signing certificate, a checksum, a"},{"line_number":131,"context_line":"specified hash method, and an image signature, will interface with Castellan"},{"line_number":132,"context_line":"to retrieve the certificate and will verify the signature using the"},{"line_number":133,"context_line":"cryptography library. More specifically, this object will use cryptography\u0027s"},{"line_number":134,"context_line":"signature verification functionality to verify that the image signature is"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_be58f68b","line":131,"in_reply_to":"3a29b11f_7bc9105a","updated":"2015-10-23 18:03:22.000000000","message":"There isn\u0027t really a required \"integration\" step. Castellan is already included in global requirements. All we need to do in order to use it for this feature is include it is Nova\u0027s requirements.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":144,"context_line":"image. Instead, Nova will throw an exception and log an error. If the"},{"line_number":145,"context_line":"signature verification succeeds, Nova will proceed with booting the instance."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"The next component will be to add functionality to the cryptography library"},{"line_number":148,"context_line":"which will validate a given certificate chain against a pool of given root"},{"line_number":149,"context_line":"certificates which are known to be trusted. This functionality will verify the"},{"line_number":150,"context_line":"signature of each certificate in the chain by retreiving the public key of the"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_7b3ef02a","line":147,"updated":"2015-10-23 17:07:56.000000000","message":"I suspect this spec won\u0027t see much review until the cryptography piece is merged. Is it relevant to a Nova spec to discuss components to be added to other libraries?","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":144,"context_line":"image. Instead, Nova will throw an exception and log an error. If the"},{"line_number":145,"context_line":"signature verification succeeds, Nova will proceed with booting the instance."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"The next component will be to add functionality to the cryptography library"},{"line_number":148,"context_line":"which will validate a given certificate chain against a pool of given root"},{"line_number":149,"context_line":"certificates which are known to be trusted. This functionality will verify the"},{"line_number":150,"context_line":"signature of each certificate in the chain by retreiving the public key of the"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_fe2f4ea5","line":147,"in_reply_to":"3a29b11f_7b3ef02a","updated":"2015-10-23 18:03:22.000000000","message":"I believe it\u0027s relevant, since it informs the reviewers of the path to implementation for the feature.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":158,"context_line":"certificates against a set of trusted root certificates is a standard, and has"},{"line_number":159,"context_line":"been outlined in RFC 5280 [4]."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Once the certificate validation functionality has been added to cryptography"},{"line_number":162,"context_line":"library, we will amend the object which performs signature verification by"},{"line_number":163,"context_line":"incorporating certificate validation into the signature verification workflow."},{"line_number":164,"context_line":"We will implement a method which will use GET requests to dynamically fetch"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_fb020072","line":161,"updated":"2015-10-23 17:07:56.000000000","message":"nit: ...added to the cryptography...","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":158,"context_line":"certificates against a set of trusted root certificates is a standard, and has"},{"line_number":159,"context_line":"been outlined in RFC 5280 [4]."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Once the certificate validation functionality has been added to cryptography"},{"line_number":162,"context_line":"library, we will amend the object which performs signature verification by"},{"line_number":163,"context_line":"incorporating certificate validation into the signature verification workflow."},{"line_number":164,"context_line":"We will implement a method which will use GET requests to dynamically fetch"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_3ee4e6aa","line":161,"in_reply_to":"3a29b11f_fb020072","updated":"2015-10-23 18:03:22.000000000","message":"Done","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"d3b75b89777000dd9cedf7800dca2269a85c9fce","unresolved":false,"context_lines":[{"line_number":195,"context_line":"at the certificate authority."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"An alternative to using the verify_glance_signatures configuration flag to"},{"line_number":198,"context_line":"specify that Nova should perform image signature verification is using"},{"line_number":199,"context_line":"\"trusted\" flavors to specify that individual instances should be created from"},{"line_number":200,"context_line":"signed images. The user, when using the Nova CLI to boot an instance, would"},{"line_number":201,"context_line":"specify one of these \"trusted\" flavors to indicate that image signature"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_0db3370b","line":198,"updated":"2015-10-23 15:26:46.000000000","message":"minor suggestion:  s/is using/is to use/","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":195,"context_line":"at the certificate authority."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"An alternative to using the verify_glance_signatures configuration flag to"},{"line_number":198,"context_line":"specify that Nova should perform image signature verification is using"},{"line_number":199,"context_line":"\"trusted\" flavors to specify that individual instances should be created from"},{"line_number":200,"context_line":"signed images. The user, when using the Nova CLI to boot an instance, would"},{"line_number":201,"context_line":"specify one of these \"trusted\" flavors to indicate that image signature"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_bee6b6ae","line":198,"in_reply_to":"3a29b11f_0db3370b","updated":"2015-10-23 18:03:22.000000000","message":"Done","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a792f2b65997b8e9a566c12e0b8d86c23b567016","unresolved":false,"context_lines":[{"line_number":204,"context_line":"initial implementation. If added, the trusted flavors option will work"},{"line_number":205,"context_line":"alongside the configuration option approach. In this case, Nova would perform"},{"line_number":206,"context_line":"image signature verification if either the configuration flag is set, or if"},{"line_number":207,"context_line":"the user has specified booting an instance of the \"trusted\" flavor."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Data model impact"},{"line_number":210,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_bb58088c","line":207,"updated":"2015-10-23 17:07:56.000000000","message":"It sounds like with trusted flavors, Nova has no choice but to verify the signature, unlike with the verify_glance_signatures path. Is that discrepancy ok?","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":204,"context_line":"initial implementation. If added, the trusted flavors option will work"},{"line_number":205,"context_line":"alongside the configuration option approach. In this case, Nova would perform"},{"line_number":206,"context_line":"image signature verification if either the configuration flag is set, or if"},{"line_number":207,"context_line":"the user has specified booting an instance of the \"trusted\" flavor."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Data model impact"},{"line_number":210,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_91c08b7e","line":207,"in_reply_to":"3a29b11f_bb58088c","updated":"2015-10-23 18:03:22.000000000","message":"This is definitely something the community will have to decide before we attempt to implement any sort of API or trusted flavors change. Allowing the end user to declare that an image must be signed potentially forces Nova to perform taxing computations which may not be desired by the cloud provider.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"d3b75b89777000dd9cedf7800dca2269a85c9fce","unresolved":false,"context_lines":[{"line_number":243,"context_line":"---------------------"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":246,"context_line":"from the image, and an error message will be logged."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Performance Impact"},{"line_number":249,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_88ab87d6","line":246,"updated":"2015-10-23 15:26:46.000000000","message":"Though it\u0027s obvious, you may want to say what the user would be expected to do as a result of this error, which presumably would be to initiate a reload of the signed image into Glance, or ignore the error at their own risk.","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":243,"context_line":"---------------------"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":246,"context_line":"from the image, and an error message will be logged."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Performance Impact"},{"line_number":249,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_3efb8649","line":246,"in_reply_to":"3a29b11f_88ab87d6","updated":"2015-10-23 18:03:22.000000000","message":"Done","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"d3b75b89777000dd9cedf7800dca2269a85c9fce","unresolved":false,"context_lines":[{"line_number":261,"context_line":""},{"line_number":262,"context_line":"In order to use this feature, a key manager must be deployed and configured."},{"line_number":263,"context_line":"Additionally, Nova must be configured to use a root certificate which has a"},{"line_number":264,"context_line":"root of trust which can fill an end user\u0027s certificate signing requests."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"Developer impact"},{"line_number":267,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_c8b97f7b","line":264,"updated":"2015-10-23 15:26:46.000000000","message":"suggestion:  s/which can fill an end user\u0027s/that can respond to end user\u0027s/","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"74834cf2fc80a6143bfd80aca601b36ada917d10","unresolved":false,"context_lines":[{"line_number":261,"context_line":""},{"line_number":262,"context_line":"In order to use this feature, a key manager must be deployed and configured."},{"line_number":263,"context_line":"Additionally, Nova must be configured to use a root certificate which has a"},{"line_number":264,"context_line":"root of trust which can fill an end user\u0027s certificate signing requests."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"Developer impact"},{"line_number":267,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a29b11f_5ef8c249","line":264,"in_reply_to":"3a29b11f_c8b97f7b","updated":"2015-10-23 18:03:22.000000000","message":"Done","commit_id":"c7cb81a354ea1befb84722a511d8ee0a89438588"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"With this proposed change, Nova will verify the signature of a signed image"},{"line_number":68,"context_line":"while downloading that image. If the image signature cannot be verified, then"},{"line_number":69,"context_line":"Nova will not boot the image and instead return an error to the users\u0027"},{"line_number":70,"context_line":"request."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The user will begin to use this feature by uploading the image and the image"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_1403090f","line":69,"updated":"2015-10-23 18:45:26.000000000","message":"Does Nova return an error to the user?  Or just put the instance into an error state?","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"With this proposed change, Nova will verify the signature of a signed image"},{"line_number":68,"context_line":"while downloading that image. If the image signature cannot be verified, then"},{"line_number":69,"context_line":"Nova will not boot the image and instead return an error to the users\u0027"},{"line_number":70,"context_line":"request."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The user will begin to use this feature by uploading the image and the image"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_4fe6ce45","line":69,"in_reply_to":"3a29b11f_1403090f","updated":"2015-10-23 19:33:58.000000000","message":"You are correct, Nova simply puts the instance into an error state. I\u0027ll put this clarification in the next draft.","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":99,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":100,"context_line":"object to verify this signature metadata before storing the image. If the"},{"line_number":101,"context_line":"signature is not valid or the metadata is incomplete, this API method will"},{"line_number":102,"context_line":"return a 400 error status and refuse to store the image. Note that, if the"},{"line_number":103,"context_line":"signature metadata is simply not present, the image will be stored as it would"},{"line_number":104,"context_line":"normally."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_94ab99d6","line":102,"updated":"2015-10-23 18:45:26.000000000","message":"It\u0027s more accurate to say that the API will return a 400 error status and put the image into a \"killed\" state.","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":99,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":100,"context_line":"object to verify this signature metadata before storing the image. If the"},{"line_number":101,"context_line":"signature is not valid or the metadata is incomplete, this API method will"},{"line_number":102,"context_line":"return a 400 error status and refuse to store the image. Note that, if the"},{"line_number":103,"context_line":"signature metadata is simply not present, the image will be stored as it would"},{"line_number":104,"context_line":"normally."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_6fe38a34","line":102,"in_reply_to":"3a29b11f_94ab99d6","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":106,"context_line":"The user would then create an instance from this image using the Nova API\u0027s"},{"line_number":107,"context_line":"boot method. If the verify_glance_signatures flag in nova.conf is set to"},{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signing. Nova will compute the MD5 checksum"},{"line_number":110,"context_line":"of the image data and pass the checksum and image properties to the"},{"line_number":111,"context_line":"signature_utils object, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_b47a5576","line":109,"updated":"2015-10-23 18:45:26.000000000","message":"Would it be better to say \"image signature verification\" instead of \"image signing\"?","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":106,"context_line":"The user would then create an instance from this image using the Nova API\u0027s"},{"line_number":107,"context_line":"boot method. If the verify_glance_signatures flag in nova.conf is set to"},{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signing. Nova will compute the MD5 checksum"},{"line_number":110,"context_line":"of the image data and pass the checksum and image properties to the"},{"line_number":111,"context_line":"signature_utils object, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_6fbaaa0c","line":109,"in_reply_to":"3a29b11f_b47a5576","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Project Priority"},{"line_number":120,"context_line":"----------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"None"},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_74c35d8b","line":120,"updated":"2015-10-23 18:45:26.000000000","message":"Note that this section is no longer part of the mitaka template for Nova.\n\nSee: https://github.com/openstack/nova-specs/commit/d123172f6d9bffe7e595b64670f91a33feb40ff2","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Project Priority"},{"line_number":120,"context_line":"----------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"None"},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_2f3b529e","line":120,"in_reply_to":"3a29b11f_74c35d8b","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":147,"context_line":"The next component will be to add functionality to the cryptography library"},{"line_number":148,"context_line":"which will validate a given certificate chain against a pool of given root"},{"line_number":149,"context_line":"certificates which are known to be trusted. This functionality will verify the"},{"line_number":150,"context_line":"signature of each certificate in the chain by retreiving the public key of the"},{"line_number":151,"context_line":"next certificate in the chain and performing a standard signature verification"},{"line_number":152,"context_line":"operation. The final certificate in the chain should be self-signed, so we"},{"line_number":153,"context_line":"verify it by retrieving it\u0027s public key and performing the same signature"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_74f83dc5","line":150,"updated":"2015-10-23 18:45:26.000000000","message":"\"retreiving\" should be replaced with \"retrieving\"","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":147,"context_line":"The next component will be to add functionality to the cryptography library"},{"line_number":148,"context_line":"which will validate a given certificate chain against a pool of given root"},{"line_number":149,"context_line":"certificates which are known to be trusted. This functionality will verify the"},{"line_number":150,"context_line":"signature of each certificate in the chain by retreiving the public key of the"},{"line_number":151,"context_line":"next certificate in the chain and performing a standard signature verification"},{"line_number":152,"context_line":"operation. The final certificate in the chain should be self-signed, so we"},{"line_number":153,"context_line":"verify it by retrieving it\u0027s public key and performing the same signature"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_8f4aa626","line":150,"in_reply_to":"3a29b11f_74f83dc5","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":210,"context_line":"Data model impact"},{"line_number":211,"context_line":"-----------------"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"The accompanying work in Glance introduces additional Glance image properties"},{"line_number":214,"context_line":"necessary for image signing. The initial implementation in Nova will introduce"},{"line_number":215,"context_line":"a single configuration flag indicating whether Nova should perform image"},{"line_number":216,"context_line":"signature verification before booting an image."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_94cab96d","line":213,"updated":"2015-10-23 18:45:26.000000000","message":"Should this say \"introduced\" instead of \"introduces\" since the change has already been merged into glance?","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":210,"context_line":"Data model impact"},{"line_number":211,"context_line":"-----------------"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"The accompanying work in Glance introduces additional Glance image properties"},{"line_number":214,"context_line":"necessary for image signing. The initial implementation in Nova will introduce"},{"line_number":215,"context_line":"a single configuration flag indicating whether Nova should perform image"},{"line_number":216,"context_line":"signature verification before booting an image."}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_0f5d36ec","line":213,"in_reply_to":"3a29b11f_94cab96d","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":246,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":247,"context_line":"from the image, and an error message will be logged. The user would then have"},{"line_number":248,"context_line":"to reinitiate an upload of the image to Glance with the correct signature"},{"line_number":249,"context_line":"metadata in order to boot the image."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Performance Impact"},{"line_number":252,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_b1b4a782","line":249,"updated":"2015-10-23 18:45:26.000000000","message":"Note that as it currently is implemented in glance, it is possible for a user to update the signature metadata for an existing image.  So a user could also choose to modify the signature metadata to be the correct signature metadata for the image that failed, rather than having to re-upload again.","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":246,"context_line":"If the verification of a signature fails, then Nova will not boot an instance"},{"line_number":247,"context_line":"from the image, and an error message will be logged. The user would then have"},{"line_number":248,"context_line":"to reinitiate an upload of the image to Glance with the correct signature"},{"line_number":249,"context_line":"metadata in order to boot the image."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Performance Impact"},{"line_number":252,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_af6e8294","line":249,"in_reply_to":"3a29b11f_b1b4a782","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"48e69ebc704cff5b4b2469f07759608d1ad1e0b2","unresolved":false,"context_lines":[{"line_number":351,"context_line":""},{"line_number":352,"context_line":"Cryptography API: https://pypi.python.org/pypi/cryptography/0.2.2"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"[1] https://review.openstack.org/#/c/177948/"},{"line_number":355,"context_line":"[2] https://en.wikipedia.org/wiki/MD5#Security"},{"line_number":356,"context_line":"[3] https://github.com/openstack/glance/blob/master/glance/common/signature_utils.py"},{"line_number":357,"context_line":"[4] https://tools.ietf.org/html/rfc5280#section-6.1"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_b45575fb","line":354,"updated":"2015-10-23 18:45:26.000000000","message":"Would it be better to link to the merged spec? (this spec includes a couple updates beyond the patch linked to here)\n\nhttps://github.com/openstack/glance-specs/blob/master/specs/liberty/image-signing-and-verification-support.rst\n\nIf referencing reviewer comments (as is done when mentioning pycrypto), it may be good to include a link to the patch as well.","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"69193b827b033186662b6c17ec119ae3e9cebc63","unresolved":false,"context_lines":[{"line_number":351,"context_line":""},{"line_number":352,"context_line":"Cryptography API: https://pypi.python.org/pypi/cryptography/0.2.2"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"[1] https://review.openstack.org/#/c/177948/"},{"line_number":355,"context_line":"[2] https://en.wikipedia.org/wiki/MD5#Security"},{"line_number":356,"context_line":"[3] https://github.com/openstack/glance/blob/master/glance/common/signature_utils.py"},{"line_number":357,"context_line":"[4] https://tools.ietf.org/html/rfc5280#section-6.1"}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a29b11f_8f94e644","line":354,"in_reply_to":"3a29b11f_b45575fb","updated":"2015-10-23 19:33:58.000000000","message":"Done","commit_id":"c056bce01f39c02ab327e565d875503d0f433c40"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":119,"context_line":"Proposed change"},{"line_number":120,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The first component in this change is the creation of a standalone object"},{"line_number":123,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":124,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":125,"context_line":"which, when passed a reference to the signing certificate, a checksum, a"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_a5e8b317","line":122,"updated":"2015-10-27 00:49:20.000000000","message":"I think we need to avoid using the word object here, as we use that for data model constructs in nova.objects. I\u0027m pretty sure what you\u0027re talking about here is adding a utility method to do the verification in nova.image.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":119,"context_line":"Proposed change"},{"line_number":120,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The first component in this change is the creation of a standalone object"},{"line_number":123,"context_line":"responsible for the bulk of the functionality necessary for image signature"},{"line_number":124,"context_line":"verification. This object will primarily consist of a public-facing method,"},{"line_number":125,"context_line":"which, when passed a reference to the signing certificate, a checksum, a"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_9c22e4b8","line":122,"in_reply_to":"3a29b11f_a5e8b317","updated":"2015-10-27 13:02:09.000000000","message":"Done","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"c5b9dc8dd60a1f1110907b01d81164860fe36b4b","unresolved":false,"context_lines":[{"line_number":145,"context_line":"signature of each certificate in the chain by retrieving the public key of the"},{"line_number":146,"context_line":"next certificate in the chain and performing a standard signature verification"},{"line_number":147,"context_line":"operation. The final certificate in the chain should be self-signed, so we"},{"line_number":148,"context_line":"verify it by retrieving it\u0027s public key and performing the same signature"},{"line_number":149,"context_line":"verification operation. Once the signatures of the certificate chain are"},{"line_number":150,"context_line":"validated, we will validate the chain against the trusted root certificates by"},{"line_number":151,"context_line":"checking that at least one of the root certificates shares an issuer with the"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_a51c6114","line":148,"updated":"2015-10-23 21:07:00.000000000","message":"typo: it\u0027s -\u003e its","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":145,"context_line":"signature of each certificate in the chain by retrieving the public key of the"},{"line_number":146,"context_line":"next certificate in the chain and performing a standard signature verification"},{"line_number":147,"context_line":"operation. The final certificate in the chain should be self-signed, so we"},{"line_number":148,"context_line":"verify it by retrieving it\u0027s public key and performing the same signature"},{"line_number":149,"context_line":"verification operation. Once the signatures of the certificate chain are"},{"line_number":150,"context_line":"validated, we will validate the chain against the trusted root certificates by"},{"line_number":151,"context_line":"checking that at least one of the root certificates shares an issuer with the"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_1c1d7473","line":148,"in_reply_to":"3a29b11f_a51c6114","updated":"2015-10-27 13:02:09.000000000","message":"Done","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":151,"context_line":"checking that at least one of the root certificates shares an issuer with the"},{"line_number":152,"context_line":"final certificate in the chain. This algorithm for validating chains of"},{"line_number":153,"context_line":"certificates against a set of trusted root certificates is a standard, and has"},{"line_number":154,"context_line":"been outlined in RFC 5280 [4]."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Once the certificate validation functionality has been added to the"},{"line_number":157,"context_line":"cryptography library, we will amend the object which performs signature"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_05e40739","line":154,"updated":"2015-10-27 00:49:20.000000000","message":"What is the crypto library you intend to use? Is it used by any existing OpenStack projects? Also, how are we doing key management here? Where are you fetching these keys from to verify them?","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":151,"context_line":"checking that at least one of the root certificates shares an issuer with the"},{"line_number":152,"context_line":"final certificate in the chain. This algorithm for validating chains of"},{"line_number":153,"context_line":"certificates against a set of trusted root certificates is a standard, and has"},{"line_number":154,"context_line":"been outlined in RFC 5280 [4]."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Once the certificate validation functionality has been added to the"},{"line_number":157,"context_line":"cryptography library, we will amend the object which performs signature"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_3f55c2c5","line":154,"in_reply_to":"3a29b11f_05e40739","updated":"2015-10-27 13:02:09.000000000","message":"The name of the cryptography library we are using is \"cryptography\", which is admittedly a bit confusing. Cryptography is used in the accompanying functionality in Glance, and is part of OpenStack\u0027s global requirements.\n\nThe signing certificate is fetched from the key manager via the Castellan interface. All intermediate certificates are fetched from the internet using information contained in the Authority Information Access extension of the previous certificate in the certificate chain. The signing keys are contained in these certificates.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":168,"context_line":"certificate\u0027s chain against the root of trust indicated by the service\u0027s root"},{"line_number":169,"context_line":"certificate\u0027s chain. If this validation succeeds, the object will proceed with"},{"line_number":170,"context_line":"the signature verification process. If not, this object will throw an"},{"line_number":171,"context_line":"exception and log an error."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"The certificate references will be used to access the certificates from a key"},{"line_number":174,"context_line":"manager through the interface provided by Castellan."}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_e5bd4b03","line":171,"updated":"2015-10-27 00:49:20.000000000","message":"I don\u0027t know how I feel about nova instance boots depending on key servers on the internet being up. On the one hand it makes sense from a security context, but I wonder if its a good idea from a reliability and deployment perspective.\n\nHas the glance team considered whether these keys should be stored somewhere else such as in glance?","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":168,"context_line":"certificate\u0027s chain against the root of trust indicated by the service\u0027s root"},{"line_number":169,"context_line":"certificate\u0027s chain. If this validation succeeds, the object will proceed with"},{"line_number":170,"context_line":"the signature verification process. If not, this object will throw an"},{"line_number":171,"context_line":"exception and log an error."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"The certificate references will be used to access the certificates from a key"},{"line_number":174,"context_line":"manager through the interface provided by Castellan."}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_7f201a4a","line":171,"in_reply_to":"3a29b11f_e5bd4b03","updated":"2015-10-27 13:02:09.000000000","message":"Glance is not configured to support key storage. Additionally, storing keys in Glance would defeat the purpose of this feature since it is meant to verify image integrity in a scenario where Glance cannot be trusted (see: Attack Model). The alternative to fetching a certificate chain at each boot is to fetch them once and store them in the key manager. This is not ideal, since this will quickly result in a massive amount of certificates being stored. Additionally, in order to ensure that these stored certificates are still valid, we would need to contact a CRL or OCSP endpoint via the internet anyway. So storing the certs doesn\u0027t really buy you any additional reliability; you\u0027ll still have to reach out in order to verify the trust chain.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":179,"context_line":"An alternative to using Cryptography for the hashing and signing functionality"},{"line_number":180,"context_line":"is to use PyCrypto. We are electing to use Cryptography based on both the"},{"line_number":181,"context_line":"shift away from PyCrypto in OpenStack\u0027s requirements and the recommendations"},{"line_number":182,"context_line":"of cryptographers reviewing the accompanying Glance spec [5]."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"An alternative to using certificates for signing and signature verification"},{"line_number":185,"context_line":"would be to use a public key. However, this approach presents the significant"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_6557fbca","line":182,"updated":"2015-10-27 00:49:20.000000000","message":"Ahhh, interesting. I didn\u0027t realize that \"cryptography\" is the name of the library. Can we please make that clearer in this document?","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":179,"context_line":"An alternative to using Cryptography for the hashing and signing functionality"},{"line_number":180,"context_line":"is to use PyCrypto. We are electing to use Cryptography based on both the"},{"line_number":181,"context_line":"shift away from PyCrypto in OpenStack\u0027s requirements and the recommendations"},{"line_number":182,"context_line":"of cryptographers reviewing the accompanying Glance spec [5]."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"An alternative to using certificates for signing and signature verification"},{"line_number":185,"context_line":"would be to use a public key. However, this approach presents the significant"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_1fa6c6c1","line":182,"in_reply_to":"3a29b11f_6557fbca","updated":"2015-10-27 13:02:09.000000000","message":"This library is also known as pyca/cryptography. I\u0027ll use that nomenclature to make it clear that I\u0027m referencing a specific library.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"47cd559b471468d09a1adeec4638936c206a2187","unresolved":false,"context_lines":[{"line_number":233,"context_line":"--------------------"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"This change will involve adding log messages to indicate the success or"},{"line_number":236,"context_line":"failure of verifying an image\u0027s signature."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"Other end user impact"},{"line_number":239,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a29b11f_a50433c6","line":236,"updated":"2015-10-27 00:49:20.000000000","message":"Sorry, this isn\u0027t what we mean here. This section is intended to cover messages we send to systems such as ceilometer to inform it of instance state etc. So, I think you can just say \"none\" here.","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"b1ca19159fbf5eb774d546a24f877662349b2691","unresolved":false,"context_lines":[{"line_number":233,"context_line":"--------------------"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"This change will involve adding log messages to indicate the success or"},{"line_number":236,"context_line":"failure of verifying an image\u0027s signature."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"Other end user impact"},{"line_number":239,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a26ad4f_dfafee92","line":236,"in_reply_to":"3a29b11f_a50433c6","updated":"2015-10-27 13:02:09.000000000","message":"Done","commit_id":"a6933de63d0b3eefc46b2d0372259ee7b00721ef"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* signature_hash_method - A string designating the hash method used for"},{"line_number":80,"context_line":"  signing. Currently, the supported values are \u0027SHA-224\u0027, \u0027SHA-256\u0027, \u0027SHA-384\u0027"},{"line_number":81,"context_line":"  and \u0027SHA-512\u0027."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* signature_key_type - A string designating the signature scheme used to"},{"line_number":84,"context_line":"  generate the signature. Currently, the only supported value is \u0027RSA-PSS\u0027."}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_ae909b96","line":81,"updated":"2015-11-03 22:42:43.000000000","message":"Is there a technical argument for supporting anything other than SHA-512?","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* signature_hash_method - A string designating the hash method used for"},{"line_number":80,"context_line":"  signing. Currently, the supported values are \u0027SHA-224\u0027, \u0027SHA-256\u0027, \u0027SHA-384\u0027"},{"line_number":81,"context_line":"  and \u0027SHA-512\u0027."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* signature_key_type - A string designating the signature scheme used to"},{"line_number":84,"context_line":"  generate the signature. Currently, the only supported value is \u0027RSA-PSS\u0027."}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_5983e2cc","line":81,"in_reply_to":"fa80f949_ae909b96","updated":"2015-11-04 14:49:02.000000000","message":"The code merged in Glance supports all these options, so for the sake of interoperability we need to support these SHA variants.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":90,"context_line":"specify:"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* mask_gen_algorithm - A string designating the mask generation algorithm for"},{"line_number":93,"context_line":"  RSA-PSS. Currently, the only supported value is \u0027MGF1\u0027."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":96,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_8ed59744","line":93,"updated":"2015-11-03 22:42:43.000000000","message":"This almost certainly shouldn\u0027t be configurable. On the off chance that anything goes wrong with MGF1 (this is _extremely_ unlikely), we should probably just have a different signature_key_type.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":90,"context_line":"specify:"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* mask_gen_algorithm - A string designating the mask generation algorithm for"},{"line_number":93,"context_line":"  RSA-PSS. Currently, the only supported value is \u0027MGF1\u0027."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":96,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_7949068b","line":93,"in_reply_to":"fa80f949_8ed59744","updated":"2015-11-04 14:49:02.000000000","message":"Again, we have to support this is in Nova for interoperability\u0027s sake. We could potentially abandon this metadata in Glance and then in Nova if it isn\u0027t necessary.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":96,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":97,"context_line":"  specified."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":100,"context_line":"utility to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_cebb9f0d","line":97,"updated":"2015-11-03 22:42:43.000000000","message":"Is there a technical argument for this being anything other than the maximum?","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":96,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":97,"context_line":"  specified."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":100,"context_line":"utility to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_dcaa6019","line":97,"in_reply_to":"fa80f949_cebb9f0d","updated":"2015-11-04 14:49:02.000000000","message":"See previous comments about interoperability.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":107,"context_line":"boot method. If the verify_glance_signatures flag in nova.conf is set to"},{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signature verification. Nova will compute"},{"line_number":110,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":111,"context_line":"to the signature_utils class, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_cec15f30","line":110,"updated":"2015-11-03 22:42:43.000000000","message":"I noticed this above somewhere too; it might be a good idea to clarify that this is just Nova\u0027s own checksum, which _right now_ happens to be MD5.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":107,"context_line":"boot method. If the verify_glance_signatures flag in nova.conf is set to"},{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signature verification. Nova will compute"},{"line_number":110,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":111,"context_line":"to the signature_utils class, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_7c3a5438","line":110,"in_reply_to":"fa80f949_cec15f30","updated":"2015-11-04 14:49:02.000000000","message":"It is actually not \"Nova\u0027s own checksum\" i.e. the checksum that is already computed as a part of an integrity check. Nova\u0027s glanceclient performs an integrity check when an image is downloaded to Nova for the first time, but the MD5 hash resulting from this computation is not stored nor is it accessible in Nova. Therefore, this change requires Nova to perform the checksum computation upon download. The rationale is explained in the comments on: https://review.openstack.org/#/c/189843/\n\n\"...we could trust that the Glance image property \u0027checksum\u0027 is an accurate checksum for the downloaded image data. We could then perform signature verification based on this checksum. This is perhaps more efficient but less secure, since an adversary could provide the checksum for the signed image in response to the show() call and provide a tainted image and the tainted image\u0027s checksum during the download() call.\"\n\nSo that\u0027s the explanation for why we are hashing the image data a second time. We are using MD5 in order to be interoperable with the code in Glance, which currently does not support configurable checksum algorithms. Once Glance supports configurable checksum algorithms, this will be described by an additional image property, and Nova/Glance will be able to use an actual hash algorithm (like a SHA variant) for this step of signature verification.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signature verification. Nova will compute"},{"line_number":110,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":111,"context_line":"to the signature_utils class, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_0e7a0725","line":111,"updated":"2015-11-03 22:42:43.000000000","message":"signature_utils doesn\u0027t sound like the name of a class. Module?","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":108,"context_line":"\u0027True\u0027, Nova will call out to Glance for the image\u0027s properties, which include"},{"line_number":109,"context_line":"the properties necessary for image signature verification. Nova will compute"},{"line_number":110,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":111,"context_line":"to the signature_utils class, which will verify the signature. If signature"},{"line_number":112,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_1c69c8be","line":111,"in_reply_to":"fa80f949_0e7a0725","updated":"2015-11-04 14:49:02.000000000","message":"I\u0027ll change this in the next iteration.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":115,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":116,"context_line":"information about the signing certificate."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_aedbbb1a","line":116,"updated":"2015-11-03 22:42:43.000000000","message":"Will we still be doing the part where the user specifies the trust root when creating a server in a different spec, right?","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":113,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":114,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":115,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":116,"context_line":"information about the signing certificate."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_7246fb24","line":116,"in_reply_to":"fa80f949_aedbbb1a","updated":"2015-11-04 14:49:02.000000000","message":"No. The user does not determine the trust root. The cloud providers specify a trusted CA, and the user submits a CSR to this CA and uses the resulting certificate to sign an image.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"25a17a188958abdbd45d6a4ea2f3157be07a7ce8","unresolved":false,"context_lines":[{"line_number":146,"context_line":"verify the signature of each certificate in the chain by retrieving the public"},{"line_number":147,"context_line":"key of the next certificate in the chain and performing a standard signature"},{"line_number":148,"context_line":"verification operation. The final certificate in the chain should be self-"},{"line_number":149,"context_line":"signed, so we verify it by retrieving its public key and performing the same"},{"line_number":150,"context_line":"signature verification operation. Once the signatures of the certificate chain"},{"line_number":151,"context_line":"are validated, we will validate the chain against the trusted root"},{"line_number":152,"context_line":"certificates by checking that at least one of the root certificates shares an"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_116b0a20","line":149,"updated":"2015-11-03 22:42:43.000000000","message":"It seems like certificate verification shouldn\u0027t rely on just anything that\u0027s self-signed, but these abilities should be encoded in the cert. For example, the root CAs you\u0027re using to view this website have CA\u003dTRUE. (That\u0027s not the greatest encoding scheme, but at least the cert explicitly says what makes it special.) ISTR RFC 5280 encodes all of that, though, so as long as it\u0027s specified that this is RFC 5280-compatible (and maybe that\u0027s all it should say); that\u0027s fine.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"352decd96f80cb3f980029b98d92b957183cd48e","unresolved":false,"context_lines":[{"line_number":146,"context_line":"verify the signature of each certificate in the chain by retrieving the public"},{"line_number":147,"context_line":"key of the next certificate in the chain and performing a standard signature"},{"line_number":148,"context_line":"verification operation. The final certificate in the chain should be self-"},{"line_number":149,"context_line":"signed, so we verify it by retrieving its public key and performing the same"},{"line_number":150,"context_line":"signature verification operation. Once the signatures of the certificate chain"},{"line_number":151,"context_line":"are validated, we will validate the chain against the trusted root"},{"line_number":152,"context_line":"certificates by checking that at least one of the root certificates shares an"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa80f949_124c4f41","line":149,"in_reply_to":"fa80f949_116b0a20","updated":"2015-11-04 14:49:02.000000000","message":"This is a simplified explanation of the process of certificate chain validation for the sake of explanation of the Nova community; I didn\u0027t want to get into the nitty gritty of x509 extensions and OIDs. I\u0027ll work on re-wording this so it\u0027s a little clearer.","commit_id":"7326fb153e322b863c04ed1e200ad492fb3aa0a0"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":36,"context_line":"* Man-in-the-Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_4fe0a9fa","line":39,"updated":"2015-11-18 12:11:08.000000000","message":"what about controlling both barbican and glance, where would that leave us? It could resign compromised images, and give us the changed certs, etc.\n\nOr is the idea we use the local machine certificate store?\n\nMaybe I am over thinking this.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":36,"context_line":"* Man-in-the-Middle Attack - An adversary with access to the network between"},{"line_number":37,"context_line":"  Nova and Glance is altering image data as Nova downloads the data from"},{"line_number":38,"context_line":"  Glance. The adversary is potentially incorporating malware into the image"},{"line_number":39,"context_line":"  and/or altering the image metadata."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"* Untrusted Glance - In a hybrid cloud deployment, Glance is hosted on"},{"line_number":42,"context_line":"  machines which are located in a physically insecure location or is hosted by"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_20252fc0","line":39,"in_reply_to":"ba8a016a_4fe0a9fa","updated":"2015-11-18 21:25:37.000000000","message":"Even if the attacker controls Barbican as well, it can\u0027t re-sign images without the private key corresponding to a cert issued by a trusted CA. The private key is never uploaded to OpenStack, so this scenario is unlikely.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f22d4cec8b124c629ea2feb3fa44e5192aaacb25","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  a company with limited security infrastructure. Adversaries may be able to"},{"line_number":44,"context_line":"  compromise the integrity of Glance and/or the integrity of images stored by"},{"line_number":45,"context_line":"  Glance through physical access to the host machines or through poor network"},{"line_number":46,"context_line":"  security on the part of the company hosting Glance."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Please note that our threat model considers only threats to the integrity of"},{"line_number":49,"context_line":"images while they are in transit between the end user and Glance, while they"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_725d3414","line":46,"updated":"2015-11-06 16:09:39.000000000","message":"The spec as described does not achieve this goal.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  a company with limited security infrastructure. Adversaries may be able to"},{"line_number":44,"context_line":"  compromise the integrity of Glance and/or the integrity of images stored by"},{"line_number":45,"context_line":"  Glance through physical access to the host machines or through poor network"},{"line_number":46,"context_line":"  security on the part of the company hosting Glance."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Please note that our threat model considers only threats to the integrity of"},{"line_number":49,"context_line":"images while they are in transit between the end user and Glance, while they"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_6fa32db3","line":46,"in_reply_to":"fa80f949_725d3414","updated":"2015-11-18 12:11:08.000000000","message":"Given your note below, +1","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1d0d95e10bc0510b81831d48c1e614625bb35c48","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  generate the signature. Currently, the only supported value is RSA-PSS."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* signature_certificate_uuid - A string encoding the certificate"},{"line_number":79,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Additionally, there are optional image signature metadata which the user can"},{"line_number":82,"context_line":"specify:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_2fc5738d","line":79,"updated":"2015-11-09 13:58:08.000000000","message":"Another more minor thing, is that since Liberty we have standardized on naming prefixes for all image metaadata properties. See the Nova ImageMetaProps object for example:\n\nhttps://review.openstack.org/gitweb?p\u003dopenstack/nova.git;a\u003dblob;f\u003dnova/objects/image_meta.py;h\u003db9aba9e88908c1c36686af8ea3a1c4b46593a5b4;hb\u003dHEAD#l166\n\nSo all these properties related to image signatures must have \u0027img_\u0027 as their name prefix.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  generate the signature. Currently, the only supported value is RSA-PSS."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* signature_certificate_uuid - A string encoding the certificate"},{"line_number":79,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Additionally, there are optional image signature metadata which the user can"},{"line_number":82,"context_line":"specify:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_7b23e8a7","line":79,"in_reply_to":"ba8a016a_95545eff","updated":"2015-11-18 21:25:37.000000000","message":"Correct. Glance devs and PTL have agreed to pursue the \"sign the image data\" approach, so changing the metadata properties to meet these requirements should not be an issue.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"87f928f7e21689d739120e3f5f189e6d6c6a008a","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  generate the signature. Currently, the only supported value is RSA-PSS."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* signature_certificate_uuid - A string encoding the certificate"},{"line_number":79,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Additionally, there are optional image signature metadata which the user can"},{"line_number":82,"context_line":"specify:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_95545eff","line":79,"in_reply_to":"ba8a016a_c046ae4e","updated":"2015-11-18 12:21:07.000000000","message":"Glance devs have agreed with the renaming change, given that fixing the security design requires a non-back compatible change already.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  generate the signature. Currently, the only supported value is RSA-PSS."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"* signature_certificate_uuid - A string encoding the certificate"},{"line_number":79,"context_line":"  uuid used to retrieve the certificate from the key manager."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Additionally, there are optional image signature metadata which the user can"},{"line_number":82,"context_line":"specify:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_c046ae4e","line":79,"in_reply_to":"da85f559_2fc5738d","updated":"2015-11-18 12:11:08.000000000","message":"although, these are glance define not nova defined, so I feel OK with having a signature_ prefix.\n\nBut you a right, based on the nova system, they would be img_","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1d0d95e10bc0510b81831d48c1e614625bb35c48","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":88,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":89,"context_line":"  specified."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":92,"context_line":"module to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_cf6387b0","line":89,"updated":"2015-11-09 13:58:08.000000000","message":"It seems these should have \u0027signature\u0027 as their name prefix in common with the others you show above, as well as the \u0027img_\u0027 prefix I mention.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":88,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":89,"context_line":"  specified."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":92,"context_line":"module to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_dbbc5408","line":89,"in_reply_to":"ba8a016a_6076e2a5","updated":"2015-11-18 21:25:37.000000000","message":"Again, this shouldn\u0027t be an issue. We may follow LVH\u0027s suggestion and just ditch these properties entirely, as there are well-established defaults for these and they only apply to RSA-PSS.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"bae2216f4b6eb9b8342e8dcd8f69472f9a5f46d9","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":88,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":89,"context_line":"  specified."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":92,"context_line":"module to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_90d98259","line":89,"in_reply_to":"ba8a016a_6b744c35","updated":"2015-11-19 15:35:44.000000000","message":"yeah, following the good defaults LVH is talking about is way better.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"179ebecc94f15891302c099e3af22da26334b08c","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":88,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":89,"context_line":"  specified."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":92,"context_line":"module to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_6b744c35","line":89,"in_reply_to":"ba8a016a_dbbc5408","updated":"2015-11-19 09:23:07.000000000","message":"That sounds like  a good idea - avoiding adding properties without a clear user demand is wise.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* pss_salt_length - A string representation of an int representing the salt"},{"line_number":88,"context_line":"  length for RSA-PSS. Defaults to the maximum salt length if it is not"},{"line_number":89,"context_line":"  specified."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"The image verification functionality in Glance then uses the signature_utils"},{"line_number":92,"context_line":"module to verify this signature metadata before storing the image. If the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_6076e2a5","line":89,"in_reply_to":"da85f559_cf6387b0","updated":"2015-11-18 12:11:08.000000000","message":"+1","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"5a4e3d7164f72ab7ad600d76d7997ac4bcc30b2b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":103,"context_line":"to the signature_utils module, which will verify the signature. If signature"},{"line_number":104,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_dc1a007d","line":105,"updated":"2015-11-18 18:14:29.000000000","message":"I feel like this config variable is just for transition period. Eventually when whole feature is implemented, we shouldn\u0027t need this variable, all image should be signature verified.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":102,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":103,"context_line":"to the signature_utils module, which will verify the signature. If signature"},{"line_number":104,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_60bca2dc","line":105,"updated":"2015-11-18 12:11:08.000000000","message":"This feels a little dodgy, changing the API behaviour with a config variable.\n\nWhat about using a flavor extra spec, such that the flavor says if it requires images to have a signature and have that verified?\n\nWhat we could have a config for, I feel, is preferring the signature, if present, over the checksum. So rather than using the checksum, use the signature to verify the image, regardless of the flavor. The downside is that man-in-the-middle can just remove the signature, hence the need for the flavor enforcing where you care about that. Maybe we just ignore this later bit.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":102,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":103,"context_line":"to the signature_utils module, which will verify the signature. If signature"},{"line_number":104,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_f204d618","line":105,"in_reply_to":"ba8a016a_60bca2dc","updated":"2015-11-18 21:25:37.000000000","message":"Don\u0027t config variables already change API behavior? For example, if you have ephemeral storage encryption enabled, you can expect to see a whole host of different failures when making a boot call if your key manager is incorrectly configured or inaccessible for some reason.\n\nI think we eventually will have to implement trusted flavors so that a cloud can allow both signed and unsigned images, and the end user can decide which one they prefer.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"bae2216f4b6eb9b8342e8dcd8f69472f9a5f46d9","unresolved":false,"context_lines":[{"line_number":102,"context_line":"the MD5 checksum of the image data and pass the checksum and image properties"},{"line_number":103,"context_line":"to the signature_utils module, which will verify the signature. If signature"},{"line_number":104,"context_line":"verification fails, or if the image signature metadata is either incomplete or"},{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_509b1a66","line":105,"in_reply_to":"ba8a016a_f204d618","updated":"2015-11-19 15:35:44.000000000","message":"Honestly, I see most of those cases as mistakes.\n\nAdding this in the flavor does seem to implement allowing both options within a cloud straight away, which is a handy side effect.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"01fe430c017ae3ae298f868b0e82f7b68e07a6b6","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_c1c77096","line":108,"updated":"2015-11-06 15:12:53.000000000","message":"So if I\u0027m reading this right, we\u0027re not actually performing a signature check against the image, but against the checksum of the image. So when Nova validates the image integrity it \n\n - Compute the MD5 checksum of the image\n - Check the signature against the MD5 checksum\n\nGiven that MD5 is considered to be a obsolete crypto algorithm, I think that this approach is really a bad idea. I realize there is a note later than we\u0027re going to make hash algorithm configurable in glance to allow stronger options, but I think that is still pretty awful.\n\nI think we should be computing  \u0026 verifying the signature against the image contents directly. Then when Nova sees a signature provided by glance it can ignore the MD5 checksum entirely and not bother computing it - it can just directly verify the signature against the image.  This makes the signature verification strong regardless of whether glance uses a \"strong\" checksum or not - indeed it makes the checksum unnecessary.\n\nRather than making it possible to glance to have configurable checksums, it would be better if glance had its own signing key, so if the user does not sign the image they upload, glance can sign it with its own key. That way, Nova would be able todo strong signature verification for *all* images. A Nova user would of course have to have a way to express what signing keys they trust. A default deployment would obviously trust the glance built-in signing key.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_9bf00c69","line":108,"in_reply_to":"ba8a016a_80a8a68e","updated":"2015-11-18 21:25:37.000000000","message":"Python-Glanceclient performs an integrity check on the image\u0027s MD5 checksum regardless of whether our feature is enabled. If we implement the \"sign the image data\" approach, Nova will ignore the checksum regardless of whether the feature is enabled or not.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0f87ae2b3d3f30e0284da6e95a4a89b6218ec5d1","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_869441e2","line":108,"in_reply_to":"da85f559_065931fe","updated":"2015-11-10 17:27:50.000000000","message":"If glance has already implemented this broken scheme, then it really needs to be fixed to use\n\n   RSA-PSS(SHA256(IMAGE-CONTENT))\n\nWhat it does already is broken by design, due to fact that MD5 is obsolete. I\u0027m not going to approve a spec for Nova that uses MD5, just because glance has already made  such a mistake.  I\u0027ve no intention of approving a feature which uses MD5 in a cryptographic solution regardless of whether glance has used it\n\nEven if glance made its checksum configurable, this is not a satisfactory solution, as realistically existing deployments are unlikely to switch from using MD5 to something else, due to their pre-existing data. They should not be prevented from enabling strong image signature verification just because they have existing MD5 based content hashes. \n\nIf we ignore the existing checksum support entirely, then there in fact ceases to be any reason at all to make the existing checksum configurable - the checksum is completely obsoleted by the signature feature.\n\nUsing 2 hashes adds no benefit from a cryptographic POV - in fact it has clear downside because it degrades the security of the solution to be that of the weakest hash algorithm used.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"e0aeaddc3648deaadc9d6cbfa6e8b09362b5de34","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_0be93a80","line":108,"in_reply_to":"da85f559_0848652c","updated":"2015-11-10 17:05:34.000000000","message":"One thing to note is that the signature must be over the glance checksum hash. The reason is that glance verifies the signature, and it does not want to compute two separate hashes. For example, they did not want Glance to use MD5 checksum and the image signing hash be something else.\n\nI think until Glance has a configurable checksum algorithm then this might be the best we can do unless we changed Glance, but I do not think that is an option. They did not want to compute two separate hashes. The only other option would be for Glance to not verify the signature for signed images, but I think they want that feature as well. Without it you would have a delay before you realized that an image signature was bad.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1c09ddef18d4a76e985becdcd1979721a7744a69","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_5c615238","line":108,"in_reply_to":"da85f559_0848652c","updated":"2015-11-10 15:56:14.000000000","message":"You are mis-reading what I suggest. Using the properties at line 68, consider we have \n\n  signature_hash_method\u003dsha256\n  signature_key_type\u003drsa-pss\n\nAnd glance is (hardcoded) to use MD5 as a checksum\n\nThis spec is proposing we compute the following\n\n  signature \u003d RSA-PSS(SHA256(MD5(IMAGE-CONTENT)))\n\nThis bakes use of the insecure MD5 algorithm into the image signing feature. This is awful because MD5 is a considered to be an obsolete algorithm that is typically *forbidden* from use in any crytographic scenario by many government\u0026 organizations.\n.\nI am saying we should completely ignore the current weak glance checksum and compute\n\n  signature \u003d RSA-PSS(SHA256(IMAGE-CONTENT))\n\nNote this does *not* apply the asymmetric encryption algorithm to 100\u0027s of MB of image content. Only the SHA256 algorithm (or whatever was listed in the signature_hash_method property) is applied to the large image content. The RSA-PASS encryption is only applied to the tiny SHA256 hash result.\n\nSo what I am proposing has no significant mpact on computational costs here.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"add53d385dc2b48c7636acfa004b311d38b48f36","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_e1f5f7ca","line":108,"in_reply_to":"da85f559_0be93a80","updated":"2015-11-10 17:30:58.000000000","message":"Daniel, thanks for clarifying. Sorry for the confusion. That was my mistake.\n\nI still think we are stuck with MD5 for the reasons Dane and I mentioned. I agree MD5 is not ideal, but I believe it to be the best alternative considering all of the requirements. Do you agree or have a proposed solution?","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0f87ae2b3d3f30e0284da6e95a4a89b6218ec5d1","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_c626c9cd","line":108,"in_reply_to":"da85f559_0be93a80","updated":"2015-11-10 17:27:50.000000000","message":"It will not be neccessary to compute two separate hashes to verify image integrity. If a signature is present for the image, then the existing checksum adds no value and can be completely ignored for verification purposes.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":11829,"name":"Laurens Van Houtven","email":"_@lvh.io","username":"lvh"},"change_message_id":"4826d20e2e645442faef20ce2f3c954dde743344","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_8969f1c0","line":108,"in_reply_to":"da85f559_35cf0681","updated":"2015-11-09 16:45:16.000000000","message":"Always happy to provide some cryptographic guidance:\n\n1. Yes, you almost always just sign a hash. The counterexample that comes to mind is where you instead encrypt a MAC key (usually together with an encryption key), which is useful for multi-receiver encryption; either way you\u0027re still operating on a fixed-size input.\n\n2. The cited paper is definitely outdated; in \u002796 we had an inkling, but not practical breaks. What we have now _are_ practical breaks. It\u0027s tricky to see how exploitable they are; it\u0027s likely that Glance images would permit extension; single-block attacks are plenty to produce a backdoored image. It\u0027s my understanding that we\u0027re already (separately from this effort) moving away from MD5 to a secure hash. A signature is much better than none at all, of course; but we probably shouldn\u0027t advertise it as a secure signature feature before we have a better hash function in place.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_80a8a68e","line":108,"in_reply_to":"da85f559_3a8f25ce","updated":"2015-11-18 12:11:08.000000000","message":"+1 for a direct signing of the image as danpb is suggesting here.\n\nI think we can be clear the checksum is just ignored if the signature is present, if configured.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"3b2427d27d36e4590889175493c16dd802dd6a8f","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_becfa454","line":108,"in_reply_to":"da85f559_4a0833da","updated":"2015-11-12 13:19:35.000000000","message":"It is impossible to avoid backends compatibility issues with the current solution. We fundamentally need to change the approach to not use MD5, at which point all tenant users need to change the way they generate signatures. \n\nAs described above the use of double-hashing has a number of bad effects\n\n- The user needs to know which hash glance happens to be using for its checksum. By signing the content directly, the user only needs to have a key, they do no need care about any aspect of glance code or configuration. This is very desirable IMHO\n\n- If you are signing the checksum, then the security of the signature is only as strong as the checksum. If the checksum uses SHA-256, then there ceases to be any point in using SHA-512 in the signature, as it doesn\u0027t buy any benefit, just a false sense of extra security. \n\n- If the glance administrator or developers ever wants to change the checksum in any way, this will invalidates all existing signatures. This is the problem we\u0027re already facing with the need to abandon use of MD5.\n\nI can see *no* compelling reasons to use RSA-PSS(SHA-512(SHA-256(IMAGE DATA))), and many downsides. This is just not a sensible approach. We should sign the content directly RSA-PSS(SHA-512(IMAGE DATA)) and avoid all these issues. It also removes any need to even make glance checksums configurable, as checksums over no benefit over verifying the signatures.\n\n\nWhat I suggest is not hard to accomplish in glance in an efficient manner, by pushing the checksum calculation out of the glance_store code.\n\nThe glance_store/_drivers/*.py classes need their \u0027add\u0027 method extended so that it accepts an optional callback. Then instead of (or as well as) calling checksum.update() when reading the data, they can invoke the provided  callback method passing the data chunk.\n\nThen in glance when glance.location. set_data calls add_to_backend, it can pass in a callback that feeds the data into the signature hash method directly.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56e68ee278aedcfc1d22f7cb899bbdd45fa886ea","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_065931fe","line":108,"in_reply_to":"da85f559_5c615238","updated":"2015-11-10 17:15:30.000000000","message":"Daniel is right about the minimal impact on computational costs of his approach. The two characterizations of our respective proposed methods above are correct, which means that the asymmetric key operations are applied to data the size of a SHA-256 digest in either case. However, I stand by the following approach:\n\n  signature \u003d RSA-PSS(SHA256(MD5(IMAGE-CONTENT)))\n\nOne reason I support this approach is that signing the hash is a standard practice (Note that signing refers to the composition of SHA-256 and RSA-PSS operations in the above equation). From a more practical standpoint, this approach is what has already been merged in Glance in Liberty, and one requirement of the feature in Nova is that it be interoperable with the accompanying functionality in Glance. The user should be able to sign an image once, upload it to Glance, have Glance verify the signature, and have Nova verify the same signature before booting. A change to this approach that would require a user to sign an image twice, in two different but easily conflated ways would be a huge detriment to the usability of both features.\n\nYes, having the MD5 hash in the mix is cryptographically weak. Once checksum configurability is added to Glance, however, our approach will be both far more usable than the alternative, as well as equivalently secure. Even with the weak MD5 checksum, our approach represents a security improvement from what exists currently. An adversary could bypass the current image integrity checks by replacing a valid image with a tainted image and simply rewriting the metadata to include the MD5 checksum of the tainted image. Our initial approach increases the difficulty of such an attack by requiring the attacker to generate a tainted image that has an MD5 collision with a valid one. This is certainly a non-trivial attack.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f9bb8ad9b02f865f1d8514a6d211ca9ef5559df6","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_ac1c0314","line":108,"in_reply_to":"da85f559_8969f1c0","updated":"2015-11-09 17:06:35.000000000","message":"I do understand that digital signatures effectively using a hash of the content in creating the signature- that in itself is fine.  What is proposed in this spec though is not that - it is using a hash of a hash of the content, where the latter hash is the obsolete MD5 hash. ie the spec proposes\n\n  SIGNATURE-DATA \u003d  SIGNATURE-HASH(GLANCE-CHECKSUM-HASH(CONTENT))\n\nI am saying we should ignore the existing glance checksum hash since it is known to be insecure and just do\n\n  SIGNATURE-DATA \u003d  SIGNATURE-HASH(CONTENT)\n\nSigning the hash of the content is not adding value - it is just making the overall solution weaker due to glance\u0027s use of MD5.\n\nHaving glance\u0027s hash be configurable is not an entirely satisfactory solution either. There are existing large deployments of openstack that will be unlikely to change the glance default hash due to their pre-existing data set.  They should not be prevented from using the strong crypto signatures as a result.\n\nIf apply the signature to the full content, and totally ignore glance\u0027s existing checksum, then we have a strong solution for image signing with no depedancy on enhancing glance to have customizable checksum hash, nor any dependency on the deployment being configured to use that better checksum.\n\nIn Nova when downloading an image from glance, it would preferentially verify the image signature. Only if the signature is not provided for an image would it fallback to checking the legacy glance image checksum. If we further then enhance glance to have its own signing key, glance can provide signatures on images where the user has not themselves provided one. That would then let nova rely on signature verification and stop using the checksums at all.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"bac811eb854cd581c25ab7905d26bdc3fbbd9eca","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_0848652c","line":108,"in_reply_to":"da85f559_ac1c0314","updated":"2015-11-10 15:37:31.000000000","message":"SIGNATURE-HASH(CONTENT) would invoke significant overhead as computing the signature would require asymmetric key operations on a huge piece of data. While it would result in the same effect it is much faster to do SIGNATURE(HASH(CONTENT)).\n\n\"Asymmetric encryption techniques are almost 1000 times slower than symmetric techniques, because they require more computational processing power.\" http://www.cse.wustl.edu/~jain/cse567-06/ftp/encryption_perf/\n\nDoing a SIGNATURE(HASH(CONTENT)) is the standard way to go.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"96a54103141a3185cbc5706964a552ba44aa5b28","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_3a8f25ce","line":108,"in_reply_to":"da85f559_becfa454","updated":"2015-11-12 20:40:39.000000000","message":"I brought these comments up to the glance community during the glance meeting today (http://eavesdrop.openstack.org/meetings/glance/2015/glance.2015-11-12-13.59.html) and it was requested to start a mailing list thread about this topic, which has been done (http://lists.openstack.org/pipermail/openstack-dev/2015-November/079348.html).","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"261d0fc3e7070689bf0f67ffc57397d0a0022032","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_4a0833da","line":108,"in_reply_to":"da85f559_ce1a447d","updated":"2015-11-12 13:02:25.000000000","message":"@Daniel Berrange: Assuming an implementation of hash algorithm configurability in Glance which avoids the backwards compatibility issues you raise here, would an implementation of this feature which signs a cryptographically strong hash be acceptable? For example, if the \"strong hash\" was SHA-256:\n\nsignature \u003d RSA-PSS(SHA-512(SHA-256(IMAGE DATA)))\n\nIf this is acceptable to you, we can fix the MD5 issue in Glance as well as create an initial, secure implementation in Nova which uses the same signature scheme as the Glance implementation.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"11efc6ccba509c8a67496589d56b0ca88115febf","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_ce1a447d","line":108,"in_reply_to":"da85f559_e1f5f7ca","updated":"2015-11-11 08:32:42.000000000","message":"MD5 has no place in any cryptographically secure solution.\n\nFrom the tenant user POV, there is no way it is possible to maintain backwards compatibility with the existing implemented solution in glance. Even if glance made its checksum configurable, that would be a backwards *incompatible* change, because the tenant users would have change how they generate their signatures. It would also require new APIs they would have to call in order to query glance to find out what checksum it was configured to use which adds extra burden on the clients wishing todo signatures. It also means the deployments could never change the checksum algorithm used on an existing site, because doing that would invalidate all existing image signatures.\n\nGiven that this the sensible way forward is to just do what I have suggested and completely ignore the existing glance checksum, whether MD5 or some configurable alternative. Simply perform the signature calculation against the content, using the key + hash defined by the signature properties. Since the image property names also need to be changed too have the correct \"img_\" prefix on their names this gives us easy way to detect the old broken signature method vs the new secure signature method. ie if the property \u0027signature\u0027 is found assume the old method, if the new \u0027img_signature\u0027 property is found assume the new method. Glance can support both methods for a release of two before dropping it. Nova can immediately implement the new secure method.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"0c2077494009d615f427a63f2564ba74457fa2d5","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_e89610ef","line":108,"in_reply_to":"fa80f949_05381dee","updated":"2015-11-06 18:17:28.000000000","message":"Ok, so as I mentioned earlier, it seems we\u0027d be better off just directly performing the signature check against the image content, and completely ignoring the checksum. \n\nThis produces a solution which is always secure and would not require the admin to know to configure a stronger checksum. It would in fact avoid any need to make checksums configurable at all - glance could simply use a self-signature instead of a checksum itself too.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"12b298b1ad69cb09620e568b6ec705cca09fa171","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_72b45434","line":108,"in_reply_to":"fa80f949_67e25431","updated":"2015-11-06 16:04:06.000000000","message":"Correction: The first paragraph in my response above is incorrect. The malicious user could pass signature verification with a tainted image if they succeed in colliding the MD5 checksum of the tainted image with that of a valid image and leaving the original cert_uuid and signature intact. My defense of this weakness in our approach is that we are aware of it and will fix it by adding checksum configurability in Glance.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f22d4cec8b124c629ea2feb3fa44e5192aaacb25","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_72fe94af","line":108,"in_reply_to":"fa80f949_67e25431","updated":"2015-11-06 16:09:39.000000000","message":"I\u0027m really not following your description here. In some places you talk about signature of the MD5 checksum, in other places you talk about signature of the image. How many signatures do we have ? Line 68 onwards describes the parameters provided when creating the image, which only mentions a single signature:\n\n   * signature - A string representation of the base 64 encoding of the signature of the image\u0027s MD5 checksum.\n\nIf we *only* have a signature of the MD5 checksum of the image contents, then this is vulnerable to MD5 collisions.\n\nIf we *also* have a signature of the image contents directly, then this is secure, at which point having a signature of the MD5 checksum appears to add no value.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"877d8149e88ed409848f8e21adb951d5a55faff8","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_05381dee","line":108,"in_reply_to":"fa80f949_72fe94af","updated":"2015-11-06 17:57:08.000000000","message":"The only signature used for image signature verification is the signed MD5 checksum. Once checksum configurability is added to Glance, deployers will be able to replace MD5 with a stronger algorithm, such as SHA-256.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"353a10734f47caf8b62eb63af350873df22ae14e","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_67e25431","line":108,"in_reply_to":"fa80f949_c1c77096","updated":"2015-11-06 15:49:12.000000000","message":"We are performing the signature check against the signed MD5 checksum of the image, we are not suggesting naively checking the MD5 checksum. This is an important distinction. Assume an adversary is able to collide the MD5 checksum of a tainted image with the MD5 checksum of an image with a valid signature. Without access to the private key which signed the valid image initially, the adversary is still unable to collide the signature of the tainted image with the verified image. Furthermore, this adversary will be unable to generate a signature on this tainted image which will pass certificate validation unless they also have access to a private key which corresponds to a certificate which has been signed by a trusted CA. Even though the choice of MD5 for generating the checksum is weak and needs to be updated as soon as the functionality is available in Glance, the feature we are suggesting does provide enhanced image integrity.\n\nProviding Glance with a signing key is a feature we will likely pursue in the future in order to support an untrusted user use case, but goes completely against the use case we are trying to support with this feature. If Glance has a signing key, then the issue you have pointed out below (malicious actor replacing a valid signed image with a tainted signed image) becomes feasible.  The malicious actor is untrusted and therefore has not been able to obtain a certificate signed by the CA, so they are unable to sign malicious images in a manner that will pass Nova\u0027s certificate validation. Instead, they would request that Glance sign the image with their valid signing key.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"0c0589bb34ed21065995f1869569e584f58f1f6f","unresolved":false,"context_lines":[{"line_number":105,"context_line":"absent, booting the instance will fail and Nova will log an exception. If"},{"line_number":106,"context_line":"signature verification succeeds, Nova will boot the instance and log a message"},{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":19,"id":"da85f559_35cf0681","line":108,"in_reply_to":"fa80f949_e89610ef","updated":"2015-11-09 14:37:05.000000000","message":"In practice, most digital signature algorithms sign a hash of the content (i.e., image) rather than the content itself [1, 2]. Signing the hash 1) improves efficiency, 2) avoids complexities related to splitting content that is longer than the RSA modulus, and 3) provides greater assurance to the integrity of the content because splitting the content admits the possibility of reordering it or dropping portions with similar modifications to the signature. So it would be unusual not to follow what appears to be standard practice by the cryptography community by signing / verifying against the image content rather than its hash.\n\nPlease correct me if I\u0027m wrong, but it seems like the *real* concern is the MD5 hash -- in particular, its collision resistance. I don\u0027t know if the information presented by Bellare and Rogaway [1] is considered outdated and obsolete at this point, but they do allow MD5 to be used in the same fashion as this specification (i.e., a hash function for the content to be signed). lvh\u0027s more crypto-specific comments on prior patch sets (e.g., see comments on patch set 8) have also not indicated that MD5 *must* be replaced with another hash algorithm, just that it\u0027s desirable to transition away from it.\n\n\nReferences\n\n[1] Mihir Bellare and Phillip Rogaway, \"The Exact Security of Digital Signatures -- How to Sign with RSA and Rabin,\" Eurocrypt \u002796. Online: http://web.cs.ucdavis.edu/~rogaway/papers/exact.pdf\n\n[2] Burt Kaliski, \"Raising the Standard for RSA Signatures: RSA-PSS,\" 2003. Online: http://www.emc.com/emc-plus/rsa-labs/historical/raising-standard-rsa-signatures-rsa-pss.htm","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"},{"line_number":112,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_60dfc20d","line":110,"updated":"2015-11-18 12:11:08.000000000","message":"We don\u0027t cover here how Nova creates snapshots and uploads those to Glance. Is that on purpose?\n\nI would expect a more common case would be to block glance upload for users, but be sure all your base images and snapshots are secured.\n\nWhat happens with snapshots, does Nova sign the image on upload? I guess Nova is pre-configured with a reference to barbican to get the cert to use? Maybe the user has the option of re-signing the image with their own cert at a later date, if they want to?","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"87f928f7e21689d739120e3f5f189e6d6c6a008a","unresolved":false,"context_lines":[{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"},{"line_number":112,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_7539baa3","line":110,"in_reply_to":"ba8a016a_60dfc20d","updated":"2015-11-18 12:21:07.000000000","message":"There are certainly cases where Nova will want to have its own signing key and sign images. IMHO, it is best to keep this spec focused merely on the signature verification feature though. Leave the other things to be dealt with in separate specs, as this one is already large enough.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"},{"line_number":112,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_db9d3467","line":110,"in_reply_to":"ba8a016a_7539baa3","updated":"2015-11-18 21:25:37.000000000","message":"Agreed. We have given thought to how this feature will work with snapshots (and are confident that the implementation discussed here will not preclude the possibility of signing snapshots), but that work is completely dependent upon updating Nova to use v2 of the Glance API, so it seems premature to discuss that in this spec.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"bae2216f4b6eb9b8342e8dcd8f69472f9a5f46d9","unresolved":false,"context_lines":[{"line_number":107,"context_line":"indicating that image signature verification succeeded along with detailed"},{"line_number":108,"context_line":"information about the signing certificate."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Proposed change"},{"line_number":112,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_309e9607","line":110,"in_reply_to":"ba8a016a_db9d3467","updated":"2015-11-19 15:35:44.000000000","message":"Nova already uses glance v2 for a few releases, when required, such as getting image locations. This seems very similar to that (see include_locations in nova/image/glance.py)\n\nBut keeping the scope small seems like a good idea.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":125,"context_line":"in Glance [3]. We then propose an initial implementation by incorporating this"},{"line_number":126,"context_line":"module into Nova\u0027s control flow for booting instances from images. Upon"},{"line_number":127,"context_line":"downloading an image, Nova will check whether the verify_glance_signatures"},{"line_number":128,"context_line":"configuration flag is set in nova.conf. If so, the module will perform image"},{"line_number":129,"context_line":"signature verification using image properties passed to Nova by Glance. If"},{"line_number":130,"context_line":"this fails, or if the image signature metadata is incomplete or missing, Nova"},{"line_number":131,"context_line":"will not boot the image. Instead, Nova will throw an exception and log an"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_0077d6d3","line":128,"updated":"2015-11-18 12:11:08.000000000","message":"I don\u0027t like configuration changing the API behaviour, see above about the flavor extra spec.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":150,"context_line":"certificate chain for the signing certificate, fetch the root certificates"},{"line_number":151,"context_line":"through Castellan, and will verify this chain against the trusted root"},{"line_number":152,"context_line":"certificates using the functionality in the pyca/cryptography library. If the"},{"line_number":153,"context_line":"chain fails validation, then an exception will be thrown and signature"},{"line_number":154,"context_line":"verification will fail. Nova will retrieve the root certificate references"},{"line_number":155,"context_line":"necessary to call the updated functionality of the signature_utils module by"},{"line_number":156,"context_line":"reading the references in from a root_certificate_references configuration"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_a02daaa9","line":153,"updated":"2015-11-18 12:11:08.000000000","message":"It feels like this should live inside python-glanceclient so any user can download and then validate an image? But lets leave that for now, its not that important in the spec.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"01fe430c017ae3ae298f868b0e82f7b68e07a6b6","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_e19b9464","line":220,"updated":"2015-11-06 15:12:53.000000000","message":"This change proposed does not actually achieve this level of assurance referred to here. It only protects against attacks on the communication channel between Nova and Glance.  It does not protect against an adversary with access to Glance.\n\nie consider two users with authorized access to glance Fred and Bob\n\n- Fred uploads image XXX  with signature AAA\n- Bob uploads image YYY with signature BBB\n- Fred tells Nova to boot image XXX\n- Glance gives Nova back image YYY and signature BBB\n- Nova verifies signature BBB against image YYY and succeeds.\n\nAs a result Fred is *not* running the image which they originally uploaded - they are instead running an image from Bob.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"160c801a70edac6350c17f3b351bed63c9822afb","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_b21ace7b","line":220,"in_reply_to":"ba8a016a_75bc5adc","updated":"2015-11-18 21:25:37.000000000","message":"As Castellan currently works, access to objects is limited to the user that uploaded them. This means that, for the short term, end users will only be able to boot images which they have signed. Once the access control lists change, we could potentially pursue an API change to allow the user to specify the cert_uuid, or perhaps the signature, at boot time. We\u0027ll probably have to pursue an API change anyway to provide the user with the ownership info of the image\u0027s signing certificate and the base64 encoding of the signature when the image boots successfully with image signature verification.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"87f928f7e21689d739120e3f5f189e6d6c6a008a","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_75bc5adc","line":220,"in_reply_to":"ba8a016a_a0e36aa3","updated":"2015-11-18 12:21:07.000000000","message":"Passing the cert to Nova a  boot time is certainly an option, but it would be rather tedious. Ultimately I think we need to have an explicit association between   users \u003c-\u003e trusted certificates, and/or   projects \u003c-\u003e trusted certificates.  Whether that\u0027s something Nova should maintain, or if we can outsource it to Barbican or Keystone, I don\u0027t know / care, as long as we have some such association. Without it, we have little protection against compromised glance server lieing to us by providing a different image+signature from the one we requested.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"bae2216f4b6eb9b8342e8dcd8f69472f9a5f46d9","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_1394bc40","line":220,"in_reply_to":"ba8a016a_b21ace7b","updated":"2015-11-19 15:35:44.000000000","message":"I was thinking passing the cert was just an extra thing, if you are ultra worried.\n\nThe user mapping makes some sense. I was expecting the public bit of the cert being available to everyone? Otherwise this get very messy with shared images, and base images, etc?","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"877d8149e88ed409848f8e21adb951d5a55faff8","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_c859cc36","line":220,"in_reply_to":"fa80f949_87b2d892","updated":"2015-11-06 17:57:08.000000000","message":"The next iteration will reflect this limitation.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f22d4cec8b124c629ea2feb3fa44e5192aaacb25","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_87b2d892","line":220,"in_reply_to":"fa80f949_a4535a6a","updated":"2015-11-06 16:09:39.000000000","message":"You\u0027re missing the point of what I was saying. In my example Bob is not the bad guy - Bob is another approved user of glance, who can upload images as they so desire and has approved access to a signing key. \n\nNow a bad guy, Frank, attacks glance, identifies an existing uploaded image that happens to have some feature they wish to take advantage. eg Frank notices that Bob has uploaded an outdated copy of Fedora with some remotely exploitable security flaw. The bad guy, Frank, changes glance so that whenever Fred requests an image, Fred is instead given the other insecure image that Bob originally uploaded.\n\nThe bad guy doesn\u0027t need to sign images, nor do they need to modify images. They can still cause Fred to execute an image that is *not* the one Fred uploaded / wants.\n\nThus, the security claim here that this provides assurance that Fred is running the image they uploaded is not satisfied.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3d8a6bdd38e62b7d0e0815edb1f0efb46c301559","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba8a016a_a0e36aa3","line":220,"in_reply_to":"fa80f949_c859cc36","updated":"2015-11-18 12:11:08.000000000","message":"To Daniel\u0027s point here, could we not have the user provide the certificate as an glance image override, using this API:\nhttps://review.openstack.org/#/c/230382\n\nThat would let the user specific the exact cert they are expecting to be used, I think. This assumes they re-upload or resign the images they care about, so its validated using a cert where they believe only they have the private key. It certainly feels more protected, I could be missing something.\n\nPS, I am suggesting this as an optional future extra really, to try and reduce certain limitations of the general approach.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"353a10734f47caf8b62eb63af350873df22ae14e","unresolved":false,"context_lines":[{"line_number":217,"context_line":"the communication network between Nova and Glance. This feature facilitates"},{"line_number":218,"context_line":"the creation of a logical trust boundary between Nova and Glance; this trust"},{"line_number":219,"context_line":"boundary permits the end user to have high assurance that Nova is booting the"},{"line_number":220,"context_line":"image which they originally uploaded."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"Although Nova will use certificates to perform this task, the certificates"},{"line_number":223,"context_line":"will be stored by a key manager and accessed via Castellan."}],"source_content_type":"text/x-rst","patch_set":19,"id":"fa80f949_a4535a6a","line":220,"in_reply_to":"fa80f949_e19b9464","updated":"2015-11-06 15:49:12.000000000","message":"I disagree. Bob uploading image YYY with signature BBB requires Bob to have a private key corresponding to a certificate which has been signed by a trusted CA. An untrusted adversary with access to Glance will not have such a private key/certificate and any image signed by them will not pass certificate validation and therefore will not be booted by Nova.","commit_id":"b9ba3a526e6002befeb84df73ff61699476bc958"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ad5dd8af11b762b5413ec903522562bb9b643209","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  signing. Currently, the supported values are  SHA-224, SHA-256, SHA-384 and"},{"line_number":73,"context_line":"  SHA-512. MD5 and other cryptographically weak hash methods will not be"},{"line_number":74,"context_line":"  supported for this field. Any image signed with an unsupported hash"},{"line_number":75,"context_line":"  algorithm will not pass validation."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* img_signature_key_type - A string designating the signature scheme used to"},{"line_number":78,"context_line":"  generate the signature."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7a740942_e2032e75","line":75,"updated":"2015-12-03 15:55:39.000000000","message":"Nit: I wonder if we just have a sensible default for that, like SHA-256 I guess?","commit_id":"208c6fecef39421739db350b6a7b83a25438d885"}]}