)]}'
{"specs/mitaka/approved/ssh-host-certificates.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f933cab17f9d391d8df3a6f707a3a59164003632","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Another way to obtain a trusted host key is to request signing inside of"},{"line_number":75,"context_line":"cloudinit itself, however this again requires trusting a newly created instance"},{"line_number":76,"context_line":"and potentially making the metadata service an RPC endpoint rather than"},{"line_number":77,"context_line":"readonly service."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Instead of creating a new set of routes, keys could be stored along existing"},{"line_number":80,"context_line":"SSH keypairs. This is a bad idea in case user confuses the meaning of keypairs."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba8a016a_e64c4d78","line":77,"updated":"2015-11-23 16:18:25.000000000","message":"we use the metadata service to receive encrypted passwords already, so thats acceptable, if we really really need it.\n\nWhile its less secure, we could use cloud-init and config drive to inject a host key thats generated on boot?\n\nIf thats a problem, you could use the initial key for the first connection, and generate a new key, to avoid the leak from the metadata service being an issue? Or you configure cloud-init to reset the key and send it back via the metadata service?\n\nHmm, thats messy though.","commit_id":"0e89f6ce9fa48f4bc1750f64bd94b2daa129bec9"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"dfbc5d9a23b0db6c6284829b9a9029ac6bae0e04","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Another way to obtain a trusted host key is to request signing inside of"},{"line_number":75,"context_line":"cloudinit itself, however this again requires trusting a newly created instance"},{"line_number":76,"context_line":"and potentially making the metadata service an RPC endpoint rather than"},{"line_number":77,"context_line":"readonly service."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Instead of creating a new set of routes, keys could be stored along existing"},{"line_number":80,"context_line":"SSH keypairs. This is a bad idea in case user confuses the meaning of keypairs."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba8a016a_335d9979","line":77,"in_reply_to":"ba8a016a_e64c4d78","updated":"2015-11-24 04:28:15.000000000","message":"I\u0027m planning to update the spec this week. The new instance secure data/user spec should solve the problem. It will have to be implemented first of course...","commit_id":"0e89f6ce9fa48f4bc1750f64bd94b2daa129bec9"}]}