)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bf79e24e223e4879b55725f2979ef05df18e56cf","unresolved":false,"context_lines":[{"line_number":12,"context_line":"signature verification prior to boot."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I764b2a07a974119762c782203960c8d8f250dbef"},{"line_number":15,"context_line":"Blueprint: nova-support-image-signing"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1aa78d24_bdcf3e56","line":15,"updated":"2016-07-14 13:40:45.000000000","message":"This blueprint was marked completed in mitaka. If there is still work to do, it has to happen in ocata at this point under a new blueprint.","commit_id":"b359e6cdf2f17575639abc6f3060033df8fa56f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3010ebdf2acad7ddca3ba3d10707b5adbfa27b2f","unresolved":false,"context_lines":[{"line_number":12,"context_line":"signature verification prior to boot."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I764b2a07a974119762c782203960c8d8f250dbef"},{"line_number":15,"context_line":"Blueprint: nova-support-image-signing"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"fa6399be_c1aa3fd4","line":15,"updated":"2016-10-11 22:04:36.000000000","message":"There is already a spec for this blueprint here:\n\nhttps://review.openstack.org/#/c/343654/\n\nSo are both specs for the same blueprint? Or is trusted flavors for something else?","commit_id":"9682a51b60cb16dc99756493d8fd1fab6ff90b72"}],"specs/newton/approved/trusted-flavors.rst":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"74383244207562e8ebbefe97c121d227aacfaca5","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Documentation Impact"},{"line_number":205,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"The existing image signature verification instruction in the operations guide"},{"line_number":208,"context_line":"will be amended to include detailed trusted flavors instructions for both"},{"line_number":209,"context_line":"administrators and end users."},{"line_number":210,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7aa08908_7e59ab8d","line":207,"range":{"start_line":207,"start_character":42,"end_line":207,"end_character":53},"updated":"2016-06-08 16:11:43.000000000","message":"nit: instructions","commit_id":"b359e6cdf2f17575639abc6f3060033df8fa56f8"}],"specs/ocata/approved/trusted-flavors.rst":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"8f82b323667d89c3e26b52f105427b7356ac6d0e","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Documentation Impact"},{"line_number":205,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"The existing image signature verification instruction in the operations guide"},{"line_number":208,"context_line":"will be amended to include detailed trusted flavors instructions for both"},{"line_number":209,"context_line":"administrators and end users."},{"line_number":210,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bacf61ea_f2666eb9","line":207,"range":{"start_line":207,"start_character":42,"end_line":207,"end_character":53},"updated":"2016-08-01 15:31:07.000000000","message":"nit: instructions","commit_id":"9682a51b60cb16dc99756493d8fd1fab6ff90b72"}],"specs/pike/approved/api-option-signatures.rst":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"use signed images exclusively will still the have option to do so. In"},{"line_number":67,"context_line":"deployments where the \"verify_glance_signatures\" option is enabled, all"},{"line_number":68,"context_line":"instances will undergo signature verification regardless of API options."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Alternatives"},{"line_number":71,"context_line":"------------"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_5777a0a1","line":69,"updated":"2017-10-12 15:28:07.000000000","message":"I\u0027d think this flag would also have to be stored in the RequestSpec so that when moving the instance via cold migration, live migration, evacuate or shelve offload/unshelve the image would be verified on the new host - or does it not work that way?","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":71,"context_line":"------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"An alternative to altering the Nova API is to package the"},{"line_number":74,"context_line":"\"verify_glance_signatures\" flag within the flavor extra spec. This approach is"},{"line_number":75,"context_line":"described in previous versions of this spec. While this approach may be"},{"line_number":76,"context_line":"simpler from an implementation standpoint, it has several drawbacks from a"},{"line_number":77,"context_line":"deployment perspective. Most notably, the trusted flavors approach would"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_7403ba10","line":74,"range":{"start_line":74,"start_character":27,"end_line":74,"end_character":61},"updated":"2017-10-12 15:28:07.000000000","message":"I wasn\u0027t going to suggest flavor extra specs, but what about image metadata? Could be the same proliferation issue though, but at least it\u0027s something that can be controlled by the user.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":87,"context_line":"REST API impact"},{"line_number":88,"context_line":"---------------"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"This changes defines a new boolean option, called \"verify_glance_signatures\""},{"line_number":91,"context_line":"in the POST request for the Compute API\u0027s servers/ resource. Below is an"},{"line_number":92,"context_line":"example POST request containing the \"verify_glance_signatures\" flag."},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_b70ed42f","line":90,"range":{"start_line":90,"start_character":58,"end_line":90,"end_character":64},"updated":"2017-10-12 15:28:07.000000000","message":"s/glance/image/ ?\n\nThe user knows about the image service, not that it\u0027s codename is glance.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":105,"context_line":"                }"},{"line_number":106,"context_line":"            ]"},{"line_number":107,"context_line":"        }"},{"line_number":108,"context_line":"        \"verify_glance_signatures\": \"True\""},{"line_number":109,"context_line":"    }"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_f70c4c3c","line":108,"updated":"2017-10-12 15:28:07.000000000","message":"Why would it not be part of the server body?","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Notifications impact"},{"line_number":117,"context_line":"--------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Other end user impact"},{"line_number":122,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_b737f4e3","line":119,"updated":"2017-10-12 15:28:07.000000000","message":"I\u0027d think we\u0027d add this new flag to the server create versioned notifications.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":122,"context_line":"---------------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"If the verification of a signature fails, then Nova does not boot an instance"},{"line_number":125,"context_line":"from the image, and an error message is logged. The user then has to edit the"},{"line_number":126,"context_line":"image’s metadata through the Glance API, the Nova API, or the Horizon"},{"line_number":127,"context_line":"interface; or reinitiate an upload of the image to Glance with the correct"},{"line_number":128,"context_line":"signature metadata in order to boot the image."}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_775f3c0e","line":125,"range":{"start_line":125,"start_character":16,"end_line":125,"end_character":46},"updated":"2017-10-12 15:28:07.000000000","message":"and presumably an instance fault is recorded so the user/admin knows why the instance failed to boot","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"If the verification of a signature fails, then Nova does not boot an instance"},{"line_number":125,"context_line":"from the image, and an error message is logged. The user then has to edit the"},{"line_number":126,"context_line":"image’s metadata through the Glance API, the Nova API, or the Horizon"},{"line_number":127,"context_line":"interface; or reinitiate an upload of the image to Glance with the correct"},{"line_number":128,"context_line":"signature metadata in order to boot the image."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_77b4dc35","line":126,"range":{"start_line":126,"start_character":8,"end_line":126,"end_character":16},"updated":"2017-10-12 15:28:07.000000000","message":"What specific metadata? a signature? if you\u0027re adding image metadata for signature verification, then why not also set the flag for validating that signature within the image too rather than make it a flag on the POST /servers request - as noted above?","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"If the verification of a signature fails, then Nova does not boot an instance"},{"line_number":125,"context_line":"from the image, and an error message is logged. The user then has to edit the"},{"line_number":126,"context_line":"image’s metadata through the Glance API, the Nova API, or the Horizon"},{"line_number":127,"context_line":"interface; or reinitiate an upload of the image to Glance with the correct"},{"line_number":128,"context_line":"signature metadata in order to boot the image."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_f781ec4b","line":126,"range":{"start_line":126,"start_character":41,"end_line":126,"end_character":53},"updated":"2017-10-12 15:28:07.000000000","message":"the compute api no longer proxies image metadata updates to glance after a certain microversion, so we don\u0027t want to mention that as an option","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":134,"context_line":"verification is only performed if the deployment is configured to support it"},{"line_number":135,"context_line":"and the user requests it."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"When signature verification occurs, there is latency as a result of retrieving"},{"line_number":138,"context_line":"certificates from the key manager through the Castellan interface. There is"},{"line_number":139,"context_line":"also CPU overhead associated with hashing the image data and decrypting a"},{"line_number":140,"context_line":"signature using a public key."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Other deployer impact"},{"line_number":143,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_778dfc79","line":140,"range":{"start_line":137,"start_character":0,"end_line":140,"end_character":29},"updated":"2017-10-12 15:28:07.000000000","message":"Does this happen in the compute service or in the API service? If it happens in the compute service, then yes you\u0027ll need to store this flag in the RequestSpec so it\u0027s re-verified per host when you move the instance.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":159,"context_line":"Primary assignee:"},{"line_number":160,"context_line":"  dane-fichter"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Reviewers"},{"line_number":163,"context_line":"---------"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Core reviewer(s):"},{"line_number":166,"context_line":"  Not Yet Identified"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Work Items"},{"line_number":169,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_b7d8147f","line":166,"range":{"start_line":162,"start_character":0,"end_line":166,"end_character":20},"updated":"2017-10-12 15:28:07.000000000","message":"This isn\u0027t a thing, so remove this from the template.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[{"line_number":189,"context_line":"Testing"},{"line_number":190,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"We will need to implement both unit and Tempest tests to test this"},{"line_number":193,"context_line":"functionality."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5f4e5783_d7c6f09a","line":192,"range":{"start_line":192,"start_character":40,"end_line":192,"end_character":53},"updated":"2017-10-12 15:28:07.000000000","message":"presumably these tests would go in the barbican tempest plugin yes?","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3693ed4674c717b07f5008698f356776ae9441b1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"5f4e5783_b7c13483","line":209,"updated":"2017-10-12 15:28:07.000000000","message":"Add the History section.","commit_id":"d57d21d27072420a7bd1d0184f647a44655d5d6d"}],"specs/pike/approved/trusted-flavors.rst":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"e4d9972227df1e53137d7f6eab7888242164d48e","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Trusted Flavors"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"As of Mitaka, Nova is capable of verifying digital signatures associated with"},{"line_number":14,"context_line":"Glance images. For more information on this work, view the original spec at:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_00db0050","line":11,"updated":"2017-03-21 19:18:35.000000000","message":"This should be updated to https://blueprints.launchpad.net/nova/+spec/nova-trusted-flavors","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"114c5338995ba9b5733697a383a4cd4fa2179bb9","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Please note that this change is not intended to replace the existing"},{"line_number":81,"context_line":"\"verify_glance_signatures\" configuration flag. Deployments which choose to"},{"line_number":82,"context_line":"use signed images exclusively will still the have option to do so."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Alternatives"},{"line_number":85,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_18c65048","line":82,"updated":"2017-03-20 17:15:53.000000000","message":"Just to be clear, if you have verify_glance_signatures\u003dTrue and you have a flavor marked as verify_glance_signatures\u003dFalse, what happens?","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56948772d7d118959697f379f83ec7b02934a792","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Please note that this change is not intended to replace the existing"},{"line_number":81,"context_line":"\"verify_glance_signatures\" configuration flag. Deployments which choose to"},{"line_number":82,"context_line":"use signed images exclusively will still the have option to do so."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Alternatives"},{"line_number":85,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_c742103e","line":82,"in_reply_to":"1a1ced50_18c65048","updated":"2017-03-20 21:10:01.000000000","message":"The value of the config option would override the flavor.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"99a91e21d9e6f690b3d54f3717a05a380b95ceb1","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Please note that this change is not intended to replace the existing"},{"line_number":81,"context_line":"\"verify_glance_signatures\" configuration flag. Deployments which choose to"},{"line_number":82,"context_line":"use signed images exclusively will still the have option to do so."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Alternatives"},{"line_number":85,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_903915f5","line":82,"in_reply_to":"1a1ced50_c742103e","updated":"2017-03-21 14:39:39.000000000","message":"Yeah, that sounds safest, we should add that in here. I may have just missed that!","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"114c5338995ba9b5733697a383a4cd4fa2179bb9","unresolved":false,"context_lines":[{"line_number":91,"context_line":"occur. This seems to be an unnecessary API change, as trusted flavors do"},{"line_number":92,"context_line":"provide some benefits over an API change. As indicated above, trusted flavors"},{"line_number":93,"context_line":"will allow administrators to bundle several security features in a single"},{"line_number":94,"context_line":"flavor."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Data model impact"},{"line_number":97,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_582c4802","line":94,"updated":"2017-03-20 17:15:53.000000000","message":"Hmm, it feels like the API change is more about which certs you trust, and that is important for different reasons.\n\nI am thinking about this one:\nhttps://review.openstack.org/#/c/441538","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56948772d7d118959697f379f83ec7b02934a792","unresolved":false,"context_lines":[{"line_number":91,"context_line":"occur. This seems to be an unnecessary API change, as trusted flavors do"},{"line_number":92,"context_line":"provide some benefits over an API change. As indicated above, trusted flavors"},{"line_number":93,"context_line":"will allow administrators to bundle several security features in a single"},{"line_number":94,"context_line":"flavor."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Data model impact"},{"line_number":97,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_a7a994e1","line":94,"in_reply_to":"1a1ced50_582c4802","updated":"2017-03-20 21:10:01.000000000","message":"Here \"API change\" refers to more overtly changing the API to allow end users to request signature verification.\n\nThe cert validation spec details a completely distinct API change.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"99a91e21d9e6f690b3d54f3717a05a380b95ceb1","unresolved":false,"context_lines":[{"line_number":91,"context_line":"occur. This seems to be an unnecessary API change, as trusted flavors do"},{"line_number":92,"context_line":"provide some benefits over an API change. As indicated above, trusted flavors"},{"line_number":93,"context_line":"will allow administrators to bundle several security features in a single"},{"line_number":94,"context_line":"flavor."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Data model impact"},{"line_number":97,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_302b0196","line":94,"in_reply_to":"1a1ced50_a7a994e1","updated":"2017-03-21 14:39:39.000000000","message":"True, I guess I lump both of those things together in my head.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"114c5338995ba9b5733697a383a4cd4fa2179bb9","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"* We will amend the flavor creation code to reject flavors which set the"},{"line_number":171,"context_line":"  \"verify_glance_signatures\" flavor extra spec to True when the libvirt driver"},{"line_number":172,"context_line":"  is not in use."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"* We will amend the _populate_instance_for_create method to check the flavor"},{"line_number":175,"context_line":"  information for the \"verify_glance_signatures\" flavor extra spec."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_b8137c0c","line":172,"updated":"2017-03-20 17:15:53.000000000","message":"Thats not really practical to implement. I think instead you should use virt driver capabilities to reject a build to a compute worker that doesn\u0027t support that capability.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56948772d7d118959697f379f83ec7b02934a792","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"* We will amend the flavor creation code to reject flavors which set the"},{"line_number":171,"context_line":"  \"verify_glance_signatures\" flavor extra spec to True when the libvirt driver"},{"line_number":172,"context_line":"  is not in use."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"* We will amend the _populate_instance_for_create method to check the flavor"},{"line_number":175,"context_line":"  information for the \"verify_glance_signatures\" flavor extra spec."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_4789c025","line":172,"in_reply_to":"1a1ced50_b8137c0c","updated":"2017-03-20 21:10:01.000000000","message":"Agreed. That seems preferable.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"114c5338995ba9b5733697a383a4cd4fa2179bb9","unresolved":false,"context_lines":[{"line_number":171,"context_line":"  \"verify_glance_signatures\" flavor extra spec to True when the libvirt driver"},{"line_number":172,"context_line":"  is not in use."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"* We will amend the _populate_instance_for_create method to check the flavor"},{"line_number":175,"context_line":"  information for the \"verify_glance_signatures\" flavor extra spec."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_181c9011","line":178,"range":{"start_line":174,"start_character":0,"end_line":178,"end_character":53},"updated":"2017-03-20 17:15:53.000000000","message":"Why? The flavor is already stored in the instance?","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56948772d7d118959697f379f83ec7b02934a792","unresolved":false,"context_lines":[{"line_number":171,"context_line":"  \"verify_glance_signatures\" flavor extra spec to True when the libvirt driver"},{"line_number":172,"context_line":"  is not in use."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"* We will amend the _populate_instance_for_create method to check the flavor"},{"line_number":175,"context_line":"  information for the \"verify_glance_signatures\" flavor extra spec."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_a780b447","line":178,"range":{"start_line":174,"start_character":0,"end_line":178,"end_character":53},"in_reply_to":"1a1ced50_181c9011","updated":"2017-03-20 21:10:01.000000000","message":"Good point. I\u0027ll amend this to reflect that.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"114c5338995ba9b5733697a383a4cd4fa2179bb9","unresolved":false,"context_lines":[{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"* Virtualization drivers which call this method will parse the Instance"},{"line_number":184,"context_line":"  object, check the value of the \"verify_glance_signatures\" field, and pass"},{"line_number":185,"context_line":"  this on to the download method."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"* Instead of simply checking the value of the \"verify_glance_signatures\""},{"line_number":188,"context_line":"  configuration flag, this method will now perform signature verification if"},{"line_number":189,"context_line":"  either the configuration flag or the input parameter is set."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_b89d3c5b","line":189,"range":{"start_line":180,"start_character":0,"end_line":189,"end_character":62},"updated":"2017-03-20 17:15:53.000000000","message":"Can\u0027t the image/glance.py just get this information from the instance object, and do what is needed based on that?","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"99a91e21d9e6f690b3d54f3717a05a380b95ceb1","unresolved":false,"context_lines":[{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"* Virtualization drivers which call this method will parse the Instance"},{"line_number":184,"context_line":"  object, check the value of the \"verify_glance_signatures\" field, and pass"},{"line_number":185,"context_line":"  this on to the download method."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"* Instead of simply checking the value of the \"verify_glance_signatures\""},{"line_number":188,"context_line":"  configuration flag, this method will now perform signature verification if"},{"line_number":189,"context_line":"  either the configuration flag or the input parameter is set."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_6b54acfe","line":189,"range":{"start_line":180,"start_character":0,"end_line":189,"end_character":62},"in_reply_to":"1a1ced50_47b700d8","updated":"2017-03-21 14:39:39.000000000","message":"Very true. Maybe this just becomes a helper method in image/glance.py that takes an instance object and decides the value of verify_glance_signature? I just think that logic should live in image/glance.py. But thats all implementation details really.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4cb3c3e5062ff7621e241a71732f96ab77e364c6","unresolved":false,"context_lines":[{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"* Virtualization drivers which call this method will parse the Instance"},{"line_number":184,"context_line":"  object, check the value of the \"verify_glance_signatures\" field, and pass"},{"line_number":185,"context_line":"  this on to the download method."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"* Instead of simply checking the value of the \"verify_glance_signatures\""},{"line_number":188,"context_line":"  configuration flag, this method will now perform signature verification if"},{"line_number":189,"context_line":"  either the configuration flag or the input parameter is set."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_ee2340a5","line":189,"range":{"start_line":180,"start_character":0,"end_line":189,"end_character":62},"in_reply_to":"1a1ced50_6b54acfe","updated":"2017-03-21 15:18:21.000000000","message":"image/glance.py doesn\u0027t really handle the instance object at all. Much like the download() method, it\u0027s pretty much just about interacting with the Glance endpoint. The calls to the download() method (which performs signature verification) happen from a virt driver, so from my view the virt driver has to be the component that looks at the flavor/instance and decides whether to pass verify_glance_signatures\u003dTrue or not.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"56948772d7d118959697f379f83ec7b02934a792","unresolved":false,"context_lines":[{"line_number":177,"context_line":"* We will add a \"verify_glance_signatures\" field to the Instance object and"},{"line_number":178,"context_line":"  set this field according to the flavor information."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"* The download method of the nova/image/glance.py module will now include an"},{"line_number":181,"context_line":"  additional keyword argument, also called \"verify_glance_signatures.\""},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"* Virtualization drivers which call this method will parse the Instance"},{"line_number":184,"context_line":"  object, check the value of the \"verify_glance_signatures\" field, and pass"},{"line_number":185,"context_line":"  this on to the download method."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"* Instead of simply checking the value of the \"verify_glance_signatures\""},{"line_number":188,"context_line":"  configuration flag, this method will now perform signature verification if"},{"line_number":189,"context_line":"  either the configuration flag or the input parameter is set."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_47b700d8","line":189,"range":{"start_line":180,"start_character":0,"end_line":189,"end_character":62},"in_reply_to":"1a1ced50_b89d3c5b","updated":"2017-03-20 21:10:01.000000000","message":"The download() method does not take the instance as a parameter. The download() method essentially just transfers the image from a remote location or the image cache to the location of the instance Nova is about to boot. Adding the verify_glance_signature flag as a kwarg allows some virt drivers to pass it in if they support trusted flavors, but doesn\u0027t break the download method for others.","commit_id":"009708a5ca919b518ffb4d49fda91005f2bfb369"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4da583e71d5d4f3d26b5429b81173b55a0ae8f2f","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\"verify_glance_signatures\" extra spec to \"True.\" Note that a supported driver"},{"line_number":62,"context_line":"must be in use in order to use this flavor extra spec. If the end user prefers"},{"line_number":63,"context_line":"that their instance is booted from a signed image, the end user selects one of"},{"line_number":64,"context_line":"these trusted flavors when booting their instance."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"When Nova boots an instance, the virtualization driver passes the"},{"line_number":67,"context_line":"Instance object\u0027s flavor information to Nova\u0027s ImageAPI module as an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_a8690426","line":64,"updated":"2017-04-01 15:14:12.000000000","message":"This is not a user-friendly experience in my opinion, for a couple reasons. One, it will cause an explosion of flavors. The cloud administrator will basically need to create a \"trusted\" version of each of her flavors just so end users can say to Nova \"hey, make sure the image is verified before launching.\" Secondly, this is adding yet more \"goo\" to the existing flavor extra_specs mess, which is something I\u0027d love to avoid.\n\nInstead of coupling this functionality to flavors, can we instead consider adding a new key to the POST /servers request payload called \"verify_image_signature\" which would contain an optional boolean value that would instruct Nova to perform the signature verification for the image used in launching the instance?","commit_id":"d1030da01e7597db234a9e06a877586d2a67ee95"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4da583e71d5d4f3d26b5429b81173b55a0ae8f2f","unresolved":false,"context_lines":[{"line_number":67,"context_line":"Instance object\u0027s flavor information to Nova\u0027s ImageAPI module as an"},{"line_number":68,"context_line":"additional parameter. This module is responsible for initiating"},{"line_number":69,"context_line":"and processing Nova\u0027s downloads of Glance images and already contains the"},{"line_number":70,"context_line":"existing calls to Nova\u0027s signature verification code."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Now, instead of simply checking a \"verify_glance_signatures\" configuration"},{"line_number":73,"context_line":"flag, the module performs signature verification if either the aforementioned"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_88764006","line":70,"updated":"2017-04-01 15:14:12.000000000","message":"Instead of the flavor, we could more easily create a new \"verify_image_signature\" attribute on the RequestSpec object. That way, the Flavor object isn\u0027t necessary to mess with.","commit_id":"d1030da01e7597db234a9e06a877586d2a67ee95"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4da583e71d5d4f3d26b5429b81173b55a0ae8f2f","unresolved":false,"context_lines":[{"line_number":165,"context_line":"----------"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* We will use virt driver capabilities to reject builds of the trusted"},{"line_number":168,"context_line":"  flavors for compute workers that don\u0027t support trusted flavors [1]."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"* The download method of the nova/image/glance.py module will now include"},{"line_number":171,"context_line":"  the flavor information as a parameter."}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_6873fc16","line":168,"updated":"2017-04-01 15:14:12.000000000","message":"I\u0027m not sure why this feature should happen in the virt driver layer at all... couldn\u0027t image signature verification occur before the virt driver is ever called?","commit_id":"d1030da01e7597db234a9e06a877586d2a67ee95"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4da583e71d5d4f3d26b5429b81173b55a0ae8f2f","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  flavors for compute workers that don\u0027t support trusted flavors [1]."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"* The download method of the nova/image/glance.py module will now include"},{"line_number":171,"context_line":"  the flavor information as a parameter."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"* Instead of simply checking the value of the \"verify_glance_signatures\""},{"line_number":174,"context_line":"  configuration flag, this method will now perform signature verification if"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_48627840","line":171,"updated":"2017-04-01 15:14:12.000000000","message":"Not sure why the flavor would be passed to the download() method. Whether or not an image is verified doesn\u0027t change that you need to download the image...","commit_id":"d1030da01e7597db234a9e06a877586d2a67ee95"}]}