)]}'
{"specs/ocata/approved/nova-certificate-validation.rst":[{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"d2d98d32559f4d0787689b55b62acb35252e9e33","unresolved":false,"context_lines":[{"line_number":14,"context_line":"robust certificate validation."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":"Nova is capable of verifying the signature of a signed image by using Cursive,"},{"line_number":20,"context_line":"a new OpenStack library for conducting operations with cryptographic"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3ac371cc_b592df49","line":17,"updated":"2016-08-18 21:28:36.000000000","message":"s/Problem Description/Problem description","commit_id":"360537ac823002cf832ce20b7412ded8d65773dc"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"d2d98d32559f4d0787689b55b62acb35252e9e33","unresolved":false,"context_lines":[{"line_number":55,"context_line":"signed images can be booted by the compute service."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Proposed Change"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":60,"context_line":"Supporting certificate validation requires several changes. The first adds a"},{"line_number":61,"context_line":"Nova configuration option in nova.conf that pertains to Cursive. This option,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3ac371cc_557bab29","line":58,"updated":"2016-08-18 21:28:36.000000000","message":"s/Proposed Change/Proposed change","commit_id":"360537ac823002cf832ce20b7412ded8d65773dc"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"71c7167d54fef09c39c7dc5d412f324ac32e72fc","unresolved":false,"context_lines":[{"line_number":85,"context_line":"included in the certificate verification context. These failures can occur for"},{"line_number":86,"context_line":"a variety of reasons including:"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"* failure to parse the certificate file data as a PEM or DER-encoded certificate"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"* certificate valid date ranges do not include the current time"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ac06dbe_cc10beae","line":88,"updated":"2016-08-24 13:54:02.000000000","message":"Looks like this line is too long.","commit_id":"979eb09f28cae1c688999cd3dfc71ebc899514af"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"bc42f14f2c038c24ddb30631530441edfe7e3165","unresolved":false,"context_lines":[{"line_number":53,"context_line":"chains rooted in the trust store, will pass certificate validation when Nova"},{"line_number":54,"context_line":"verifies an image signature. This allows the administrator to control which"},{"line_number":55,"context_line":"signed images can be booted by the compute service."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Proposed change"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_5729ebe4","line":56,"updated":"2016-09-27 13:27:29.000000000","message":"The use case and problem description don\u0027t really mesh/correlate very well.\n\nIn the problem you talk about a user uploading a signed image to glance and then booting it in Nova. Meanwhile an attacker has replaced the image in glance with a different one, signed by a different key. So the problem is the tenant user is not booting the image that they thought they were booting.  IOW, there are \"N\" (where N \u003e 1) certificates that exist in the CA that could be used to sign VM images, and the user only trusts a subset of those certificates, where that subset is potentially as small as 1.\n\nNow in the use case you\u0027re talking about a cloud admin specifying a set of permitted certificates per-compute node. This does not address the problem scenario described previously. You\u0027ve merely made the global set of permitted certificates a little bit smaller - this makes the attack slightly harder, but the attack still exists.\n\nIMHO any kind of reliance on a global certificate list is fundamentally broken. We need to have a permitted certificate list associated with *tenant user* accounts, so the tenant is in charge of deciding which certificates they trust for booting VMs they are running.  The tenants list might include some certificates owned \u0026 managed by the cloud administrator for uploading shared images to glance, or it might only contain the certificates owned by the tenant user themselves, or both.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3bb0cfa16b0e7f5ca2e01c1ee2dfe202f920d622","unresolved":false,"context_lines":[{"line_number":53,"context_line":"chains rooted in the trust store, will pass certificate validation when Nova"},{"line_number":54,"context_line":"verifies an image signature. This allows the administrator to control which"},{"line_number":55,"context_line":"signed images can be booted by the compute service."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Proposed change"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_6c6dd997","line":56,"in_reply_to":"5a8bc5a2_5729ebe4","updated":"2016-09-29 15:53:58.000000000","message":"You present some good points. Tying tenant user identity to a set of trusted certificates would more tightly restrict the attack surface. I\u0027m trying to envision what this would look like. What service would be in charge of this mapping? When I think of tenant data I mentally jump to Keystone, but this seems like something better handled by a key/certificate management service like Castellan/Barbican. However, I don\u0027t think those projects have the notion of tagging or filtering secrets, in this case certificates, on \"trusted\" status.\n\nI also think the cloud admin is in a better position to handle certificate revocation. It\u0027s part of maintaining cloud infrastructure and makes life easier for the user.\n\nBrainstorming here: a tenant user could select certificates from the trust store that they trust, or they could submit their own certificates to be included in the trust store. The cloud admin would have final say over what\u0027s included and could still perform revocation as needed.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3bb0cfa16b0e7f5ca2e01c1ee2dfe202f920d622","unresolved":false,"context_lines":[{"line_number":62,"context_line":"\u0027certificate_trust_store\u0027, stores the file system path to the directory"},{"line_number":63,"context_line":"containing the compute service\u0027s certificate trust store. Each trusted"},{"line_number":64,"context_line":"certificate exists as a file in this directory. Once processed, it will not"},{"line_number":65,"context_line":"be possible to change the location or content of the trust store in Cursive"},{"line_number":66,"context_line":"without restarting the compute service. If the \u0027certificate_trust_store\u0027"},{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_a64d4074","line":65,"range":{"start_line":65,"start_character":35,"end_line":65,"end_character":45},"updated":"2016-09-29 15:53:58.000000000","message":"Drop \"or content\" here.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"c02593181241d08b47cb9f9a4a345f0a18a024e5","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_53af5e7c","line":70,"updated":"2016-09-27 01:37:33.000000000","message":"Quick question to make sure I understand the proposal correctly.  Your proposal is that the \"trust store\" is a directory in the filesystem on each compute node.  The store could be loaded with certificates by, for example, puppet, and the compute restarted to create the certificate verification context.  Revocation could be accomplished by a using puppet to deploy the updated store and then restarting the compute.\n\nThis strikes me as kind of impractical for a large cloud.  Maybe certificate revocation is a low-frequency operation, but when it occurs, we\u0027d want it to happen pretty quickly and be minimally disruptive.  I\u0027m not sure that this proposal accomplishes that.\n\nI notice that there\u0027s no mention of Barbican or Castellan anywhere in this document.  My naive impression is that a certificate management service is what you really want here.  It would be helpful if you could explain why you prefer the local filesystem approach instead.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"bf629dd4a8619e6b1c7bedbd5b94a473250ab60b","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a95cdbc_d5e15cd2","line":70,"in_reply_to":"3a98d1f4_3a213fb5","updated":"2016-10-04 15:28:47.000000000","message":"I\u0027m gathering information on alternatives, but I wanted to make sure I understand exactly what you mean by \"tenant user\" here. Users can be members of multiple projects, or tenants. Are you envisioning that each user has their own cert trust store that follows them around OpenStack? If not, are you instead referring to cert trust stores associated with individual projects/tenants, accessible to all users belonging to that grouping? Or are you thinking of a blending of both approaches?","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"c61b24e8b733d926d42be9fad3cbf3521fa9e9b3","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_7a4587b1","line":70,"in_reply_to":"3a98d1f4_e644a875","updated":"2016-09-29 16:21:04.000000000","message":"Regarding using Barbican for certificate management/verification, there was a mailing list thread recently (lists.openstack.org/pipermail/openstack-dev/2016-September/103793.html) where the Barbican team said that they will be deprecating their Certificate Issuance feature and do not intend to further develop CA integration with Barbican, although Barbican will still store certificate.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"25071b2a06536ec9a929e5ecc28199f0cade0a13","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_3a213fb5","line":70,"in_reply_to":"3a98d1f4_e644a875","updated":"2016-09-29 16:25:26.000000000","message":"The performance issue feels pretty irrelevant to me. Nova is validating the signature after reading the image data from glance - fetching a few KB of certificate data is lost in the noise after reading many 100\u0027s of MB/GB of image data from glance in order to validate the signature. The actual certificates can easily be cached too if absolutely needed for performance reasons, but I very much doubt it is.\n\nWRT the question of mapping between tenant identities and certificates - it is unclear because no such mapping exists until someone actually proposes a solution. So effectively you are saying you\u0027re not proposing a solution because the solution doesn\u0027t yet exist.  \n\nI don\u0027t think that going down the route of storing certs on the host filesystem per compute node is a good use of time \u0026 resources for Nova. It is not aligned with direction I think we need for certificate validation \u0026 management long term in Nova. So is spending effort developing \u0026 reviewing  something we don\u0027t want long term, and which doesn\u0027t take us incrementally closer to what we want either. It is essentially a dead-end which we\u0027ll then have to support indefinitely once implemented, even when we do finally get the preferred solution.\n\nSo again I\u0027d like to see a spec that actually proposes a design for the right long term solution wrt tenant / cert mapping.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3bb0cfa16b0e7f5ca2e01c1ee2dfe202f920d622","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_4cf49d86","line":70,"in_reply_to":"5a8bc5a2_37d37fd6","updated":"2016-09-29 15:53:58.000000000","message":"Continuing from my responses above, it\u0027s unclear where/how tenant identity and trusted certificates are mapped together. Using a filesystem-based trust store was the simplest first stab at implementing support for trusted certificates. The idea was that once a working version of certificate validation was in place we could iterate and improve on it as needed.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3bb0cfa16b0e7f5ca2e01c1ee2dfe202f920d622","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a98d1f4_e644a875","line":70,"in_reply_to":"5a8bc5a2_53af5e7c","updated":"2016-09-29 15:53:58.000000000","message":"Correct, the \"trust store\" is a directory in the filesystem on each compute node containing trusted certificates. For large deployments this could take a different form, like a shared network drive. However, the certificate verification context is created each time signature verification needs to be done; compute *does not* need to be restarted for certificate additions/removals to take effect. Compute *will* need to be restarted if you want to change the location of the trust store, since this value is a configuration value. (Note: \"or content\" above is ambiguous. I\u0027ll drop it in the next update. Sorry for the confusion.)\n\nThis means that certificate revocation occurs quickly once a bad certificate is identified; simply remove it from the trust store directory and it\u0027s gone. The downside is the performance hit; if signature verification happens frequently and there are many certificates in the trust store, the time to boot a VM would be increased.\n\nThe argument around the local filesystem approach, as opposed to a certificate management service like Barbican, focuses on performance. It should be faster to load the trust store from a local directory than it would be to load it across the network from a different service, especially if this is done on every signature verification call. Of course, if the trust store is a shared network drive as mentioned above, the performance hit may be a wash when compared to a separate service.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"bc42f14f2c038c24ddb30631530441edfe7e3165","unresolved":false,"context_lines":[{"line_number":67,"context_line":"option is left unset, the certificate trust store loaded into memory will be"},{"line_number":68,"context_line":"empty. The value of the \u0027certificate_trust_store\u0027 option is provided to the"},{"line_number":69,"context_line":"Cursive utilities that conduct signature verification and certificate"},{"line_number":70,"context_line":"validation."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The second change involves loading the certificates in the certificate trust"},{"line_number":73,"context_line":"store and storing them in a certificate verification context. This work will"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a8bc5a2_37d37fd6","line":70,"in_reply_to":"5a8bc5a2_53af5e7c","updated":"2016-09-27 13:27:29.000000000","message":"I rather agree - the idea of managing trusted certificate stores on disk on the compute nodes is the wrong model and does not take us anywhere nearer to solving the ultimate problem which is that we need an association between tenant users \u0026 permitted certs, as it is fundamentally a question of whom the tenant trusts to sign images, not whom the cloud admin trusts to sign images.","commit_id":"f622c492c2c31286788fcd4e0e8ae700181be973"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"32bd6d0987bd53e1977229696e70c4e5a8d5dda4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"parameter, trusted_certificates, to the server create command of the nova API."},{"line_number":67,"context_line":"The value of the parameter is an array containing the string IDs of the"},{"line_number":68,"context_line":"trusted certificates used to validate the signed image\u0027s signing certificate."},{"line_number":69,"context_line":"These IDs are assigned by the certificate manager upon upload of the trusted"},{"line_number":70,"context_line":"certificates. Multiple IDs are allowed here to provide flexibility for the"},{"line_number":71,"context_line":"user. It may not be feasible for the user to know which specific certificate"},{"line_number":72,"context_line":"corresponds to their image. Allowing the user to define a set of trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_357a9524","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":49},"updated":"2016-11-12 18:12:55.000000000","message":"Is this the Nova CertManager? Or some other external system? I thought the only thing that used nova-cert was the ec2api and we had actually be talking about removing nova-cert.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":66,"context_line":"parameter, trusted_certificates, to the server create command of the nova API."},{"line_number":67,"context_line":"The value of the parameter is an array containing the string IDs of the"},{"line_number":68,"context_line":"trusted certificates used to validate the signed image\u0027s signing certificate."},{"line_number":69,"context_line":"These IDs are assigned by the certificate manager upon upload of the trusted"},{"line_number":70,"context_line":"certificates. Multiple IDs are allowed here to provide flexibility for the"},{"line_number":71,"context_line":"user. It may not be feasible for the user to know which specific certificate"},{"line_number":72,"context_line":"corresponds to their image. Allowing the user to define a set of trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_d5979937","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":49},"in_reply_to":"9a629dbe_357a9524","updated":"2016-11-12 18:33:22.000000000","message":"Or is this Barbican?\n\nhttp://docs.openstack.org/developer/barbican/api/reference/certificates.html\n\nBecause ^ is marked for deprecation.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":66,"context_line":"parameter, trusted_certificates, to the server create command of the nova API."},{"line_number":67,"context_line":"The value of the parameter is an array containing the string IDs of the"},{"line_number":68,"context_line":"trusted certificates used to validate the signed image\u0027s signing certificate."},{"line_number":69,"context_line":"These IDs are assigned by the certificate manager upon upload of the trusted"},{"line_number":70,"context_line":"certificates. Multiple IDs are allowed here to provide flexibility for the"},{"line_number":71,"context_line":"user. It may not be feasible for the user to know which specific certificate"},{"line_number":72,"context_line":"corresponds to their image. Allowing the user to define a set of trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_59163fa8","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":49},"in_reply_to":"9a629dbe_4bc90eac","updated":"2016-11-14 15:30:35.000000000","message":"OK, we should put something early in the spec explaining what that is, and that it\u0027s not nova\u0027s CertManager (nova-cert service) or Barbican as I was definitely confused about us using deprecated services.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"parameter, trusted_certificates, to the server create command of the nova API."},{"line_number":67,"context_line":"The value of the parameter is an array containing the string IDs of the"},{"line_number":68,"context_line":"trusted certificates used to validate the signed image\u0027s signing certificate."},{"line_number":69,"context_line":"These IDs are assigned by the certificate manager upon upload of the trusted"},{"line_number":70,"context_line":"certificates. Multiple IDs are allowed here to provide flexibility for the"},{"line_number":71,"context_line":"user. It may not be feasible for the user to know which specific certificate"},{"line_number":72,"context_line":"corresponds to their image. Allowing the user to define a set of trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_6d033d0e","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":49},"in_reply_to":"9a629dbe_59163fa8","updated":"2016-11-14 16:20:16.000000000","message":"Will do.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":66,"context_line":"parameter, trusted_certificates, to the server create command of the nova API."},{"line_number":67,"context_line":"The value of the parameter is an array containing the string IDs of the"},{"line_number":68,"context_line":"trusted certificates used to validate the signed image\u0027s signing certificate."},{"line_number":69,"context_line":"These IDs are assigned by the certificate manager upon upload of the trusted"},{"line_number":70,"context_line":"certificates. Multiple IDs are allowed here to provide flexibility for the"},{"line_number":71,"context_line":"user. It may not be feasible for the user to know which specific certificate"},{"line_number":72,"context_line":"corresponds to their image. Allowing the user to define a set of trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_4bc90eac","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":49},"in_reply_to":"9a629dbe_d5979937","updated":"2016-11-14 13:06:54.000000000","message":"We are referring to the cloud\u0027s key manager here. Trusted certs will be uploaded using the \u0027secret store\u0027 API method, not any part of the Barbican certificate manager or Nova\u0027s CertManager.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2bcdec9f32ba0b5356205c2d657d9e01a67cda13","unresolved":false,"context_lines":[{"line_number":73,"context_line":"certificates removes the need for an image/certificate mapping, simplifying"},{"line_number":74,"context_line":"the user experience. When provided, nova will pass these values to the"},{"line_number":75,"context_line":"signature verification routine, which will use them to fetch the trusted"},{"line_number":76,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":77,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":78,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":79,"context_line":"preserved with the server data."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b2920d9e","line":76,"range":{"start_line":76,"start_character":19,"end_line":76,"end_character":28},"updated":"2016-11-14 17:43:42.000000000","message":"So does this put a nova dependency on castellan?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"62561d6e1880dae765b8b7c3164026fe0f013fab","unresolved":false,"context_lines":[{"line_number":73,"context_line":"certificates removes the need for an image/certificate mapping, simplifying"},{"line_number":74,"context_line":"the user experience. When provided, nova will pass these values to the"},{"line_number":75,"context_line":"signature verification routine, which will use them to fetch the trusted"},{"line_number":76,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":77,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":78,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":79,"context_line":"preserved with the server data."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a77a97e_194b0f2d","line":76,"range":{"start_line":76,"start_character":19,"end_line":76,"end_character":28},"in_reply_to":"9a629dbe_b2920d9e","updated":"2016-11-14 18:26:41.000000000","message":"castellan is already being used by nova (see nova/signature_utils.py or nova/conf/key_manager.py) so this just uses a preexisting dependency.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":178,"context_line":""},{"line_number":179,"context_line":"None"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_1542f1ad","line":181,"updated":"2016-11-12 18:33:22.000000000","message":"You should note somewhere in here that this is going to be done under a new microversion as it changes the request body.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":178,"context_line":""},{"line_number":179,"context_line":"None"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_53ed4024","line":181,"in_reply_to":"9a629dbe_1542f1ad","updated":"2016-11-14 14:32:39.000000000","message":"Will do.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"43eb8cce7b244b3040fbf771c00d643ab6855ef9","unresolved":false,"context_lines":[{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"},{"line_number":185,"context_line":"image, including the new trusted_certificates parameter:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_d58159c4","line":184,"range":{"start_line":184,"start_character":39,"end_line":184,"end_character":58},"updated":"2016-11-12 18:35:28.000000000","message":"How about rebuild?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"},{"line_number":185,"context_line":"image, including the new trusted_certificates parameter:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_d9508f61","line":184,"range":{"start_line":184,"start_character":39,"end_line":184,"end_character":58},"in_reply_to":"9a629dbe_ab78ea2c","updated":"2016-11-14 15:30:35.000000000","message":"OK, I think that\u0027s the generic response, but I\u0027m looking for specifics on which APIs are going to change to pass in a list of trusted cert IDs in the request. So far I think that\u0027s at least server create and server rebuild.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"},{"line_number":185,"context_line":"image, including the new trusted_certificates parameter:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_ab78ea2c","line":184,"range":{"start_line":184,"start_character":39,"end_line":184,"end_character":58},"in_reply_to":"9a629dbe_d58159c4","updated":"2016-11-14 13:06:54.000000000","message":"Signature verification and certificate verification will occur any time an image is downloaded from Glance while signature verification is enabled in Nova.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":181,"context_line":"REST API impact"},{"line_number":182,"context_line":"---------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The following is an example request to create a new server from a signed"},{"line_number":185,"context_line":"image, including the new trusted_certificates parameter:"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_2d48655b","line":184,"range":{"start_line":184,"start_character":39,"end_line":184,"end_character":58},"in_reply_to":"9a629dbe_d9508f61","updated":"2016-11-14 16:20:16.000000000","message":"We can expand this to cover server rebuild. It should look exactly the same.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":189,"context_line":"{"},{"line_number":190,"context_line":"    \"server\": {"},{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_55c38937","line":192,"updated":"2016-11-12 18:33:22.000000000","message":"nit: I\u0027m pretty sure we don\u0027t take a URL for imageRef anymore, it\u0027s just an image uuid.\n\nSee: cbd3ec476f769c42e5b2a0ef8c996b60935e7f6c","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":189,"context_line":"{"},{"line_number":190,"context_line":"    \"server\": {"},{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_93cef8b2","line":192,"in_reply_to":"9a629dbe_55c38937","updated":"2016-11-14 14:32:39.000000000","message":"Understood, I\u0027ll update this. I believe I pulled this example from the docs. If I can find the spot I can also file a doc bug so that can be updated to match.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","},{"line_number":196,"context_line":"            \"11111111-1111-1111-1111-111111111111\","},{"line_number":197,"context_line":"            \"22222222-2222-2222-2222-222222222222\""},{"line_number":198,"context_line":"        ],"},{"line_number":199,"context_line":"        \"metadata\": {"},{"line_number":200,"context_line":"            \"My Server Name\": \"Example Signed Server\""},{"line_number":201,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_35cff556","line":198,"range":{"start_line":194,"start_character":8,"end_line":198,"end_character":10},"updated":"2016-11-12 18:33:22.000000000","message":"Can you provide sample jsonschema for this also, like format, type, min/max numbers, etc. There is some prose on that below, but it would be good to see the jsonschema in here as well.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","},{"line_number":196,"context_line":"            \"11111111-1111-1111-1111-111111111111\","},{"line_number":197,"context_line":"            \"22222222-2222-2222-2222-222222222222\""},{"line_number":198,"context_line":"        ],"},{"line_number":199,"context_line":"        \"metadata\": {"},{"line_number":200,"context_line":"            \"My Server Name\": \"Example Signed Server\""},{"line_number":201,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_8d34114b","line":198,"range":{"start_line":194,"start_character":8,"end_line":198,"end_character":10},"in_reply_to":"9a629dbe_1cee75ec","updated":"2016-11-14 16:20:16.000000000","message":"Will do.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","},{"line_number":196,"context_line":"            \"11111111-1111-1111-1111-111111111111\","},{"line_number":197,"context_line":"            \"22222222-2222-2222-2222-222222222222\""},{"line_number":198,"context_line":"        ],"},{"line_number":199,"context_line":"        \"metadata\": {"},{"line_number":200,"context_line":"            \"My Server Name\": \"Example Signed Server\""},{"line_number":201,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b34a1c26","line":198,"range":{"start_line":194,"start_character":8,"end_line":198,"end_character":10},"in_reply_to":"9a629dbe_35cff556","updated":"2016-11-14 14:32:39.000000000","message":"Definitely. Is an example or more info easy to find in the docs or can you point to a source for that?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","},{"line_number":196,"context_line":"            \"11111111-1111-1111-1111-111111111111\","},{"line_number":197,"context_line":"            \"22222222-2222-2222-2222-222222222222\""},{"line_number":198,"context_line":"        ],"},{"line_number":199,"context_line":"        \"metadata\": {"},{"line_number":200,"context_line":"            \"My Server Name\": \"Example Signed Server\""},{"line_number":201,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_1cee75ec","line":198,"range":{"start_line":194,"start_character":8,"end_line":198,"end_character":10},"in_reply_to":"9a629dbe_99f7f7f4","updated":"2016-11-14 15:30:35.000000000","message":"The API request sample you have here is good, just also looking for a little section on the jsonschema for the trusted_certificates field.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"8e753c1f5fa345a42541c3161397a686403119c5","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        \"name\": \"example-name\","},{"line_number":192,"context_line":"        \"imageRef\": \"http://glance.openstack.example.com/images/\u003cid-here\u003e\","},{"line_number":193,"context_line":"        \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":194,"context_line":"        \"trusted_certificates\": ["},{"line_number":195,"context_line":"            \"00000000-0000-0000-0000-000000000000\","},{"line_number":196,"context_line":"            \"11111111-1111-1111-1111-111111111111\","},{"line_number":197,"context_line":"            \"22222222-2222-2222-2222-222222222222\""},{"line_number":198,"context_line":"        ],"},{"line_number":199,"context_line":"        \"metadata\": {"},{"line_number":200,"context_line":"            \"My Server Name\": \"Example Signed Server\""},{"line_number":201,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_99f7f7f4","line":198,"range":{"start_line":194,"start_character":8,"end_line":198,"end_character":10},"in_reply_to":"9a629dbe_b34a1c26","updated":"2016-11-14 14:58:55.000000000","message":"Nevermind, I think I know what\u0027s needed.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":217,"context_line":"signed before the feature is enabled."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Migration will require users to upload their trusted certificates to the"},{"line_number":220,"context_line":"certificate manager if they intend to specify them with the create request."},{"line_number":221,"context_line":"All image signing certificates must already be in the certificate manager to"},{"line_number":222,"context_line":"support signature verification."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_75d5ede2","line":220,"range":{"start_line":220,"start_character":0,"end_line":220,"end_character":19},"updated":"2016-11-12 18:33:22.000000000","message":"I\u0027m still confused as to what this is, nova, barbican, or other?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":217,"context_line":"signed before the feature is enabled."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Migration will require users to upload their trusted certificates to the"},{"line_number":220,"context_line":"certificate manager if they intend to specify them with the create request."},{"line_number":221,"context_line":"All image signing certificates must already be in the certificate manager to"},{"line_number":222,"context_line":"support signature verification."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_adf715f4","line":220,"range":{"start_line":220,"start_character":0,"end_line":220,"end_character":19},"in_reply_to":"9a629dbe_3c8ed927","updated":"2016-11-14 16:20:16.000000000","message":"Regarding barbican, I believe you\u0027re referring to the CA capability, which is deprecated. Barbican still supports storing and retrieving certificates, which is separate from the CA functionality (the creation of new certificates). I\u0027ll make this explicit in the next update.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":217,"context_line":"signed before the feature is enabled."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Migration will require users to upload their trusted certificates to the"},{"line_number":220,"context_line":"certificate manager if they intend to specify them with the create request."},{"line_number":221,"context_line":"All image signing certificates must already be in the certificate manager to"},{"line_number":222,"context_line":"support signature verification."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_8bc9665d","line":220,"range":{"start_line":220,"start_character":0,"end_line":220,"end_character":19},"in_reply_to":"9a629dbe_75d5ede2","updated":"2016-11-14 13:06:54.000000000","message":"Again, this should simply say \"key manager\".","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":217,"context_line":"signed before the feature is enabled."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Migration will require users to upload their trusted certificates to the"},{"line_number":220,"context_line":"certificate manager if they intend to specify them with the create request."},{"line_number":221,"context_line":"All image signing certificates must already be in the certificate manager to"},{"line_number":222,"context_line":"support signature verification."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b3e69c14","line":220,"range":{"start_line":220,"start_character":0,"end_line":220,"end_character":19},"in_reply_to":"9a629dbe_8bc9665d","updated":"2016-11-14 14:32:39.000000000","message":"Yes and no. In most cases the key manager and the certificate manager will be the same service. In most cases (as OpenStack stands today) this service will be barbican. It is possible that the key manager and the certificate manager could be different services. It is also possible that (one day) other third-party services could be used to support this. Right now, barbican is really the only option.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":217,"context_line":"signed before the feature is enabled."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"Migration will require users to upload their trusted certificates to the"},{"line_number":220,"context_line":"certificate manager if they intend to specify them with the create request."},{"line_number":221,"context_line":"All image signing certificates must already be in the certificate manager to"},{"line_number":222,"context_line":"support signature verification."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_3c8ed927","line":220,"range":{"start_line":220,"start_character":0,"end_line":220,"end_character":19},"in_reply_to":"9a629dbe_b3e69c14","updated":"2016-11-14 15:30:35.000000000","message":"OK, I think the confusion for me is that the certs API in barbican is deprecated, so if it\u0027s just key manager and that\u0027s barbican for openstack options right now, then let\u0027s be clear, or at least mention that. We had talked about a separate cert management service at some point in the big tent, but since that\u0027s a thing that doesn\u0027t exist today it\u0027s probably best to either not mention that or qualify it as a thing that doesn\u0027t exist today so we can\u0027t rely on it.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":231,"context_line":"Notifications impact"},{"line_number":232,"context_line":"--------------------"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b5094597","line":234,"updated":"2016-11-12 18:33:22.000000000","message":"Hmm, do we add the certificates to the server create notification? I\u0027m not sure we\u0027d need to or what the use case would be, and it might actually be better to not send those out in a notification.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":231,"context_line":"Notifications impact"},{"line_number":232,"context_line":"--------------------"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_adce35b2","line":234,"in_reply_to":"9a629dbe_3c2a59e8","updated":"2016-11-14 16:20:16.000000000","message":"Ah, ok. I doubt the certificate info would be needed in those notifications, though if someone can make an argument for them I\u0027m fine with adding those in.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6bdbec7559ba75ce857ac493226281a032b2fc0e","unresolved":false,"context_lines":[{"line_number":231,"context_line":"Notifications impact"},{"line_number":232,"context_line":"--------------------"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_d2da2117","line":234,"in_reply_to":"9a629dbe_adce35b2","updated":"2016-11-14 17:46:03.000000000","message":"We have versioned notifications so we could add them in later if someone wants them. I\u0027d just leave them out for now as you have here.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":231,"context_line":"Notifications impact"},{"line_number":232,"context_line":"--------------------"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_f39e5462","line":234,"in_reply_to":"9a629dbe_b5094597","updated":"2016-11-14 14:32:39.000000000","message":"What do you mean here? Like reporting back certificate info in the initial response? I wasn\u0027t thinking that the cert info would be needed, hence why it\u0027s empty.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":231,"context_line":"Notifications impact"},{"line_number":232,"context_line":"--------------------"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_3c2a59e8","line":234,"in_reply_to":"9a629dbe_f39e5462","updated":"2016-11-14 15:30:35.000000000","message":"No I meant in like the compute.instance.create.end notification that goes out after a server is created on the compute manager, or compute.instance.create.start that goes out in the compute API.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_f5ff3d63","line":236,"updated":"2016-11-12 18:33:22.000000000","message":"Based on this dev list thread I just started:\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2016-November/107195.html\n\nI got to thinking about evacuate which is a recreate of a server on another host but it uses the same image and flavor originally used to create the server.\n\nSince we\u0027re not persisting the trusted certificates passed in, we wouldn\u0027t have them when evacuating the instance and rebuilding it elsewhere. What problems does that pose?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"65c6d71484adcec4523dd5bc164bc5ddf2ad578f","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_68624baf","line":236,"in_reply_to":"9a629dbe_0d03a1b9","updated":"2016-11-14 16:33:06.000000000","message":"Looking at the InstanceExtras schema, it looks like we\u0027d need to add another column for the trusted cert data (e.g., trusted_certificate_ids, Column(Text)). This would also presumably require database migrations.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_0d03a1b9","line":236,"in_reply_to":"9a629dbe_1ce2f59f","updated":"2016-11-14 16:20:16.000000000","message":"Agreed on the cert store piece. If storing the cert IDs with the instance data in instance_extras is the best place for it, we can definitely do that. Given this would use preexisting functionality, would this also need a Data Model change?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_cb927ef6","line":236,"in_reply_to":"9a629dbe_3524550b","updated":"2016-11-14 13:06:54.000000000","message":"Can we persist the trusted cert UUIDs for each instance in Nova\u0027s database and reuse them for recreates or migrations?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6bdbec7559ba75ce857ac493226281a032b2fc0e","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_52fd316d","line":236,"in_reply_to":"9a629dbe_68624baf","updated":"2016-11-14 17:46:03.000000000","message":"Yeah we\u0027d have a database schema migration for the new column. The column data itself is just a json blob.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_1ce2f59f","line":236,"in_reply_to":"9a629dbe_73e6c4e9","updated":"2016-11-14 15:30:35.000000000","message":"We don\u0027t want to turn nova into a cert store / service, so we don\u0027t want an actual Certificate resource or anything, but I could see the need to persist the list of trusted certs with a given instance, maybe in the instance_extras table. That\u0027s where keypairs are being stored per instance now too.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_73e6c4e9","line":236,"in_reply_to":"9a629dbe_cb927ef6","updated":"2016-11-14 14:32:39.000000000","message":"Yeah, this is an interesting case. If evacuate/cold/live migration pull the image from glance, signature verification and certificate validation would be performed again. If there\u0027s no set of trusted certificate IDs available at this time, then boot would fail. We will need some way to persist those within nova (tied to the server data) if we need to support these cases.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c214de7f5a2a90ce020671e6022db262e1413f0b","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"None"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Other end user impact"},{"line_number":237,"context_line":"---------------------"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"With support being added for the OS_TRUSTED_CERTIFICATE_IDS environment"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_3524550b","line":236,"in_reply_to":"9a629dbe_f5ff3d63","updated":"2016-11-12 18:33:48.000000000","message":"Similar question for cold and live migration.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":273,"context_line":"Other deployer impact"},{"line_number":274,"context_line":"---------------------"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Developer impact"},{"line_number":279,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_55f1c993","line":276,"updated":"2016-11-12 18:33:22.000000000","message":"Would it be beneficial to store the trusted certificate IDs in the config drive or expose them to the guest via the metadata service?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":273,"context_line":"Other deployer impact"},{"line_number":274,"context_line":"---------------------"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Developer impact"},{"line_number":279,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b36cdc37","line":276,"in_reply_to":"9a629dbe_55f1c993","updated":"2016-11-14 14:32:39.000000000","message":"Given the points about evacuate and cold/live migration, some sort of trusted certificate ID persistence will likely be needed. Could one of these options suffice?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"eaea5874d1c3d701eeea05fe18cd8f68b6929acf","unresolved":false,"context_lines":[{"line_number":273,"context_line":"Other deployer impact"},{"line_number":274,"context_line":"---------------------"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Developer impact"},{"line_number":279,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_7c5771ca","line":276,"in_reply_to":"9a629dbe_b36cdc37","updated":"2016-11-14 15:17:39.000000000","message":"As for picking the config drive or the metadata service, I\u0027m honestly not familiar enough with either to know which would be better (I\u0027m fine supporting either). Another opinion here would be welcome.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":273,"context_line":"Other deployer impact"},{"line_number":274,"context_line":"---------------------"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"None"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Developer impact"},{"line_number":279,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_3cbb3977","line":276,"in_reply_to":"9a629dbe_b36cdc37","updated":"2016-11-14 15:30:35.000000000","message":"If the guest needs/wants them then they have to show up in config drive or the metadata API, but both are optional. If you persist the trusted cert UUIDs per instance, which I think we have to for evacuate/migration to work, then they could also be exposed via the metadata API.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":290,"context_line":"Primary assignee:"},{"line_number":291,"context_line":"  Peter Hamilton"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"Reviewers"},{"line_number":294,"context_line":"---------"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"Core reviewer(s):"},{"line_number":297,"context_line":"  Not Yet Identified"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Work Items"},{"line_number":300,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_75ec0dbb","line":297,"range":{"start_line":293,"start_character":0,"end_line":297,"end_character":20},"updated":"2016-11-12 18:33:22.000000000","message":"This isn\u0027t a thing we have, i.e. signing up cores for a given blueprint, should probably remove this.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":290,"context_line":"Primary assignee:"},{"line_number":291,"context_line":"  Peter Hamilton"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"Reviewers"},{"line_number":294,"context_line":"---------"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"Core reviewer(s):"},{"line_number":297,"context_line":"  Not Yet Identified"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Work Items"},{"line_number":300,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_f3f1f496","line":297,"range":{"start_line":293,"start_character":0,"end_line":297,"end_character":20},"in_reply_to":"9a629dbe_75ec0dbb","updated":"2016-11-14 14:32:39.000000000","message":"Ok, will do. It is part of the spec template though; should I just chuck this subsection or set it as None?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":290,"context_line":"Primary assignee:"},{"line_number":291,"context_line":"  Peter Hamilton"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"Reviewers"},{"line_number":294,"context_line":"---------"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"Core reviewer(s):"},{"line_number":297,"context_line":"  Not Yet Identified"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Work Items"},{"line_number":300,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_2d1785ee","line":297,"range":{"start_line":293,"start_character":0,"end_line":297,"end_character":20},"in_reply_to":"9a629dbe_7c6cd108","updated":"2016-11-14 16:20:16.000000000","message":"Huh, I must\u0027ve pulled it from an older template then. Regardless, I\u0027ve cut it.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":290,"context_line":"Primary assignee:"},{"line_number":291,"context_line":"  Peter Hamilton"},{"line_number":292,"context_line":""},{"line_number":293,"context_line":"Reviewers"},{"line_number":294,"context_line":"---------"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"Core reviewer(s):"},{"line_number":297,"context_line":"  Not Yet Identified"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Work Items"},{"line_number":300,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_7c6cd108","line":297,"range":{"start_line":293,"start_character":0,"end_line":297,"end_character":20},"in_reply_to":"9a629dbe_f3f1f496","updated":"2016-11-14 15:30:35.000000000","message":"It\u0027s not part of the ocata template:\n\nhttps://specs.openstack.org/openstack/nova-specs/specs/ocata/approved/ocata-template.html#implementation","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":315,"context_line":"validation, using the certificate verification context to validate the"},{"line_number":316,"context_line":"signing certificate."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Update novaclient to support the trusted_certificates parameter."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"* Update novaclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b5306557","line":318,"updated":"2016-11-12 18:33:22.000000000","message":"Hmm, nova CLI is supposed to be more or less deprecated, but because openstackclient doesn\u0027t yet support microversions we continue to add support to novaclient. So I guess this is OK.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":315,"context_line":"validation, using the certificate verification context to validate the"},{"line_number":316,"context_line":"signing certificate."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Update novaclient to support the trusted_certificates parameter."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"* Update novaclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_0d9f2160","line":318,"in_reply_to":"9a629dbe_7c3a11e9","updated":"2016-11-14 16:20:16.000000000","message":"Will do.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":315,"context_line":"validation, using the certificate verification context to validate the"},{"line_number":316,"context_line":"signing certificate."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Update novaclient to support the trusted_certificates parameter."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"* Update novaclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_f34d74c5","line":318,"in_reply_to":"9a629dbe_b5306557","updated":"2016-11-14 14:32:39.000000000","message":"I wasn\u0027t honestly sure if novaclient would need to be covered. I included it just to be safe but if it\u0027s not needed we can cut it out. Up to you.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":315,"context_line":"validation, using the certificate verification context to validate the"},{"line_number":316,"context_line":"signing certificate."},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Update novaclient to support the trusted_certificates parameter."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"* Update novaclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_7c3a11e9","line":318,"in_reply_to":"9a629dbe_f34d74c5","updated":"2016-11-14 15:30:35.000000000","message":"I\u0027d leave it in given the issues with OSC not supporting microversions yet. We\u0027d have to implement this in novaclient anyway because those have to be supported in order, i.e. if this was microversion 2.50, you can\u0027t add support for 2.51 to novaclient without also having 2.50 supported.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"},{"line_number":322,"context_line":"by the user."},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"* Update openstackclient to support the trusted_certificates parameter."},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"* Update openstackclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":327,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_353d352b","line":324,"updated":"2016-11-12 18:33:22.000000000","message":"re: above I\u0027m not entirely sure this will work until OSC supports microversions.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"},{"line_number":322,"context_line":"by the user."},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"* Update openstackclient to support the trusted_certificates parameter."},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"* Update openstackclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":327,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_fc2e21a4","line":324,"in_reply_to":"9a629dbe_06362db4","updated":"2016-11-14 15:30:35.000000000","message":"Yeah. I\u0027m mostly musing to myself here.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":321,"context_line":"environment variable when the trusted_certificates parameter is not provided"},{"line_number":322,"context_line":"by the user."},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"* Update openstackclient to support the trusted_certificates parameter."},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"* Update openstackclient to pull the value of the OS_TRUSTED_CERTIFICATE_IDS"},{"line_number":327,"context_line":"environment variable when the trusted_certificates parameter is not provided"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_06362db4","line":324,"in_reply_to":"9a629dbe_353d352b","updated":"2016-11-14 13:06:54.000000000","message":"Isn\u0027t this a general problem for Nova?","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e309acdaeb4b534c8a4b2e47b204f877d7055951","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_75432daf","line":334,"updated":"2016-11-12 18:33:22.000000000","message":"We\u0027re dependent on getting a gate-tempest-dsvm-security-ubuntu-xenial job defined which runs tempest with signed images and barbican as the key manager.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2bcdec9f32ba0b5356205c2d657d9e01a67cda13","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_52a45107","line":334,"range":{"start_line":334,"start_character":0,"end_line":334,"end_character":4},"updated":"2016-11-14 17:43:42.000000000","message":"What about castellan which was mentioned earlier.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"69f8b85a73206408445dc49428d6518cc29ef9e6","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_b3da1ce8","line":334,"in_reply_to":"9a629dbe_260971de","updated":"2016-11-14 14:32:39.000000000","message":"Ah, yep, should have added that. Will do.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00ab5c85917ae142101bc48b65e6fdebb30ab299","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_47257aac","line":334,"in_reply_to":"9a629dbe_260971de","updated":"2016-11-14 15:30:35.000000000","message":"FWIW I don\u0027t think there will be Tempest changes, maybe you meant QA blueprint, but I\u0027m not sure we even need a QA blueprint for creating a new job. It\u0027s just something we start working on and it can be an experimental queue job to start until we stabilize it.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"009c21588703b376f13eb3768a36920797fcfdc1","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_cd944946","line":334,"in_reply_to":"9a629dbe_47257aac","updated":"2016-11-14 16:20:16.000000000","message":"Well, it\u0027s likely the Tempest tests mentioned below in Testing will go into this new gate job. So it\u0027s a dependency for testing at least.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"4c816dc5b0d4e81d5811a460c7094cdfa4289e0b","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_260971de","line":334,"in_reply_to":"9a629dbe_75432daf","updated":"2016-11-14 13:06:54.000000000","message":"We will add this and reference the relevant tempest blueprint.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6bdbec7559ba75ce857ac493226281a032b2fc0e","unresolved":false,"context_lines":[{"line_number":331,"context_line":"Dependencies"},{"line_number":332,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"None"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_923ee927","line":334,"in_reply_to":"9a629dbe_cd944946","updated":"2016-11-14 17:46:03.000000000","message":"Oh right for the microversion, sure.","commit_id":"0f735c4fb2755008708f86f53815207f1976d193"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"334ac3038ec372a6f99772695361101bd5654ebf","unresolved":false,"context_lines":[{"line_number":424,"context_line":""},{"line_number":425,"context_line":"[2] \"Cursive.\" Online: https://launchpad.net/cursive"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"[3] \"Cleanup of signature_utils code.\" Online: https://blueprints.launchpad.net/nova/+spec/signture-utils-code-cleanup"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"[4] \"Use cursive for signature verification.\" Online: https://review.openstack.org/#/c/351232/"},{"line_number":430,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a71b18c_e0de2b6c","line":427,"range":{"start_line":427,"start_character":47,"end_line":427,"end_character":118},"updated":"2016-12-02 22:26:04.000000000","message":"Should this link be replaced with the following? https://blueprints.launchpad.net/nova/+spec/signature-code-cleanup","commit_id":"6f91d66c7c2feb55332295e72d3ef3c417274096"}],"specs/pike/approved/nova-certificate-validation.rst":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":85,"context_line":"certificates removes the need for an image/certificate mapping, simplifying"},{"line_number":86,"context_line":"the user experience. When provided, nova will pass these values to the"},{"line_number":87,"context_line":"signature verification routine, which will use them to fetch the trusted"},{"line_number":88,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":89,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":90,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":91,"context_line":"preserved with the server data."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_a3ab67d4","line":88,"updated":"2017-04-01 15:41:10.000000000","message":"s/is not required/is ignored by Nova/ ?","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":85,"context_line":"certificates removes the need for an image/certificate mapping, simplifying"},{"line_number":86,"context_line":"the user experience. When provided, nova will pass these values to the"},{"line_number":87,"context_line":"signature verification routine, which will use them to fetch the trusted"},{"line_number":88,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":89,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":90,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":91,"context_line":"preserved with the server data."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_d3e1812c","line":88,"in_reply_to":"dfeb2761_a3ab67d4","updated":"2017-04-03 13:33:12.000000000","message":"Done","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":88,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":89,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":90,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":91,"context_line":"preserved with the server data."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The second change adds a parameter, trusted_certificates, to the server"},{"line_number":94,"context_line":"rebuild command of the nova API. This parameter is identical to the parameter"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_83b8632a","line":91,"updated":"2017-04-01 15:41:10.000000000","message":"++ on this concept, however the fifth change below seems to contradict this principle of not storing the trusted cert IDs? In that change, you\u0027re storing the trusted cert IDs in the instance_extra table.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":88,"context_line":"certificates using castellan. This parameter is optional and is not required"},{"line_number":89,"context_line":"when booting a non-signed image. If provided, the value of the parameter is"},{"line_number":90,"context_line":"ephemeral and will persist for the duration of the request. It is not"},{"line_number":91,"context_line":"preserved with the server data."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"The second change adds a parameter, trusted_certificates, to the server"},{"line_number":94,"context_line":"rebuild command of the nova API. This parameter is identical to the parameter"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_d3686188","line":91,"in_reply_to":"dfeb2761_83b8632a","updated":"2017-04-03 13:33:12.000000000","message":"Yep, this bit was leftover from a prior draft. I\u0027ll modify it to match the storage approach.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":93,"context_line":"The second change adds a parameter, trusted_certificates, to the server"},{"line_number":94,"context_line":"rebuild command of the nova API. This parameter is identical to the parameter"},{"line_number":95,"context_line":"described in the first change above. This parameter is optional and is not"},{"line_number":96,"context_line":"required when rebuilding a non-signed image. If provided, the value of the"},{"line_number":97,"context_line":"parameter is ephemeral and will persist for the duration of the request. It"},{"line_number":98,"context_line":"is not preserved with the server data."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_63b55f31","line":96,"updated":"2017-04-01 15:41:10.000000000","message":"s/is not required/is ignored by Nova/","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":93,"context_line":"The second change adds a parameter, trusted_certificates, to the server"},{"line_number":94,"context_line":"rebuild command of the nova API. This parameter is identical to the parameter"},{"line_number":95,"context_line":"described in the first change above. This parameter is optional and is not"},{"line_number":96,"context_line":"required when rebuilding a non-signed image. If provided, the value of the"},{"line_number":97,"context_line":"parameter is ephemeral and will persist for the duration of the request. It"},{"line_number":98,"context_line":"is not preserved with the server data."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_930899d9","line":96,"in_reply_to":"dfeb2761_63b55f31","updated":"2017-04-03 13:33:12.000000000","message":"Done","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"6a5342736ddbe14d0bd05f03a550c6fb481036e3","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The third change adds a certificate verification context to conduct"},{"line_number":101,"context_line":"certificate validation. This work will live with the signature verification"},{"line_number":102,"context_line":"routine in signature_utils. The verification context stores an arbitrary set"},{"line_number":103,"context_line":"of certificates and uses them to validate individual certificates submitted"},{"line_number":104,"context_line":"for certificate validation. The context attempts to build a certificate chain"},{"line_number":105,"context_line":"for submitted certificates, cryptographically verifying that each parent"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_667e716c","line":102,"updated":"2017-04-03 13:38:24.000000000","message":"LOL, shows you how much I know about this area :)","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The third change adds a certificate verification context to conduct"},{"line_number":101,"context_line":"certificate validation. This work will live with the signature verification"},{"line_number":102,"context_line":"routine in signature_utils. The verification context stores an arbitrary set"},{"line_number":103,"context_line":"of certificates and uses them to validate individual certificates submitted"},{"line_number":104,"context_line":"for certificate validation. The context attempts to build a certificate chain"},{"line_number":105,"context_line":"for submitted certificates, cryptographically verifying that each parent"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_43849b5e","line":102,"updated":"2017-04-01 15:41:10.000000000","message":"signature_utils is an oslo library? external Python lib? in either case, would be nice to make it a link to whereever the code resides.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The third change adds a certificate verification context to conduct"},{"line_number":101,"context_line":"certificate validation. This work will live with the signature verification"},{"line_number":102,"context_line":"routine in signature_utils. The verification context stores an arbitrary set"},{"line_number":103,"context_line":"of certificates and uses them to validate individual certificates submitted"},{"line_number":104,"context_line":"for certificate validation. The context attempts to build a certificate chain"},{"line_number":105,"context_line":"for submitted certificates, cryptographically verifying that each parent"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_53ea11ac","line":102,"in_reply_to":"dfeb2761_43849b5e","updated":"2017-04-03 13:33:12.000000000","message":"signature_utils lives in Nova actually (/nova/signature_utils.py). Since both Glance and Nova used signature_utils originally, it was pulled out into Cursive. We\u0027re in the process of updating Nova to replace signature_utils with Cursive (see https://review.openstack.org/#/c/351232/).\n\nIf Cursive is integrated, the bulk of the certificate validation code will go into Cursive instead (see the first Alternative below).","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":103,"context_line":"of certificates and uses them to validate individual certificates submitted"},{"line_number":104,"context_line":"for certificate validation. The context attempts to build a certificate chain"},{"line_number":105,"context_line":"for submitted certificates, cryptographically verifying that each parent"},{"line_number":106,"context_line":"certificate in the chain has signed its child certificate. pyca/cryptography"},{"line_number":107,"context_line":"is used to conduct all certificate and cryptographic operations here. The"},{"line_number":108,"context_line":"context also checks various constraints to determine if a certificate is"},{"line_number":109,"context_line":"valid, including valid timestamp checks. If the context cannot build a valid"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_23899774","line":106,"updated":"2017-04-01 15:41:10.000000000","message":"Please make pyca/cryptography a link.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":103,"context_line":"of certificates and uses them to validate individual certificates submitted"},{"line_number":104,"context_line":"for certificate validation. The context attempts to build a certificate chain"},{"line_number":105,"context_line":"for submitted certificates, cryptographically verifying that each parent"},{"line_number":106,"context_line":"certificate in the chain has signed its child certificate. pyca/cryptography"},{"line_number":107,"context_line":"is used to conduct all certificate and cryptographic operations here. The"},{"line_number":108,"context_line":"context also checks various constraints to determine if a certificate is"},{"line_number":109,"context_line":"valid, including valid timestamp checks. If the context cannot build a valid"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_13c7e947","line":106,"in_reply_to":"dfeb2761_23899774","updated":"2017-04-03 13:33:12.000000000","message":"Done","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":117,"context_line":"changes above). It then passes the signing certificate through the context"},{"line_number":118,"context_line":"for certificate validation. If validation succeeds, signature verification"},{"line_number":119,"context_line":"can proceed as normal. If validation fails, signature verification fails as"},{"line_number":120,"context_line":"well and server creation is halted."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The fifth change updates the nova data model to support certificate"},{"line_number":123,"context_line":"validation during automatic server operations, like server evacuation and"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_037e936a","line":120,"updated":"2017-04-01 15:41:10.000000000","message":"s/and server creation is halted/, the server is placed in an ERROR state and a fault is returned to the user.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":117,"context_line":"changes above). It then passes the signing certificate through the context"},{"line_number":118,"context_line":"for certificate validation. If validation succeeds, signature verification"},{"line_number":119,"context_line":"can proceed as normal. If validation fails, signature verification fails as"},{"line_number":120,"context_line":"well and server creation is halted."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The fifth change updates the nova data model to support certificate"},{"line_number":123,"context_line":"validation during automatic server operations, like server evacuation and"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_d34aa1aa","line":120,"in_reply_to":"dfeb2761_037e936a","updated":"2017-04-03 13:33:12.000000000","message":"Done","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The fifth change updates the nova data model to support certificate"},{"line_number":123,"context_line":"validation during automatic server operations, like server evacuation and"},{"line_number":124,"context_line":"cold or live migrations. To support these cases, the trusted certificate IDs"},{"line_number":125,"context_line":"used for certificate validation must be stored with the instance data, since"},{"line_number":126,"context_line":"the user cannot be expected to provide them. The InstanceExtra functionality"},{"line_number":127,"context_line":"in nova already supports keypairs associated with instances. This change will"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_e3828f4f","line":124,"updated":"2017-04-01 15:41:10.000000000","message":"cold migration is not an automatic server operation. Neither actually is server evacuation (which is a rebuild operation). I think perhaps you might change the wording here from \"automatic\" to something like \"operations that may be done by an admin against the server without all the information the end user originally supplied to the nova boot command\"?","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The fifth change updates the nova data model to support certificate"},{"line_number":123,"context_line":"validation during automatic server operations, like server evacuation and"},{"line_number":124,"context_line":"cold or live migrations. To support these cases, the trusted certificate IDs"},{"line_number":125,"context_line":"used for certificate validation must be stored with the instance data, since"},{"line_number":126,"context_line":"the user cannot be expected to provide them. The InstanceExtra functionality"},{"line_number":127,"context_line":"in nova already supports keypairs associated with instances. This change will"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_73d195cd","line":124,"in_reply_to":"dfeb2761_e3828f4f","updated":"2017-04-03 13:33:12.000000000","message":"Done","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"569df614061c96cfa7c7a28a91b9c3f7c1367708","unresolved":false,"context_lines":[{"line_number":250,"context_line":"                \"My Server Name\": \"Example Signed Server\""},{"line_number":251,"context_line":"            }"},{"line_number":252,"context_line":"        }"},{"line_number":253,"context_line":"    }"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":256,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_c3978b90","line":253,"updated":"2017-04-01 15:41:10.000000000","message":"++ to above REST API changes. Very sensible. I\u0027d like to see the trusted-flavors spec use a similar approach instead of coupling the image signature verification to flavors.","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"3c112eefe2a7a253b724800557d4d8868ace8c72","unresolved":false,"context_lines":[{"line_number":250,"context_line":"                \"My Server Name\": \"Example Signed Server\""},{"line_number":251,"context_line":"            }"},{"line_number":252,"context_line":"        }"},{"line_number":253,"context_line":"    }"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":256,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dfeb2761_13ffe934","line":253,"in_reply_to":"dfeb2761_c3978b90","updated":"2017-04-03 13:33:12.000000000","message":"Thanks Jay!","commit_id":"5212836fd402fe2460c9a73290699a74200cbc5c"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"78dfeec3ccf008707af7187b8da7e1273795f28e","unresolved":false,"context_lines":[{"line_number":261,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"},{"line_number":262,"context_line":"ID allocation schemes; while some use strict UUIDs, others use simple"},{"line_number":263,"context_line":"incrementing integers or raw hex strings. For this feature, the type of"},{"line_number":264,"context_line":"trusted_certificates will be an array containing zero or more xsd:string"},{"line_number":265,"context_line":"values."},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"The following is a JSON schema description of the trusted_certificates"}],"source_content_type":"text/x-rst","patch_set":12,"id":"bff0334d_9dfbc245","line":264,"updated":"2017-04-10 14:59:07.000000000","message":"it\u0027s not XSD:string. It\u0027s just a JSON string type, but meh... :)","commit_id":"be5989a2c1dadfd294ab51516d4a8ac2f34576de"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":132,"context_line":"the instance data, since the user cannot be expected to provide them. The"},{"line_number":133,"context_line":"InstanceExtra functionality in nova already supports keypairs associated with"},{"line_number":134,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":135,"context_line":"trusted_certificate_ids column, which will contain the JSON blob from the"},{"line_number":136,"context_line":"server request containing the trusted certificate IDs."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"The sixth change updates the novaclient/openstackclient to support the"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_1972067c","line":135,"range":{"start_line":135,"start_character":55,"end_line":135,"end_character":64},"updated":"2017-04-11 11:00:42.000000000","message":"It would be nice to confirm this is a serialised versioned object.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"46903292ee1c3b4efeb0b34c0b2e8a4f6efa39de","unresolved":false,"context_lines":[{"line_number":132,"context_line":"the instance data, since the user cannot be expected to provide them. The"},{"line_number":133,"context_line":"InstanceExtra functionality in nova already supports keypairs associated with"},{"line_number":134,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":135,"context_line":"trusted_certificate_ids column, which will contain the JSON blob from the"},{"line_number":136,"context_line":"server request containing the trusted certificate IDs."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"The sixth change updates the novaclient/openstackclient to support the"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_eee8b37c","line":135,"range":{"start_line":135,"start_character":55,"end_line":135,"end_character":64},"in_reply_to":"bff0334d_1972067c","updated":"2017-04-11 13:42:36.000000000","message":"An oslo versionedobject? Can you provide more info? I\u0027m not that familiar with them.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":148,"context_line":"variable, there is no way for nova to obtain a trusted certificate for"},{"line_number":149,"context_line":"certificate validation. In this case there would be no way to determine if"},{"line_number":150,"context_line":"the image\u0027s signing certificate is trusted so signature verification would"},{"line_number":151,"context_line":"fail, in turn failing server creation."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Alternatives"},{"line_number":154,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_39fa6abc","line":151,"updated":"2017-04-11 11:00:42.000000000","message":"How does this relate to microversions? If a user boots an signed image today and it works, after this upgrade they must switch to the new microversion in order to boot the image at all?\n\nI am surprised we don\u0027t have a default list of certs. I would expect us to trust by default all the base images in the system that may be signed by the operators cert, which we could trust by default. I was thinking a configuration value with a list of uuids.\n\nWhen a user specifies the list, it would replace any default list we may have, there is no union of lists that is done. So we should get the same behaviour, but with a slightly smoother bump. I think?","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"e1ffd5b64637bf53a86ccf82e7024ffbee1adb16","unresolved":false,"context_lines":[{"line_number":148,"context_line":"variable, there is no way for nova to obtain a trusted certificate for"},{"line_number":149,"context_line":"certificate validation. In this case there would be no way to determine if"},{"line_number":150,"context_line":"the image\u0027s signing certificate is trusted so signature verification would"},{"line_number":151,"context_line":"fail, in turn failing server creation."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Alternatives"},{"line_number":154,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_ee443376","line":151,"in_reply_to":"bff0334d_2ee0dbcc","updated":"2017-04-11 13:44:13.000000000","message":"Sorry, I see what you mean now. Adding in the enable/disable flag will handle this.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"46903292ee1c3b4efeb0b34c0b2e8a4f6efa39de","unresolved":false,"context_lines":[{"line_number":148,"context_line":"variable, there is no way for nova to obtain a trusted certificate for"},{"line_number":149,"context_line":"certificate validation. In this case there would be no way to determine if"},{"line_number":150,"context_line":"the image\u0027s signing certificate is trusted so signature verification would"},{"line_number":151,"context_line":"fail, in turn failing server creation."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Alternatives"},{"line_number":154,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_2ee0dbcc","line":151,"in_reply_to":"bff0334d_39fa6abc","updated":"2017-04-11 13:42:36.000000000","message":"The API updates will be done under a new microversion, so if a deployment has not upgraded signed images should still boot just fine.\n\nI\u0027m fine with adding in a default, overrideable list of certs.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":194,"context_line":"revocation could be integrated outside of the compute service, for example"},{"line_number":195,"context_line":"within the certificate manager or through another third-party service. This"},{"line_number":196,"context_line":"would grant nova the benefits of timely revocation without complicating the"},{"line_number":197,"context_line":"signature verification and certificate validation features in nova itself."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"It should be noted here that support for certificate revocation is intended"},{"line_number":200,"context_line":"to be added in future work for this feature."}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_b9b9dacc","line":197,"updated":"2017-04-11 11:00:42.000000000","message":"++ doing that outside of Nova, ideally in a transparent way (maybe just a disable CRL flag in Nova, or something).","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":264,"context_line":"    {"},{"line_number":265,"context_line":"        \"type\": \"array\","},{"line_number":266,"context_line":"        \"minItems\": 0,"},{"line_number":267,"context_line":"        \"maxItems\": 50,"},{"line_number":268,"context_line":"        \"uniqueItems\": true,"},{"line_number":269,"context_line":"        \"items\": {"},{"line_number":270,"context_line":"            \"type\": \"string\""}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_d9013e08","line":267,"updated":"2017-04-11 11:00:42.000000000","message":"Thanks. That seems good, making it the same as tags.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":331,"context_line":"certificates, and the frequency of signature verification, this could"},{"line_number":332,"context_line":"introduce a performance burden on the compute service. To alleviate this, see"},{"line_number":333,"context_line":"Alternatives above regarding a persistent certificate trust store and"},{"line_number":334,"context_line":"dynamically loading certificates from remote storage."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"Other deployer impact"},{"line_number":337,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_193d662a","line":334,"updated":"2017-04-11 11:00:42.000000000","message":"I was assuming the library would consider implementing some level of local caching, as seems appropriate. This all seems like something Nova shouldn\u0027t worry about, which I guess is the main thing.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":338,"context_line":""},{"line_number":339,"context_line":"All prior usage of the server create/rebuild API when booting signed images"},{"line_number":340,"context_line":"will now fail if the corresponding trusted_certificates parameter is not"},{"line_number":341,"context_line":"provided with the request."},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"Developer impact"},{"line_number":344,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_59d3eed5","line":341,"updated":"2017-04-11 11:00:42.000000000","message":"I would really rather we didn\u0027t have this big bump.\n\nCould we not have a configuration to disable the checking, and deprecate that configuration, just to allow for a smooth upgrade.\n\nI would feel happier about this if we had a \"default\" list of trusted certs for those that don\u0027t specify the override. I know that doesn\u0027t work for a bunch of users, but we default to an empty list of trust, which gives you the same behaviour you have here.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"46903292ee1c3b4efeb0b34c0b2e8a4f6efa39de","unresolved":false,"context_lines":[{"line_number":338,"context_line":""},{"line_number":339,"context_line":"All prior usage of the server create/rebuild API when booting signed images"},{"line_number":340,"context_line":"will now fail if the corresponding trusted_certificates parameter is not"},{"line_number":341,"context_line":"provided with the request."},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"Developer impact"},{"line_number":344,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_4e8c3fd6","line":341,"in_reply_to":"bff0334d_59d3eed5","updated":"2017-04-11 13:42:36.000000000","message":"I\u0027m fine with adding both conf options. I\u0027ll fold those in.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ffbde2e138241bd6bfa4fdbad90a47baa55ced69","unresolved":false,"context_lines":[{"line_number":446,"context_line":"  * - Pike"},{"line_number":447,"context_line":"    - Re-proposed for official review"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Newton"},{"line_number":450,"context_line":"------"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":"The initial version of this spec was released towards the end of the Newton"},{"line_number":453,"context_line":"development cycle in preparation for Ocata, focusing on a certificate trust"},{"line_number":454,"context_line":"store implementation rooted on the compute host filesystem and managed by the"},{"line_number":455,"context_line":"cloud administrator. Versions 2, 3, and 4 involved minor formatting and"},{"line_number":456,"context_line":"grammatical updates."},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"Version 5 received feedback from the nova core team, focusing specifically"},{"line_number":459,"context_line":"on (1) the need for tighter integration between trusted certificate"},{"line_number":460,"context_line":"management and tenant users, and (2) the potential scalability issues with"},{"line_number":461,"context_line":"distributed certificate file management across large clouds. Further feedback"},{"line_number":462,"context_line":"was also solicited from the community through a post to the openstack-dev"},{"line_number":463,"context_line":"mailing list [7]."},{"line_number":464,"context_line":""},{"line_number":465,"context_line":"Version 6 updated the proposed approach, preserving the filesystem-based"},{"line_number":466,"context_line":"certificate trust store while adding an update to the nova API. This API"},{"line_number":467,"context_line":"change allowed users to specify the trusted certificate ID when creating new"},{"line_number":468,"context_line":"instances."},{"line_number":469,"context_line":""},{"line_number":470,"context_line":"Ocata"},{"line_number":471,"context_line":"-----"},{"line_number":472,"context_line":""},{"line_number":473,"context_line":"Version 7 incorporated feedback received from the Ocata Design Summit,"},{"line_number":474,"context_line":"officially removing the filesystem-based certificate trust store approach"},{"line_number":475,"context_line":"and focusing solely on updating the nova API to allow the user to submit"},{"line_number":476,"context_line":"a set of trusted certificate IDs when creating new instances."},{"line_number":477,"context_line":""},{"line_number":478,"context_line":"Version 8 addressed further feedback from the nova core team, including:"},{"line_number":479,"context_line":""},{"line_number":480,"context_line":"* highlighting a dependency on barbican as the only supported castellan"},{"line_number":481,"context_line":"  backend"},{"line_number":482,"context_line":"* updating the nova API changes to include the rebuild operation"},{"line_number":483,"context_line":"* updating the nova data model to support storing the set of trusted"},{"line_number":484,"context_line":"  certificate IDs with the instance data in instance_extras, thereby"},{"line_number":485,"context_line":"  supporting automatic operations like instance evacuation and cold/live"},{"line_number":486,"context_line":"  migrations"},{"line_number":487,"context_line":""},{"line_number":488,"context_line":"Pike"},{"line_number":489,"context_line":"----"},{"line_number":490,"context_line":"Version 9 duplicated Version 8 as a clean slate for the Pike review process."},{"line_number":491,"context_line":"Version 10 addressed minor whitespace and spec formatting errors."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Version 11 added the new History section from the Pike spec template and"},{"line_number":494,"context_line":"incorporated feedback received on Version 9, clarifying API details and"},{"line_number":495,"context_line":"reordering the Security, Other end user, and Other deployer impact sections."},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Version 12 addressed further reviewer feedback, clarifying nova handling of"},{"line_number":498,"context_line":"the API changes and resolving discrepancies in spec details."},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"Version 13 updated the spec to reflect the integration of cursive into nova,"},{"line_number":501,"context_line":"moving the certificate validation code to cursive."}],"source_content_type":"text/x-rst","patch_set":13,"id":"bff0334d_79e7d2ad","line":501,"range":{"start_line":449,"start_character":0,"end_line":501,"end_character":50},"updated":"2017-04-11 11:00:42.000000000","message":"This seems like too much detail, we don\u0027t normally include this.","commit_id":"79a1152bfc37dedc777f5568c9663b4d40268007"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cad1f4cef485c8069ce2862d6e6742d87474213","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Supporting certificate validation requires several changes. The initial change"},{"line_number":80,"context_line":"adds a pair of new configuration options. The first configuration option,"},{"line_number":81,"context_line":"enable_certificate_validation, will enable the use of the cursive certificate"},{"line_number":82,"context_line":"validation routine when conducting image signature verification (see the"},{"line_number":83,"context_line":"fifth change below). This option will only be used if verify_glance_signatures"},{"line_number":84,"context_line":"is set to True and will default to False, allowing signature verification to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ff52f3f_1a805f8b","line":81,"range":{"start_line":81,"start_character":0,"end_line":81,"end_character":29},"updated":"2017-04-13 12:42:01.000000000","message":"Did we want to deprecate this already, noting that it is just here to help with the upgrade?\n\nAlthough... honestly, lets see what makes sense later.","commit_id":"0f1f9d690c316d8a48cea81655732d2911906c44"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cad1f4cef485c8069ce2862d6e6742d87474213","unresolved":false,"context_lines":[{"line_number":253,"context_line":"            \"name\": \"example-name\","},{"line_number":254,"context_line":"            \"imageRef\": \"70a599e0-31e7-49b7-b260-868f441e862b\","},{"line_number":255,"context_line":"            \"flavorRef\": \"http://openstack.example.com/flavors/1\","},{"line_number":256,"context_line":"            \"trusted_certificates\": ["},{"line_number":257,"context_line":"                \"00000000-0000-0000-0000-000000000000\","},{"line_number":258,"context_line":"                \"11111111-1111-1111-1111-111111111111\","},{"line_number":259,"context_line":"                \"22222222-2222-2222-2222-222222222222\""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ff52f3f_9a822fc8","line":256,"updated":"2017-04-13 12:42:01.000000000","message":"So if the user specifies the trusted_certificates, I think above you say we just ignore them.\n\nI am tempted to say we should return a 400 Bad Request error if a user requests the trusted_certificates and the certificate verification is disabled. ... but that does start to break the idea of setting it in an environment variable.\n\nMaybe this is fine as it is, lets try it.","commit_id":"0f1f9d690c316d8a48cea81655732d2911906c44"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cad1f4cef485c8069ce2862d6e6742d87474213","unresolved":false,"context_lines":[{"line_number":307,"context_line":"in the trusted_certificates parameter. If an API call is made for a signed"},{"line_number":308,"context_line":"image and exceeds the maximum number of allowed certificate IDs, then the"},{"line_number":309,"context_line":"API call will fail."},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"Security impact"},{"line_number":312,"context_line":"---------------"},{"line_number":313,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ff52f3f_9ad0efcb","line":310,"updated":"2017-04-13 12:42:01.000000000","message":"I wonder if there is an upgrade thing here too. This API should return 400 until all compute nodes are running a version that takes the new trusted_certificates parameter?\n\nBut given we are generally just ignoring them, I think we are fine just accepting them.","commit_id":"0f1f9d690c316d8a48cea81655732d2911906c44"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"628fe64636706d07a0e09f5c966e5cb01b3ab61b","unresolved":false,"context_lines":[{"line_number":541,"context_line":""},{"line_number":542,"context_line":"Version 14 added support for two new configuration options to smooth the"},{"line_number":543,"context_line":"transition to use for certificate validation, in addition to clarifying the"},{"line_number":544,"context_line":"use of oslo versionedobjects for the modification to InstanceExtra."}],"source_content_type":"text/x-rst","patch_set":14,"id":"7ffa3b31_8683fc04","line":544,"updated":"2017-04-14 16:42:57.000000000","message":"Actually, I quite like the added detail and history. Gives me some information on how thinking has changed over time.","commit_id":"0f1f9d690c316d8a48cea81655732d2911906c44"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cad1f4cef485c8069ce2862d6e6742d87474213","unresolved":false,"context_lines":[{"line_number":485,"context_line":"  * - Pike"},{"line_number":486,"context_line":"    - Re-proposed for official review"},{"line_number":487,"context_line":""},{"line_number":488,"context_line":"Newton"},{"line_number":489,"context_line":"------"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"The initial version of this spec was released towards the end of the Newton"},{"line_number":492,"context_line":"development cycle in preparation for Ocata, focusing on a certificate trust"},{"line_number":493,"context_line":"store implementation rooted on the compute host filesystem and managed by the"},{"line_number":494,"context_line":"cloud administrator. Versions 2, 3, and 4 involved minor formatting and"},{"line_number":495,"context_line":"grammatical updates."},{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Version 5 received feedback from the nova core team, focusing specifically"},{"line_number":498,"context_line":"on (1) the need for tighter integration between trusted certificate"},{"line_number":499,"context_line":"management and tenant users, and (2) the potential scalability issues with"},{"line_number":500,"context_line":"distributed certificate file management across large clouds. Further feedback"},{"line_number":501,"context_line":"was also solicited from the community through a post to the openstack-dev"},{"line_number":502,"context_line":"mailing list [7]."},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"Version 6 updated the proposed approach, preserving the filesystem-based"},{"line_number":505,"context_line":"certificate trust store while adding an update to the nova API. This API"},{"line_number":506,"context_line":"change allowed users to specify the trusted certificate ID when creating new"},{"line_number":507,"context_line":"instances."},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"Ocata"},{"line_number":510,"context_line":"-----"},{"line_number":511,"context_line":""},{"line_number":512,"context_line":"Version 7 incorporated feedback received from the Ocata Design Summit,"},{"line_number":513,"context_line":"officially removing the filesystem-based certificate trust store approach"},{"line_number":514,"context_line":"and focusing solely on updating the nova API to allow the user to submit"},{"line_number":515,"context_line":"a set of trusted certificate IDs when creating new instances."},{"line_number":516,"context_line":""},{"line_number":517,"context_line":"Version 8 addressed further feedback from the nova core team, including:"},{"line_number":518,"context_line":""},{"line_number":519,"context_line":"* highlighting a dependency on barbican as the only supported castellan"},{"line_number":520,"context_line":"  backend"},{"line_number":521,"context_line":"* updating the nova API changes to include the rebuild operation"},{"line_number":522,"context_line":"* updating the nova data model to support storing the set of trusted"},{"line_number":523,"context_line":"  certificate IDs with the instance data in instance_extras, thereby"},{"line_number":524,"context_line":"  supporting automatic operations like instance evacuation and cold/live"},{"line_number":525,"context_line":"  migrations"},{"line_number":526,"context_line":""},{"line_number":527,"context_line":"Pike"},{"line_number":528,"context_line":"----"},{"line_number":529,"context_line":"Version 9 duplicated Version 8 as a clean slate for the Pike review process."},{"line_number":530,"context_line":"Version 10 addressed minor whitespace and spec formatting errors."},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"Version 11 added the new History section from the Pike spec template and"},{"line_number":533,"context_line":"incorporated feedback received on Version 9, clarifying API details and"},{"line_number":534,"context_line":"reordering the Security, Other end user, and Other deployer impact sections."},{"line_number":535,"context_line":""},{"line_number":536,"context_line":"Version 12 addressed further reviewer feedback, clarifying nova handling of"},{"line_number":537,"context_line":"the API changes and resolving discrepancies in spec details."},{"line_number":538,"context_line":""},{"line_number":539,"context_line":"Version 13 updated the spec to reflect the integration of cursive into nova,"},{"line_number":540,"context_line":"moving the certificate validation code to cursive."},{"line_number":541,"context_line":""},{"line_number":542,"context_line":"Version 14 added support for two new configuration options to smooth the"},{"line_number":543,"context_line":"transition to use for certificate validation, in addition to clarifying the"},{"line_number":544,"context_line":"use of oslo versionedobjects for the modification to InstanceExtra."}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ff52f3f_25ae682e","line":544,"range":{"start_line":488,"start_character":0,"end_line":544,"end_character":67},"updated":"2017-04-13 12:42:01.000000000","message":"I am still tempted to delete this bit.","commit_id":"0f1f9d690c316d8a48cea81655732d2911906c44"}]}