)]}'
{"specs/pike/approved/nova-certificate-validation.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":70,"context_line":"requirements for a certificate manager. In the future, any OpenStack or"},{"line_number":71,"context_line":"third-party service that is supported by castellan and provides certificate"},{"line_number":72,"context_line":"management could be used instead of barbican."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Proposed change"},{"line_number":75,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_b470bcdd","line":73,"updated":"2017-03-21 16:47:29.000000000","message":"If the user doesn\u0027t specify any certificates, it seems to make sense to have a default set of validations the system can make?\n\nI get why you want the user to specify exactly who/what they trust, but it seems good to start off with the system saying what it trusts.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":70,"context_line":"requirements for a certificate manager. In the future, any OpenStack or"},{"line_number":71,"context_line":"third-party service that is supported by castellan and provides certificate"},{"line_number":72,"context_line":"management could be used instead of barbican."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Proposed change"},{"line_number":75,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_53504232","line":73,"in_reply_to":"1a1ced50_b470bcdd","updated":"2017-03-22 17:52:49.000000000","message":"Using a default compute node trust store was part of the original proposal for this feature but discussions with the core team deemed it impractical for various reasons, including cloud-wide scalability, admin management, user legibility, etc.\n\nWe also received feedback that this feature should be tightly tied to the user, to ensure that the user can trust the image being verified. A default trust store would be under the control of the cloud admin(s) and not the users.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":154,"context_line":"already been proposed [4]. If cursive is integrated into nova before the"},{"line_number":155,"context_line":"certificate validation work is completed, all changes pertaining to"},{"line_number":156,"context_line":"signature_utils and certificate validation will be made to cursive instead."},{"line_number":157,"context_line":"This includes the creation and usage of the certificate verification context."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"An alternative approach to certificate validation here would be to support"},{"line_number":160,"context_line":"certificate trust stores, collections of trusted certificates associated with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_62f8414a","line":157,"updated":"2017-03-21 16:47:29.000000000","message":"Why are we not talking this approach? This makes lots of sense to me, particularly when it comes to all the optimisations and CRL checks, etc.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":154,"context_line":"already been proposed [4]. If cursive is integrated into nova before the"},{"line_number":155,"context_line":"certificate validation work is completed, all changes pertaining to"},{"line_number":156,"context_line":"signature_utils and certificate validation will be made to cursive instead."},{"line_number":157,"context_line":"This includes the creation and usage of the certificate verification context."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"An alternative approach to certificate validation here would be to support"},{"line_number":160,"context_line":"certificate trust stores, collections of trusted certificates associated with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_f3acce8d","line":157,"in_reply_to":"1a1ced50_62f8414a","updated":"2017-03-22 17:52:49.000000000","message":"The primary reason is because cursive is not yet integrated into nova. If/once it is, then yes, this work would naturally leverage and extend cursive\u0027s capabilities.\n\nGiven nova still uses its own signature_utils, this option is simply an alternative.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"3a3309fa06be130df75bf8cfb72c9a7ba90410c6","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"The InstanceExtra database model will be updated to include a new text"},{"line_number":209,"context_line":"column, trusted_certificate_ids, which will contain the JSON blob of the"},{"line_number":210,"context_line":"trusted certificate IDs provided with server create/rebuild requests."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"REST API impact"},{"line_number":213,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_7db5db2f","line":210,"updated":"2017-03-06 18:16:33.000000000","message":"Is a JSON blob the best option here? I assume this is to avoid having yet another table off a 1:n relationship?","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"The InstanceExtra database model will be updated to include a new text"},{"line_number":209,"context_line":"column, trusted_certificate_ids, which will contain the JSON blob of the"},{"line_number":210,"context_line":"trusted certificate IDs provided with server create/rebuild requests."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"REST API impact"},{"line_number":213,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_53bcc2ba","line":210,"in_reply_to":"1a1ced50_b447dc75","updated":"2017-03-22 17:52:49.000000000","message":"That\u0027s fine by me, I\u0027ll move it back over.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"The InstanceExtra database model will be updated to include a new text"},{"line_number":209,"context_line":"column, trusted_certificate_ids, which will contain the JSON blob of the"},{"line_number":210,"context_line":"trusted certificate IDs provided with server create/rebuild requests."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"REST API impact"},{"line_number":213,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_b447dc75","line":210,"in_reply_to":"ba2be162_19806c46","updated":"2017-03-21 16:47:29.000000000","message":"Hmm, we really should be continuing the discussion on the original change of https://review.openstack.org/#/c/357151 so we all have the full context here.\n\nPlease restore that old change, and push this patch on top of that existing thread.\n\nI assume this is a o.vo that is a list object.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"a6366d7bb11f7e5f87d0a179cd1d357edc96f9c5","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"The InstanceExtra database model will be updated to include a new text"},{"line_number":209,"context_line":"column, trusted_certificate_ids, which will contain the JSON blob of the"},{"line_number":210,"context_line":"trusted certificate IDs provided with server create/rebuild requests."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"REST API impact"},{"line_number":213,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_19806c46","line":210,"in_reply_to":"ba2be162_7db5db2f","updated":"2017-03-06 21:14:45.000000000","message":"This was recommended by Matt Riedemann during discussions on Patch Set 7 of the ocata version of the spec (see https://review.openstack.org/#/c/357151/7/specs/ocata/approved/nova-certificate-validation.rst under the \"Other end user impact\" section).\n\nIn short, yes. We don\u0027t want to add another table or dedicated Certificate resource but we need the certificate IDs to persist with the instance data. Since instance keypairs are currently stored in instance_extras, it seemed reasonable to store the certificate IDs there as well.\n\nAs for the format, I\u0027m open to other options but a blob of some sort is required to avoid more significant database changes.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":274,"context_line":"}"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Note that there is no upper limit being proposed for the number of"},{"line_number":277,"context_line":"certificate IDs included in the trusted_certificates parameter."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Security impact"},{"line_number":280,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_34020c0c","line":277,"updated":"2017-03-21 16:47:29.000000000","message":"Thats bad, can\u0027t we just have a limit of 50, or something like that?\n\nI don\u0027t like unbounded DB growth.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":274,"context_line":"}"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Note that there is no upper limit being proposed for the number of"},{"line_number":277,"context_line":"certificate IDs included in the trusted_certificates parameter."},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Security impact"},{"line_number":280,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_33e026cd","line":277,"in_reply_to":"1a1ced50_34020c0c","updated":"2017-03-22 17:52:49.000000000","message":"I\u0027m fine with imposing whatever limit is deemed acceptable.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":340,"context_line":"Other deployer impact"},{"line_number":341,"context_line":"---------------------"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"None"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"Developer impact"},{"line_number":346,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_424d05c3","line":343,"updated":"2017-03-21 16:47:29.000000000","message":"Maybe see security impact about the migration challenges?","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":340,"context_line":"Other deployer impact"},{"line_number":341,"context_line":"---------------------"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"None"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":"Developer impact"},{"line_number":346,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_13d6caf0","line":343,"in_reply_to":"1a1ced50_424d05c3","updated":"2017-03-22 17:52:49.000000000","message":"Done","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1cc5e1f4995ac71c9d5d8ed94d776c0ee7957134","unresolved":false,"context_lines":[{"line_number":362,"context_line":""},{"line_number":363,"context_line":"* Add a new nova API parameter, trusted_certificates, to the server create"},{"line_number":364,"context_line":"command. The value of this parameter will need to be passed through to the"},{"line_number":365,"context_line":"signature verification step when downloading the image from glance."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"* Define the certificate verification context class, in addition to various"},{"line_number":368,"context_line":"utility functions used to inspect and make decisions on certificate"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_225e4944","line":365,"updated":"2017-03-21 16:47:29.000000000","message":"Nit: this should be the last step, before the client work, to expose the feature via the API.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"927029d5322f0ccc8a6a278eac14adfe2c55b41e","unresolved":false,"context_lines":[{"line_number":362,"context_line":""},{"line_number":363,"context_line":"* Add a new nova API parameter, trusted_certificates, to the server create"},{"line_number":364,"context_line":"command. The value of this parameter will need to be passed through to the"},{"line_number":365,"context_line":"signature verification step when downloading the image from glance."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"* Define the certificate verification context class, in addition to various"},{"line_number":368,"context_line":"utility functions used to inspect and make decisions on certificate"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a1ced50_b3fb3678","line":365,"in_reply_to":"1a1ced50_225e4944","updated":"2017-03-22 17:52:49.000000000","message":"Good point, I\u0027ll move it.","commit_id":"083cdecab2e59ecaa5ab7e664516f1c7a18da7d6"}]}