)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"e7d1e2ea85f5a10b925106b9624b229a95a42e51","unresolved":false,"context_lines":[{"line_number":20,"context_line":"APIImpact"},{"line_number":21,"context_line":"DocImpact"},{"line_number":22,"context_line":"SecurityImpact"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Change-Id: I121b2e7641c77a4872a1e801eb039050e6a996ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"df3967d1_713698b7","line":23,"updated":"2017-07-28 17:31:15.000000000","message":"You should add the \"Previously-approved: Pike\" tag (see https://github.com/openstack/nova-specs/blob/master/README.rst#previously-approved-specifications )","commit_id":"bd4af8dfb7a57049e171bf36c89ebb667d003008"}],"specs/queens/approved/nova-certificate-validation.rst":[{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"54e6a7e33481cf546ee8a49b76ac43a93f70ca91","unresolved":false,"context_lines":[{"line_number":342,"context_line":"An example openrc file is shown below, using the same trusted certificate IDs"},{"line_number":343,"context_line":"as those used in the API example (see REST API Impact above):"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":".. code-block:: javascript"},{"line_number":346,"context_line":""},{"line_number":347,"context_line":"    export OS_USERNAME\u003dusername"},{"line_number":348,"context_line":"    export OS_PASSWORD\u003dpassword"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9f436f4f_09ea0f0e","line":345,"updated":"2017-08-11 10:50:59.000000000","message":"probably doesnt matter, but this is not javascript :)","commit_id":"beda550f103b1218e4d92bb3901158b3e19c088d"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"f4f9b281c2170ce712cb5edf80ebc82a5cefcc73","unresolved":false,"context_lines":[{"line_number":342,"context_line":"An example openrc file is shown below, using the same trusted certificate IDs"},{"line_number":343,"context_line":"as those used in the API example (see REST API Impact above):"},{"line_number":344,"context_line":""},{"line_number":345,"context_line":".. code-block:: javascript"},{"line_number":346,"context_line":""},{"line_number":347,"context_line":"    export OS_USERNAME\u003dusername"},{"line_number":348,"context_line":"    export OS_PASSWORD\u003dpassword"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9f436f4f_d9a59ea3","line":345,"in_reply_to":"9f436f4f_09ea0f0e","updated":"2017-08-15 17:08:54.000000000","message":"Good point, I\u0027ll change it to \u0027bash\u0027.","commit_id":"beda550f103b1218e4d92bb3901158b3e19c088d"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":32,"context_line":"corresponding certificate, verify the image signature, and proceed to boot a"},{"line_number":33,"context_line":"virtual machine using the malicious image data. Providing support for"},{"line_number":34,"context_line":"certificate validation in cursive helps nova detect this attack scenario and"},{"line_number":35,"context_line":"take steps to alert the user of the potential compromise."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Note that this threat model considers glance to be untrusted and does not"},{"line_number":38,"context_line":"include threats to the integrity, availability, or confidentiality of nova. It"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_0a9dc265","line":35,"updated":"2017-10-04 12:27:25.000000000","message":"+1","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":39,"context_line":"assumes that: (1) an attacker has access to the certificate manager and is"},{"line_number":40,"context_line":"able to store certificates for use with image signing, and (2) this attacker"},{"line_number":41,"context_line":"is unable to access arbitrary certificate public/private key pairs belonging"},{"line_number":42,"context_line":"to other users. An attacker with such access would be able to impersonate the"},{"line_number":43,"context_line":"user, replacing signed images and perfectly updating the corresponding image"},{"line_number":44,"context_line":"signatures and metadata as needed to conceal the attack."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Use Cases"},{"line_number":47,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_8a82d2ff","line":44,"range":{"start_line":42,"start_character":16,"end_line":44,"end_character":56},"updated":"2017-10-04 12:27:25.000000000","message":"ack.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"5cd38b41bb0c9a8a7bbb4ea9eb6cb2523b479ecb","unresolved":false,"context_lines":[{"line_number":84,"context_line":"is set to True and will default to False, allowing signature verification to"},{"line_number":85,"context_line":"work without certificate validation until a compute deployment has fully"},{"line_number":86,"context_line":"upgraded. Certificate validation will only be performed if this option is set"},{"line_number":87,"context_line":"to True."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The second configuration option, default_trusted_certificate_ids, will contain"},{"line_number":90,"context_line":"a list of certificate IDs that are designated as trusted by the compute"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_b075cafc","line":87,"updated":"2017-10-05 19:52:00.000000000","message":"In looking through the code, I get worried that there is going to be a scenario here where a misconfigured cloud ends up letting people pass certificates in, but silently throws them away. Giving the wrong expectations to the user.\n\nI would expect if I pass a parameter in to validate using the following certs, the request either succeeds, or fails super hard and fast letting me know it can\u0027t do that.\n\nIn the past when we\u0027ve had items like this that can\u0027t really downgrade, we put it in a microversion, then test against minimum service version, to ensure all computes can support the feature before we allow it to pass.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"46316a60dcd633e5ed2544439bd72a9ce9a432b2","unresolved":false,"context_lines":[{"line_number":84,"context_line":"is set to True and will default to False, allowing signature verification to"},{"line_number":85,"context_line":"work without certificate validation until a compute deployment has fully"},{"line_number":86,"context_line":"upgraded. Certificate validation will only be performed if this option is set"},{"line_number":87,"context_line":"to True."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The second configuration option, default_trusted_certificate_ids, will contain"},{"line_number":90,"context_line":"a list of certificate IDs that are designated as trusted by the compute"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_890b798c","line":87,"in_reply_to":"7f515b1d_49b3734e","updated":"2017-10-11 14:13:00.000000000","message":"I\u0027m actually ok if we do a 400 error early if the admin has turned it off. I just don\u0027t want a silly downgrade of security for the user.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"37160415400e977b1f37b38253089c47215ce99f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"is set to True and will default to False, allowing signature verification to"},{"line_number":85,"context_line":"work without certificate validation until a compute deployment has fully"},{"line_number":86,"context_line":"upgraded. Certificate validation will only be performed if this option is set"},{"line_number":87,"context_line":"to True."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The second configuration option, default_trusted_certificate_ids, will contain"},{"line_number":90,"context_line":"a list of certificate IDs that are designated as trusted by the compute"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_49b3734e","line":87,"in_reply_to":"7f515b1d_b075cafc","updated":"2017-10-06 18:54:55.000000000","message":"This is a great point. I think it is reasonable to conduct certificate/signature verification *if* the user specified certificate IDs with the nova request, even if those features are disabled. It matches the user\u0027s expectations and it removes the chance for the user to assume a secure check occurred when it actually did not.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":124,"context_line":"is saved and will persist for the lifetime of the server data. If the"},{"line_number":125,"context_line":"parameter is not provided when rebuilding a server with a signed image, the"},{"line_number":126,"context_line":"prior set of trusted certificate IDs associated with the server will be"},{"line_number":127,"context_line":"preserved."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Both of the above changes have been implemented and are currently part of a"},{"line_number":130,"context_line":"work-in-progress patch. See [13] for more information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_8ae532df","line":127,"updated":"2017-10-04 12:27:25.000000000","message":"ack. good that you remembered rebuild :)","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":170,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":171,"context_line":"trusted_certificate_ids column, which will contain the list of trusted"},{"line_number":172,"context_line":"certificate IDs. The underlying storage will leverage oslo versionedobjects,"},{"line_number":173,"context_line":"requiring a new trusted_certificate_id module in nova/objects."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"The above change is being implemented and is currently a work-in-progress"},{"line_number":176,"context_line":"patch. See [11] for more information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_6a38b63c","line":173,"range":{"start_line":173,"start_character":16,"end_line":173,"end_character":62},"updated":"2017-10-04 12:27:25.000000000","message":"technically not a new module but rather just a new field on the Instance object.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"37160415400e977b1f37b38253089c47215ce99f","unresolved":false,"context_lines":[{"line_number":170,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":171,"context_line":"trusted_certificate_ids column, which will contain the list of trusted"},{"line_number":172,"context_line":"certificate IDs. The underlying storage will leverage oslo versionedobjects,"},{"line_number":173,"context_line":"requiring a new trusted_certificate_id module in nova/objects."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"The above change is being implemented and is currently a work-in-progress"},{"line_number":176,"context_line":"patch. See [11] for more information."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_a6c57490","line":173,"range":{"start_line":173,"start_character":16,"end_line":173,"end_character":62},"in_reply_to":"7f515b1d_6a38b63c","updated":"2017-10-06 18:54:55.000000000","message":"Good catch. This detail changed once implementation got started. I\u0027ll fix this.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":210,"context_line":"perspective. Trust stores also introduce a new construct that must be"},{"line_number":211,"context_line":"trusted by the user, especially if the user is not directly responsible for"},{"line_number":212,"context_line":"maintaining their trust store. These restrictions may not be feasible for"},{"line_number":213,"context_line":"some cloud deployments."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"An alternative to the user providing trusted certificates, or storing trusted"},{"line_number":216,"context_line":"certificates in a trust store, would be to dynamically fetch certificates"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_aa17cea3","line":213,"updated":"2017-10-04 12:27:25.000000000","message":"agreed","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"ee90f39baecd493b4d634cdaab7c2647af588785","unresolved":false,"context_lines":[{"line_number":285,"context_line":"        \"rebuild\": {"},{"line_number":286,"context_line":"            \"name\": \"example-name\","},{"line_number":287,"context_line":"            \"imageRef\": \"70a599e0-31e7-49b7-b260-868f441e862b\","},{"line_number":288,"context_line":"            \"trusted_certificates\": ["},{"line_number":289,"context_line":"                \"00000000-0000-0000-0000-000000000000\","},{"line_number":290,"context_line":"                \"11111111-1111-1111-1111-111111111111\","},{"line_number":291,"context_line":"                \"22222222-2222-2222-2222-222222222222\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_c57f66a9","line":288,"updated":"2017-10-05 19:23:56.000000000","message":"I think my only question is whether we imagine the use of these certificates in other contexts, or the introduction of other kinds of certificates in the future. So if you are comfortable with this name or if \"trusted_image_certificates\" would be better.\n\nI\u0027m ok with your preferences, but wanted to make sure it was considered.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"37160415400e977b1f37b38253089c47215ce99f","unresolved":false,"context_lines":[{"line_number":285,"context_line":"        \"rebuild\": {"},{"line_number":286,"context_line":"            \"name\": \"example-name\","},{"line_number":287,"context_line":"            \"imageRef\": \"70a599e0-31e7-49b7-b260-868f441e862b\","},{"line_number":288,"context_line":"            \"trusted_certificates\": ["},{"line_number":289,"context_line":"                \"00000000-0000-0000-0000-000000000000\","},{"line_number":290,"context_line":"                \"11111111-1111-1111-1111-111111111111\","},{"line_number":291,"context_line":"                \"22222222-2222-2222-2222-222222222222\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_262e2443","line":288,"in_reply_to":"7f515b1d_c57f66a9","updated":"2017-10-06 18:54:55.000000000","message":"I\u0027m fine changing the name to \"trusted_image_certificates\". At the moment I can\u0027t envision other uses for these certificates, but it\u0027s possible future API changes could introduce additional certificates for other features.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"f0d6f7ef7eb5a3e96365982c2ec11ca8c02a744f","unresolved":false,"context_lines":[{"line_number":295,"context_line":"            }"},{"line_number":296,"context_line":"        }"},{"line_number":297,"context_line":"    }"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":300,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"},{"line_number":301,"context_line":"ID allocation schemes; while some use strict UUIDs, others use simple"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_657b12f4","line":298,"updated":"2017-10-05 19:18:23.000000000","message":"I think my only question is do you envision the trusted_certificates to end up in the default server view? That\u0027s not clear here. It seems like it should be for consistency of the server model.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"37160415400e977b1f37b38253089c47215ce99f","unresolved":false,"context_lines":[{"line_number":295,"context_line":"            }"},{"line_number":296,"context_line":"        }"},{"line_number":297,"context_line":"    }"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":300,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"},{"line_number":301,"context_line":"ID allocation schemes; while some use strict UUIDs, others use simple"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_e940df09","line":298,"in_reply_to":"7f515b1d_657b12f4","updated":"2017-10-06 18:54:55.000000000","message":"I think it is reasonable to include the certificate IDs in the server view (I\u0027m assuming the output from the show command here) *if* they are set on the instance. If no certificate IDs are configured, we won\u0027t bother showing an empty/unset field.\n\nIn the past there were concerns about cluttering up the output from show with security information. I think conditionally including it if it\u0027s present is a good compromise.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b7e87cc0c3845bbed2d7826e077809769062bbe2","unresolved":false,"context_lines":[{"line_number":295,"context_line":"            }"},{"line_number":296,"context_line":"        }"},{"line_number":297,"context_line":"    }"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":300,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"},{"line_number":301,"context_line":"ID allocation schemes; while some use strict UUIDs, others use simple"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_c12417c9","line":298,"in_reply_to":"7f515b1d_a92bd5e8","updated":"2017-10-19 20:53:20.000000000","message":"I\u0027m late to the party but I think we need to return the key in the response regardless of the list being empty, otherwise it\u0027s inconsistent with tags and volumes and other things on the instance, and it could be confusing if I\u0027m requesting a certain microversion to see the certs on the instance details and nothing is returned - did I the user screw up my request or is the server broken?","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"46316a60dcd633e5ed2544439bd72a9ce9a432b2","unresolved":false,"context_lines":[{"line_number":295,"context_line":"            }"},{"line_number":296,"context_line":"        }"},{"line_number":297,"context_line":"    }"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"Note that while in these examples the values in trusted_certificates are"},{"line_number":300,"context_line":"UUIDs they are not guaranteed to be so. Certificate managers use different"},{"line_number":301,"context_line":"ID allocation schemes; while some use strict UUIDs, others use simple"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_a92bd5e8","line":298,"in_reply_to":"7f515b1d_e940df09","updated":"2017-10-11 14:13:00.000000000","message":"Yes, I\u0027m fine with optionally displaying them.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"27e244997510766533d7dc001b1b64178204056b","unresolved":false,"context_lines":[{"line_number":376,"context_line":"Nova will load the user\u0027s trusted certificates via cursive every time"},{"line_number":377,"context_line":"signature verification is performed. Depending upon the size and number of"},{"line_number":378,"context_line":"certificates, and the frequency of signature verification, this could"},{"line_number":379,"context_line":"introduce a performance burden on the compute service. To alleviate this, see"},{"line_number":380,"context_line":"Alternatives above regarding a persistent certificate trust store and"},{"line_number":381,"context_line":"dynamically loading certificates from remote storage."},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"Other deployer impact"},{"line_number":384,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_6ad436be","line":381,"range":{"start_line":379,"start_character":55,"end_line":381,"end_character":53},"updated":"2017-10-04 12:27:25.000000000","message":"personally I don\u0027t see performance being a concern when using trusted certificates in the launch request. Basically, the user is saying it\u0027s more important to be absolutely secure that be a few milliseconds faster to boot.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"37160415400e977b1f37b38253089c47215ce99f","unresolved":false,"context_lines":[{"line_number":376,"context_line":"Nova will load the user\u0027s trusted certificates via cursive every time"},{"line_number":377,"context_line":"signature verification is performed. Depending upon the size and number of"},{"line_number":378,"context_line":"certificates, and the frequency of signature verification, this could"},{"line_number":379,"context_line":"introduce a performance burden on the compute service. To alleviate this, see"},{"line_number":380,"context_line":"Alternatives above regarding a persistent certificate trust store and"},{"line_number":381,"context_line":"dynamically loading certificates from remote storage."},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"Other deployer impact"},{"line_number":384,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7f515b1d_e959fffd","line":381,"range":{"start_line":379,"start_character":55,"end_line":381,"end_character":53},"in_reply_to":"7f515b1d_6ad436be","updated":"2017-10-06 18:54:55.000000000","message":"For the record, I agree with you. We wanted to include this caveat mainly to be thorough, and since it has come up in conversation in the past.","commit_id":"a0f4638eaee90d9d1d901adfffb611ffecd28dc1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b7e87cc0c3845bbed2d7826e077809769062bbe2","unresolved":false,"context_lines":[{"line_number":209,"context_line":""},{"line_number":210,"context_line":"The eighth and final change updates the output of the server show command to"},{"line_number":211,"context_line":"include the list of trusted certificate IDs stored with the server instance"},{"line_number":212,"context_line":"data. If no certificate IDs are stored with the server instance data, the"},{"line_number":213,"context_line":"output from the server show command will be unchanged. An empty or unset"},{"line_number":214,"context_line":"field will not be shown to reduce clutter in the server show command output."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Alternatives"},{"line_number":217,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f4b6375_c17657d9","line":214,"range":{"start_line":212,"start_character":6,"end_line":214,"end_character":76},"updated":"2017-10-19 20:53:20.000000000","message":"I\u0027m not sure I agree with this. We expose tags in the server details response even if there are no tags associated with the server. From a user POV, it\u0027s good to know that you\u0027ve requested details at a certain microversion to see the certs in the response, whether they are empty or not, so you\u0027re not confused if you requested the correct microversion if they don\u0027t show up simply because there aren\u0027t any.\n\nI won\u0027t block on this since it\u0027s an implementation detail, but I think it should change / get amended in the spec.","commit_id":"ffdbd9d0709b81379faff7e5399f22176b26141d"}]}