)]}'
{"specs/rocky/approved/nova-validate-certificates.rst":[{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"eb8124b96e42e6cb7289fc3509ab9dd9e5169dd2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Nova Certificate Validation"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"OpenStack now supports signature verification for signed images. However, it"},{"line_number":6,"context_line":"does not support strong certificate validation for certificates used to"},{"line_number":7,"context_line":"generate image signatures. Specifically, nova has no mechanism to identify"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_42694423","line":4,"updated":"2018-02-05 15:20:03.000000000","message":"Blueprint url ( https://blueprints.launchpad.net/nova/+spec/nova-validate-certificates ) should be added","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Nova Certificate Validation"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"OpenStack now supports signature verification for signed images. However, it"},{"line_number":6,"context_line":"does not support strong certificate validation for certificates used to"},{"line_number":7,"context_line":"generate image signatures. Specifically, nova has no mechanism to identify"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_396eb8c9","line":4,"in_reply_to":"3fa0c359_42694423","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"f32e49a0d8f6f6776607ee2d8078cbce4b3a8744","unresolved":false,"context_lines":[{"line_number":101,"context_line":"merged into nova. See [9] for implementation details."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The second change adds a parameter, trusted_image_certificates, to the server"},{"line_number":104,"context_line":"create command of the nova API. The value of the parameter is an array"},{"line_number":105,"context_line":"containing the string IDs of the trusted certificates used to validate the"},{"line_number":106,"context_line":"signed image\u0027s signing certificate. These IDs are assigned by the certificate"},{"line_number":107,"context_line":"manager upon upload of the trusted certificates. Multiple IDs are allowed here"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_e35ba82b","line":104,"range":{"start_line":104,"start_character":65,"end_line":104,"end_character":70},"updated":"2018-02-05 22:10:16.000000000","message":"We\u0027ve technically implemented this as a list.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":101,"context_line":"merged into nova. See [9] for implementation details."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The second change adds a parameter, trusted_image_certificates, to the server"},{"line_number":104,"context_line":"create command of the nova API. The value of the parameter is an array"},{"line_number":105,"context_line":"containing the string IDs of the trusted certificates used to validate the"},{"line_number":106,"context_line":"signed image\u0027s signing certificate. These IDs are assigned by the certificate"},{"line_number":107,"context_line":"manager upon upload of the trusted certificates. Multiple IDs are allowed here"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_1965fce1","line":104,"range":{"start_line":104,"start_character":65,"end_line":104,"end_character":70},"in_reply_to":"3fa0c359_e35ba82b","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"f32e49a0d8f6f6776607ee2d8078cbce4b3a8744","unresolved":false,"context_lines":[{"line_number":180,"context_line":"the instance data, since the user cannot be expected to provide them. The"},{"line_number":181,"context_line":"InstanceExtra functionality in nova already supports keypairs associated with"},{"line_number":182,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":183,"context_line":"trusted_certificate_ids column, which will contain the list of trusted"},{"line_number":184,"context_line":"certificate IDs. The underlying storage will leverage oslo versionedobjects,"},{"line_number":185,"context_line":"requiring a new trusted_image_certificate_id field."},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_a3d92084","line":183,"range":{"start_line":183,"start_character":0,"end_line":183,"end_character":23},"updated":"2018-02-05 22:10:16.000000000","message":"We ended up naming the column \"trusted_certs\" [1]. It also may be worth mentioning that we had to create a new TrustedCerts object [2] for instances to reference. You started alluding to it at the beginning, but it may be worth being more specific.\n\n[1] https://review.openstack.org/#/c/537897/\n[2] https://review.openstack.org/#/c/489408/","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":180,"context_line":"the instance data, since the user cannot be expected to provide them. The"},{"line_number":181,"context_line":"InstanceExtra functionality in nova already supports keypairs associated with"},{"line_number":182,"context_line":"instances. This change will update the InstanceExtra schema to support a"},{"line_number":183,"context_line":"trusted_certificate_ids column, which will contain the list of trusted"},{"line_number":184,"context_line":"certificate IDs. The underlying storage will leverage oslo versionedobjects,"},{"line_number":185,"context_line":"requiring a new trusted_image_certificate_id field."},{"line_number":186,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_b96168d6","line":183,"range":{"start_line":183,"start_character":0,"end_line":183,"end_character":23},"in_reply_to":"3fa0c359_a3d92084","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"f32e49a0d8f6f6776607ee2d8078cbce4b3a8744","unresolved":false,"context_lines":[{"line_number":187,"context_line":"The above change has been implemented and awaits additional nova feedback."},{"line_number":188,"context_line":"See [11] for more information."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"The seventh change updates the novaclient/openstackclient to support the"},{"line_number":191,"context_line":"trusted_image_certificates parameter for the server create/rebuild commands."},{"line_number":192,"context_line":"This includes support for a new environment variable,"},{"line_number":193,"context_line":"OS_TRUSTED_CERTIFICATE_IDS, that can be used to define a comma-delimited list"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_a31e000a","line":190,"range":{"start_line":190,"start_character":31,"end_line":190,"end_character":57},"updated":"2018-02-05 22:10:16.000000000","message":"Is it worth mentioning the difference between the CLI options? Specifically, novaclient will take in a comma-delimited list, but openstackclient will take a UUID per flag.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":187,"context_line":"The above change has been implemented and awaits additional nova feedback."},{"line_number":188,"context_line":"See [11] for more information."},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"The seventh change updates the novaclient/openstackclient to support the"},{"line_number":191,"context_line":"trusted_image_certificates parameter for the server create/rebuild commands."},{"line_number":192,"context_line":"This includes support for a new environment variable,"},{"line_number":193,"context_line":"OS_TRUSTED_CERTIFICATE_IDS, that can be used to define a comma-delimited list"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_d95eb411","line":190,"range":{"start_line":190,"start_character":31,"end_line":190,"end_character":57},"in_reply_to":"3fa0c359_a31e000a","updated":"2018-02-14 20:14:39.000000000","message":"I think we can gloss over that detail.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"eb8124b96e42e6cb7289fc3509ab9dd9e5169dd2","unresolved":false,"context_lines":[{"line_number":508,"context_line":""},{"line_number":509,"context_line":"[10] \"Add certificate validation.\" https://review.openstack.org/#/c/357202/"},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"[11] \"Add trusted_certs to Instance object.\" https://review.openstack.org/#/c/489408/"},{"line_number":512,"context_line":""},{"line_number":513,"context_line":"[12] \"Implement certificate_utils.\" https://review.openstack.org/#/c/479949/"},{"line_number":514,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_027d7cb0","line":511,"range":{"start_line":511,"start_character":0,"end_line":511,"end_character":85},"updated":"2018-02-05 15:20:03.000000000","message":"This patch was split into two patches, the second being at: https://review.openstack.org/#/c/537897/","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":508,"context_line":""},{"line_number":509,"context_line":"[10] \"Add certificate validation.\" https://review.openstack.org/#/c/357202/"},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"[11] \"Add trusted_certs to Instance object.\" https://review.openstack.org/#/c/489408/"},{"line_number":512,"context_line":""},{"line_number":513,"context_line":"[12] \"Implement certificate_utils.\" https://review.openstack.org/#/c/479949/"},{"line_number":514,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_59a864da","line":511,"range":{"start_line":511,"start_character":0,"end_line":511,"end_character":85},"in_reply_to":"3fa0c359_027d7cb0","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"eb8124b96e42e6cb7289fc3509ab9dd9e5169dd2","unresolved":false,"context_lines":[{"line_number":517,"context_line":"[14] \"Microversion 2.54 - Add trusted_certificates param.\" https://review.openstack.org/#/c/500396/"},{"line_number":518,"context_line":""},{"line_number":519,"context_line":"[15] \"Create/Rebuild server with trusted certificate IDs.\" https://review.openstack.org/#/c/501926/"},{"line_number":520,"context_line":""},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"History"},{"line_number":523,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_7d2661ba","line":520,"updated":"2018-02-05 15:20:03.000000000","message":"There\u0027s also a tempest patch (at https://review.openstack.org/526485 ) and a barbican-tempest-plugin patch (at https://review.openstack.org/515210 ) that might be worth including.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":517,"context_line":"[14] \"Microversion 2.54 - Add trusted_certificates param.\" https://review.openstack.org/#/c/500396/"},{"line_number":518,"context_line":""},{"line_number":519,"context_line":"[15] \"Create/Rebuild server with trusted certificate IDs.\" https://review.openstack.org/#/c/501926/"},{"line_number":520,"context_line":""},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"History"},{"line_number":523,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_f9acd0ef","line":520,"in_reply_to":"3fa0c359_7d2661ba","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"eb8124b96e42e6cb7289fc3509ab9dd9e5169dd2","unresolved":false,"context_lines":[{"line_number":539,"context_line":"  * - Pike"},{"line_number":540,"context_line":"    - Re-proposed for official review"},{"line_number":541,"context_line":"    - Approved"},{"line_number":542,"context_line":"  * - Queens"},{"line_number":543,"context_line":"    - Re-proposed for official review"},{"line_number":544,"context_line":""},{"line_number":545,"context_line":"Newton"},{"line_number":546,"context_line":"------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_02e1fc9a","line":543,"range":{"start_line":542,"start_character":0,"end_line":543,"end_character":37},"updated":"2018-02-05 15:20:03.000000000","message":"This should be updated so that it mentions that approval was received in Queens, and is now being re-proposed in Rocky.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":539,"context_line":"  * - Pike"},{"line_number":540,"context_line":"    - Re-proposed for official review"},{"line_number":541,"context_line":"    - Approved"},{"line_number":542,"context_line":"  * - Queens"},{"line_number":543,"context_line":"    - Re-proposed for official review"},{"line_number":544,"context_line":""},{"line_number":545,"context_line":"Newton"},{"line_number":546,"context_line":"------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_b9b6483e","line":543,"range":{"start_line":542,"start_character":0,"end_line":543,"end_character":37},"in_reply_to":"3fa0c359_02e1fc9a","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"eb8124b96e42e6cb7289fc3509ab9dd9e5169dd2","unresolved":false,"context_lines":[{"line_number":607,"context_line":"implementing the various changes detailed by the spec."},{"line_number":608,"context_line":""},{"line_number":609,"context_line":"Version 17 added details addressing a silent fail scenario, conditionally"},{"line_number":610,"context_line":"including certificate information in server metadata, and other minor fixes."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_82ee6c86","line":610,"updated":"2018-02-05 15:20:03.000000000","message":"It might be good to add a section here for Rocky.","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"6b049ce9f94962a3fe7cb2cf0ab9cec53314caa3","unresolved":false,"context_lines":[{"line_number":607,"context_line":"implementing the various changes detailed by the spec."},{"line_number":608,"context_line":""},{"line_number":609,"context_line":"Version 17 added details addressing a silent fail scenario, conditionally"},{"line_number":610,"context_line":"including certificate information in server metadata, and other minor fixes."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_d9b3144d","line":610,"in_reply_to":"3fa0c359_82ee6c86","updated":"2018-02-14 20:14:39.000000000","message":"Done","commit_id":"931935bc446fcaef5a2ddfb38b81fb43c26c987f"}]}