)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"b19c3e32703d3e5c91d53c2477fca1036f8eeb44","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"A new configuration property \u0027cacert\u0027 is added which specifies a CA"},{"line_number":10,"context_line":"bundle file to use in verifying vCenter server certificate. If this"},{"line_number":11,"context_line":"proeprty is omitted, the server certificate won\u0027t be verified."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Closes-Bug: #1276207"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3acd31a7_8d06a0cc","line":11,"updated":"2015-05-04 17:54:49.000000000","message":"proeprty -\u003e property\n\nAlso, throughout OpenStack there is usually an option to ignore certificate checks separately. \n\nThis disadvantage of only providing cacert which always must be set to do https, is that you can\u0027t just load a self-signed but trusted cert into the operating system that python-requests would automatically check.  I think this is more typically how this is done.\n\nSo I\u0027d rather have it so when cacert is omitted, the certificate is verified but with the default location of the certificate store for the operating system.  And provide an boolean option to override the verification.","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"}],"nova/virt/vmwareapi/driver.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"e8e401052d1684299666973ebca9cf316c47d370","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    cfg.StrOpt(\u0027host_password\u0027,"},{"line_number":57,"context_line":"               help\u003d\u0027Password for connection to VMware VC host.\u0027,"},{"line_number":58,"context_line":"               secret\u003dTrue),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027cacert\u0027,"},{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.MultiStrOpt(\u0027cluster_name\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3acd31a7_cd4a58c5","line":59,"updated":"2015-05-04 18:02:34.000000000","message":"Once example of the options typically given:\n\n# CA certificate file path for communicating with LDAP servers. \n(string value)\n\n#tls_cacertfile \u003d \u003cNone\u003e\n\n# CA certificate directory path for communicating with LDAP \nservers. (string value)\n\n#tls_cacertdir \u003d \u003cNone\u003e\n\n# Specifies what checks to perform on client certificates in an incoming TLS\n\n# session. (string value)\n\n# Allowed values: demand, never, allow\n\n#tls_req_cert \u003d demand","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"fe361eb3e0c70d56f01af60041c5f9154189d9e1","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    cfg.StrOpt(\u0027host_password\u0027,"},{"line_number":57,"context_line":"               help\u003d\u0027Password for connection to VMware VC host.\u0027,"},{"line_number":58,"context_line":"               secret\u003dTrue),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027cacert\u0027,"},{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.MultiStrOpt(\u0027cluster_name\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3acd31a7_6e3e908d","line":59,"in_reply_to":"3acd31a7_cd4a58c5","updated":"2015-05-05 02:00:05.000000000","message":"Please add \u0027insecure\u0027 as an option.  Ignore my comment on needing a cacert directory.\n\nAlso, the option name of \u0027cacert\u0027 already differs from the Cinder VMware driver\u0027s option of ca_file.  Can we make these consistent across projects for easiness of deployers?\n\nIts actually more useful to set insecure\u003dFalse and cacert\u003dNone so that oslo_vmware verifies certificates with the operating system\u0027s ca-certificate store.","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"134448fe3db669b1a9cda2022c96f603d2d9aaff","unresolved":false,"context_lines":[{"line_number":58,"context_line":"               secret\u003dTrue),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027cacert\u0027,"},{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.MultiStrOpt(\u0027cluster_name\u0027,"},{"line_number":63,"context_line":"                    help\u003d\u0027Name of a VMware Cluster ComputeResource.\u0027),"},{"line_number":64,"context_line":"    cfg.StrOpt(\u0027datastore_regex\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3acd31a7_2d9d4c59","line":61,"updated":"2015-05-04 17:58:23.000000000","message":"certificate -\u003e certificate.\n\nI think more description is necessary.  In your commit message you mention an unexpected behavior where certificates are not verified if this is omitted.","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"fe361eb3e0c70d56f01af60041c5f9154189d9e1","unresolved":false,"context_lines":[{"line_number":683,"context_line":"                 password\u003dCONF.vmware.host_password,"},{"line_number":684,"context_line":"                 retry_count\u003dCONF.vmware.api_retry_count,"},{"line_number":685,"context_line":"                 scheme\u003d\"https\","},{"line_number":686,"context_line":"                 cacert\u003dCONF.vmware.cacert):"},{"line_number":687,"context_line":"        super(VMwareAPISession, self).__init__("},{"line_number":688,"context_line":"                host\u003dhost_ip,"},{"line_number":689,"context_line":"                port\u003dhost_port,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3acd31a7_2e441819","line":686,"updated":"2015-05-05 02:00:05.000000000","message":"Please pass \u0027insecure\u0027 from an option here","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"fe361eb3e0c70d56f01af60041c5f9154189d9e1","unresolved":false,"context_lines":[{"line_number":694,"context_line":"                scheme\u003dscheme,"},{"line_number":695,"context_line":"                create_session\u003dTrue,"},{"line_number":696,"context_line":"                wsdl_loc\u003dCONF.vmware.wsdl_location,"},{"line_number":697,"context_line":"                cacert\u003dcacert"},{"line_number":698,"context_line":"                )"},{"line_number":699,"context_line":""},{"line_number":700,"context_line":"    def _is_vim_object(self, module):"}],"source_content_type":"text/x-python","patch_set":1,"id":"3acd31a7_0e4efc3a","line":697,"updated":"2015-05-05 02:00:05.000000000","message":"Please pass \u0027insecure\u0027 from an option here","commit_id":"5772cb4a195e936b9a08c61f0ef608c61c67fb75"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"0a2df40aa3cb7d7d4de245524916e7d57827450c","unresolved":false,"context_lines":[{"line_number":58,"context_line":"               secret\u003dTrue),"},{"line_number":59,"context_line":"    cfg.StrOpt(\u0027ca_file\u0027,"},{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_0897fbec","line":61,"updated":"2015-05-05 16:26:47.000000000","message":"NIT: end of sentence needs a period","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"f930353728a20a9c0141739ea18aef0cf83c26fa","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_e8371ffd","line":63,"updated":"2015-05-05 16:29:12.000000000","message":"Why is default True?  Should be false (secure by default)","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"dd84ad28b239a10812011c573081f67f5f8c6277","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_8bfb05c1","line":63,"in_reply_to":"3acd31a7_2bb4f132","updated":"2015-05-05 16:40:17.000000000","message":"IMO, security takes precedence over backward compatibility.  \n\nAnd from my experience deploying, there is never perfect backward compatibility, something always has to be changed.\n\nMy vote is still False, but we\u0027ll see what others think.","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"a83c665920b98fc793089a1424e53c6b6fb85760","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_ef271eb4","line":63,"in_reply_to":"3acd31a7_8bfb05c1","updated":"2015-05-05 20:33:04.000000000","message":"Also, glance_store defaults to False.\n\nhttps://github.com/openstack/glance_store/blob/master/glance_store/_drivers/vmware_datastore.py#L95","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"90e73cf0beed13b43cb8e441f848282f8e360185","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_8f3d4adf","line":63,"in_reply_to":"3acd31a7_cf7fc2de","updated":"2015-05-05 21:09:54.000000000","message":"True, looks like glance uses the parameter different.  I have marked the bug with Glance as impacted too.","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":9172,"name":"Radoslav Gerganov","email":"rgerganov@vmware.com","username":"rgerganov"},"change_message_id":"4aa0eae356b558c8d9850f565293077f4adeeb2a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_2bb4f132","line":63,"in_reply_to":"3acd31a7_e8371ffd","updated":"2015-05-05 16:34:40.000000000","message":"No. This will break the backward compatibility.","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"},{"author":{"_account_id":9172,"name":"Radoslav Gerganov","email":"rgerganov@vmware.com","username":"rgerganov"},"change_message_id":"b5d788eee357ba01fc61495da84252b8849c6340","unresolved":false,"context_lines":[{"line_number":60,"context_line":"               help\u003d\u0027Specify a CA bundle file to use in verifying the \u0027"},{"line_number":61,"context_line":"                    \u0027vCenter server certificate\u0027),"},{"line_number":62,"context_line":"    cfg.BoolOpt(\u0027insecure\u0027,"},{"line_number":63,"context_line":"                default\u003dTrue,"},{"line_number":64,"context_line":"                help\u003d\u0027If true, the vCenter server certificate is not \u0027"},{"line_number":65,"context_line":"                     \u0027verified. If false, then the default CA truststore is \u0027"},{"line_number":66,"context_line":"                     \u0027used for verification. This option is ignored if \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"3acd31a7_cf7fc2de","line":63,"in_reply_to":"3acd31a7_ef271eb4","updated":"2015-05-05 20:57:19.000000000","message":"The \u0027insecure\u0027 property in glance is for using HTTPS, *not* for verifying certificates (which is another bug per se).\n\nAnyway, if we want \u0027False\u0027 as default here, we need to fix Minesweeper first.","commit_id":"631c6c1ca7024a3f5fd20df8166e9591dee0557a"}]}