)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5607515a6a2ade9c24fe3551c7a97ddab74a11bf","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Ideally, I\u0027d like to backport this change all the way down to"},{"line_number":61,"context_line":"stable/liberty."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Closes-Bug #1621536"},{"line_number":64,"context_line":"Change-Id: Id6a9c4ec9ba3420190647dfb72b314ae9008eae7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a89bdaa_4bae4d99","line":63,"updated":"2016-09-09 21:58:29.000000000","message":"Also Closes-Bug: #1613199","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":16907,"name":"Diana Clarke","email":"diana.joan.clarke@gmail.com","username":"diana-clarke"},"change_message_id":"03bbbb8057a107fed7a59e80311f2afd544bd136","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Ideally, I\u0027d like to backport this change all the way down to"},{"line_number":61,"context_line":"stable/liberty."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Closes-Bug #1621536"},{"line_number":64,"context_line":"Change-Id: Id6a9c4ec9ba3420190647dfb72b314ae9008eae7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a89bdaa_6ccec784","line":63,"in_reply_to":"9a89bdaa_4bae4d99","updated":"2016-09-09 23:50:31.000000000","message":"Interesting. Thanks for digging that other bug up, @mriedem.\n\nThe commit that introduced paramiko in liberty converted two methods that had previously used ssh-keygen: generate_key_pair \u0026 generate_fingerprint.\n\nThis patch only reverts one of those cases: generate_key_pair. I suspect I would need to revert both cases back to ssh-keygen to fix that other bug too (but I didn\u0027t dig too deeply), and reverting generate_fingerprint opens the OpenSSH 6.8 can of worms (https://review.openstack.org/#/c/191847/). \n\nI\u0027ll look into manually testing these combinations on Monday, and report back. Have a great weekend!","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":16907,"name":"Diana Clarke","email":"diana.joan.clarke@gmail.com","username":"diana-clarke"},"change_message_id":"781734e350b247060d9c4a244a4c0585fae6f516","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Ideally, I\u0027d like to backport this change all the way down to"},{"line_number":61,"context_line":"stable/liberty."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Closes-Bug #1621536"},{"line_number":64,"context_line":"Change-Id: Id6a9c4ec9ba3420190647dfb72b314ae9008eae7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a89bdaa_efb19290","line":63,"in_reply_to":"9a89bdaa_6ccec784","updated":"2016-09-13 02:54:55.000000000","message":"Based on some more digging, I think that\u0027s a different bug that I\u0027ll address in a second patch since I\u0027ll need to address the OpenSSH 6.8 changes if we also revert back to using ssh-keygen for the fingerprint code path as well (it\u0027s not a simple revert).","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"fa7223dd78db2108443df3643579df76488cec17","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"fa6399be_07bc5504","updated":"2016-10-11 16:42:11.000000000","message":"I think this needs a little reworking. Reading through it the first time, I thought the only issue was that paramiko \u003c 2.0 moved key encoding from DER to BER. However, since you later say Newton onwards use paramiko \u003e\u003d 2.0 then it seemed this patch was totally unnecessary for stable/newton and master. Having read it again since, I\u0027m thinking what you\u0027re actually trying to say is that paramiko introduces too many downsides compared to its upsides. If this is indeed the case, then we should simply say as much :)","commit_id":"1d6fc3931326fbfaeaf150a5815ea8911c335b7b"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"fa7223dd78db2108443df3643579df76488cec17","unresolved":false,"context_lines":[{"line_number":60,"context_line":"older paramiko versions, makes me think that perhaps we should just go"},{"line_number":61,"context_line":"back to using ssh-keygen."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Ideally, I\u0027d like to backport this change all the way down to"},{"line_number":64,"context_line":"stable/liberty."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Closes-Bug #1621536"},{"line_number":67,"context_line":"Change-Id: Id6a9c4ec9ba3420190647dfb72b314ae9008eae7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"fa6399be_cce4440f","line":64,"range":{"start_line":63,"start_character":0,"end_line":64,"end_character":15},"updated":"2016-10-11 16:42:11.000000000","message":"nit: Don\u0027t know if this should be in here","commit_id":"1d6fc3931326fbfaeaf150a5815ea8911c335b7b"}],"nova/crypto.py":[{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"889c2b16b551c70573869584561d05e584651030","unresolved":false,"context_lines":[{"line_number":134,"context_line":"                \u0027-f\u0027, private_key_path, \u0027-C\u0027, \u0027Generated-by-Nova\u0027]"},{"line_number":135,"context_line":"        if bits is not None:"},{"line_number":136,"context_line":"            args.extend([\u0027-b\u0027, bits])"},{"line_number":137,"context_line":"        utils.execute(*args)"},{"line_number":138,"context_line":"        if not os.path.exists(private_key_path):"},{"line_number":139,"context_line":"            raise exception.FileNotFound(private_key_path)"},{"line_number":140,"context_line":"        with open(private_key_path) as f:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_df809bfa","line":137,"updated":"2016-09-08 20:16:55.000000000","message":"One of the justifications with going to paramiko over ssh-keygen, is it was one less untracked exec dependency in the system. I think the compatibility issues are probably worth considering this effective revert.\n\nHowever, as we\u0027re injecting back a shadow dependency, it would be good to catch the case where ssh-keygen does not exist in the path (people might have wedged this in a minimal container, as they are all the rage) and log a meaningful ERROR on the command not found case.\n\nAnd we\u0027ll want to release note it, as it\u0027s a dependency shift that people will need to be aware of.\n\nSo -1 for 3 things:\n\nWe should wait until master opens up (that should be about a week away).\n\nWe should log a meaningful error if ssh-keygen exec throws an exception that the command is not found.\n\nWe should have a release note describing that ssh-keygen needs to be installed on nova-api nodes.","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":16907,"name":"Diana Clarke","email":"diana.joan.clarke@gmail.com","username":"diana-clarke"},"change_message_id":"fa86e67c5f97d0bc20528893377cefebc3b3cb56","unresolved":false,"context_lines":[{"line_number":134,"context_line":"                \u0027-f\u0027, private_key_path, \u0027-C\u0027, \u0027Generated-by-Nova\u0027]"},{"line_number":135,"context_line":"        if bits is not None:"},{"line_number":136,"context_line":"            args.extend([\u0027-b\u0027, bits])"},{"line_number":137,"context_line":"        utils.execute(*args)"},{"line_number":138,"context_line":"        if not os.path.exists(private_key_path):"},{"line_number":139,"context_line":"            raise exception.FileNotFound(private_key_path)"},{"line_number":140,"context_line":"        with open(private_key_path) as f:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_62ac588d","line":137,"in_reply_to":"9a89bdaa_5f2e4ba6","updated":"2016-09-08 20:43:10.000000000","message":"Yup. I noticed that which is why I didn\u0027t revert the fingerprint stuff as well, and instead proposed a middle ground approach.","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"57f852565d14212bc3fb434ce93980f659bc2dbd","unresolved":false,"context_lines":[{"line_number":134,"context_line":"                \u0027-f\u0027, private_key_path, \u0027-C\u0027, \u0027Generated-by-Nova\u0027]"},{"line_number":135,"context_line":"        if bits is not None:"},{"line_number":136,"context_line":"            args.extend([\u0027-b\u0027, bits])"},{"line_number":137,"context_line":"        utils.execute(*args)"},{"line_number":138,"context_line":"        if not os.path.exists(private_key_path):"},{"line_number":139,"context_line":"            raise exception.FileNotFound(private_key_path)"},{"line_number":140,"context_line":"        with open(private_key_path) as f:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_5f2e4ba6","line":137,"in_reply_to":"9a89bdaa_df809bfa","updated":"2016-09-08 20:31:15.000000000","message":"++\n\nAlso calling command lines is not an robust solution in general, for example, see https://review.openstack.org/#/c/191847/\n\nI\u0027d rather see py cryptography used here instead, but I\u0027m not sure it has all the function necessary.","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"},{"author":{"_account_id":16907,"name":"Diana Clarke","email":"diana.joan.clarke@gmail.com","username":"diana-clarke"},"change_message_id":"fa86e67c5f97d0bc20528893377cefebc3b3cb56","unresolved":false,"context_lines":[{"line_number":134,"context_line":"                \u0027-f\u0027, private_key_path, \u0027-C\u0027, \u0027Generated-by-Nova\u0027]"},{"line_number":135,"context_line":"        if bits is not None:"},{"line_number":136,"context_line":"            args.extend([\u0027-b\u0027, bits])"},{"line_number":137,"context_line":"        utils.execute(*args)"},{"line_number":138,"context_line":"        if not os.path.exists(private_key_path):"},{"line_number":139,"context_line":"            raise exception.FileNotFound(private_key_path)"},{"line_number":140,"context_line":"        with open(private_key_path) as f:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a89bdaa_62c7f864","line":137,"in_reply_to":"9a89bdaa_df809bfa","updated":"2016-09-08 20:43:10.000000000","message":"Given that this isn\u0027t going to make it into Newton, I\u0027m tempted to just solve this downstream in Liberty \u0026 Mitaka, and otherwise leave this code as-is.\n\nI was looking for a solution that spanned Liberty/Mitaka/Newton/Ocata, but since that\u0027s not going to happen, I\u0027m no longer all that invested in this patch ;)\n\nThat said, I\u0027m also happy to improve the ssh-keygen solution which dates back to 2010 (initial commit). Just let me know your preference.","commit_id":"5d7f948781823dd4f7782c66549c86fe29512037"}]}