)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"29e40fcbd8b8b3250bc327b36fae3f2d4120947f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"correct passphrase is then added to the volume before the mangled"},{"line_number":20,"context_line":"passphrase is finally removed. This workaround can be removed in a"},{"line_number":21,"context_line":"future release once it is safe to assume that all LuksEncryptor volumes"},{"line_number":22,"context_line":"have had any mangled passphrases replaced in this way."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"This isn\u0027t possible for CryptsetupEncryptor volumes as the plain mode"},{"line_number":25,"context_line":"used by cryptsetup does not provide a way for adding and removing keys."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"9a629dbe_2041c7a9","line":22,"updated":"2016-11-10 12:33:39.000000000","message":"I suspect we might need to give folks a tool to \"check\" their volumes before we can remove this, but thats a longer term thing.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"df64fbbc8d64f5c926d6be66094c4119eb402d53","unresolved":false,"context_lines":[{"line_number":25,"context_line":"used by cryptsetup does not provide a way for adding and removing keys."},{"line_number":26,"context_line":"As such on a permission denied error a second attempt is made to open"},{"line_number":27,"context_line":"the volume using a mangled passphrase. Unlike the above workaround this"},{"line_number":28,"context_line":"cannot be removed in a future release."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: I7096463c5eba951dd6322ee6965435e877ca0371"},{"line_number":31,"context_line":"Partial-bug: #1633518"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"9a629dbe_cc4621bf","line":28,"updated":"2016-11-07 14:46:40.000000000","message":"So in summary, we can remove that mangled passphrase correction for the LuksEncryptor in a future release, but not for CryptsetupEncryptor as long as we support the plain mode. Is there any way we can deprecate the plain mode and remove this fix entirely in a future cycle?","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"}],"nova/volume/encryptors/cryptsetup.py":[{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"f399da3a20f3effc69b39e8a40bd31a588d6efd7","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_08371cb1","line":156,"updated":"2016-11-07 17:14:51.000000000","message":"Agreed, I can reach out to the ops list about this later in the week before deprecating it for a cycle and hopefully removing it in Pike.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"316c89512e34cc5f8ca313ea46d6aaaafee43c32","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"ba5da102_38aefee7","line":156,"updated":"2016-11-04 11:51:21.000000000","message":"Ewww, I never noticed that we supported the \u0027plain\u0027 encryption mode. We should never have let this into tree as it has horrible characteristics for usage, specifically inability to change the passphrase as you\u0027ve seen here, and consequently no way to cleanly revoke access on delete either :-(","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"a0dab2aaadd42d173dbdd72c936b6ad090d33c61","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_d7910f9b","line":156,"updated":"2016-11-08 16:09:35.000000000","message":"I\u0027d rather do that in another change once we are sure we can depreacte it.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"aae387ff4b76d83b10cfdda28aa3477acf8a6124","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_685df8e8","line":156,"in_reply_to":"9a629dbe_08371cb1","updated":"2016-11-07 17:16:28.000000000","message":"Great. Thanks, Lee.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"e79236c16f08a463163c6d4c22cbb20b5224a41d","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_4b0d608f","line":156,"in_reply_to":"9a629dbe_685df8e8","updated":"2016-11-08 15:15:03.000000000","message":"If we are planning on deprecating plain mode, does this change need a release note or some other documentation of our plan?","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"5a6e9cd673173cd9ec634bebd93385bcb3b35a40","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_efa037a8","line":156,"in_reply_to":"9a629dbe_6c95153f","updated":"2016-11-07 14:59:25.000000000","message":"That would certainly be my preference - I\u0027m not sure whether there was a particular use case that required the \"plain\" mode though - at very least we\u0027d need to ask the operators list if anyone requires it","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"29e40fcbd8b8b3250bc327b36fae3f2d4120947f","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_609d7f65","line":156,"in_reply_to":"9a629dbe_d7910f9b","updated":"2016-11-10 12:33:39.000000000","message":"yeah, a separate change to deprecate this mode is a good idea.\n\nIf nothing else, as danpb said, this proves why its a bad idea to support this mode.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"df64fbbc8d64f5c926d6be66094c4119eb402d53","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                LOG.info(_LI(\"Unable to open %s with the current passphrase, \""},{"line_number":154,"context_line":"                             \"attempting to use a mangled passphrase to open \""},{"line_number":155,"context_line":"                             \"the volume.\"), self.dev_path)"},{"line_number":156,"context_line":"                self._open_volume(self._get_mangled_passphrase(key), **kwargs)"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"        # modify the original symbolic link to refer to the decrypted device"},{"line_number":159,"context_line":"        utils.execute(\u0027ln\u0027, \u0027--symbolic\u0027, \u0027--force\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_6c95153f","line":156,"in_reply_to":"ba5da102_38aefee7","updated":"2016-11-07 14:46:40.000000000","message":"Can we deprecate the use of \u0027plain\u0027 mode?","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"}],"nova/volume/encryptors/luks.py":[{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"02fc75c5c133e8ca470fc221f7b06248ce46d4ac","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        # Verify that we can open the volume with the current passphrase"},{"line_number":112,"context_line":"        # before removing the mangled passphrase."},{"line_number":113,"context_line":"        self._open_volume(passphrase, **kwargs)"},{"line_number":114,"context_line":"        self._close_volume(**kwargs)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        # luksRemoveKey only prompts for the key to remove."},{"line_number":117,"context_line":"        utils.execute(\u0027cryptsetup\u0027, \u0027luksRemoveKey\u0027, self.dev_path,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_1b7ef218","line":114,"updated":"2016-11-10 12:51:24.000000000","message":"Aside from logging something in ERROR I don\u0027t think there\u0027s much we can do at this point so it seemed correct to allow the failure to bubble up. This also goes for L93-94.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"29e40fcbd8b8b3250bc327b36fae3f2d4120947f","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        # Verify that we can open the volume with the current passphrase"},{"line_number":112,"context_line":"        # before removing the mangled passphrase."},{"line_number":113,"context_line":"        self._open_volume(passphrase, **kwargs)"},{"line_number":114,"context_line":"        self._close_volume(**kwargs)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        # luksRemoveKey only prompts for the key to remove."},{"line_number":117,"context_line":"        utils.execute(\u0027cryptsetup\u0027, \u0027luksRemoveKey\u0027, self.dev_path,"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_c0d9eb58","line":114,"updated":"2016-11-10 12:33:39.000000000","message":"Nit: not 100% sure what we do with failures here. I guess they are just raised, and we fail here. Thats probably the right thing to do I guess.","commit_id":"2010c13c0a229531a1ec3c84fb9c05e7310cf824"}]}