)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add certificate validation docs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change addes documentation for Nova\u0027s certificate validation"},{"line_number":10,"context_line":"feature."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"DocImpact"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"bf659307_75c9c6a9","line":9,"range":{"start_line":9,"start_character":12,"end_line":9,"end_character":17},"updated":"2018-04-13 21:05:34.000000000","message":"adds","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"547a7b65821bee757dc1a90d19f76190a24afb6c","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This change adds documentation for Nova\u0027s certificate validation"},{"line_number":10,"context_line":"feature."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"DocImpact"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: If551f1265cf662c76a0c7cb38781641a77af0826"},{"line_number":15,"context_line":"Implements: blueprint nova-validate-certificates"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":47,"id":"5f7c97a3_4f7f3166","line":12,"updated":"2018-06-14 20:12:56.000000000","message":"This tag generates a nova bug, which we don\u0027t need, since this is a docs patch.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"}],"doc/source/index.rst":[{"author":{"_account_id":7634,"name":"Takashi Natsume","email":"takanattie@gmail.com","username":"natsumet"},"change_message_id":"b0b66df7f0fbb056eb216445b0db7ec6d88cfbcb","unresolved":false,"context_lines":[{"line_number":166,"context_line":"  in your hosts, you\u0027ll want to dive into this configuration."},{"line_number":167,"context_line":"* :doc:`Exposing custom metadata to compute instances \u003c/user/vendordata\u003e`: How and"},{"line_number":168,"context_line":"  when you might want to extend the basic metadata exposed to compute instances"},{"line_number":169,"context_line":"  (either via metadata server or config drive) for your specific purposes."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Reference Material"},{"line_number":172,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":34,"id":"5f7c97a3_a40b5529","line":169,"updated":"2018-06-06 06:26:39.000000000","message":"You can add:\n\n* :doc:`Certificate Validation \u003c/user/certificate-validation\u003e`: Enabling and\n  using image signature certificate validation in nova.","commit_id":"b02468df526124ce57d3b5f28b72febfa90945e5"}],"doc/source/user/certificate-validation.rst":[{"author":{"_account_id":15888,"name":"Zhenyu Zheng","email":"zheng.zhenyu@outlook.com","username":"Kevin_Zheng"},"change_message_id":"6cd55714440402177bf31d9c8d57be73b8d05ecf","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2016 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_3c42b9ac","line":2,"range":{"start_line":2,"start_character":16,"end_line":2,"end_character":20},"updated":"2018-06-07 03:43:24.000000000","message":"nit, maybe should change to 2018","commit_id":"31c7fc47419536d70c555c622b657da12a31ae0f"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2016 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_95cc9abb","line":2,"range":{"start_line":2,"start_character":16,"end_line":2,"end_character":20},"updated":"2018-04-13 21:05:34.000000000","message":"is it? ;)","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"eb3b93fa23758698e4a1204053605b87ba3f79fa","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2016 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_7543066d","line":2,"range":{"start_line":2,"start_character":16,"end_line":2,"end_character":20},"in_reply_to":"bf659307_95cc9abb","updated":"2018-04-13 21:23:59.000000000","message":"Woops. Copy/paste error :-/","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":59,"context_line":"-------------"},{"line_number":60,"context_line":"Nova will use the key manager defined by the Castellan key manager interface,"},{"line_number":61,"context_line":"which is the Barbican key manager by default. To use a different key manager,"},{"line_number":62,"context_line":"update the key_manager option\u0027s backend value in the Nova configurations. For"},{"line_number":63,"context_line":"example::"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"  [key_manager]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_d56452bb","line":62,"range":{"start_line":62,"start_character":11,"end_line":62,"end_character":21},"updated":"2018-04-13 21:05:34.000000000","message":"``CONF.key_manager``","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"An image will need a few properties for signature verification to be enabled:"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"img_signature"},{"line_number":76,"context_line":"  Signature of your image. Signature restrictions are:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  * 255 character limit"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_35758e64","line":75,"range":{"start_line":75,"start_character":0,"end_line":75,"end_character":13},"updated":"2018-04-13 21:05:34.000000000","message":"``img_signature``","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  * 255 character limit"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"img_signature_hash_method"},{"line_number":82,"context_line":"  Method used to hash your signature. Possible hash methods are:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  * SHA-224"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_15664abc","line":81,"range":{"start_line":81,"start_character":0,"end_line":81,"end_character":25},"updated":"2018-04-13 21:05:34.000000000","message":"``img_signature_hash_method``","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":86,"context_line":"  * SHA-384"},{"line_number":87,"context_line":"  * SHA-512"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"img_signature_key_type"},{"line_number":90,"context_line":"  Key type used for your image. Possible key types are:"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  * RSA-PSS"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_b5067ecd","line":89,"range":{"start_line":89,"start_character":0,"end_line":89,"end_character":22},"updated":"2018-04-13 21:05:34.000000000","message":"``img_signature_key_type``","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    * SECP521R1"},{"line_number":101,"context_line":"    * SECP384R1"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"img_signature_certificate_uuid"},{"line_number":104,"context_line":"  UUID of the certificate that you upload to the key manager. Possible certificate types are:"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"  * X_509"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_950fbade","line":103,"range":{"start_line":103,"start_character":0,"end_line":103,"end_character":30},"updated":"2018-04-13 21:05:34.000000000","message":"``img_signature_certificate_uuid``","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    * SECP384R1"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"img_signature_certificate_uuid"},{"line_number":104,"context_line":"  UUID of the certificate that you upload to the key manager. Possible certificate types are:"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"  * X_509"},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_f5ff16a8","line":104,"range":{"start_line":104,"start_character":35,"end_line":104,"end_character":41},"updated":"2018-04-13 21:05:34.000000000","message":"uploaded","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":127,"context_line":"       $ export OS_TRUSTED_IMAGE_CERTIFICATE_IDS\u003d79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"   Command-Line Flag"},{"line_number":130,"context_line":"     If booting or rebuilding an instance using the :command:`nova` commands,"},{"line_number":131,"context_line":"     use the ``--trusted-image-certificate-ids`` flag to define a comma-delimited"},{"line_number":132,"context_line":"     list of trusted certificate IDs. For example:"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"     .. code-block:: console"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"       $ nova boot myInstanceName \\"},{"line_number":137,"context_line":"           --flavor 1 \\"},{"line_number":138,"context_line":"           --image myImageId \\"},{"line_number":139,"context_line":"           --trusted-image-certificate-ids 79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"     If booting or rebuilding an instance using the :command:`openstack server` commands,"},{"line_number":142,"context_line":"     use the ``--trusted-image-certificate-id`` flag to define a single trusted"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_f518761e","line":139,"range":{"start_line":130,"start_character":0,"end_line":139,"end_character":116},"updated":"2018-04-13 21:05:34.000000000","message":"I\u0027m actually not sure we should even be supporting the nova CLI tool any more... I suppose it doesn\u0027t hurt to include this information here, but at the same time we should be encouraging use of openstackclient.","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":157,"context_line":"     Use the Nova configuration option ``default_trusted_certificate_ids`` to define"},{"line_number":158,"context_line":"     a comma-delimited list of trusted certificate IDs. This configuration value is"},{"line_number":159,"context_line":"     only used if ``enable_certificate_validation`` is set to True, and the trusted"},{"line_number":160,"context_line":"     certificate IDs are not specified anywhere else. The Nova configuration where"},{"line_number":161,"context_line":"     this option is added must be used with the Nova API. For example::"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"       [glance]"},{"line_number":164,"context_line":"       default_trusted_certificate_ids\u003d79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_3596ee4d","line":161,"range":{"start_line":160,"start_character":54,"end_line":161,"end_character":57},"updated":"2018-04-13 21:05:34.000000000","message":"This is a little oddly worded. How about something like this?\n\n Note that these configuration options must be specified in\n the Nova configuration file that controls the Nova API \n services, as opposed to other Nova services (conductor, \n compute nodes, scheduler, etc.)\n\nYou may actually want to consider making this a note in the top section of this doc...\n\nYou can use:\n\n .. note::\n\n     text text text...","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"eb3b93fa23758698e4a1204053605b87ba3f79fa","unresolved":false,"context_lines":[{"line_number":157,"context_line":"     Use the Nova configuration option ``default_trusted_certificate_ids`` to define"},{"line_number":158,"context_line":"     a comma-delimited list of trusted certificate IDs. This configuration value is"},{"line_number":159,"context_line":"     only used if ``enable_certificate_validation`` is set to True, and the trusted"},{"line_number":160,"context_line":"     certificate IDs are not specified anywhere else. The Nova configuration where"},{"line_number":161,"context_line":"     this option is added must be used with the Nova API. For example::"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"       [glance]"},{"line_number":164,"context_line":"       default_trusted_certificate_ids\u003d79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_15796ac3","line":161,"range":{"start_line":160,"start_character":54,"end_line":161,"end_character":57},"in_reply_to":"bf659307_3596ee4d","updated":"2018-04-13 21:23:59.000000000","message":"Much better wording. Added as note above.","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":527,"context_line":"  Length: 434333 (424K) [application/x-tar]"},{"line_number":528,"context_line":"  Saving to: ‘cirros.tar.gz’"},{"line_number":529,"context_line":""},{"line_number":530,"context_line":"  cirros.tar.gz       100%[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003e] 424.15K  --.-KB/s    in 0.1s    "},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"  2018-02-19 11:37:54 (3.79 MB/s) - ‘cirros.tar.gz’ saved [434333/434333]"},{"line_number":533,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_f5d716ed","line":530,"range":{"start_line":530,"start_character":77,"end_line":530,"end_character":81},"updated":"2018-04-13 21:05:34.000000000","message":"*gasp*","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"eb3b93fa23758698e4a1204053605b87ba3f79fa","unresolved":false,"context_lines":[{"line_number":527,"context_line":"  Length: 434333 (424K) [application/x-tar]"},{"line_number":528,"context_line":"  Saving to: ‘cirros.tar.gz’"},{"line_number":529,"context_line":""},{"line_number":530,"context_line":"  cirros.tar.gz       100%[\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003e] 424.15K  --.-KB/s    in 0.1s    "},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"  2018-02-19 11:37:54 (3.79 MB/s) - ‘cirros.tar.gz’ saved [434333/434333]"},{"line_number":533,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_35782ec2","line":530,"range":{"start_line":530,"start_character":77,"end_line":530,"end_character":81},"in_reply_to":"bf659307_f5d716ed","updated":"2018-04-13 21:23:59.000000000","message":"Argh, how did I miss that?!","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"755e0ad07f5856a4b3caf10647d08218759911eb","unresolved":false,"context_lines":[{"line_number":625,"context_line":""},{"line_number":626,"context_line":".. note:: The instance should successfully boot and certificate validation"},{"line_number":627,"context_line":"          should succeed. The Nova log output should indicate that \"Image"},{"line_number":628,"context_line":"          signature certificate validation succeeded\"."},{"line_number":629,"context_line":""},{"line_number":630,"context_line":"Other Links"},{"line_number":631,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_b5075e82","line":628,"updated":"2018-04-13 21:05:34.000000000","message":"The above examples are awesome, Jackie. Great work on this.","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"eb3b93fa23758698e4a1204053605b87ba3f79fa","unresolved":false,"context_lines":[{"line_number":625,"context_line":""},{"line_number":626,"context_line":".. note:: The instance should successfully boot and certificate validation"},{"line_number":627,"context_line":"          should succeed. The Nova log output should indicate that \"Image"},{"line_number":628,"context_line":"          signature certificate validation succeeded\"."},{"line_number":629,"context_line":""},{"line_number":630,"context_line":"Other Links"},{"line_number":631,"context_line":"-----------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"bf659307_557362e7","line":628,"in_reply_to":"bf659307_b5075e82","updated":"2018-04-13 21:23:59.000000000","message":"Thanks!","commit_id":"b1a5fb15ad5721271c7176bde498fe4a4a506826"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"47e9ea4648076f2b98c038c22939f761307d8ec8","unresolved":false,"context_lines":[{"line_number":106,"context_line":"    * SECP384R1"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"``img_signature_certificate_uuid``"},{"line_number":109,"context_line":"  UUID of the certificate that you uploaded to the key manager. Possible certificate types are:"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"  * X_509"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Using Certificate Validation"},{"line_number":114,"context_line":"----------------------------"}],"source_content_type":"text/x-rst","patch_set":31,"id":"5f7c97a3_e1da2de7","line":111,"range":{"start_line":109,"start_character":64,"end_line":111,"end_character":9},"updated":"2018-05-29 16:41:06.000000000","message":"Is this copy/pasta from somewhere?","commit_id":"6341ff8f8796cc1c2fbb7f60b8418ba06796c6e1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"47e9ea4648076f2b98c038c22939f761307d8ec8","unresolved":false,"context_lines":[{"line_number":630,"context_line":".. note:: The instance should successfully boot and certificate validation"},{"line_number":631,"context_line":"          should succeed. The Nova log output should indicate that \"Image"},{"line_number":632,"context_line":"          signature certificate validation succeeded\"."},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other Links"},{"line_number":635,"context_line":"-----------"},{"line_number":636,"context_line":"* https://etherpad.openstack.org/p/mitaka-glance-image-signing-instructions"}],"source_content_type":"text/x-rst","patch_set":31,"id":"5f7c97a3_01af292a","line":633,"updated":"2018-05-29 16:41:06.000000000","message":"I\u0027ve said it before. I\u0027ll say it again. The above is some of the best documentation ever submitted for a new feature in Nova/OpenStack. Really well done.","commit_id":"6341ff8f8796cc1c2fbb7f60b8418ba06796c6e1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"776ec311054c8051c06751f71b385a6379e68eff","unresolved":false,"context_lines":[{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Certificate validation operates in concert with signature validation in"},{"line_number":33,"context_line":"Cursive. It takes in a list of trusted certificate IDs and verifies that the"},{"line_number":34,"context_line":"certificate used to sign the image being booted is cryptographically linked to"},{"line_number":35,"context_line":"at least one of the provided trusted certificates. This provides the user with"},{"line_number":36,"context_line":"confidence in the identity and integrity of the image being booted."}],"source_content_type":"text/x-rst","patch_set":39,"id":"5f7c97a3_dee070fb","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":7},"updated":"2018-06-07 18:32:01.000000000","message":"nit: s/Cursive/cursive/ ?","commit_id":"fa9389f6a5b177fd6dcc963bd3f490e9fcc1033d"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2018 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_77d69129","line":2,"updated":"2018-06-14 14:11:19.000000000","message":"no need for a Foundation copyright.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2018 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_2453fc18","line":2,"in_reply_to":"5f7c97a3_77d69129","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":12,"context_line":"      distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":13,"context_line":"      WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":14,"context_line":"      License for the specific language governing permissions and limitations"},{"line_number":15,"context_line":"      under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Image Signature Certificate Validation"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_9717adee","line":15,"updated":"2018-06-14 14:11:19.000000000","message":"you don\u0027t need to license the documentation.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":12,"context_line":"      distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":13,"context_line":"      WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":14,"context_line":"      License for the specific language governing permissions and limitations"},{"line_number":15,"context_line":"      under the License."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Image Signature Certificate Validation"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_44587830","line":15,"in_reply_to":"5f7c97a3_9717adee","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"applied to the creation or rebuild of an instance."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_57bcb5da","line":25,"range":{"start_line":25,"start_character":68,"end_line":25,"end_character":69},"updated":"2018-06-14 14:11:19.000000000","message":"nit: not needed.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":22,"context_line":"applied to the creation or rebuild of an instance."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_043a80c3","line":25,"range":{"start_line":25,"start_character":68,"end_line":25,"end_character":69},"in_reply_to":"5f7c97a3_57bcb5da","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"},{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_d7cf657c","line":27,"range":{"start_line":27,"start_character":30,"end_line":27,"end_character":59},"updated":"2018-06-14 14:11:19.000000000","message":"nit: [glance]/enable_certification_validation","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"},{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_24a1bcf8","line":27,"range":{"start_line":27,"start_character":30,"end_line":27,"end_character":59},"in_reply_to":"5f7c97a3_d7cf657c","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Certificate validation operates in concert with signature validation in"},{"line_number":33,"context_line":"Cursive. It takes in a list of trusted certificate IDs and verifies that the"},{"line_number":34,"context_line":"certificate used to sign the image being booted is cryptographically linked to"},{"line_number":35,"context_line":"at least one of the provided trusted certificates. This provides the user with"},{"line_number":36,"context_line":"confidence in the identity and integrity of the image being booted."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_37aa5983","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":7},"updated":"2018-06-14 14:11:19.000000000","message":"you should link the project IMHO.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Certificate validation operates in concert with signature validation in"},{"line_number":33,"context_line":"Cursive. It takes in a list of trusted certificate IDs and verifies that the"},{"line_number":34,"context_line":"certificate used to sign the image being booted is cryptographically linked to"},{"line_number":35,"context_line":"at least one of the provided trusted certificates. This provides the user with"},{"line_number":36,"context_line":"confidence in the identity and integrity of the image being booted."}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_44a63812","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":7},"in_reply_to":"5f7c97a3_37aa5983","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Certificate validation will only be performed if image signature validation is"},{"line_number":39,"context_line":"enabled. However, the presence of trusted certificate IDs overides the"},{"line_number":40,"context_line":"``enable_certificate_validation`` and ``verify_glance_signatures`` settings. In"},{"line_number":41,"context_line":"other words, if a list of trusted certificate IDs is provided to the instance"},{"line_number":42,"context_line":"create or rebuild commands, signature verification and certificate validation will"},{"line_number":43,"context_line":"be performed, regardless of their settings in the Nova configurations."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_d7cbe54f","line":41,"range":{"start_line":41,"start_character":13,"end_line":41,"end_character":77},"updated":"2018-06-14 14:11:19.000000000","message":"You should make an internal link to L124.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Certificate validation will only be performed if image signature validation is"},{"line_number":39,"context_line":"enabled. However, the presence of trusted certificate IDs overides the"},{"line_number":40,"context_line":"``enable_certificate_validation`` and ``verify_glance_signatures`` settings. In"},{"line_number":41,"context_line":"other words, if a list of trusted certificate IDs is provided to the instance"},{"line_number":42,"context_line":"create or rebuild commands, signature verification and certificate validation will"},{"line_number":43,"context_line":"be performed, regardless of their settings in the Nova configurations."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_84d3f05f","line":41,"range":{"start_line":41,"start_character":13,"end_line":41,"end_character":77},"in_reply_to":"5f7c97a3_d7cbe54f","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_f78f012b","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":17},"updated":"2018-06-14 14:11:19.000000000","message":"nit: configuration","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_a4506cd7","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":17},"in_reply_to":"5f7c97a3_f78f012b","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":165,"context_line":"     certificate IDs are not specified anywhere else. For example::"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"       [glance]"},{"line_number":168,"context_line":"       default_trusted_certificate_ids\u003d79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Example Usage"},{"line_number":171,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_57dd9511","line":168,"updated":"2018-06-14 14:11:19.000000000","message":"you should mention this config opt is per nova-api service, like you did for the two other options.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":165,"context_line":"     certificate IDs are not specified anywhere else. For example::"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"       [glance]"},{"line_number":168,"context_line":"       default_trusted_certificate_ids\u003d79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Example Usage"},{"line_number":171,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_e46f4491","line":168,"in_reply_to":"5f7c97a3_57dd9511","updated":"2018-06-14 19:27:15.000000000","message":"It\u0027s also used in compute.","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"7fff97cf01831446682a2b1b0e0cbaef08a5635b","unresolved":false,"context_lines":[{"line_number":630,"context_line":".. note:: The instance should successfully boot and certificate validation"},{"line_number":631,"context_line":"          should succeed. The Nova log output should indicate that \"Image"},{"line_number":632,"context_line":"          signature certificate validation succeeded\"."},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other Links"},{"line_number":635,"context_line":"-----------"},{"line_number":636,"context_line":"* https://etherpad.openstack.org/p/mitaka-glance-image-signing-instructions"}],"source_content_type":"text/x-rst","patch_set":46,"id":"5f7c97a3_37e6d9e8","line":633,"updated":"2018-06-14 14:11:19.000000000","message":"Thanks for the example, it really helps to understand ! ++","commit_id":"daf5864b6bc259484a0b4b978c4a2c3bd3cfb322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c966e1bc","line":26,"range":{"start_line":26,"start_character":17,"end_line":26,"end_character":23},"updated":"2018-06-14 19:18:32.000000000","message":"``[glance]``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_290bd5d5","line":26,"range":{"start_line":26,"start_character":39,"end_line":26,"end_character":58},"updated":"2018-06-14 19:18:32.000000000","message":"nit: ``nova.conf`` configuration file.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_240bfcd5","line":26,"range":{"start_line":26,"start_character":17,"end_line":26,"end_character":23},"in_reply_to":"5f7c97a3_c966e1bc","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"},{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c9fb41bc","line":27,"range":{"start_line":27,"start_character":28,"end_line":27,"end_character":61},"updated":"2018-06-14 19:18:32.000000000","message":"We can link to the actual docs on these using:\n\n:oslo.config:option:`enable_certificate_validation`","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Certificate validation is meant to be performed jointly with image signature"},{"line_number":25,"context_line":"verification, but each feature has its own Nova configuration option, to be"},{"line_number":26,"context_line":"specified in the glance section of the Nova configurations. To enable"},{"line_number":27,"context_line":"certificate validation, set ``enable_certificate_validation`` to True. To"},{"line_number":28,"context_line":"enable signature validation, set ``verify_glance_signatures`` to True."},{"line_number":29,"context_line":"Conversely, to disable either of these features, set their option to False or"},{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_44107801","line":27,"range":{"start_line":27,"start_character":28,"end_line":27,"end_character":61},"in_reply_to":"5f7c97a3_c9fb41bc","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Certificate validation operates in concert with signature validation in"},{"line_number":33,"context_line":"Cursive. It takes in a list of trusted certificate IDs and verifies that the"},{"line_number":34,"context_line":"certificate used to sign the image being booted is cryptographically linked to"},{"line_number":35,"context_line":"at least one of the provided trusted certificates. This provides the user with"},{"line_number":36,"context_line":"confidence in the identity and integrity of the image being booted."}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e91ddd10","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":7},"updated":"2018-06-14 19:18:32.000000000","message":"`Cursive`_\n\n.. _Cursive: https://github.com/openstack/cursive","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":30,"context_line":"do not include the option in the Nova configurations at all."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Certificate validation operates in concert with signature validation in"},{"line_number":33,"context_line":"Cursive. It takes in a list of trusted certificate IDs and verifies that the"},{"line_number":34,"context_line":"certificate used to sign the image being booted is cryptographically linked to"},{"line_number":35,"context_line":"at least one of the provided trusted certificates. This provides the user with"},{"line_number":36,"context_line":"confidence in the identity and integrity of the image being booted."}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e4f424d3","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":7},"in_reply_to":"5f7c97a3_e91ddd10","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c9e901e4","line":49,"range":{"start_line":49,"start_character":41,"end_line":49,"end_character":49},"updated":"2018-06-14 19:18:32.000000000","message":"It\u0027s not just nova-api though, it\u0027s also nova-compute.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_49de513f","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":17},"updated":"2018-06-14 19:18:32.000000000","message":"configuration","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c4fb28bc","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":17},"in_reply_to":"5f7c97a3_49de513f","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. note::"},{"line_number":48,"context_line":"    Certificate validation configuration options must be specified in the Nova"},{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a4fe2cad","line":49,"range":{"start_line":49,"start_character":41,"end_line":49,"end_character":49},"in_reply_to":"5f7c97a3_c9e901e4","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":"Key manager that is a backend to the `Castellan Interface`_. Possible key managers are:"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_09c93978","line":52,"updated":"2018-06-14 19:18:32.000000000","message":"We should also have a limitations section on supported virt drivers which can link to the feature support matrix change:\n\nhttp://logs.openstack.org/90/574890/4/check/build-openstack-sphinx-docs/03dc22f/html/user/support-matrix.html#operation_trusted_certs\n\nWe could also mention the lack of support for volume-backed instances in a limitations section, and reference the policy rules for create and rebuild at some point.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    confiugration file that controls the Nova API services, as opposed to other Nova"},{"line_number":50,"context_line":"    services (conductor, compute nodes, scheduler, etc.)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Requirements"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":"Key manager that is a backend to the `Castellan Interface`_. Possible key managers are:"},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_44acf89e","line":52,"in_reply_to":"5f7c97a3_09c93978","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* `Barbican`_"},{"line_number":57,"context_line":"* `Vault`_"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":".. _Castellan Interface: https://git.openstack.org/cgit/openstack/castellan"},{"line_number":60,"context_line":".. _Barbican: https://docs.openstack.org/barbican/latest/contributor/devstack.html"},{"line_number":61,"context_line":".. _Vault: https://www.vaultproject.io/"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_29b2f507","line":59,"range":{"start_line":59,"start_character":25,"end_line":59,"end_character":75},"updated":"2018-06-14 19:18:32.000000000","message":"probably better to link to docs than code right?\n\nhttps://docs.openstack.org/castellan/latest/","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* `Barbican`_"},{"line_number":57,"context_line":"* `Vault`_"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":".. _Castellan Interface: https://git.openstack.org/cgit/openstack/castellan"},{"line_number":60,"context_line":".. _Barbican: https://docs.openstack.org/barbican/latest/contributor/devstack.html"},{"line_number":61,"context_line":".. _Vault: https://www.vaultproject.io/"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e490a452","line":59,"range":{"start_line":59,"start_character":25,"end_line":59,"end_character":75},"in_reply_to":"5f7c97a3_29b2f507","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":64,"context_line":"-------------"},{"line_number":65,"context_line":"Nova will use the key manager defined by the Castellan key manager interface,"},{"line_number":66,"context_line":"which is the Barbican key manager by default. To use a different key manager,"},{"line_number":67,"context_line":"update the ``CONF.key_manager`` option\u0027s backend value in the Nova configurations."},{"line_number":68,"context_line":"For example::"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"  [key_manager]"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_4985f106","line":67,"range":{"start_line":67,"start_character":13,"end_line":67,"end_character":17},"updated":"2018-06-14 19:18:32.000000000","message":"CONF is a code variable, so this should be ``[key_manager]`` or just link to the section in the options:\n\n:oslo.config:option:`key_manager`","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":64,"context_line":"-------------"},{"line_number":65,"context_line":"Nova will use the key manager defined by the Castellan key manager interface,"},{"line_number":66,"context_line":"which is the Barbican key manager by default. To use a different key manager,"},{"line_number":67,"context_line":"update the ``CONF.key_manager`` option\u0027s backend value in the Nova configurations."},{"line_number":68,"context_line":"For example::"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"  [key_manager]"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a49aac6c","line":67,"range":{"start_line":67,"start_character":13,"end_line":67,"end_character":17},"in_reply_to":"5f7c97a3_4985f106","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":121,"context_line":"     verify_glance_signatures \u003d True"},{"line_number":122,"context_line":"     enable_certificate_validation \u003d True"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"2. A list of trusted certificate IDs is provided by one of three ways:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"   Environment Variable"},{"line_number":127,"context_line":"     Use the environment variable ``OS_TRUSTED_IMAGE_CERTIFICATE_IDS`` to"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_695ead7a","line":124,"updated":"2018-06-14 19:18:32.000000000","message":"nit: I\u0027d probably make a note that the CLI changes are pending some changes to python-novaclient and python-openstackclient.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":121,"context_line":"     verify_glance_signatures \u003d True"},{"line_number":122,"context_line":"     enable_certificate_validation \u003d True"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"2. A list of trusted certificate IDs is provided by one of three ways:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"   Environment Variable"},{"line_number":127,"context_line":"     Use the environment variable ``OS_TRUSTED_IMAGE_CERTIFICATE_IDS`` to"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_049cc059","line":124,"in_reply_to":"5f7c97a3_695ead7a","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":124,"context_line":"2. A list of trusted certificate IDs is provided by one of three ways:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"   Environment Variable"},{"line_number":127,"context_line":"     Use the environment variable ``OS_TRUSTED_IMAGE_CERTIFICATE_IDS`` to"},{"line_number":128,"context_line":"     define a comma-delimited list of trusted certificate IDs. For example:"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"     .. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_29e3d5da","line":127,"updated":"2018-06-14 19:18:32.000000000","message":"This is pending the novaclient / OSC changes right?\n\nhttps://review.openstack.org/#/c/500396/\n\nhttps://review.openstack.org/#/c/501926/","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":124,"context_line":"2. A list of trusted certificate IDs is provided by one of three ways:"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"   Environment Variable"},{"line_number":127,"context_line":"     Use the environment variable ``OS_TRUSTED_IMAGE_CERTIFICATE_IDS`` to"},{"line_number":128,"context_line":"     define a comma-delimited list of trusted certificate IDs. For example:"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"     .. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e49e6454","line":127,"in_reply_to":"5f7c97a3_29e3d5da","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":144,"context_line":"           --trusted-image-certificate-ids 79a6ad17-3298-4e55-8b3a-1672dd93c40f,b20f5600-3c9d-4af5-8f37-3110df3533a0"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"     If booting or rebuilding an instance using the :command:`openstack server` commands,"},{"line_number":147,"context_line":"     use the ``--trusted-image-certificate-id`` flag to define a single trusted"},{"line_number":148,"context_line":"     certificate ID. The flag may be used multiple times to specify multiple trusted"},{"line_number":149,"context_line":"     certificate IDs. For example:"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_49365154","line":147,"range":{"start_line":147,"start_character":43,"end_line":147,"end_character":45},"updated":"2018-06-14 19:18:32.000000000","message":"I thought this was a typo but I guess it\u0027s not:\n\nhttps://review.openstack.org/#/c/501926/5/openstackclient/compute/v2/server.py","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":153,"context_line":"       $ openstack server create myInstanceName \\"},{"line_number":154,"context_line":"           --flavor 1 \\"},{"line_number":155,"context_line":"           --image myImageId \\"},{"line_number":156,"context_line":"           --os-compute-api-version\u003d2.61 \\"},{"line_number":157,"context_line":"           --nic net-id\u003dfd25c0b2-b36b-45a8-82e4-ab52516289e5 \\"},{"line_number":158,"context_line":"           --trusted-image-certificate-id 79a6ad17-3298-4e55-8b3a-1672dd93c40f \\"},{"line_number":159,"context_line":"           --trusted-image-certificate-id b20f5600-3c9d-4af5-8f37-3110df3533a0"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_6910edac","line":156,"range":{"start_line":156,"start_character":38,"end_line":156,"end_character":40},"updated":"2018-06-14 19:18:32.000000000","message":"63","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":153,"context_line":"       $ openstack server create myInstanceName \\"},{"line_number":154,"context_line":"           --flavor 1 \\"},{"line_number":155,"context_line":"           --image myImageId \\"},{"line_number":156,"context_line":"           --os-compute-api-version\u003d2.61 \\"},{"line_number":157,"context_line":"           --nic net-id\u003dfd25c0b2-b36b-45a8-82e4-ab52516289e5 \\"},{"line_number":158,"context_line":"           --trusted-image-certificate-id 79a6ad17-3298-4e55-8b3a-1672dd93c40f \\"},{"line_number":159,"context_line":"           --trusted-image-certificate-id b20f5600-3c9d-4af5-8f37-3110df3533a0"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_64b494d5","line":156,"range":{"start_line":156,"start_character":38,"end_line":156,"end_character":40},"in_reply_to":"5f7c97a3_6910edac","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":161,"context_line":"   Nova Configuration Option"},{"line_number":162,"context_line":"     Use the Nova configuration option ``default_trusted_certificate_ids`` to define"},{"line_number":163,"context_line":"     a comma-delimited list of trusted certificate IDs. This configuration value is"},{"line_number":164,"context_line":"     only used if ``enable_certificate_validation`` is set to True, and the trusted"},{"line_number":165,"context_line":"     certificate IDs are not specified anywhere else. For example::"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"       [glance]"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_09661957","line":164,"range":{"start_line":164,"start_character":18,"end_line":164,"end_character":66},"updated":"2018-06-14 19:18:32.000000000","message":"it\u0027s also only if verify_glance_signatures is True, right?\n\nhttps://review.openstack.org/#/c/486204/115/nova/compute/api.py@995\n\nhttps://review.openstack.org/#/c/479949/78/nova/image/glance.py@399","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":161,"context_line":"   Nova Configuration Option"},{"line_number":162,"context_line":"     Use the Nova configuration option ``default_trusted_certificate_ids`` to define"},{"line_number":163,"context_line":"     a comma-delimited list of trusted certificate IDs. This configuration value is"},{"line_number":164,"context_line":"     only used if ``enable_certificate_validation`` is set to True, and the trusted"},{"line_number":165,"context_line":"     certificate IDs are not specified anywhere else. For example::"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"       [glance]"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a4c14c32","line":164,"range":{"start_line":164,"start_character":18,"end_line":164,"end_character":66},"in_reply_to":"5f7c97a3_09661957","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":200,"context_line":"Create a certificate configuration file"},{"line_number":201,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":202,"context_line":"For these instructions, we will create a single configuration file called"},{"line_number":203,"context_line":"ca.conf, which contains various sections that we can specify for use on the"},{"line_number":204,"context_line":"command-line during certificate requests and generation."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Note that this certificate will be able to sign other certificates because it"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_89630942","line":203,"range":{"start_line":203,"start_character":0,"end_line":203,"end_character":7},"updated":"2018-06-14 19:18:32.000000000","message":"``ca.conf``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":200,"context_line":"Create a certificate configuration file"},{"line_number":201,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":202,"context_line":"For these instructions, we will create a single configuration file called"},{"line_number":203,"context_line":"ca.conf, which contains various sections that we can specify for use on the"},{"line_number":204,"context_line":"command-line during certificate requests and generation."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Note that this certificate will be able to sign other certificates because it"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e4cc2464","line":203,"range":{"start_line":203,"start_character":0,"end_line":203,"end_character":7},"in_reply_to":"5f7c97a3_89630942","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Generate the certificate authority (CA) and corresponding private key"},{"line_number":258,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":259,"context_line":"For these instructions, we will save the certificate as cert_ca.pem and the"},{"line_number":260,"context_line":"private key as key_ca.pem. This certificate will be a self-signed root"},{"line_number":261,"context_line":"certificate authority (CA) that can sign other CAs and non-CA certificates."},{"line_number":262,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_495df177","line":259,"range":{"start_line":259,"start_character":56,"end_line":259,"end_character":67},"updated":"2018-06-14 19:18:32.000000000","message":"``cert_ca.pem``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Generate the certificate authority (CA) and corresponding private key"},{"line_number":258,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":259,"context_line":"For these instructions, we will save the certificate as cert_ca.pem and the"},{"line_number":260,"context_line":"private key as key_ca.pem. This certificate will be a self-signed root"},{"line_number":261,"context_line":"certificate authority (CA) that can sign other CAs and non-CA certificates."},{"line_number":262,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_04ca8045","line":259,"range":{"start_line":259,"start_character":56,"end_line":259,"end_character":67},"in_reply_to":"5f7c97a3_495df177","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":257,"context_line":"Generate the certificate authority (CA) and corresponding private key"},{"line_number":258,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":259,"context_line":"For these instructions, we will save the certificate as cert_ca.pem and the"},{"line_number":260,"context_line":"private key as key_ca.pem. This certificate will be a self-signed root"},{"line_number":261,"context_line":"certificate authority (CA) that can sign other CAs and non-CA certificates."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c94821b5","line":260,"range":{"start_line":260,"start_character":15,"end_line":260,"end_character":25},"updated":"2018-06-14 19:18:32.000000000","message":"``key_ca.pem``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":257,"context_line":"Generate the certificate authority (CA) and corresponding private key"},{"line_number":258,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":259,"context_line":"For these instructions, we will save the certificate as cert_ca.pem and the"},{"line_number":260,"context_line":"private key as key_ca.pem. This certificate will be a self-signed root"},{"line_number":261,"context_line":"certificate authority (CA) that can sign other CAs and non-CA certificates."},{"line_number":262,"context_line":""},{"line_number":263,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a4d62cf2","line":260,"range":{"start_line":260,"start_character":15,"end_line":260,"end_character":25},"in_reply_to":"5f7c97a3_c94821b5","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":279,"context_line":"Create the first intermediate certificate"},{"line_number":280,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":281,"context_line":"Create a certificate request for the first intermediate certificate. For these"},{"line_number":282,"context_line":"instructions, we will save the certificate request as cert_intermeidate_a.csr"},{"line_number":283,"context_line":"and the private key as key_intermediate_a.pem."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a9e04599","line":282,"range":{"start_line":282,"start_character":54,"end_line":282,"end_character":77},"updated":"2018-06-14 19:18:32.000000000","message":"Put in ``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":279,"context_line":"Create the first intermediate certificate"},{"line_number":280,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":281,"context_line":"Create a certificate request for the first intermediate certificate. For these"},{"line_number":282,"context_line":"instructions, we will save the certificate request as cert_intermeidate_a.csr"},{"line_number":283,"context_line":"and the private key as key_intermediate_a.pem."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c4d32801","line":282,"range":{"start_line":282,"start_character":54,"end_line":282,"end_character":77},"in_reply_to":"5f7c97a3_a9e04599","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":280,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":281,"context_line":"Create a certificate request for the first intermediate certificate. For these"},{"line_number":282,"context_line":"instructions, we will save the certificate request as cert_intermeidate_a.csr"},{"line_number":283,"context_line":"and the private key as key_intermediate_a.pem."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":".. code-block:: console"},{"line_number":286,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c9dd81de","line":283,"range":{"start_line":283,"start_character":23,"end_line":283,"end_character":45},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":280,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":281,"context_line":"Create a certificate request for the first intermediate certificate. For these"},{"line_number":282,"context_line":"instructions, we will save the certificate request as cert_intermeidate_a.csr"},{"line_number":283,"context_line":"and the private key as key_intermediate_a.pem."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":".. code-block:: console"},{"line_number":286,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_64025475","line":283,"range":{"start_line":283,"start_character":23,"end_line":283,"end_character":45},"in_reply_to":"5f7c97a3_c9dd81de","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":"Generate the first intermediate certificate by signing its certificate request"},{"line_number":301,"context_line":"with the CA. For these instructions we will save the certificate as"},{"line_number":302,"context_line":"cert_intermediate_a.pem."},{"line_number":303,"context_line":""},{"line_number":304,"context_line":".. code-block:: console"},{"line_number":305,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_69ec6d92","line":302,"range":{"start_line":302,"start_character":0,"end_line":302,"end_character":23},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":"Generate the first intermediate certificate by signing its certificate request"},{"line_number":301,"context_line":"with the CA. For these instructions we will save the certificate as"},{"line_number":302,"context_line":"cert_intermediate_a.pem."},{"line_number":303,"context_line":""},{"line_number":304,"context_line":".. code-block:: console"},{"line_number":305,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_24fc5c71","line":302,"range":{"start_line":302,"start_character":0,"end_line":302,"end_character":23},"in_reply_to":"5f7c97a3_69ec6d92","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":327,"context_line":"Create the second intermediate certificate"},{"line_number":328,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":329,"context_line":"Create a certificate request for the second intermediate certificate. For these"},{"line_number":330,"context_line":"instructions, we will save the certificate request as cert_intermeidate_b.csr"},{"line_number":331,"context_line":"and the private key as key_intermediate_b.pem."},{"line_number":332,"context_line":""},{"line_number":333,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c9f6e15e","line":330,"range":{"start_line":330,"start_character":54,"end_line":330,"end_character":77},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":327,"context_line":"Create the second intermediate certificate"},{"line_number":328,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":329,"context_line":"Create a certificate request for the second intermediate certificate. For these"},{"line_number":330,"context_line":"instructions, we will save the certificate request as cert_intermeidate_b.csr"},{"line_number":331,"context_line":"and the private key as key_intermediate_b.pem."},{"line_number":332,"context_line":""},{"line_number":333,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_4401586a","line":330,"range":{"start_line":330,"start_character":54,"end_line":330,"end_character":77},"in_reply_to":"5f7c97a3_c9f6e15e","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":328,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":329,"context_line":"Create a certificate request for the second intermediate certificate. For these"},{"line_number":330,"context_line":"instructions, we will save the certificate request as cert_intermeidate_b.csr"},{"line_number":331,"context_line":"and the private key as key_intermediate_b.pem."},{"line_number":332,"context_line":""},{"line_number":333,"context_line":".. code-block:: console"},{"line_number":334,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e9ff1d33","line":331,"range":{"start_line":331,"start_character":23,"end_line":331,"end_character":45},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":328,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":329,"context_line":"Create a certificate request for the second intermediate certificate. For these"},{"line_number":330,"context_line":"instructions, we will save the certificate request as cert_intermeidate_b.csr"},{"line_number":331,"context_line":"and the private key as key_intermediate_b.pem."},{"line_number":332,"context_line":""},{"line_number":333,"context_line":".. code-block:: console"},{"line_number":334,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e4f50486","line":331,"range":{"start_line":331,"start_character":23,"end_line":331,"end_character":45},"in_reply_to":"5f7c97a3_e9ff1d33","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":347,"context_line":""},{"line_number":348,"context_line":"Generate the second intermediate certificate by signing its certificate request"},{"line_number":349,"context_line":"with the first intermediate certificate. For these instructions we will save"},{"line_number":350,"context_line":"the certificate as cert_intermediate_b.pem."},{"line_number":351,"context_line":""},{"line_number":352,"context_line":".. code-block:: console"},{"line_number":353,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a9f9254f","line":350,"range":{"start_line":350,"start_character":19,"end_line":350,"end_character":42},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":347,"context_line":""},{"line_number":348,"context_line":"Generate the second intermediate certificate by signing its certificate request"},{"line_number":349,"context_line":"with the first intermediate certificate. For these instructions we will save"},{"line_number":350,"context_line":"the certificate as cert_intermediate_b.pem."},{"line_number":351,"context_line":""},{"line_number":352,"context_line":".. code-block:: console"},{"line_number":353,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a4ef0cb0","line":350,"range":{"start_line":350,"start_character":19,"end_line":350,"end_character":42},"in_reply_to":"5f7c97a3_a9f9254f","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":375,"context_line":"Create the client certificate"},{"line_number":376,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":377,"context_line":"Create a certificate request for the client certificate. For these"},{"line_number":378,"context_line":"instructions, we will save the certificate request as cert_client.csr and the"},{"line_number":379,"context_line":"private key as key_client.pem."},{"line_number":380,"context_line":""},{"line_number":381,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_299bd517","line":378,"range":{"start_line":378,"start_character":54,"end_line":378,"end_character":69},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":375,"context_line":"Create the client certificate"},{"line_number":376,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":377,"context_line":"Create a certificate request for the client certificate. For these"},{"line_number":378,"context_line":"instructions, we will save the certificate request as cert_client.csr and the"},{"line_number":379,"context_line":"private key as key_client.pem."},{"line_number":380,"context_line":""},{"line_number":381,"context_line":".. code-block:: console"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c4ec88bd","line":378,"range":{"start_line":378,"start_character":54,"end_line":378,"end_character":69},"in_reply_to":"5f7c97a3_299bd517","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":376,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":377,"context_line":"Create a certificate request for the client certificate. For these"},{"line_number":378,"context_line":"instructions, we will save the certificate request as cert_client.csr and the"},{"line_number":379,"context_line":"private key as key_client.pem."},{"line_number":380,"context_line":""},{"line_number":381,"context_line":".. code-block:: console"},{"line_number":382,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_49a09143","line":379,"range":{"start_line":379,"start_character":15,"end_line":379,"end_character":29},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":376,"context_line":"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""},{"line_number":377,"context_line":"Create a certificate request for the client certificate. For these"},{"line_number":378,"context_line":"instructions, we will save the certificate request as cert_client.csr and the"},{"line_number":379,"context_line":"private key as key_client.pem."},{"line_number":380,"context_line":""},{"line_number":381,"context_line":".. code-block:: console"},{"line_number":382,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_842c5002","line":379,"range":{"start_line":379,"start_character":15,"end_line":379,"end_character":29},"in_reply_to":"5f7c97a3_49a09143","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":395,"context_line":""},{"line_number":396,"context_line":"Generate the client certificate by signing its certificate request with the"},{"line_number":397,"context_line":"second intermediate certificate. For these instructions we will save the"},{"line_number":398,"context_line":"certificate as cert_client.pem."},{"line_number":399,"context_line":""},{"line_number":400,"context_line":".. code-block:: console"},{"line_number":401,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e984fdb4","line":398,"range":{"start_line":398,"start_character":15,"end_line":398,"end_character":30},"updated":"2018-06-14 19:18:32.000000000","message":"``","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":395,"context_line":""},{"line_number":396,"context_line":"Generate the client certificate by signing its certificate request with the"},{"line_number":397,"context_line":"second intermediate certificate. For these instructions we will save the"},{"line_number":398,"context_line":"certificate as cert_client.pem."},{"line_number":399,"context_line":""},{"line_number":400,"context_line":".. code-block:: console"},{"line_number":401,"context_line":""}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_2431bc5a","line":398,"range":{"start_line":398,"start_character":15,"end_line":398,"end_character":30},"in_reply_to":"5f7c97a3_e984fdb4","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":451,"context_line":""},{"line_number":452,"context_line":".. code-block:: console"},{"line_number":453,"context_line":""},{"line_number":454,"context_line":"  $ openstack secret store \\"},{"line_number":455,"context_line":"      --name CA \\"},{"line_number":456,"context_line":"      --algorithm RSA \\"},{"line_number":457,"context_line":"      --expiration 2018-06-29 \\"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_a98e05cf","line":454,"range":{"start_line":454,"start_character":14,"end_line":454,"end_character":20},"updated":"2018-06-14 19:18:32.000000000","message":"This isn\u0027t part of the standard OSC CLI - which OSC plugin makes this available? Looks like it\u0027s python-barbicanclient:\n\nhttp://git.openstack.org/cgit/openstack/python-barbicanclient/tree/barbicanclient/osc_plugin.py","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":451,"context_line":""},{"line_number":452,"context_line":".. code-block:: console"},{"line_number":453,"context_line":""},{"line_number":454,"context_line":"  $ openstack secret store \\"},{"line_number":455,"context_line":"      --name CA \\"},{"line_number":456,"context_line":"      --algorithm RSA \\"},{"line_number":457,"context_line":"      --expiration 2018-06-29 \\"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_44363854","line":454,"range":{"start_line":454,"start_character":14,"end_line":454,"end_character":20},"in_reply_to":"5f7c97a3_a98e05cf","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":558,"context_line":""},{"line_number":559,"context_line":".. code-block:: console"},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"  $ glance image-create \\"},{"line_number":562,"context_line":"      --property name\u003dcirros_client_signedImage \\"},{"line_number":563,"context_line":"      --property is-public\u003dtrue \\"},{"line_number":564,"context_line":"      --container-format bare \\"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_2910b559","line":561,"range":{"start_line":561,"start_character":4,"end_line":561,"end_character":23},"updated":"2018-06-14 19:18:32.000000000","message":"nit: we should use OSC commands here if possible:\n\nhttps://docs.openstack.org/python-openstackclient/latest/cli/command-objects/image.html#image-create\n\nbut I don\u0027t have the env setup properly to do that right now to get the proper output","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bd25b1d8ddca150fb575207ab43bbdf142fa164","unresolved":false,"context_lines":[{"line_number":558,"context_line":""},{"line_number":559,"context_line":".. code-block:: console"},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"  $ glance image-create \\"},{"line_number":562,"context_line":"      --property name\u003dcirros_client_signedImage \\"},{"line_number":563,"context_line":"      --property is-public\u003dtrue \\"},{"line_number":564,"context_line":"      --container-format bare \\"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e423c405","line":561,"range":{"start_line":561,"start_character":4,"end_line":561,"end_character":23},"in_reply_to":"5f7c97a3_2910b559","updated":"2018-06-14 19:44:22.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"}],"doc/source/user/index.rst":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0bd6579db7d3ac6170de267bca149576f57f8e36","unresolved":false,"context_lines":[{"line_number":12,"context_line":"   config-drive"},{"line_number":13,"context_line":"   metadata-service"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":".. todo:: The rest of this document should probably move to the admin guide."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Architecture Overview"},{"line_number":18,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_c943413f","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":76},"updated":"2018-06-14 18:45:40.000000000","message":"Note this, the rest of this doc is mostly about admin stuff, and it appears the certs validation doc itself is split into both admin stuff (configuration) and user-side stuff (how does an end user use this). ideally the admin stuff would go into the admin guide (doc/source/admin) and the end user stuff would go in here alongside the topics above for creating instances, config drive and using the metadata API.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"21cb5623b7e36d241ab5a7d4276096fbdb836b3e","unresolved":false,"context_lines":[{"line_number":12,"context_line":"   config-drive"},{"line_number":13,"context_line":"   metadata-service"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":".. todo:: The rest of this document should probably move to the admin guide."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Architecture Overview"},{"line_number":18,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_e43744e4","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":76},"in_reply_to":"5f7c97a3_295675d0","updated":"2018-06-14 19:27:15.000000000","message":"Done","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"790137078c2723cff86fbcaa02d4c267c36a2ae8","unresolved":false,"context_lines":[{"line_number":12,"context_line":"   config-drive"},{"line_number":13,"context_line":"   metadata-service"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":".. todo:: The rest of this document should probably move to the admin guide."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Architecture Overview"},{"line_number":18,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":47,"id":"5f7c97a3_295675d0","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":76},"in_reply_to":"5f7c97a3_c943413f","updated":"2018-06-14 19:18:32.000000000","message":"Having said that, it\u0027s not really easy to split up the doc you have (I mean we could, but it\u0027s probably more pain than we need at this point). I would, however, move the link out of the maintenance section below so it\u0027s more top-level for non-admin user information.","commit_id":"8cd99488f052f0d70343ae7e5b289eddc9aa74f8"}]}