)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fd121c55d32d9010b7afedf24d839c34718b255","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Parent:     35e9c2bc (Merge \"Move xenapi partition copies to privsep.\")"},{"line_number":2,"context_line":"Author:     Dan Smith \u003cdansmith@redhat.com\u003e"},{"line_number":3,"context_line":"AuthorDate: 2018-04-13 09:00:23 -0700"},{"line_number":4,"context_line":"Commit:     Jackie Truong \u003cjacklyn.truong@jhuapl.edu\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-04-14 18:07:25 +0000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9f6a8fd7_b8a5e3b7","line":2,"updated":"2018-04-16 14:38:03.000000000","message":"Should this be:\n\nJackie Truong \u003cjacklyn.truong@jhuapl.edu\u003e","commit_id":"57d906050d1d5bb2e5eb8aaf22c9d9ca5e7c9cba"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bf65227eb8ddc1f0e174f10d2243b77a9814d8e9","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Parent:     35e9c2bc (Merge \"Move xenapi partition copies to privsep.\")"},{"line_number":2,"context_line":"Author:     Dan Smith \u003cdansmith@redhat.com\u003e"},{"line_number":3,"context_line":"AuthorDate: 2018-04-13 09:00:23 -0700"},{"line_number":4,"context_line":"Commit:     Jackie Truong \u003cjacklyn.truong@jhuapl.edu\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-04-14 18:07:25 +0000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9f6a8fd7_2be3ba35","line":2,"in_reply_to":"9f6a8fd7_9598e56a","updated":"2018-04-16 17:46:37.000000000","message":"Up to you two, I don\u0027t know how pervasive the changes were when he split it out. Normally I\u0027d leave you as author and add myself as co-author if I were splitting out changes from your series.","commit_id":"57d906050d1d5bb2e5eb8aaf22c9d9ca5e7c9cba"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"63bdbcf73ec31eda95fe77e406d05f2e04f51cc0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Parent:     35e9c2bc (Merge \"Move xenapi partition copies to privsep.\")"},{"line_number":2,"context_line":"Author:     Dan Smith \u003cdansmith@redhat.com\u003e"},{"line_number":3,"context_line":"AuthorDate: 2018-04-13 09:00:23 -0700"},{"line_number":4,"context_line":"Commit:     Jackie Truong \u003cjacklyn.truong@jhuapl.edu\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-04-14 18:07:25 +0000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9f6a8fd7_9598e56a","line":2,"in_reply_to":"9f6a8fd7_b8a5e3b7","updated":"2018-04-16 16:32:47.000000000","message":"Dan technically uploaded this. Should I change?","commit_id":"57d906050d1d5bb2e5eb8aaf22c9d9ca5e7c9cba"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This makes the libvirt driver handle and pass trusted_certs through to"},{"line_number":10,"context_line":"the image download code that is now available."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: Dan Smith \u003cdansmith@redhat.com\u003e"},{"line_number":13,"context_line":"Change-Id: Ie3130e104d7ca80289f1bd9f0fee9a7a198c263c"},{"line_number":14,"context_line":"Implements: blueprint nova-validate-certificates"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":27,"id":"5f7c97a3_2fd4701f","line":11,"updated":"2018-06-12 19:15:18.000000000","message":"This is more than just the libvirt driver at this point, so it would be good to mention more about what\u0027s going on in the compute manager wrt the capability check and server version.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"}],"nova/compute/manager.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":1787,"context_line":""},{"line_number":1788,"context_line":"    def _check_trusted_certs(self, instance):"},{"line_number":1789,"context_line":"        certs_provided \u003d False"},{"line_number":1790,"context_line":"        if instance.get(\"trusted_certs\", None):"},{"line_number":1791,"context_line":"            certs_provided \u003d True"},{"line_number":1792,"context_line":""},{"line_number":1793,"context_line":"        if (certs_provided and"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_2f8b101f","line":1790,"range":{"start_line":1790,"start_character":11,"end_line":1790,"end_character":47},"updated":"2018-06-12 19:15:18.000000000","message":"This can just be:\n\n  if instance.trusted_certs\n\nSince that will lazy-load the field if it\u0027s not already set.\n\nI was going to see if we need to check:\n\n  and instance.trusted_certs.ids\n\nBut it looks like we only ever set trusted_certs on the instance if it has ids.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":1787,"context_line":""},{"line_number":1788,"context_line":"    def _check_trusted_certs(self, instance):"},{"line_number":1789,"context_line":"        certs_provided \u003d False"},{"line_number":1790,"context_line":"        if instance.get(\"trusted_certs\", None):"},{"line_number":1791,"context_line":"            certs_provided \u003d True"},{"line_number":1792,"context_line":""},{"line_number":1793,"context_line":"        if (certs_provided and"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_cae7ea11","line":1790,"range":{"start_line":1790,"start_character":11,"end_line":1790,"end_character":47},"in_reply_to":"5f7c97a3_2f8b101f","updated":"2018-06-12 19:59:30.000000000","message":"Done","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":1791,"context_line":"            certs_provided \u003d True"},{"line_number":1792,"context_line":""},{"line_number":1793,"context_line":"        if (certs_provided and"},{"line_number":1794,"context_line":"                not self.driver.capabilities.get(\u0027supports_trusted_certs\u0027,"},{"line_number":1795,"context_line":"                                                 False)):"},{"line_number":1796,"context_line":"            raise exception.BuildAbortException("},{"line_number":1797,"context_line":"                \u0027Trusted image certificates provided on host that does not \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_afcc006a","line":1794,"range":{"start_line":1794,"start_character":50,"end_line":1794,"end_character":72},"updated":"2018-06-12 19:15:18.000000000","message":"This is likely also cause for updating the feature support matrix:\n\nhttps://docs.openstack.org/nova/latest/user/support-matrix.html\n\nBut that can go in the docs change (or something separate).","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":3015,"context_line":"        else:"},{"line_number":3016,"context_line":"            image_meta \u003d instance.image_meta"},{"line_number":3017,"context_line":""},{"line_number":3018,"context_line":"        self._check_trusted_certs(instance)"},{"line_number":3019,"context_line":""},{"line_number":3020,"context_line":"        # This instance.exists message should contain the original"},{"line_number":3021,"context_line":"        # image_ref, not the new one.  Since the DB has been updated"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_cf237c04","line":3018,"updated":"2018-06-12 19:15:18.000000000","message":"I was going to say this only applies for evacuate to a new host, since if we\u0027re rebuilding on the same host then we\u0027ve already done cert validation - however, we could have the case that the instance was created on host A without trusted certs, and then they rebuilt the instance with a new image that requires trusted certs, in which case we have to ensure host A still supports trusted certs. A comment in the code with this could be nice.\n\nAlso, we don\u0027t have a unit test for this check.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":3015,"context_line":"        else:"},{"line_number":3016,"context_line":"            image_meta \u003d instance.image_meta"},{"line_number":3017,"context_line":""},{"line_number":3018,"context_line":"        self._check_trusted_certs(instance)"},{"line_number":3019,"context_line":""},{"line_number":3020,"context_line":"        # This instance.exists message should contain the original"},{"line_number":3021,"context_line":"        # image_ref, not the new one.  Since the DB has been updated"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_cafa8a73","line":3018,"in_reply_to":"5f7c97a3_cf237c04","updated":"2018-06-12 19:59:30.000000000","message":"Done","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"}],"nova/tests/unit/compute/test_compute_mgr.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        self.assertTrue(mock_log.warning.called)"},{"line_number":297,"context_line":"        self.assertFalse(mock_log.error.called)"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"    @mock.patch(\u0027nova.db.instance_extra_get_by_instance_uuid\u0027)"},{"line_number":300,"context_line":"    def _trusted_certs_setup_instance(self, mock_get,"},{"line_number":301,"context_line":"            include_trusted_certs\u003dTrue):"},{"line_number":302,"context_line":"        fake_trusted_certs \u003d objects.trusted_certs.TrustedCerts("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_cf729ce3","line":299,"updated":"2018-06-12 19:15:18.000000000","message":"This is mocking too deep IMO, why can\u0027t we just do something like this?\n\ninstance \u003d fake_instance.fake_instance_obj(self.context)\nif include_trusted_certs:\n    instance.trusted_certs \u003d objects.trusted_certs.TrustedCerts(\n            ids\u003d[\u0027fake-trusted-cert-1\u0027, \u0027fake-trusted-cert-2\u0027])\nelse:\n    instance.trusted_certs \u003d None\nreturn instance","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":296,"context_line":"        self.assertTrue(mock_log.warning.called)"},{"line_number":297,"context_line":"        self.assertFalse(mock_log.error.called)"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"    @mock.patch(\u0027nova.db.instance_extra_get_by_instance_uuid\u0027)"},{"line_number":300,"context_line":"    def _trusted_certs_setup_instance(self, mock_get,"},{"line_number":301,"context_line":"            include_trusted_certs\u003dTrue):"},{"line_number":302,"context_line":"        fake_trusted_certs \u003d objects.trusted_certs.TrustedCerts("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_ea3ae631","line":299,"in_reply_to":"5f7c97a3_cf729ce3","updated":"2018-06-12 19:59:30.000000000","message":"Done","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"}],"nova/tests/unit/virt/libvirt/fake_libvirt_utils.py":[{"author":{"_account_id":9708,"name":"Balazs Gibizer","display_name":"gibi","email":"gibizer@gmail.com","username":"gibi"},"change_message_id":"4cce408fd8eabaaa0c6c748f00e992ddb62ab98a","unresolved":false,"context_lines":[{"line_number":138,"context_line":"    pass"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"def fetch_raw_image(context, target, image_id, max_size\u003d0):"},{"line_number":142,"context_line":"    pass"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"5f7c97a3_95eb7bdb","line":141,"updated":"2018-06-12 10:49:39.000000000","message":"This also has a trusted_certs param in the libvirt/utils.py","commit_id":"192b18770b9abacb90fd58de89104a7de8255ef0"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"15cf7343404e900c34539a1943eea8ac3d2c0cf5","unresolved":false,"context_lines":[{"line_number":138,"context_line":"    pass"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"def fetch_raw_image(context, target, image_id, max_size\u003d0):"},{"line_number":142,"context_line":"    pass"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"text/x-python","patch_set":23,"id":"5f7c97a3_9004d24b","line":141,"in_reply_to":"5f7c97a3_95eb7bdb","updated":"2018-06-12 13:01:44.000000000","message":"Good catch. I\u0027ve updated it in the latest patch.","commit_id":"192b18770b9abacb90fd58de89104a7de8255ef0"}],"nova/tests/unit/virt/libvirt/test_utils.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":613,"context_line":"        context \u003d \u0027opaque context\u0027"},{"line_number":614,"context_line":"        target \u003d \u0027/tmp/targetfile\u0027"},{"line_number":615,"context_line":"        image_id \u003d \u00274\u0027"},{"line_number":616,"context_line":"        trusted_certs \u003d [\u00270b5d2c72-12cc-4ba6-a8d7-3ff5cc1d8cb8\u0027,"},{"line_number":617,"context_line":"                         \u0027674736e3-f25c-405c-8362-bbf991e0ce0a\u0027]"},{"line_number":618,"context_line":"        libvirt_utils.fetch_image(context, target, image_id, trusted_certs)"},{"line_number":619,"context_line":"        mock_images.assert_called_once_with("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_ef10b85b","line":616,"updated":"2018-06-12 19:15:18.000000000","message":"Based on how the libvirt driver calls fetch_image, it\u0027s passing a TrustedCerts object, not a list of IDs, so this is wrong.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":613,"context_line":"        context \u003d \u0027opaque context\u0027"},{"line_number":614,"context_line":"        target \u003d \u0027/tmp/targetfile\u0027"},{"line_number":615,"context_line":"        image_id \u003d \u00274\u0027"},{"line_number":616,"context_line":"        trusted_certs \u003d [\u00270b5d2c72-12cc-4ba6-a8d7-3ff5cc1d8cb8\u0027,"},{"line_number":617,"context_line":"                         \u0027674736e3-f25c-405c-8362-bbf991e0ce0a\u0027]"},{"line_number":618,"context_line":"        libvirt_utils.fetch_image(context, target, image_id, trusted_certs)"},{"line_number":619,"context_line":"        mock_images.assert_called_once_with("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_2a5c5e7b","line":616,"in_reply_to":"5f7c97a3_ef10b85b","updated":"2018-06-12 19:59:30.000000000","message":"Done","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":627,"context_line":"                                          user_name\u003d\"pie\")"},{"line_number":628,"context_line":"        target \u003d \u0027/tmp/targetfile\u0027"},{"line_number":629,"context_line":"        image_id \u003d \u00274\u0027"},{"line_number":630,"context_line":"        trusted_certs \u003d [\u00270b5d2c72-12cc-4ba6-a8d7-3ff5cc1d8cb8\u0027,"},{"line_number":631,"context_line":"                         \u0027674736e3-f25c-405c-8362-bbf991e0ce0a\u0027]"},{"line_number":632,"context_line":"        libvirt_utils.fetch_raw_image(_context, target, image_id,"},{"line_number":633,"context_line":"                                      trusted_certs)"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_af0e4038","line":630,"updated":"2018-06-12 19:15:18.000000000","message":"same","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":627,"context_line":"                                          user_name\u003d\"pie\")"},{"line_number":628,"context_line":"        target \u003d \u0027/tmp/targetfile\u0027"},{"line_number":629,"context_line":"        image_id \u003d \u00274\u0027"},{"line_number":630,"context_line":"        trusted_certs \u003d [\u00270b5d2c72-12cc-4ba6-a8d7-3ff5cc1d8cb8\u0027,"},{"line_number":631,"context_line":"                         \u0027674736e3-f25c-405c-8362-bbf991e0ce0a\u0027]"},{"line_number":632,"context_line":"        libvirt_utils.fetch_raw_image(_context, target, image_id,"},{"line_number":633,"context_line":"                                      trusted_certs)"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_0a59628c","line":630,"in_reply_to":"5f7c97a3_af0e4038","updated":"2018-06-12 19:59:30.000000000","message":"Done","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"}],"nova/virt/driver.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d2e189e120aba5787ccbc162cd8b04fb1896acfc","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        \"supports_tagged_attach_volume\": False,"},{"line_number":132,"context_line":"        \"supports_extend_volume\": False,"},{"line_number":133,"context_line":"        \"supports_multiattach\": False,"},{"line_number":134,"context_line":"        \"supports_trusted_certs\": False,"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    requires_allocation_refresh \u003d False"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_88d0da2d","line":134,"updated":"2018-06-04 13:24:26.000000000","message":"I don\u0027t see this getting read anywhere in the compute manager. What happens if I\u0027m not using the libvirt driver, or all of my computes are running Queens where this code doesn\u0027t exist, and I request a server and pass in trusted_image_certificates? Does the server get created even though there is no cert validation of the image? Since we\u0027re reporting a new capability out of the compute drivers now, I\u0027m thinking of two things:\n\n1. The API probably shouldn\u0027t allow creating a server with trusted_image_certificates if all of the computes are back-level (this would require a compute RPC service version bump and check in the API for that minimum compute service version across the deployment - we did the same for volume multi-attach support and device tags).\n\n2. The compute manager could check, during build and rebuild, if trusted_certs were provided but the driver doesn\u0027t support trusted certs, that it would be an explicit failure.\n\nFrom the \"verify_glance_signatures\" config option help, it says:\n\n\"If the image signature cannot\nbe verified or if the image signature metadata is either incomplete or\nunavailable, then nova will not boot the image and instead will place the\ninstance into an error state. This provides end users with stronger assurances\nof the integrity of the image data they are using to create servers.\"\n\nI\u0027m worried that we\u0027re leaving some gaps where we\u0027ll accept the request from the user but not actually honor it, leaving them with a false sense of security.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f1dab62c3992605b87156c034ae2caf597cebc2d","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        \"supports_tagged_attach_volume\": False,"},{"line_number":132,"context_line":"        \"supports_extend_volume\": False,"},{"line_number":133,"context_line":"        \"supports_multiattach\": False,"},{"line_number":134,"context_line":"        \"supports_trusted_certs\": False,"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    requires_allocation_refresh \u003d False"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_ec34e2ae","line":134,"in_reply_to":"5f7c97a3_4dc39d39","updated":"2018-06-05 16:45:49.000000000","message":"Well, it\u0027s two things as noted above:\n\n1. From the API, can any computes in the deployment handle this based on their version - this is a min nova-compute service version check during server create which we can drop in a later release (the T release I think).\n\n2. From the compute service, can this compute handle trusted certs and if not, fail the build (I expect we should abort the build to follow the same way that virtual device tags not being supported aborts a build).","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"38d1a724c5825d36e3a85760c352ef7045c3b8df","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        \"supports_tagged_attach_volume\": False,"},{"line_number":132,"context_line":"        \"supports_extend_volume\": False,"},{"line_number":133,"context_line":"        \"supports_multiattach\": False,"},{"line_number":134,"context_line":"        \"supports_trusted_certs\": False,"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    requires_allocation_refresh \u003d False"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_4dc39d39","line":134,"in_reply_to":"5f7c97a3_88d0da2d","updated":"2018-06-05 10:37:13.000000000","message":"I agree that we should fail if trusted certs are provided but not supported by the backend.  I will make these changes in the API patch.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"3b3f030b51d7731714ed05b84c350cb3b86d4193","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        \"supports_tagged_attach_volume\": False,"},{"line_number":132,"context_line":"        \"supports_extend_volume\": False,"},{"line_number":133,"context_line":"        \"supports_multiattach\": False,"},{"line_number":134,"context_line":"        \"supports_trusted_certs\": False,"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    requires_allocation_refresh \u003d False"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_6ed0a554","line":134,"in_reply_to":"5f7c97a3_ec34e2ae","updated":"2018-06-06 20:31:51.000000000","message":"I\u0027ve added #1 to the next patch and #2 to this patch.  Thank you again for the examples!","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"}],"nova/virt/libvirt/driver.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"bed67ec72a0a14c347cab7593a685afd8bedad54","unresolved":false,"context_lines":[{"line_number":3472,"context_line":"            disk_images, injection_info,"},{"line_number":3473,"context_line":"            fallback_from_host,"},{"line_number":3474,"context_line":"            trusted_certs"},{"line_number":3475,"context_line":"        )"},{"line_number":3476,"context_line":""},{"line_number":3477,"context_line":"        # Lookup the filesystem type if required"},{"line_number":3478,"context_line":"        os_type_with_default \u003d nova.privsep.fs.get_fs_type_for_os_type("}],"source_content_type":"text/x-python","patch_set":1,"id":"bf659307_1515ea3c","line":3475,"range":{"start_line":3475,"start_character":8,"end_line":3475,"end_character":9},"updated":"2018-04-13 20:43:32.000000000","message":"*gasp*\n\nI would have thought the parens-on-own-line posse would have caught this :P","commit_id":"b7c83b5906a8d8c6deb80ac6414537822e777ec4"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b3b6dff2a8e651e84dd38cfda076a63b6b23702c","unresolved":false,"context_lines":[{"line_number":3540,"context_line":"        # NOTE(ndipanov): Even if disk_mapping was passed in, which"},{"line_number":3541,"context_line":"        # currently happens only on rescue - we still don\u0027t want to"},{"line_number":3542,"context_line":"        # create a base image."},{"line_number":3543,"context_line":"        if not booted_from_volume:"},{"line_number":3544,"context_line":"            root_fname \u003d imagecache.get_cache_fname(disk_images[\u0027image_id\u0027])"},{"line_number":3545,"context_line":"            size \u003d instance.flavor.root_gb * units.Gi"},{"line_number":3546,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"9f6a8fd7_9e4c8777","line":3543,"range":{"start_line":3543,"start_character":8,"end_line":3543,"end_character":34},"updated":"2018-04-16 15:22:35.000000000","message":"What should happen if I\u0027m booting from volume and passing in trusted certs? Is nova going to proxy the trusted certs to cinder when nova creates the volume so that cinder will do image signature verification of the backing image in the root volume?","commit_id":"57d906050d1d5bb2e5eb8aaf22c9d9ca5e7c9cba"},{"author":{"_account_id":24711,"name":"Jackie Truong","email":"jacklyn.truong@jhuapl.edu","username":"jackie-truong"},"change_message_id":"63bdbcf73ec31eda95fe77e406d05f2e04f51cc0","unresolved":false,"context_lines":[{"line_number":3540,"context_line":"        # NOTE(ndipanov): Even if disk_mapping was passed in, which"},{"line_number":3541,"context_line":"        # currently happens only on rescue - we still don\u0027t want to"},{"line_number":3542,"context_line":"        # create a base image."},{"line_number":3543,"context_line":"        if not booted_from_volume:"},{"line_number":3544,"context_line":"            root_fname \u003d imagecache.get_cache_fname(disk_images[\u0027image_id\u0027])"},{"line_number":3545,"context_line":"            size \u003d instance.flavor.root_gb * units.Gi"},{"line_number":3546,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"9f6a8fd7_35747935","line":3543,"range":{"start_line":3543,"start_character":8,"end_line":3543,"end_character":34},"in_reply_to":"9f6a8fd7_9e4c8777","updated":"2018-04-16 16:32:47.000000000","message":"The spec did not include any plans to support trusted_certs when booting from volume. I can update the API patch so that we fail if trusted_certs are provided when booting from volume.","commit_id":"57d906050d1d5bb2e5eb8aaf22c9d9ca5e7c9cba"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1edb861f2bc67d4c4c4ef22ddb2e31fe3aa088e9","unresolved":false,"context_lines":[{"line_number":3392,"context_line":""},{"line_number":3393,"context_line":"        trusted_certs \u003d None"},{"line_number":3394,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3395,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3396,"context_line":""},{"line_number":3397,"context_line":"        self._create_and_inject_local_root("},{"line_number":3398,"context_line":"            context, instance,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_a3f2996e","line":3395,"range":{"start_line":3395,"start_character":12,"end_line":3395,"end_character":50},"updated":"2018-06-04 14:20:46.000000000","message":"On L7677 below this is different:\n\ntrusted_certs \u003d instance.trusted_certs.ids\n\nIt\u0027s going to be confusing if some methods take a TrustedCerts object and others take a list of string IDs.\n\nHow is this passing the Barbican-based CI for this?","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3b05d107b6f948ffff550db10ee1b9e373863926","unresolved":false,"context_lines":[{"line_number":3392,"context_line":""},{"line_number":3393,"context_line":"        trusted_certs \u003d None"},{"line_number":3394,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3395,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3396,"context_line":""},{"line_number":3397,"context_line":"        self._create_and_inject_local_root("},{"line_number":3398,"context_line":"            context, instance,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_e332d0f2","line":3395,"range":{"start_line":3395,"start_character":12,"end_line":3395,"end_character":50},"in_reply_to":"5f7c97a3_a3f2996e","updated":"2018-06-04 14:28:12.000000000","message":"The barbican plugin job isn\u0027t enabling cert validation which is probably why this was passing CI:\n\nhttps://review.openstack.org/#/c/515210/\n\nhttp://logs.openstack.org/10/515210/34/check/barbican-simple-crypto-devstack-tempest/a98095f/logs/screen-n-api.txt.gz#_May_25_18_22_08_080687","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"5c2c408cc7399c8d7aa3260aa5eb01cf5fbc5e78","unresolved":false,"context_lines":[{"line_number":3392,"context_line":""},{"line_number":3393,"context_line":"        trusted_certs \u003d None"},{"line_number":3394,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3395,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3396,"context_line":""},{"line_number":3397,"context_line":"        self._create_and_inject_local_root("},{"line_number":3398,"context_line":"            context, instance,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_e6189e1f","line":3395,"range":{"start_line":3395,"start_character":12,"end_line":3395,"end_character":50},"in_reply_to":"5f7c97a3_e332d0f2","updated":"2018-06-04 15:03:13.000000000","message":"It doesn\u0027t need to enable cert validation. If trusted_certs is passed or glance.verify_glance_signatures is True (which it is [1]) then the certs should be verified.\n\nHowever, I don\u0027t see any DEBUG logs in the barbican-simple-crypto-devstack-tempest job that mention \"image signature\", \"image certificate\" or \"image signing\".\n\n[1] http://logs.openstack.org/10/515210/34/check/barbican-simple-crypto-devstack-tempest/a98095f/logs/screen-n-api.txt.gz#_May_25_18_22_08_086539","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bbfd067d8028c397dbe006eda524587da534f8f4","unresolved":false,"context_lines":[{"line_number":3392,"context_line":""},{"line_number":3393,"context_line":"        trusted_certs \u003d None"},{"line_number":3394,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3395,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3396,"context_line":""},{"line_number":3397,"context_line":"        self._create_and_inject_local_root("},{"line_number":3398,"context_line":"            context, instance,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_e36090d2","line":3395,"range":{"start_line":3395,"start_character":12,"end_line":3395,"end_character":50},"in_reply_to":"5f7c97a3_e332d0f2","updated":"2018-06-04 14:34:35.000000000","message":"Or maybe this works for server create but the other calls below aren\u0027t correct, looking at the glance image API code it expects a TrustedCerts object:\n\nhttps://review.openstack.org/#/c/479949/72/nova/image/glance.py@375","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"38d1a724c5825d36e3a85760c352ef7045c3b8df","unresolved":false,"context_lines":[{"line_number":3392,"context_line":""},{"line_number":3393,"context_line":"        trusted_certs \u003d None"},{"line_number":3394,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3395,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3396,"context_line":""},{"line_number":3397,"context_line":"        self._create_and_inject_local_root("},{"line_number":3398,"context_line":"            context, instance,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_f75daa15","line":3395,"range":{"start_line":3395,"start_character":12,"end_line":3395,"end_character":50},"in_reply_to":"5f7c97a3_e6189e1f","updated":"2018-06-05 10:37:13.000000000","message":"The relevant logs are tied to n-cpu:\n\nhttp://logs.openstack.org/10/515210/35/check/barbican-simple-crypto-devstack-tempest/b641809/logs/screen-n-cpu.txt.gz#_Jun_04_15_23_54_447575\n\nI agree that this line and the line below should be identical, and a test is needed in the barbican-tempest-plugin to test that path.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bbfd067d8028c397dbe006eda524587da534f8f4","unresolved":false,"context_lines":[{"line_number":7674,"context_line":""},{"line_number":7675,"context_line":"                trusted_certs \u003d None"},{"line_number":7676,"context_line":"                if \u0027trusted_certs\u0027 in instance:"},{"line_number":7677,"context_line":"                    trusted_certs \u003d instance.trusted_certs.ids"},{"line_number":7678,"context_line":""},{"line_number":7679,"context_line":"                if cache_name.startswith(\u0027ephemeral\u0027):"},{"line_number":7680,"context_line":"                    # The argument \u0027size\u0027 is used by image.cache to"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_63a240ff","line":7677,"range":{"start_line":7677,"start_character":36,"end_line":7677,"end_character":62},"updated":"2018-06-04 14:34:35.000000000","message":"This is inconsistent with the above and looks like it wouldn\u0027t work here:\n\nhttps://review.openstack.org/#/c/479949/72/nova/image/glance.py@375\n\nThis passed CI because _create_images_and_backing is only called during reboot and live migration, neither of which are tested in the barbican plugin test CI.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"5c2c408cc7399c8d7aa3260aa5eb01cf5fbc5e78","unresolved":false,"context_lines":[{"line_number":7674,"context_line":""},{"line_number":7675,"context_line":"                trusted_certs \u003d None"},{"line_number":7676,"context_line":"                if \u0027trusted_certs\u0027 in instance:"},{"line_number":7677,"context_line":"                    trusted_certs \u003d instance.trusted_certs.ids"},{"line_number":7678,"context_line":""},{"line_number":7679,"context_line":"                if cache_name.startswith(\u0027ephemeral\u0027):"},{"line_number":7680,"context_line":"                    # The argument \u0027size\u0027 is used by image.cache to"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_e6edfef0","line":7677,"range":{"start_line":7677,"start_character":36,"end_line":7677,"end_character":62},"in_reply_to":"5f7c97a3_63a240ff","updated":"2018-06-04 15:03:13.000000000","message":"Good catch.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"38d1a724c5825d36e3a85760c352ef7045c3b8df","unresolved":false,"context_lines":[{"line_number":7674,"context_line":""},{"line_number":7675,"context_line":"                trusted_certs \u003d None"},{"line_number":7676,"context_line":"                if \u0027trusted_certs\u0027 in instance:"},{"line_number":7677,"context_line":"                    trusted_certs \u003d instance.trusted_certs.ids"},{"line_number":7678,"context_line":""},{"line_number":7679,"context_line":"                if cache_name.startswith(\u0027ephemeral\u0027):"},{"line_number":7680,"context_line":"                    # The argument \u0027size\u0027 is used by image.cache to"}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_3736c2e9","line":7677,"range":{"start_line":7677,"start_character":36,"end_line":7677,"end_character":62},"in_reply_to":"5f7c97a3_e6edfef0","updated":"2018-06-05 10:37:13.000000000","message":"Done","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":3392,"context_line":"            nova.privsep.path.chown(image(\u0027disk\u0027).path, uid\u003duid)"},{"line_number":3393,"context_line":""},{"line_number":3394,"context_line":"        trusted_certs \u003d None"},{"line_number":3395,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3396,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3397,"context_line":""},{"line_number":3398,"context_line":"        self._create_and_inject_local_root("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_aaa38e42","line":3395,"updated":"2018-06-12 19:59:30.000000000","message":"We don\u0027t really need this \u0027in\u0027 check, we can just call instance.trusted_certs which will lazy-load the field if necessary.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":3391,"context_line":"            uid \u003d pwd.getpwnam(\u0027root\u0027).pw_uid"},{"line_number":3392,"context_line":"            nova.privsep.path.chown(image(\u0027disk\u0027).path, uid\u003duid)"},{"line_number":3393,"context_line":""},{"line_number":3394,"context_line":"        trusted_certs \u003d None"},{"line_number":3395,"context_line":"        if \u0027trusted_certs\u0027 in instance:"},{"line_number":3396,"context_line":"            trusted_certs \u003d instance.trusted_certs"},{"line_number":3397,"context_line":""},{"line_number":3398,"context_line":"        self._create_and_inject_local_root("},{"line_number":3399,"context_line":"            context, instance,"},{"line_number":3400,"context_line":"            booted_from_volume, suffix,"},{"line_number":3401,"context_line":"            disk_images, injection_info,"},{"line_number":3402,"context_line":"            fallback_from_host,"},{"line_number":3403,"context_line":"            trusted_certs"},{"line_number":3404,"context_line":"        )"},{"line_number":3405,"context_line":""},{"line_number":3406,"context_line":"        # Lookup the filesystem type if required"},{"line_number":3407,"context_line":"        os_type_with_default \u003d nova.privsep.fs.get_fs_type_for_os_type("}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_4a9c3abf","line":3404,"range":{"start_line":3394,"start_character":7,"end_line":3404,"end_character":9},"updated":"2018-06-12 19:15:18.000000000","message":"As far as I can tell, nothing is testing that we\u0027re passing in trusted_certs here.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":3462,"context_line":"    def _create_and_inject_local_root(self, context, instance,"},{"line_number":3463,"context_line":"                                      booted_from_volume, suffix, disk_images,"},{"line_number":3464,"context_line":"                                      injection_info, fallback_from_host,"},{"line_number":3465,"context_line":"                                      trusted_certs):"},{"line_number":3466,"context_line":"        # File injection only if needed"},{"line_number":3467,"context_line":"        need_inject \u003d (not configdrive.required_by(instance) and"},{"line_number":3468,"context_line":"                       injection_info is not None and"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_4a4d1a98","line":3465,"range":{"start_line":3465,"start_character":38,"end_line":3465,"end_character":51},"updated":"2018-06-12 19:59:30.000000000","message":"This doesn\u0027t really need to be a parameter on this method, we have the instance object and it\u0027s only necessary to get trusted_certs if we\u0027re not doing boot from volume.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":7415,"context_line":"                instance_id\u003dinstance.uuid)"},{"line_number":7416,"context_line":""},{"line_number":7417,"context_line":"    def _try_fetch_image(self, context, path, image_id, instance,"},{"line_number":7418,"context_line":"                         fallback_from_host\u003dNone, trusted_certs\u003dNone):"},{"line_number":7419,"context_line":"        try:"},{"line_number":7420,"context_line":"            libvirt_utils.fetch_image(context, path, image_id, trusted_certs)"},{"line_number":7421,"context_line":"        except exception.ImageNotFound:"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_ca0e0a3a","line":7418,"range":{"start_line":7418,"start_character":50,"end_line":7418,"end_character":63},"updated":"2018-06-12 19:59:30.000000000","message":"same, we have the instance, just call instance.trusted_certs","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f2a23d3ea63b7782e6e4bcd4eb88bffe1fac0968","unresolved":false,"context_lines":[{"line_number":7438,"context_line":"            # NOTE(dsanders): only fetch image if it\u0027s not available at"},{"line_number":7439,"context_line":"            # kernel_path. This also avoids ImageNotFound exception if"},{"line_number":7440,"context_line":"            # the image has been deleted from glance"},{"line_number":7441,"context_line":"            if not os.path.exists(kernel_path):"},{"line_number":7442,"context_line":"                self._try_fetch_image(context,"},{"line_number":7443,"context_line":"                                      kernel_path,"},{"line_number":7444,"context_line":"                                      instance.kernel_id,"},{"line_number":7445,"context_line":"                                      instance, fallback_from_host)"},{"line_number":7446,"context_line":"            if instance.ramdisk_id:"},{"line_number":7447,"context_line":"                ramdisk_path \u003d os.path.join(instance_dir, \u0027ramdisk\u0027)"},{"line_number":7448,"context_line":"                # NOTE(dsanders): only fetch image if it\u0027s not available at"},{"line_number":7449,"context_line":"                # ramdisk_path. This also avoids ImageNotFound exception if"},{"line_number":7450,"context_line":"                # the image has been deleted from glance"},{"line_number":7451,"context_line":"                if not os.path.exists(ramdisk_path):"},{"line_number":7452,"context_line":"                    self._try_fetch_image(context,"},{"line_number":7453,"context_line":"                                          ramdisk_path,"},{"line_number":7454,"context_line":"                                          instance.ramdisk_id,"},{"line_number":7455,"context_line":"                                          instance, fallback_from_host)"},{"line_number":7456,"context_line":""},{"line_number":7457,"context_line":"    def rollback_live_migration_at_destination(self, context, instance,"},{"line_number":7458,"context_line":"                                               network_info,"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_858fa5cb","line":7455,"range":{"start_line":7441,"start_character":12,"end_line":7455,"end_character":71},"updated":"2018-06-12 20:48:06.000000000","message":"Why wouldn\u0027t we pass in trusted_certs here for kernel/ramdisk images?","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":7643,"context_line":""},{"line_number":7644,"context_line":"    def _try_fetch_image_cache(self, image, fetch_func, context, filename,"},{"line_number":7645,"context_line":"                               image_id, instance, size,"},{"line_number":7646,"context_line":"                               fallback_from_host\u003dNone, trusted_certs\u003dNone):"},{"line_number":7647,"context_line":"        try:"},{"line_number":7648,"context_line":"            image.cache(fetch_func\u003dfetch_func,"},{"line_number":7649,"context_line":"                        context\u003dcontext,"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_4a32fa11","line":7646,"range":{"start_line":7646,"start_character":56,"end_line":7646,"end_character":69},"updated":"2018-06-12 19:59:30.000000000","message":"Similar, we don\u0027t need this parameter because we have the instance, we can just call instance.trusted_certs.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3e029435656949df6b9e21831a687e339a8c6bb5","unresolved":false,"context_lines":[{"line_number":7709,"context_line":"                disk \u003d self.image_backend.by_name(instance, instance_disk,"},{"line_number":7710,"context_line":"                                                  CONF.libvirt.images_type)"},{"line_number":7711,"context_line":""},{"line_number":7712,"context_line":"                trusted_certs \u003d None"},{"line_number":7713,"context_line":"                if \u0027trusted_certs\u0027 in instance:"},{"line_number":7714,"context_line":"                    trusted_certs \u003d instance.trusted_certs"},{"line_number":7715,"context_line":""},{"line_number":7716,"context_line":"                if cache_name.startswith(\u0027ephemeral\u0027):"},{"line_number":7717,"context_line":"                    # The argument \u0027size\u0027 is used by image.cache to"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_af25e0c3","line":7714,"range":{"start_line":7712,"start_character":16,"end_line":7714,"end_character":58},"updated":"2018-06-12 19:15:18.000000000","message":"nit: this can go into the else block where we actually call _try_fetch_image_cache","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3919579361408658ee3d49ece5b4147277460e99","unresolved":false,"context_lines":[{"line_number":7709,"context_line":"                disk \u003d self.image_backend.by_name(instance, instance_disk,"},{"line_number":7710,"context_line":"                                                  CONF.libvirt.images_type)"},{"line_number":7711,"context_line":""},{"line_number":7712,"context_line":"                trusted_certs \u003d None"},{"line_number":7713,"context_line":"                if \u0027trusted_certs\u0027 in instance:"},{"line_number":7714,"context_line":"                    trusted_certs \u003d instance.trusted_certs"},{"line_number":7715,"context_line":""},{"line_number":7716,"context_line":"                if cache_name.startswith(\u0027ephemeral\u0027):"},{"line_number":7717,"context_line":"                    # The argument \u0027size\u0027 is used by image.cache to"}],"source_content_type":"text/x-python","patch_set":27,"id":"5f7c97a3_ca892aca","line":7714,"range":{"start_line":7712,"start_character":16,"end_line":7714,"end_character":58},"in_reply_to":"5f7c97a3_af25e0c3","updated":"2018-06-12 19:59:30.000000000","message":"Actually, we can lazy-load trusted certs, so the in check is probably wrong and could be hard to debug - we should just pass instance.trusted_certs to _try_fetch_image_cache.","commit_id":"993520a42a9d44603ee120afa34a202be851ccb0"}],"nova/virt/powervm/driver.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d2e189e120aba5787ccbc162cd8b04fb1896acfc","unresolved":false,"context_lines":[{"line_number":73,"context_line":"            \u0027supports_tagged_attach_volume\u0027: False,"},{"line_number":74,"context_line":"            \u0027supports_extend_volume\u0027: False,"},{"line_number":75,"context_line":"            \u0027supports_multiattach\u0027: False,"},{"line_number":76,"context_line":"            \u0027supports_trusted_certs\u0027: False,"},{"line_number":77,"context_line":"        }"},{"line_number":78,"context_line":"        super(PowerVMDriver, self).__init__(virtapi)"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_e8eaaed6","line":76,"updated":"2018-06-04 13:24:26.000000000","message":"Seems odd that this is overridden for the powervm driver but not all of the other drivers which also override the capabilities dict:\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/fake.py#n124\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/hyperv/driver.py#n95\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/ironic/driver.py#n133\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/vmwareapi/driver.py#n64\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/xenapi/driver.py#n70\n\nThis isn\u0027t a problem today because nothing is reading this value, so we aren\u0027t at risk of hitting a KeyError.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"38d1a724c5825d36e3a85760c352ef7045c3b8df","unresolved":false,"context_lines":[{"line_number":73,"context_line":"            \u0027supports_tagged_attach_volume\u0027: False,"},{"line_number":74,"context_line":"            \u0027supports_extend_volume\u0027: False,"},{"line_number":75,"context_line":"            \u0027supports_multiattach\u0027: False,"},{"line_number":76,"context_line":"            \u0027supports_trusted_certs\u0027: False,"},{"line_number":77,"context_line":"        }"},{"line_number":78,"context_line":"        super(PowerVMDriver, self).__init__(virtapi)"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"5f7c97a3_b7ebb210","line":76,"in_reply_to":"5f7c97a3_e8eaaed6","updated":"2018-06-05 10:37:13.000000000","message":"I\u0027ve overridden it for the other drivers as well.  Thank you for pointing out all of the locations.","commit_id":"684df914940f7504eeffb0d5c538828168ccde3d"}]}