)]}'
{"specs/image-verification.rst":[{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"30138619d0f22be1182845a5b5e2778be382c935","unresolved":false,"context_lines":[{"line_number":7,"context_line":"https://blueprints.launchpad.net/glance/+spec/image-signing-and-verification-support"},{"line_number":8,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In order to protect the integrity of virtual machine (VM) images in the cloud,"},{"line_number":11,"context_line":"we propose functionality that allows both end users and providers to digitally"},{"line_number":12,"context_line":"sign their VM images and allow the services that handle these images to verify"},{"line_number":13,"context_line":"the signatures associated with them. This specification summarizes the security"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_aba5bba2","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":64},"updated":"2016-05-10 18:55:32.000000000","message":"Why VM images in particular?\n\nIs there a validation that you do in Glance that determines if a signed entity is just a VM image? Today Glance can store Nova images, Ironic images, Cinder volumes, and supports format for storing docker images though the usage hasn\u0027t been verified or supported/maintained.","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3ad1c15a4f951873cd7f25ebf2d23b3e9500e136","unresolved":false,"context_lines":[{"line_number":7,"context_line":"https://blueprints.launchpad.net/glance/+spec/image-signing-and-verification-support"},{"line_number":8,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In order to protect the integrity of virtual machine (VM) images in the cloud,"},{"line_number":11,"context_line":"we propose functionality that allows both end users and providers to digitally"},{"line_number":12,"context_line":"sign their VM images and allow the services that handle these images to verify"},{"line_number":13,"context_line":"the signatures associated with them. This specification summarizes the security"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_737725a0","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":64},"in_reply_to":"dab17558_65c81ca9","updated":"2016-05-11 13:37:48.000000000","message":"One reason we are focusing on images uploaded by a user, and not the many other things stored by Glance, is that these images are uploaded and signed by an end user\u0027s keypair. Since the other things you mention here (Nova images, Cinder volumes) are created by services, each service would have to have a service-level keypair in order to sign things.","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"e807b0093e11d623e4050bf5ad13c8dc56fdc122","unresolved":false,"context_lines":[{"line_number":7,"context_line":"https://blueprints.launchpad.net/glance/+spec/image-signing-and-verification-support"},{"line_number":8,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In order to protect the integrity of virtual machine (VM) images in the cloud,"},{"line_number":11,"context_line":"we propose functionality that allows both end users and providers to digitally"},{"line_number":12,"context_line":"sign their VM images and allow the services that handle these images to verify"},{"line_number":13,"context_line":"the signatures associated with them. This specification summarizes the security"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_fa32eba5","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":64},"in_reply_to":"dab17558_aba5bba2","updated":"2016-05-10 20:54:42.000000000","message":"Maybe this could read \"In order to protect the integrity of stored images in the cloud (e.g. virtual machine images), we propose ...\"","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"1327e0f99e090ab2cc141fea036197384b8f7558","unresolved":false,"context_lines":[{"line_number":7,"context_line":"https://blueprints.launchpad.net/glance/+spec/image-signing-and-verification-support"},{"line_number":8,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In order to protect the integrity of virtual machine (VM) images in the cloud,"},{"line_number":11,"context_line":"we propose functionality that allows both end users and providers to digitally"},{"line_number":12,"context_line":"sign their VM images and allow the services that handle these images to verify"},{"line_number":13,"context_line":"the signatures associated with them. This specification summarizes the security"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_89388dd4","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":64},"in_reply_to":"dab17558_fa32eba5","updated":"2016-05-17 11:56:16.000000000","message":"Done","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"aaa3563d44cca724c778938fd5f095a9e517b497","unresolved":false,"context_lines":[{"line_number":7,"context_line":"https://blueprints.launchpad.net/glance/+spec/image-signing-and-verification-support"},{"line_number":8,"context_line":"https://blueprints.launchpad.net/nova/+spec/nova-support-image-signing"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"In order to protect the integrity of virtual machine (VM) images in the cloud,"},{"line_number":11,"context_line":"we propose functionality that allows both end users and providers to digitally"},{"line_number":12,"context_line":"sign their VM images and allow the services that handle these images to verify"},{"line_number":13,"context_line":"the signatures associated with them. This specification summarizes the security"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_65c81ca9","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":64},"in_reply_to":"dab17558_fa32eba5","updated":"2016-05-10 21:10:48.000000000","message":"yeah, that reads better I think","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"e807b0093e11d623e4050bf5ad13c8dc56fdc122","unresolved":false,"context_lines":[{"line_number":199,"context_line":"The existing image signature verification in Nova is controlled by a"},{"line_number":200,"context_line":"configuration flag: either all images are verified or none are verified. This"},{"line_number":201,"context_line":"coarse-grained approach is not practical for cloud environments where some "},{"line_number":202,"context_line":"images do not have signatures. In addition, the end user has no visibility into"},{"line_number":203,"context_line":"this configuration setting, which may cause confusion if Nova will only boot"},{"line_number":204,"context_line":"signed images but the user uploads an unsigned image. Two alternatives to"},{"line_number":205,"context_line":"remedy this situation are 1) \"trusted\" flavors where the end user implicitly"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_fae30bd7","line":202,"updated":"2016-05-10 20:54:42.000000000","message":"Need to remove the space on line 201","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"1327e0f99e090ab2cc141fea036197384b8f7558","unresolved":false,"context_lines":[{"line_number":199,"context_line":"The existing image signature verification in Nova is controlled by a"},{"line_number":200,"context_line":"configuration flag: either all images are verified or none are verified. This"},{"line_number":201,"context_line":"coarse-grained approach is not practical for cloud environments where some "},{"line_number":202,"context_line":"images do not have signatures. In addition, the end user has no visibility into"},{"line_number":203,"context_line":"this configuration setting, which may cause confusion if Nova will only boot"},{"line_number":204,"context_line":"signed images but the user uploads an unsigned image. Two alternatives to"},{"line_number":205,"context_line":"remedy this situation are 1) \"trusted\" flavors where the end user implicitly"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_69560907","line":202,"in_reply_to":"dab17558_fae30bd7","updated":"2016-05-17 11:56:16.000000000","message":"Done","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"e807b0093e11d623e4050bf5ad13c8dc56fdc122","unresolved":false,"context_lines":[{"line_number":282,"context_line":"   module,\" Launchpad, 21 December 2015. Online: https://goo.gl/gdIT9C"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":".. [Intel14] Trusted Compute Pools with Intel Trusted Execution Technology."},{"line_number":285,"context_line":"   Online: http://goo.gl/hc3Ffl"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":".. [Poulo15] Brianna Poulos, \"[glance] [nova] Image Signature Verification,\""},{"line_number":288,"context_line":"   OpenStack Development Mailing List, 12 November 2015. Online:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_da744737","line":285,"range":{"start_line":285,"start_character":25,"end_line":285,"end_character":31},"updated":"2016-05-10 20:54:42.000000000","message":"This link doesn\u0027t seem to work","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"1327e0f99e090ab2cc141fea036197384b8f7558","unresolved":false,"context_lines":[{"line_number":282,"context_line":"   module,\" Launchpad, 21 December 2015. Online: https://goo.gl/gdIT9C"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":".. [Intel14] Trusted Compute Pools with Intel Trusted Execution Technology."},{"line_number":285,"context_line":"   Online: http://goo.gl/hc3Ffl"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":".. [Poulo15] Brianna Poulos, \"[glance] [nova] Image Signature Verification,\""},{"line_number":288,"context_line":"   OpenStack Development Mailing List, 12 November 2015. Online:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_6f9e0908","line":285,"range":{"start_line":285,"start_character":25,"end_line":285,"end_character":31},"in_reply_to":"dab17558_da744737","updated":"2016-05-17 11:56:16.000000000","message":"Done","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3ad1c15a4f951873cd7f25ebf2d23b3e9500e136","unresolved":false,"context_lines":[{"line_number":282,"context_line":"   module,\" Launchpad, 21 December 2015. Online: https://goo.gl/gdIT9C"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":".. [Intel14] Trusted Compute Pools with Intel Trusted Execution Technology."},{"line_number":285,"context_line":"   Online: http://goo.gl/hc3Ffl"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":".. [Poulo15] Brianna Poulos, \"[glance] [nova] Image Signature Verification,\""},{"line_number":288,"context_line":"   OpenStack Development Mailing List, 12 November 2015. Online:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_135df914","line":285,"range":{"start_line":285,"start_character":25,"end_line":285,"end_character":31},"in_reply_to":"dab17558_da744737","updated":"2016-05-11 13:37:48.000000000","message":"Same here. Getting 404\u0027d.","commit_id":"07f466cfc31a8a1c7e469c5266bfecd1d849c097"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"5909fe2431b41705752389bda9976e740261b1d8","unresolved":false,"context_lines":[{"line_number":170,"context_line":"    user can easily upload their signing certificate to the key manager via"},{"line_number":171,"context_line":"    Castellan. We will also add indicators as to the success or failure of"},{"line_number":172,"context_line":"    signature verification and display information about the signature and"},{"line_number":173,"context_line":"    signing certificate."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Alternatives"},{"line_number":176,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"dab17558_c364284a","line":173,"updated":"2016-05-17 18:28:07.000000000","message":"+1 for adding key manager visibility to the dashboard","commit_id":"80095c90bc4fb90fd18c64a45833e37ff1014ca2"}]}