)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"2ff3f4ce6b4e13586a9b40795e5622ea20ac4b70","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"For the contribution of Image Encryption it is necessary to have a library"},{"line_number":13,"context_line":"for the encryption of decryption of large binary files, so the code can be"},{"line_number":14,"context_line":"used by projects, which want tu encrypt or decrypt images."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id4ca0b3bf23d3d76484822d2ade27bf3c444afb0"},{"line_number":17,"context_line":"Co-Authored-By: Markus Hentsch \u003cmarkus.hentsch@secustack.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_5f60bc9e","line":14,"range":{"start_line":14,"start_character":29,"end_line":14,"end_character":31},"updated":"2018-11-21 22:24:06.000000000","message":"s/tu/to","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"2ff3f4ce6b4e13586a9b40795e5622ea20ac4b70","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"For the contribution of Image Encryption it is necessary to have a library"},{"line_number":13,"context_line":"for the encryption of decryption of large binary files, so the code can be"},{"line_number":14,"context_line":"used by projects, which want tu encrypt or decrypt images."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: Id4ca0b3bf23d3d76484822d2ade27bf3c444afb0"},{"line_number":17,"context_line":"Co-Authored-By: Markus Hentsch \u003cmarkus.hentsch@secustack.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3f79a3b5_b551ef67","line":14,"range":{"start_line":14,"start_character":29,"end_line":14,"end_character":31},"updated":"2018-11-21 22:24:06.000000000","message":"s/tu/to","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"}],"specs/stein/oslo-encrypt.rst":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"5dac206c4c02f46f18de0457004b45bea2907558","unresolved":false,"context_lines":[{"line_number":11,"context_line":"example to allow the encryption of Glance images. It should consist of a"},{"line_number":12,"context_line":"suitable class hierarchy allowing for different implementations in a"},{"line_number":13,"context_line":"driver-like manner, each implementing methods to encrypt and decrypt data"},{"line_number":14,"context_line":"using a specific cipher (encryption drivers)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"The library should define an abstract base class for implementations and"},{"line_number":17,"context_line":"supply a sample encryption driver using GPG as proposed for image encryption."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_188db035","line":14,"updated":"2018-11-19 15:15:16.000000000","message":"The wording here isn\u0027t clear. Is each driver going to implement 1 cipher, or are you proposing different methods where each method is a different cipher?","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"cfcde240b25edd3fc4183e2713fcddc5b3ed8a1e","unresolved":false,"context_lines":[{"line_number":11,"context_line":"example to allow the encryption of Glance images. It should consist of a"},{"line_number":12,"context_line":"suitable class hierarchy allowing for different implementations in a"},{"line_number":13,"context_line":"driver-like manner, each implementing methods to encrypt and decrypt data"},{"line_number":14,"context_line":"using a specific cipher (encryption drivers)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"The library should define an abstract base class for implementations and"},{"line_number":17,"context_line":"supply a sample encryption driver using GPG as proposed for image encryption."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_db96403c","line":14,"in_reply_to":"3f79a3b5_188db035","updated":"2018-11-20 12:08:54.000000000","message":"Done","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"9f5bb00e7f9f5153076750b63bcb95be75c63490","unresolved":false,"context_lines":[{"line_number":11,"context_line":"example to allow the encryption of Glance images. It should consist of a"},{"line_number":12,"context_line":"suitable class hierarchy allowing for different implementations in a"},{"line_number":13,"context_line":"driver-like manner, each implementing methods to encrypt and decrypt data"},{"line_number":14,"context_line":"using a specific cipher (encryption drivers)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"The library should define an abstract base class for implementations and"},{"line_number":17,"context_line":"supply a sample encryption driver using GPG as proposed for image encryption."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_a76c8d9e","line":14,"in_reply_to":"3f79a3b5_188db035","updated":"2018-11-20 08:26:54.000000000","message":"We are proposing that each driver will implement one cipher, so that it has exactly one encrypt and one decrypt method. I will update this section to clarify this a bit more.","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"e957396dfed46ffe54d04cc91a6af80b75ae3899","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"There aren\u0027t any libraries used for encryption and decrpytion methods in"},{"line_number":35,"context_line":"OpenStack yet. So we had to consider where this would fit best, which partly"},{"line_number":36,"context_line":"happened in a dedicated etherpad [1]."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_f814749b","line":36,"updated":"2018-11-19 15:23:10.000000000","message":"Is that true? I see cryptography in the global requirements list and it\u0027s used by quite a few of our projects. How does that fit into this new library?","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"cfcde240b25edd3fc4183e2713fcddc5b3ed8a1e","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"There aren\u0027t any libraries used for encryption and decrpytion methods in"},{"line_number":35,"context_line":"OpenStack yet. So we had to consider where this would fit best, which partly"},{"line_number":36,"context_line":"happened in a dedicated etherpad [1]."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_7ba5ac9f","line":36,"in_reply_to":"3f79a3b5_f814749b","updated":"2018-11-20 12:08:54.000000000","message":"Done","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"9f5bb00e7f9f5153076750b63bcb95be75c63490","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"There aren\u0027t any libraries used for encryption and decrpytion methods in"},{"line_number":35,"context_line":"OpenStack yet. So we had to consider where this would fit best, which partly"},{"line_number":36,"context_line":"happened in a dedicated etherpad [1]."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_479d7969","line":36,"in_reply_to":"3f79a3b5_f814749b","updated":"2018-11-20 08:26:54.000000000","message":"We phrased this section in a misleading manner. We want to focus on encryption of files in this library, which is not provided by cryptography directly as far as I am aware. I could see cryptography being used for implementing one or more drivers for this library in the future though.","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"e957396dfed46ffe54d04cc91a6af80b75ae3899","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":40,"context_line":"unmainted. Using another library like cursive would also bring in additional"},{"line_number":41,"context_line":"dependencies, which might be a problem for certain projects like"},{"line_number":42,"context_line":"openstackclient."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_587b28f2","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":9},"updated":"2018-11-19 15:23:10.000000000","message":"unmaintained","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"cfcde240b25edd3fc4183e2713fcddc5b3ed8a1e","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":40,"context_line":"unmainted. Using another library like cursive would also bring in additional"},{"line_number":41,"context_line":"dependencies, which might be a problem for certain projects like"},{"line_number":42,"context_line":"openstackclient."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_9ba0c890","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":9},"in_reply_to":"3f79a3b5_587b28f2","updated":"2018-11-20 12:08:54.000000000","message":"Done","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"e957396dfed46ffe54d04cc91a6af80b75ae3899","unresolved":false,"context_lines":[{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":40,"context_line":"unmainted. Using another library like cursive would also bring in additional"},{"line_number":41,"context_line":"dependencies, which might be a problem for certain projects like"},{"line_number":42,"context_line":"openstackclient."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":45,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_f869d422","line":42,"updated":"2018-11-19 15:23:10.000000000","message":"A benefit of not calling this \"oslo.encrypt\" but using some more generic name is that it might see adoption outside of OpenStack. Do you feel there are any features of this library that would only be useful for OpenStack services?","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"9f5bb00e7f9f5153076750b63bcb95be75c63490","unresolved":false,"context_lines":[{"line_number":39,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":40,"context_line":"unmainted. Using another library like cursive would also bring in additional"},{"line_number":41,"context_line":"dependencies, which might be a problem for certain projects like"},{"line_number":42,"context_line":"openstackclient."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":45,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_e7a365af","line":42,"in_reply_to":"3f79a3b5_f869d422","updated":"2018-11-20 08:26:54.000000000","message":"I don\u0027t think adoption outside of OpenStack will make sense.\nWe don\u0027t plan to reimplement crypto but rather wrap existing implementations and mechanisms so that they can be used primarily for file encryption in OpenStack. Implementations will also involve rootwrapper/privsep, which is an OpenStack-specific dependency.","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"5dac206c4c02f46f18de0457004b45bea2907558","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The library will be incorporated by the core services Nova and Cinder as well"},{"line_number":52,"context_line":"as the openstackclient as soon as image encryption is added to each of them."},{"line_number":53,"context_line":"As the support for image encryption expands, further services may start"},{"line_number":54,"context_line":"incorporating the library in the future. Reviewer activity"},{"line_number":55,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"As this library is designed for cryptographic operations the team to review"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_b88a7c0f","line":54,"range":{"start_line":54,"start_character":40,"end_line":54,"end_character":41},"updated":"2018-11-19 15:15:16.000000000","message":"I think you want a couple of newlines here to break up this section.","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"cfcde240b25edd3fc4183e2713fcddc5b3ed8a1e","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The library will be incorporated by the core services Nova and Cinder as well"},{"line_number":52,"context_line":"as the openstackclient as soon as image encryption is added to each of them."},{"line_number":53,"context_line":"As the support for image encryption expands, further services may start"},{"line_number":54,"context_line":"incorporating the library in the future. Reviewer activity"},{"line_number":55,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"As this library is designed for cryptographic operations the team to review"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_fbaa1c6b","line":54,"range":{"start_line":54,"start_character":40,"end_line":54,"end_character":41},"in_reply_to":"3f79a3b5_b88a7c0f","updated":"2018-11-20 12:08:54.000000000","message":"Done","commit_id":"8a3b75676ce5208e89e4a4d399e558e21c389851"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"39cc20e65f8d0948c3ad02b8be42836d154d0603","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Furthermore the library should also provide a public method to retrieve the"},{"line_number":24,"context_line":"matching encryption driver for a given set of cipher specifications (cipher"},{"line_number":25,"context_line":"algorithm, type,  format), so that components consuming this library can use"},{"line_number":26,"context_line":"it without having to enumerate all available implementations."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Consuming projects"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_75fb7415","line":26,"updated":"2018-11-20 16:35:06.000000000","message":"Have you had time to give thought to what that base class would look like? If so, adding some example method signatures here would be good.\n\nI don\u0027t see anything in our new library template asking for information about the public API of the library, but if you\u0027ve given that any thought it would be good to have some of those details here, too..","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"fba1f50b71d5608d9845b84c9d0032f449825f98","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Furthermore the library should also provide a public method to retrieve the"},{"line_number":24,"context_line":"matching encryption driver for a given set of cipher specifications (cipher"},{"line_number":25,"context_line":"algorithm, type,  format), so that components consuming this library can use"},{"line_number":26,"context_line":"it without having to enumerate all available implementations."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Consuming projects"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_a51e9ab9","line":26,"in_reply_to":"3f79a3b5_75d4b7bc","updated":"2018-11-22 11:31:20.000000000","message":"A block cipher alone would be insufficient from our point of view. We want a standardised format for storing the encrypted data in a file structure that\u0027s easy to handle. That\u0027s why we chose GPG as a free implementation of OpenPGP or RFC 4880 respectively.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"2ff3f4ce6b4e13586a9b40795e5622ea20ac4b70","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Furthermore the library should also provide a public method to retrieve the"},{"line_number":24,"context_line":"matching encryption driver for a given set of cipher specifications (cipher"},{"line_number":25,"context_line":"algorithm, type,  format), so that components consuming this library can use"},{"line_number":26,"context_line":"it without having to enumerate all available implementations."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Consuming projects"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_75d4b7bc","line":26,"in_reply_to":"3f79a3b5_75fb7415","updated":"2018-11-21 22:24:06.000000000","message":"Are you looking for just a block cipher?  I\u0027m not sure what you mean with the refrence to GPG.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"39cc20e65f8d0948c3ad02b8be42836d154d0603","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"There aren\u0027t any libraries used for encryption and decryption of large files"},{"line_number":40,"context_line":"in OpenStack yet. So we had to consider where this would fit best, which"},{"line_number":41,"context_line":"partly happened in a dedicated etherpad [1]."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_f541c463","line":41,"range":{"start_line":41,"start_character":21,"end_line":41,"end_character":43},"updated":"2018-11-20 16:35:06.000000000","message":"it\u0027s probably better to use the RST syntax to create a link here, rather than using mailing-list style footnote references. Replace the end of the sentence with:\n\n  `dedicated etherpad`_.\n\nThen after a blank line insert\n\n  .. _dedicated etherpad: https://etherpad.openstack.org/p/library-for-image-encryption-and-decryption\n\nThe same applies to the previous section, which links to a few of the specs.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ce115c367f55c79a6551b2ec59897bf6c37d2725","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"There aren\u0027t any libraries used for encryption and decryption of large files"},{"line_number":40,"context_line":"in OpenStack yet. So we had to consider where this would fit best, which"},{"line_number":41,"context_line":"partly happened in a dedicated etherpad [1]."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"One option would have been writing an independent library like cursive or"},{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_7b5f93dd","line":41,"range":{"start_line":41,"start_character":21,"end_line":41,"end_character":43},"in_reply_to":"3f79a3b5_f541c463","updated":"2018-11-26 17:35:51.000000000","message":"++ please use RST Syntax.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"39cc20e65f8d0948c3ad02b8be42836d154d0603","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_382413b1","line":47,"updated":"2018-11-20 16:35:06.000000000","message":"I\u0027m not sure I buy the argument that a new library would be more maintained than an existing one. If cursive is no longer maintained, could we take it over and add these features to it?\n\nCursive appears to depend on castellan, so maybe a better argument is that it is at a higher level in the existing dependency tree than this new library would be? (I don\u0027t see any mention of this library using castellan to fetch keys, for example, so I presume the caller would have to do that.)","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"2ff3f4ce6b4e13586a9b40795e5622ea20ac4b70","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_95fab341","line":47,"in_reply_to":"3f79a3b5_382413b1","updated":"2018-11-21 22:24:06.000000000","message":"I agree here.  I think the question should be if we want to support a library shim (oslo.encrypt) so that we can switch out backends or not.  I currently don\u0027t see cryptography going anywhere.\n\nIf we do this, would we want all (most) encryption type operations to go through oslo.encrypt eventually?\n\nOne possible nice thing about this is that it could provide a better interface than the lower level libraries, I know cryptography can be \u0027fun\u0027 to use.  good for security maybe","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"fba1f50b71d5608d9845b84c9d0032f449825f98","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_706a7e50","line":47,"in_reply_to":"3f79a3b5_382413b1","updated":"2018-11-22 11:31:20.000000000","message":"You are right about the dependency tree relation being a better argument. We already received feedback from OSC not wanting to consume cursive due to the dependencies being pulled in.\n\n\u003e (I don\u0027t see any mention of this library using castellan to fetch keys, for example, so I presume the caller would have to do that.)\n\nThat\u0027s right. We don\u0027t intend the library making calls to the key manager. The methods of this library are supposed to be provided with the keys.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":14288,"name":"Matthew Thode","display_name":"prometheanfire","email":"mthode@mthode.org","username":"prometheanfire"},"change_message_id":"f18f7fdb4f1123b50b79837b8ef77e3bf9224f8b","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_cfeb3778","line":47,"in_reply_to":"3f79a3b5_697a2328","updated":"2018-11-29 19:30:36.000000000","message":"If that\u0027s the case wouldn\u0027t it be better to integrate it into something like os-brick since it\u0027s specific to images at that point?","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ce115c367f55c79a6551b2ec59897bf6c37d2725","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_bbee8bfb","line":47,"in_reply_to":"3f79a3b5_90663a56","updated":"2018-11-26 17:35:51.000000000","message":"I worry that this new library will be just as unmaintained as some other library. I really don\u0027t buy that we can\u0027t use a library that already exists.\n\nThe Dependency concernn is real. Please re-write this to indicate dependencies... there is no reason to say maintenance is the issue. It really isn\u0027t the core concern as far as I can tell.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"fba1f50b71d5608d9845b84c9d0032f449825f98","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_308e4626","line":47,"in_reply_to":"3f79a3b5_95fab341","updated":"2018-11-22 11:31:20.000000000","message":"\u003e One possible nice thing about this is that it could provide a better interface than the lower level libraries, I know cryptography can be \u0027fun\u0027 to use. good for security maybe\n\nThat\u0027s the point we intend. The library should provide wrappers (e.g. for file encryption) with simple interfaces.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"8df3702ab5fb861062eb8bd1c940dbc3f68e87d0","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_d0f59287","line":47,"in_reply_to":"3f79a3b5_95fab341","updated":"2018-11-22 11:25:16.000000000","message":"Another option is to just add an \"encryptor\" section to castellan. Castellan was already meant to be a wrapper that would handle key management. Maybe it would make sense to expand its use.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"ec302aa016e894b2885bfe7f7b5aad9285832b0e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_697a2328","line":47,"in_reply_to":"3f79a3b5_bbee8bfb","updated":"2018-11-29 17:46:57.000000000","message":"If the main concern with using existing libraries is dependencies, then maybe we need to reduce the scope of this one. Instead of an all-singing, all-dancing library that supports every encryption method, we pick one or two methods that are suited to image encryption and just implement those. That still solves the problem of multiple services needing code to handle encrypted images but hopefully keeps the dependencies minimal. As an added bonus, it limits the attack surface of a security sensitive piece of code.\n\nMaybe it\u0027s not possible to narrow things down that much, but I got the impression from our hallway conversation in Berlin that there were only one or two encryption methods actually in use for volumes, and if the same would be true of images that could help here.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"fba1f50b71d5608d9845b84c9d0032f449825f98","unresolved":false,"context_lines":[{"line_number":44,"context_line":"os_brick or use cursive right away. But those libraries tend to become"},{"line_number":45,"context_line":"unmaintained. Using another library like cursive would also bring in"},{"line_number":46,"context_line":"additional dependencies, which might be a problem for certain projects like"},{"line_number":47,"context_line":"openstackclient."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_90663a56","line":47,"in_reply_to":"3f79a3b5_d0f59287","updated":"2018-11-22 11:31:20.000000000","message":"The disadvantage of integrating this into castellan is the same as if we included it in cursive: dependencies. For example, OSC said they\u0027d like to avoid consuming cursive due to the dependencies it pulls in. Castellan has even more dependencies than cursive actually.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"39cc20e65f8d0948c3ad02b8be42836d154d0603","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"},{"line_number":51,"context_line":"to add as a dependency."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Proposed adoption model/plan"},{"line_number":54,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_d50cc845","line":51,"updated":"2018-11-20 16:35:06.000000000","message":"I wonder if we want the SDK to consume this library, too. That might make the openstackclient integration work easier.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":27665,"name":"Markus Hentsch","email":"markus.hentsch@cloudandheat.com","username":"mhen"},"change_message_id":"fba1f50b71d5608d9845b84c9d0032f449825f98","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"},{"line_number":51,"context_line":"to add as a dependency."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Proposed adoption model/plan"},{"line_number":54,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_e567b222","line":51,"in_reply_to":"3f79a3b5_d50cc845","updated":"2018-11-22 11:31:20.000000000","message":"I think that\u0027s a good idea! This would also enable developers using the SDK to make use of the new features more easily, including image encryption eventually.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ce115c367f55c79a6551b2ec59897bf6c37d2725","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Another option was to use openstacksdk, but for every other project than the"},{"line_number":50,"context_line":"openstackclient, this wasn\u0027t anything the corresponding team would have liked"},{"line_number":51,"context_line":"to add as a dependency."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Proposed adoption model/plan"},{"line_number":54,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_1b29bf38","line":51,"in_reply_to":"3f79a3b5_e567b222","updated":"2018-11-26 17:35:51.000000000","message":"The SDK would probably consume this library. I don\u0027t buy that SDK as a dependency will be an issue. For example, keystone is planning on deprecating KSC once there is parity in SDK meaning that forward looking development will only happen in SDK for interacting with Keystone\u0027s CRUD api (KeystoneAuth handles auth bits). Other projects will need to consume SDK at some point, even if it is as a proxy via oslo.limit. It will be a dependency in a number of the projects.","commit_id":"17652060aa9c8437d025de4c646a3354db7180a7"}]}