)]}'
{"id":"openstack%2Fpython-keystoneclient~453365","triplet_id":"openstack%2Fpython-keystoneclient~master~I290de92ea908dca7da34e3cc9e7e9efdc6e804f8","project":"openstack/python-keystoneclient","branch":"master","topic":"sha1","hashtags":[],"change_id":"I290de92ea908dca7da34e3cc9e7e9efdc6e804f8","subject":"Replace usages of SHA1 with SHA256","status":"ABANDONED","created":"2017-04-04 23:01:32.000000000","updated":"2017-04-12 18:39:05.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"5b086f8787bc77858ded84dc6295f0953ece1d55","_number":453365,"virtual_id_number":453365,"owner":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"value":1,"date":"2017-04-05 00:09:05.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":-1,"date":"2017-04-05 18:58:54.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},{"value":-1,"date":"2017-04-09 01:59:00.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2017-04-05 00:09:05.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"},{"updated":"2017-04-05 18:58:54.000000000","updated_by":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"reviewer":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"state":"REVIEWER"},{"updated":"2017-04-09 01:59:00.000000000","updated_by":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"reviewer":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"state":"REVIEWER"}],"messages":[{"id":"c000d1df4202417ca7a6715ef3c0c516182fe60a","author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"date":"2017-04-04 23:01:32.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"a6cf45de952fe57bafdf8753e77d1866a13972c5","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2017-04-05 00:09:05.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- gate-python-keystoneclient-docs-ubuntu-xenial http://docs-draft.openstack.org/65/453365/1/check/gate-python-keystoneclient-docs-ubuntu-xenial/fe7f03d//doc/build/html/ : SUCCESS in 1m 05s\n- gate-python-keystoneclient-pep8-ubuntu-xenial http://logs.openstack.org/65/453365/1/check/gate-python-keystoneclient-pep8-ubuntu-xenial/fc9fc3c/ : SUCCESS in 2m 02s\n- gate-python-keystoneclient-python27-ubuntu-xenial http://logs.openstack.org/65/453365/1/check/gate-python-keystoneclient-python27-ubuntu-xenial/e4afdd3/ : SUCCESS in 1m 05s\n- gate-python-keystoneclient-python35 http://logs.openstack.org/65/453365/1/check/gate-python-keystoneclient-python35/7b3e0e9/ : SUCCESS in 1m 06s\n- gate-tempest-dsvm-neutron-src-python-keystoneclient-ubuntu-xenial http://logs.openstack.org/65/453365/1/check/gate-tempest-dsvm-neutron-src-python-keystoneclient-ubuntu-xenial/3bd67de/ : SUCCESS in 1h 07m 12s\n- gate-keystoneclient-dsvm-functional-ubuntu-xenial http://logs.openstack.org/65/453365/1/check/gate-keystoneclient-dsvm-functional-ubuntu-xenial/53f90ec/ : SUCCESS in 16m 13s","accounts_in_message":[],"_revision_number":1},{"id":"850b96be119102f57bae2ba9c9cdd531cb3ad778","author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"date":"2017-04-05 18:58:54.000000000","message":"Patch Set 1: Code-Review-1\n\nSame as in the correspondent keystone change:\n\nThis needs a release note.\n\nIf this is not backwards compatible and really needs to be fixed (which I think is the case), the release note should be very clear about the issue with existing tokens upon upgrade. It\u0027d be nice to get feedback from someone from the security team on this.","accounts_in_message":[],"_revision_number":1},{"id":"fef7cc4722f31d9abc22e3f1a2e18662776f4614","author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"date":"2017-04-09 01:59:00.000000000","message":"Patch Set 1: Code-Review-1\n\nSimilar to my comment on https://review.openstack.org/#/c/453357/2\nThe collisions were found on SHA1. HMAC-SHA1 is a specific construction and should not be confused with the first.\n\nI don\u0027t have a problem with the content of this change, but with how it\u0027s presented. Specifically:\n- The commit message talks about SHA1, but the authentication is using HMAC-SHA1. That authentication method is not insecure at the moment. It\u0027s a good idea to move to SHA2 just in case, but it doesn\u0027t fix any practical, existing issue.\n- `hashlib.sha256` is available already in python2.6, so the authentication part is a NOOP - it shouldn\u0027t require a release note, because every supported platform will already use hmac-sha256.\n- The `_process_header` change should likely be a separate patch. This case *is* affected by the collision attack, but on the other hand it is a behaviour change and would require a note. Depending on how logs are analysed, it could be useful to provide a flag to keep sha1 for people who do want the values to remain the same. The use case here is correlation over time - if someone creates a collision with a hashed authentication header, the worst they can do is confuse the operator.","accounts_in_message":[],"_revision_number":1},{"id":"2288c1091d8435e52f8f50b89ce181032ca65602","author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"date":"2017-04-12 18:39:05.000000000","message":"Abandoned\n\nGoing to abandon this for now, the authentication is using HMAC-SHA1 which isn\u0027t really a security issue at this time. This might also need to be reliant on an existing keystone change if/when that happens.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"5e8af0806d7207af021adf895216801b55cf0473","revisions":{"5e8af0806d7207af021adf895216801b55cf0473":{"kind":"REWORK","_number":1,"created":"2017-04-04 23:01:32.000000000","uploader":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"ref":"refs/changes/65/453365/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/python-keystoneclient","ref":"refs/changes/65/453365/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/65/453365/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/65/453365/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/65/453365/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/python-keystoneclient refs/changes/65/453365/1"}}},"commit":{"parents":[{"commit":"cfd33730868350cd475e45569a8c1573803a6895","subject":"Fix failing PY2 and PY3 gate jobs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/cfd33730868350cd475e45569a8c1573803a6895"}]}],"author":{"name":"Gage Hugo","email":"gagehugo@gmail.com","date":"2017-04-04 22:57:46.000000000","tz":-300},"committer":{"name":"Gage Hugo","email":"gagehugo@gmail.com","date":"2017-04-04 22:57:46.000000000","tz":-300},"subject":"Replace usages of SHA1 with SHA256","message":"Replace usages of SHA1 with SHA256\n\nDue to SHA1 being unsecure and the first collision being found[0],\nit should be replaced by a more secure algorithm. This change\nreplaces multiple instances where SHA1 is used, and is replaced by\nSHA256. By replaces these instances, this change will also allow\nbandit to successfully pass as well[1].\n\n[0] https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html\n[1] https://review.openstack.org/#/c/437563/\n\nChange-Id: I290de92ea908dca7da34e3cc9e7e9efdc6e804f8\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/5e8af0806d7207af021adf895216801b55cf0473"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/5e8af0806d7207af021adf895216801b55cf0473"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}