)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a8fbe9924064c1cbe110b15ba34fe33ad9a923bf","unresolved":false,"context_lines":[{"line_number":13,"context_line":"be read by a unpriviledged source (e.g. lower priv log watchers,"},{"line_number":14,"context_line":"centralized logging, etc)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"SHA1 is no longer allowed as a hashing mode for CMS token hashing."},{"line_number":17,"context_line":"This is because SHA1 is being used to obscure tokens in the"},{"line_number":18,"context_line":"session object debug. This is done to  prevent the debug output"},{"line_number":19,"context_line":"from being potentially exposing a valid token (PKI-\u003esha1-short-id)"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1ae5cdf2_00e09fcb","line":16,"updated":"2014-06-12 23:32:13.000000000","message":"this sound like a bad reason for excluding SHA1 being use in CMS. This is for sanitizing debug output only so why can\u0027t we use something like MD5 to obscure the token ID. The insecure claim against MD5 is that it produces higher rate of collisions. But still irreversible. So using it just for obscuring debug message should be fine I think as token IDs are relative short-live and not recyclable.","commit_id":"299c88048468615d0fecf5e21a3fc4f17f428215"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e43e2b15c6a69701ee87d8c84a39ee1d3cb2a812","unresolved":false,"context_lines":[{"line_number":13,"context_line":"be read by a unpriviledged source (e.g. lower priv log watchers,"},{"line_number":14,"context_line":"centralized logging, etc)."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"SHA1 is no longer allowed as a hashing mode for CMS token hashing."},{"line_number":17,"context_line":"This is because SHA1 is being used to obscure tokens in the"},{"line_number":18,"context_line":"session object debug. This is done to  prevent the debug output"},{"line_number":19,"context_line":"from being potentially exposing a valid token (PKI-\u003esha1-short-id)"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1ae5cdf2_00633f42","line":16,"in_reply_to":"1ae5cdf2_00e09fcb","updated":"2014-06-12 23:35:54.000000000","message":"MD5 is already used by default for token hashing. Reality, no one is going to use SHA1 instead of one of the more reasonable SHA hashing that is available (e.g. SHA256).\n\nThough it should be pointed out using SHA512 will break the token persistence backend under SQL.\n\nI will discuss the other aspects of SHA vs other hashing in IRC before rolling a new patch.","commit_id":"299c88048468615d0fecf5e21a3fc4f17f428215"}],"keystoneclient/common/cms.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a8fbe9924064c1cbe110b15ba34fe33ad9a923bf","unresolved":false,"context_lines":[{"line_number":370,"context_line":"    \"\"\""},{"line_number":371,"context_line":"    if mode.lower() \u003d\u003d \u0027sha1\u0027:"},{"line_number":372,"context_line":"        raise exceptions.ClientException(\u0027SHA1 is not a supported CMS hashing \u0027"},{"line_number":373,"context_line":"                                         \u0027mode.\u0027)"},{"line_number":374,"context_line":"    if token_id is None:"},{"line_number":375,"context_line":"        return None"},{"line_number":376,"context_line":"    if is_asn1_token(token_id) or is_pkiz(token_id):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_80d3cf02","line":373,"updated":"2014-06-12 23:32:13.000000000","message":"I think we should not be excluding SHA1 from CMS hashing.","commit_id":"299c88048468615d0fecf5e21a3fc4f17f428215"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"08dd614f70620253732068ad2eb654b870398406","unresolved":false,"context_lines":[{"line_number":370,"context_line":"    \"\"\""},{"line_number":371,"context_line":"    if mode.lower() \u003d\u003d \u0027sha1\u0027:"},{"line_number":372,"context_line":"        raise exceptions.ClientException(\u0027SHA1 is not a supported CMS hashing \u0027"},{"line_number":373,"context_line":"                                         \u0027mode.\u0027)"},{"line_number":374,"context_line":"    if token_id is None:"},{"line_number":375,"context_line":"        return None"},{"line_number":376,"context_line":"    if is_asn1_token(token_id) or is_pkiz(token_id):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_fbb0ab44","line":373,"in_reply_to":"1ae5cdf2_1879efc7","updated":"2014-06-13 15:59:39.000000000","message":"We aren\u0027t excluding MD5 because it is the current default. I would have used MD5 instead of sha1 if MD5 wasn\u0027t the default hashing. When initially developing this, we dicussed in IRC that most people who would care if we\u0027re hashing (Token Revocation List etc) tokens with MD5 would never use SHA1 because it is being phased out/largely is considered broken and because SHA256 is currently available with the same mechanism.","commit_id":"299c88048468615d0fecf5e21a3fc4f17f428215"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"8b5852d862a063862728653fbdfd637a7fcaa4bb","unresolved":false,"context_lines":[{"line_number":370,"context_line":"    \"\"\""},{"line_number":371,"context_line":"    if mode.lower() \u003d\u003d \u0027sha1\u0027:"},{"line_number":372,"context_line":"        raise exceptions.ClientException(\u0027SHA1 is not a supported CMS hashing \u0027"},{"line_number":373,"context_line":"                                         \u0027mode.\u0027)"},{"line_number":374,"context_line":"    if token_id is None:"},{"line_number":375,"context_line":"        return None"},{"line_number":376,"context_line":"    if is_asn1_token(token_id) or is_pkiz(token_id):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_1879efc7","line":373,"in_reply_to":"1ae5cdf2_80d3cf02","updated":"2014-06-13 04:21:33.000000000","message":"NIST announced phasing out of the use of SHA-1 back in 2010. Out of curiosity why are we excluding SHA-1 and not also MD5?","commit_id":"299c88048468615d0fecf5e21a3fc4f17f428215"}],"keystoneclient/middleware/auth_token.py":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"f981aa7b9d3d8c0192cf42134007fccf7dafe0fc","unresolved":false,"context_lines":[{"line_number":330,"context_line":"                \u0027 only while migrating from a less secure algorithm to a more\u0027"},{"line_number":331,"context_line":"                \u0027 secure one. Once all the old tokens are expired this option\u0027"},{"line_number":332,"context_line":"                \u0027 should be set to a single value for better performance. \u0027"},{"line_number":333,"context_line":"                \u0027 NOTE: SHA1 is not an available option.\u0027),"},{"line_number":334,"context_line":"]"},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_f31bf970","line":333,"updated":"2014-06-17 19:42:04.000000000","message":"It might be worth explaining why SHA1 is not an available option.","commit_id":"6e1ae752de4984246466e47aa72c2b4471aa30f9"}],"keystoneclient/session.py":[{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"e7904bf6147bd0930203d2edb15da59e0adaa1c0","unresolved":false,"context_lines":[{"line_number":251,"context_line":"                        \u0027-H \"%(header)s: {SHA1}%(token)s\"\u0027 %"},{"line_number":252,"context_line":"                        {\u0027header\u0027: header[0],"},{"line_number":253,"context_line":"                         \u0027token\u0027: hashlib.sha1(token_id).hexdigest()})"},{"line_number":254,"context_line":"                    continue"},{"line_number":255,"context_line":"                string_parts.append(\u0027-H \"%s: %s\"\u0027 % header)"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_6ecc16bc","line":254,"updated":"2014-06-12 03:36:03.000000000","message":"for k, v in six.iteritems(headers): \n    if k.lower() \u003d\u003d \u0027\u0027:\n    else:\n        string_parts.append(\u0027-H \"%s: %s\"\u0027 % (k, v))\n\nalso as this is getting expensive let\u0027s wrap: \n\nif _logger.isEnabledFor(logging.debug):\n\naround this whole section so as not to compute it and ignore it.","commit_id":"27178c8186d382a8b0d0784f6d4057433d54dbe4"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"fe795088a3d09b0737a042b7e633bca4f5648055","unresolved":false,"context_lines":[{"line_number":251,"context_line":"                        \u0027-H \"%(header)s: {SHA1}%(token)s\"\u0027 %"},{"line_number":252,"context_line":"                        {\u0027header\u0027: header[0],"},{"line_number":253,"context_line":"                         \u0027token\u0027: hashlib.sha1(token_id).hexdigest()})"},{"line_number":254,"context_line":"                    continue"},{"line_number":255,"context_line":"                string_parts.append(\u0027-H \"%s: %s\"\u0027 % header)"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_4e559ac0","line":254,"in_reply_to":"1ae5cdf2_6ecc16bc","updated":"2014-06-12 03:38:47.000000000","message":"++ works for me.\nIn next patch.","commit_id":"27178c8186d382a8b0d0784f6d4057433d54dbe4"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2dd3f7eeb4fa34c70a9bc0f8bd681a1517fac1ae","unresolved":false,"context_lines":[{"line_number":257,"context_line":"                        # server to emit SHA1 hashed tokens (used in token"},{"line_number":258,"context_line":"                        # revocation list and as the short-form unique id of"},{"line_number":259,"context_line":"                        # PKI tokens)."},{"line_number":260,"context_line":"                        token_id \u003d header[1] + header[1][-13:]"},{"line_number":261,"context_line":"                        string_parts.append("},{"line_number":262,"context_line":"                            \u0027-H \"%(header)s: {OBSCURED}%(token)s\"\u0027 %"},{"line_number":263,"context_line":"                            {\u0027header\u0027: header[0],"}],"source_content_type":"text/x-python","patch_set":3,"id":"1ae5cdf2_1138139f","line":260,"updated":"2014-06-12 04:32:18.000000000","message":"Alternatively we could use header[1]*2 and just duplicate the header for the hash.","commit_id":"74b39df685229957c86c98c3d595bfebb95bcea5"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f55f06f7c1347ff7d9025669cbce4356d4b642db","unresolved":false,"context_lines":[{"line_number":229,"context_line":"        if requests_auth:"},{"line_number":230,"context_line":"            kwargs[\u0027auth\u0027] \u003d requests_auth"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        if _logger.isEnabledFor(logging.DEBUG):"},{"line_number":233,"context_line":"            # NOTE(morganfainberg): This whole debug section is expensive,"},{"line_number":234,"context_line":"            # there is no need to do the work if we\u0027re not going to emit a"},{"line_number":235,"context_line":"            # debug log."}],"source_content_type":"text/x-python","patch_set":4,"id":"1ae5cdf2_0770d53e","line":232,"updated":"2014-06-12 06:13:57.000000000","message":"nice!","commit_id":"ae03f3311920f56163b30edd6ae0d89e8954ec8a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f55f06f7c1347ff7d9025669cbce4356d4b642db","unresolved":false,"context_lines":[{"line_number":257,"context_line":"                        # server to emit SHA1 hashed tokens (used in token"},{"line_number":258,"context_line":"                        # revocation list and as the short-form unique id of"},{"line_number":259,"context_line":"                        # PKI tokens)."},{"line_number":260,"context_line":"                        token_id \u003d header[1] + header[1][-13:]"},{"line_number":261,"context_line":"                        string_parts.append("},{"line_number":262,"context_line":"                            \u0027-H \"%(header)s: {OBSCURED}%(token)s\"\u0027 %"},{"line_number":263,"context_line":"                            {\u0027header\u0027: header[0],"}],"source_content_type":"text/x-python","patch_set":4,"id":"1ae5cdf2_0771b50b","line":260,"updated":"2014-06-12 06:13:57.000000000","message":"just curious, why 13 bytes salt?","commit_id":"ae03f3311920f56163b30edd6ae0d89e8954ec8a"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"f981aa7b9d3d8c0192cf42134007fccf7dafe0fc","unresolved":false,"context_lines":[{"line_number":232,"context_line":"        if _logger.isEnabledFor(logging.DEBUG):"},{"line_number":233,"context_line":"            # NOTE(morganfainberg): This whole debug section is expensive,"},{"line_number":234,"context_line":"            # there is no need to do the work if we\u0027re not going to emit a"},{"line_number":235,"context_line":"            # debug log."},{"line_number":236,"context_line":"            string_parts \u003d [\u0027curl -i\u0027]"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"            # NOTE(jamielennox): None means let requests do its default"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_f3493961","line":235,"updated":"2014-06-17 19:42:04.000000000","message":"Nice optimization!","commit_id":"6e1ae752de4984246466e47aa72c2b4471aa30f9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d1a904d222cae115a12168ead26ef7fd021836f8","unresolved":false,"context_lines":[{"line_number":253,"context_line":"                        string_parts.append("},{"line_number":254,"context_line":"                            \u0027-H \"%(header)s: {SHA1}%(token)s\"\u0027 %"},{"line_number":255,"context_line":"                            {\u0027header\u0027: header[0],"},{"line_number":256,"context_line":"                             \u0027token\u0027: hashlib.sha1("},{"line_number":257,"context_line":"                                 header[1].encode(\u0027utf8\u0027)).hexdigest()})"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_e0007c04","line":256,"updated":"2014-06-17 20:53:12.000000000","message":"@brant: is this going to freak out your compliance friends?","commit_id":"6e1ae752de4984246466e47aa72c2b4471aa30f9"}]}