)]}'
{"id":"openstack%2Frequirements~276554","triplet_id":"openstack%2Frequirements~master~Id233df6061da47bd28f543615b6bf2a75e29a6cb","project":"openstack/requirements","branch":"master","hashtags":[],"change_id":"Id233df6061da47bd28f543615b6bf2a75e29a6cb","subject":"Add ndg-httpsclient to global requirements","status":"ABANDONED","created":"2016-02-05 03:45:14.000000000","updated":"2016-02-08 17:40:54.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"bb6da834910b950bd0065b59898a46d3f8ff964d","_number":276554,"virtual_id_number":276554,"owner":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"date":"2016-02-05 16:39:08.000000000","_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},{"date":"2016-02-05 03:52:14.000000000","_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},{"value":1,"date":"2016-02-05 05:55:19.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"recommended":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"disliked":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"all":[{"value":-1,"date":"2016-02-05 16:30:43.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},{"value":1,"date":"2016-02-05 03:52:22.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":-1,"date":"2016-02-05 12:49:23.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},{"value":-1,"date":"2016-02-05 12:46:53.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},{"value":0,"permitted_voting_range":{"min":-1,"max":0},"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},{"date":"2016-02-05 12:55:26.000000000","_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2016-02-05 03:52:14.000000000","updated_by":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"reviewer":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"state":"REVIEWER"},{"updated":"2016-02-05 05:55:19.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"},{"updated":"2016-02-05 12:46:53.000000000","updated_by":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"reviewer":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"state":"REVIEWER"},{"updated":"2016-02-05 12:49:23.000000000","updated_by":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"reviewer":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"state":"REVIEWER"},{"updated":"2016-02-05 12:55:26.000000000","updated_by":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"reviewer":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"state":"REVIEWER"},{"updated":"2016-02-05 16:30:43.000000000","updated_by":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"reviewer":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"state":"REVIEWER"}],"messages":[{"id":"1991512b9e4a4c86ee9df3f71b6b47b95e33a18e","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 03:45:14.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"cd3c36c90454cf6e4821446b402da582aa063dbf","author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"date":"2016-02-05 03:52:14.000000000","message":"Patch Set 1:\n\n+1","accounts_in_message":[],"_revision_number":1},{"id":"d9501abdad7fd09fc75b58a9f5b07ba2e9d73343","author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"date":"2016-02-05 03:52:22.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"ad37bc6e690e415f1b450285eb68a3fc07d8ac18","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2016-02-05 05:55:19.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- gate-tempest-dsvm-full http://logs.openstack.org/54/276554/1/check/gate-tempest-dsvm-full/3de1525/ : SUCCESS in 43m 48s\n- gate-tempest-dsvm-postgres-full http://logs.openstack.org/54/276554/1/check/gate-tempest-dsvm-postgres-full/6f1375b/ : SUCCESS in 56m 28s\n- gate-tempest-dsvm-neutron-full http://logs.openstack.org/54/276554/1/check/gate-tempest-dsvm-neutron-full/16efb72/ : SUCCESS in 56m 14s\n- gate-grenade-dsvm http://logs.openstack.org/54/276554/1/check/gate-grenade-dsvm/3d0656b/ : SUCCESS in 42m 14s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/54/276554/1/check/gate-tempest-dsvm-large-ops/cdadb37/ : SUCCESS in 34m 47s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/54/276554/1/check/gate-tempest-dsvm-neutron-large-ops/663738d/ : SUCCESS in 47m 54s\n- gate-requirements-pypy http://logs.openstack.org/54/276554/1/check/gate-requirements-pypy/9b2c408/ : SUCCESS in 1m 00s (non-voting)\n- gate-requirements-docs http://docs-draft.openstack.org/54/276554/1/check/gate-requirements-docs/33bc6db//doc/build/html/ : SUCCESS in 56s\n- gate-requirements-pep8 http://logs.openstack.org/54/276554/1/check/gate-requirements-pep8/f5c0124/ : SUCCESS in 37s\n- gate-requirements-python27 http://logs.openstack.org/54/276554/1/check/gate-requirements-python27/e4b0f5d/ : SUCCESS in 39s\n- gate-requirements-integration-dsvm http://logs.openstack.org/54/276554/1/check/gate-requirements-integration-dsvm/1c8c64a/ : SUCCESS in 1h 22m 06s\n- gate-requirements-integration-dsvm-resolver http://logs.openstack.org/54/276554/1/check/gate-requirements-integration-dsvm-resolver/0068758/ : FAILURE in 28m 42s (non-voting)\n- gate-requirements-tox-validate http://logs.openstack.org/54/276554/1/check/gate-requirements-tox-validate/5d4442f/ : SUCCESS in 51s\n- gate-grenade-dsvm-multinode http://logs.openstack.org/54/276554/1/check/gate-grenade-dsvm-multinode/09c1f49/ : SUCCESS in 48m 19s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"725e00eef6cff8f9645f30f7ddf83eafe8cb8b52","author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"date":"2016-02-05 12:30:59.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"d8f71c2bc30909c02e59b14b342bc17071cc0054","author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"date":"2016-02-05 12:32:40.000000000","message":"Patch Set 1: Code-Review+1\n\nAdam, There\u0027s a few more questions in the template, can you please cover those in the commit message too?","accounts_in_message":[],"_revision_number":1},{"id":"a745ed3ada86e267e92bbe7fcebfdb3ec80981dd","author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"date":"2016-02-05 12:46:53.000000000","message":"Patch Set 1: Code-Review-1\n\nI get that urllib3 doesn\u0027t validate these, but requests doesn\u0027t either?","accounts_in_message":[],"_revision_number":1},{"id":"4f691543e5946a02ac5f1d4d3beaa9cfbc14163f","author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"date":"2016-02-05 12:48:10.000000000","message":"Patch Set 1:\n\nhttp://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification","accounts_in_message":[],"_revision_number":1},{"id":"7311dbe5287f8164f68063cd9c0294517fb2cc66","author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"date":"2016-02-05 12:49:23.000000000","message":"Patch Set 1: Code-Review-1\n\nHmm, Sean just pointed out http://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification","accounts_in_message":[],"_revision_number":1},{"id":"33054eaedc23ef4bbf78d31b410cd9b95b9f8d4e","author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"date":"2016-02-05 16:19:39.000000000","message":"Patch Set 1:\n\nWe found in our testing that requests would still connect to a server with an expired server cert - I will let Adam speak to the details on that","accounts_in_message":[],"_revision_number":1},{"id":"7a037a95d8b2fcb4aba46d1e221d67dbed88ce0b","author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"date":"2016-02-05 16:22:17.000000000","message":"Patch Set 1:\n\nIs there an upstream requests bug German/Adam?","accounts_in_message":[],"_revision_number":1},{"id":"4fc264b980e62304be98e245263f1a71dd3aa54a","author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"date":"2016-02-05 16:30:43.000000000","message":"Patch Set 1: Code-Review-1\n\nGerman, please file a bug upstream (or better yet, email Cory and I with your reproduction case).\n\nFurther, this dependency + the ones in the \"secure\" extra are only for SNI on versions of Python 2.7 \u003c 2.7.9","accounts_in_message":[],"_revision_number":1},{"id":"d72a2251e5c8c1a1cbdfdaa5d7eaca01d4dd915b","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 16:39:08.000000000","message":"Patch Set 1:\n\nThe relevant bug was here for Octavia:\nhttps://bugs.launchpad.net/octavia/+bug/1494417\nRequests ships with its own version of urllib3, which still does not include a real full SSL verifier.\nWe found in our testing that invalid certs were being let through, even with requests\u0027 verifier being used. Unfortunately I can\u0027t seem to find a bug for that...","accounts_in_message":[],"_revision_number":1},{"id":"976b0593f292a0ec66b7ba81e028a4be0616f0d6","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 16:42:05.000000000","message":"Patch Set 1:\n\nAh, I see I missed some responses...\nI do not know if there is an upstream bug for this in requests. We will have to revisit that testing and see if we can get data to submit one, if it doesn\u0027t already exist -- though I thought it was well documented from urllib3 that this is the appropriate way to handle SSL verification.\n\nI\u0027ll see about answering the rest of the questions in the submission form, but I thought packaging didn\u0027t matter for things in pip with no other system deps? (Other than pyOpenSSL which is already required globally)","accounts_in_message":[],"_revision_number":1},{"id":"bab66926f6626795880d436b0a2ba5703ee3b41a","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 16:49:54.000000000","message":"Patch Set 1:\n\nI\u0027m talking to one of the devs of Requests now, I will get exactly what we need sorted out soon.","accounts_in_message":[],"_revision_number":1},{"id":"eab62bd3211166167840e98b5724ac4ee5c1e75b","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 16:59:08.000000000","message":"Patch Set 1:\n\nOk, so it seems that if this is running on anything prior to 2.7.9 those warnings mean two things:\n* No SNI support (we don\u0027t need it, so whatever)\n* Vulnerable to BREACH attack (this could be a concern)\n\nI\u0027m going to try to replicate our other issues with validation as soon as I get an environment spun up.","accounts_in_message":[],"_revision_number":1},{"id":"a1c2fb444e21dbb974655a6a1d861595e5451602","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 18:09:02.000000000","message":"Patch Set 1:\n\nI can\u0027t seem to repro the expired cert validation issue anymore, so it\u0027s possible that was an issue on our side that was fixed elsewhere. Looking at BREACH, I am not sure whether we fit the full vulnerability criteria, so it\u0027s possible we may not need this after all. We may want to simply ignore and squelch the warnings, re: http://urllib3.readthedocs.org/en/latest/security.html#within-the-code","accounts_in_message":[],"_revision_number":1},{"id":"ea9d00f4a7680dd9443d00c2a3f59bbb6672406e","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-05 18:14:12.000000000","message":"Patch Set 1:\n\nSorry, meant CRIME, not BREACH. Small mixup. :P","accounts_in_message":[],"_revision_number":1},{"id":"bb6da834910b950bd0065b59898a46d3f8ff964d","author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"date":"2016-02-08 17:40:54.000000000","message":"Abandoned\n\nI think it\u0027s still possible we might be vulnerable to the CRIME exploit without this, but this is significantly mitigated by a number of other factors, like the use of private networks and secure deployment options that limit attack surface area. I\u0027m willing to drop this for the time being, and we can revisit it if we decide this is actually a serious concern.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"7cfd414be94275b6bf34ee47d4384ae61c59148b","revisions":{"7cfd414be94275b6bf34ee47d4384ae61c59148b":{"kind":"REWORK","_number":1,"created":"2016-02-05 03:45:14.000000000","uploader":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"ref":"refs/changes/54/276554/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/requirements","ref":"refs/changes/54/276554/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/requirements refs/changes/54/276554/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/requirements refs/changes/54/276554/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/requirements refs/changes/54/276554/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/requirements refs/changes/54/276554/1"}}},"commit":{"parents":[{"commit":"529c4aea69a36e3353a35dcb4af876ae19dcdcba","subject":"Merge \"Updated from generate-constraints\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/requirements/commit/529c4aea69a36e3353a35dcb4af876ae19dcdcba"}]}],"author":{"name":"Adam Harwell","email":"flux.adam@gmail.com","date":"2016-02-05 03:40:22.000000000","tz":-360},"committer":{"name":"Adam Harwell","email":"flux.adam@gmail.com","date":"2016-02-05 03:40:22.000000000","tz":-360},"subject":"Add ndg-httpsclient to global requirements","message":"Add ndg-httpsclient to global requirements\n\nThis package is recommended for secure operations by:\nhttp://urllib3.readthedocs.org/en/latest/security.html\n\nIt has a BSD license and supports both Py2 and Py3.\nIt is part of urllib3[secure] and requests[secure].\n\nWe would like to import this in the Octavia project so \u0027requests\u0027 can\nproperly verify HTTPS requests and validate client/server certs.\n\nChange-Id: Id233df6061da47bd28f543615b6bf2a75e29a6cb\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/requirements/commit/7cfd414be94275b6bf34ee47d4384ae61c59148b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/requirements/commit/7cfd414be94275b6bf34ee47d4384ae61c59148b"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}