)]}'
{"specs/liberty/anchor/direct-asn1.rst":[{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"7c5699c8bcdacf771efadffea7c625b86062b8e7","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"- Right now, we run into the need for a new OpenSSL function quite often."},{"line_number":58,"context_line":"  Cryptography.io can\u0027t realistically expose all of them, but on the other hand"},{"line_number":59,"context_line":"  we can\u0027t wait until new cryptography.io release every time we require new"},{"line_number":60,"context_line":"  code. This results in Anchor getting more and more cffi code."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"While it may look like cryptography.io has nice abstractions for X509 which"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_996e6c95","line":59,"updated":"2015-07-24 00:27:16.000000000","message":"I think it needs to be better defined why the options are to wait for the primitives to be done upstream or do it directly in Anchor.  Why can\u0027t we contribute directly to cryptography.io, rather than just wait?  What is the extra complexity?  Does it make sense for this library to have a mid-level interface, rather than just high?","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"cd2b0f88a1ecf22f6262625672b3f9cd20c93f81","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"- Right now, we run into the need for a new OpenSSL function quite often."},{"line_number":58,"context_line":"  Cryptography.io can\u0027t realistically expose all of them, but on the other hand"},{"line_number":59,"context_line":"  we can\u0027t wait until new cryptography.io release every time we require new"},{"line_number":60,"context_line":"  code. This results in Anchor getting more and more cffi code."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"While it may look like cryptography.io has nice abstractions for X509 which"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_e8eb1877","line":59,"in_reply_to":"3a50d1a3_996e6c95","updated":"2015-07-24 04:35:39.000000000","message":"The problem is that if cryptography.io doesn\u0027t expose some function, we cannot dynamically add it in Anchor (at least not easily and with matching types) - we need to submit it to c.io, then wait for release, then consume in Anchor. It\u0027s not about the complexity, but time until we can use it.\n\nWith other projects, you can sometimes patch upstream classes to provide what you need. For cffi compiled code that\u0027s just not practical (or possible if you\u0027re using system-wide c.io - you can\u0027t recompile then).\n\nI\u0027m not sure I understand the mid-level interface part, could you expand on this?","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"7c5699c8bcdacf771efadffea7c625b86062b8e7","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"While it may look like cryptography.io has nice abstractions for X509 which"},{"line_number":63,"context_line":"could be used here, they are not great for one main reason: there\u0027s no"},{"line_number":64,"context_line":"modification support at the moment and implementing it is not trivial and is"},{"line_number":65,"context_line":"subject to memory management bugs mentioned before."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_59ff84aa","line":64,"updated":"2015-07-24 00:27:16.000000000","message":"Is this being tracked by the upstream of cryptography.io ?","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"cd2b0f88a1ecf22f6262625672b3f9cd20c93f81","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"While it may look like cryptography.io has nice abstractions for X509 which"},{"line_number":63,"context_line":"could be used here, they are not great for one main reason: there\u0027s no"},{"line_number":64,"context_line":"modification support at the moment and implementing it is not trivial and is"},{"line_number":65,"context_line":"subject to memory management bugs mentioned before."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_ae3999da","line":64,"in_reply_to":"3a50d1a3_59ff84aa","updated":"2015-07-24 04:35:39.000000000","message":"Not that I know of. It would be on the level of \"could you implement set_ for every get_ you have, please?\". I\u0027ll see if there\u0027s a good way to phrase / request it.","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"7c5699c8bcdacf771efadffea7c625b86062b8e7","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        return x509.BasicConstraints(ca, path_length)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"While an equivalent with pyasn1 would be:"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    def _build_basic_constraints(self, ext):"},{"line_number":116,"context_line":"        ca \u003d ext[\u0027cA\u0027]"},{"line_number":117,"context_line":"        path_length \u003d ext[\u0027pathLenConstraint\u0027]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_f99f7063","line":114,"updated":"2015-07-24 00:27:16.000000000","message":"Do you consider this a long term direction whilst waiting for cruptography.io to have better primitives (causing it to become tech debt), or is this a long term thing?","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"cd2b0f88a1ecf22f6262625672b3f9cd20c93f81","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        return x509.BasicConstraints(ca, path_length)"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"While an equivalent with pyasn1 would be:"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    def _build_basic_constraints(self, ext):"},{"line_number":116,"context_line":"        ca \u003d ext[\u0027cA\u0027]"},{"line_number":117,"context_line":"        path_length \u003d ext[\u0027pathLenConstraint\u0027]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_aeaf592a","line":114,"in_reply_to":"3a50d1a3_f99f7063","updated":"2015-07-24 04:35:39.000000000","message":"Long term. I guess there\u0027s a better example to include why I don\u0027t think c.io can even provide an interface we need:\n\nIf we used c.io interface for names, the name in the csr would be parsed into x509.Name object (_decode_x509_name_entry). In that code, the following happens (value \u003d _asn1_string_to_utf8(backend, data)). While it\u0027s not incorrect and it\u0027s very convenient for reading the name fields, we lost the type of that string. We cannot guarantee anymore that when it\u0027s added to the resulting certificate it\u0027s going to have the same representation.\n\nThis matters because (RFC3280, page 21, yes I know it\u0027s not the latest RFC, but I bet many implementations use 2002 rules, not 2008):\n\n      (a) attribute values encoded in different types (e.g.,\n      PrintableString and BMPString) may be assumed to represent\n      different strings;\n\nAnd it could potentially break chain verification.\n\nThis is only one case of a general issue: if you strip asn1 data, you can\u0027t guarantee you serialise the same data.\n\nNow, I\u0027m not a X509/PKI/crypto expert - I\u0027m happy for people to tell me I shouldn\u0027t worry about it, but every few pages I run into stuff like this and lean more and more towards the idea that the only sane way is to copy exact asn1 structure from CSR to X509 for names and extensions.","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"7c5699c8bcdacf771efadffea7c625b86062b8e7","unresolved":false,"context_lines":[{"line_number":153,"context_line":"----------"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Target Milestone for completion:"},{"line_number":156,"context_line":"  Liberty-1"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Work Items"},{"line_number":159,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_797b602a","line":156,"updated":"2015-07-24 00:27:16.000000000","message":"Liberty-1 was last month. https://wiki.openstack.org/wiki/Liberty_Release_Schedule","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"cd2b0f88a1ecf22f6262625672b3f9cd20c93f81","unresolved":false,"context_lines":[{"line_number":153,"context_line":"----------"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Target Milestone for completion:"},{"line_number":156,"context_line":"  Liberty-1"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Work Items"},{"line_number":159,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_ce6425e7","line":156,"in_reply_to":"3a50d1a3_797b602a","updated":"2015-07-24 04:35:39.000000000","message":"sorry, template copy-pasta","commit_id":"2095a42a79895be4f1fae17862acbdb4785924d9"}]}