)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    barbican_key_id \u003d \u003ckey_id\u003e"},{"line_number":32,"context_line":"    barbican_username \u003d swift"},{"line_number":33,"context_line":"    barbican_password \u003d swift"},{"line_number":34,"context_line":"    barbican_project_name \u003d service"},{"line_number":35,"context_line":"    barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"The encryption root secret shall be created and stored in the external"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":17,"id":"1a6eadb0_eee21ed4","line":34,"updated":"2016-12-16 17:25:07.000000000","message":"I haven\u0027t tested this part yet, but if you taken upon Alistair\u0027s suggestion on renaming \u0027service\u0027 as project name, then this should change here as well as other references in docs.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    barbican_key_id \u003d \u003ckey_id\u003e"},{"line_number":32,"context_line":"    barbican_username \u003d swift"},{"line_number":33,"context_line":"    barbican_password \u003d swift"},{"line_number":34,"context_line":"    barbican_project_name \u003d service"},{"line_number":35,"context_line":"    barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"The encryption root secret shall be created and stored in the external"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":17,"id":"1a6eadb0_086ef295","line":34,"in_reply_to":"1a6eadb0_eee21ed4","updated":"2016-12-20 15:44:28.000000000","message":"Fixed.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"}],"doc/source/overview_encryption.rst":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":127,"context_line":".. _encryption_root_secret_in_external_kms:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_b848405d","line":130,"updated":"2016-10-05 09:03:22.000000000","message":"+1 for updating the docs :)","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":127,"context_line":".. _encryption_root_secret_in_external_kms:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_3a1eba63","line":130,"in_reply_to":"1a95cdbc_b848405d","updated":"2016-10-05 22:14:44.000000000","message":"Thx!","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"},{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret, are the e.g., the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that the encryption root secret may in the backend of the"},{"line_number":138,"context_line":"key management system e.g., be stored in a hardware security module (HSM) for"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_fd0b9a7b","line":135,"updated":"2016-10-05 09:03:22.000000000","message":"suggest replacing \", are the e.g.,\" with \"include\"","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"},{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret, are the e.g., the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that the encryption root secret may in the backend of the"},{"line_number":138,"context_line":"key management system e.g., be stored in a hardware security module (HSM) for"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_6bab1b75","line":135,"in_reply_to":"1a95cdbc_fd0b9a7b","updated":"2016-10-05 22:14:44.000000000","message":"Fixed in next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":141,"context_line":"For retrieving the encryption root secret from an external key management"},{"line_number":142,"context_line":"system, the keymaster uses the  `Barbican client"},{"line_number":143,"context_line":"\u003chttp://docs.openstack.org/developer/python-barbicanclient/\u003e`_ directly (when"},{"line_number":144,"context_line":"using the"},{"line_number":145,"context_line":"v2 Identity API), or the `Castellan library"},{"line_number":146,"context_line":"\u003chttp://docs.openstack.org/developer/castellan/\u003e`_ (when using the v3 API) to"},{"line_number":147,"context_line":"communicate with Barbican. It"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_9de2969e","line":144,"updated":"2016-10-05 09:03:22.000000000","message":"is this true? - I don\u0027t see any dependency on barbicanclient in the code","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":141,"context_line":"For retrieving the encryption root secret from an external key management"},{"line_number":142,"context_line":"system, the keymaster uses the  `Barbican client"},{"line_number":143,"context_line":"\u003chttp://docs.openstack.org/developer/python-barbicanclient/\u003e`_ directly (when"},{"line_number":144,"context_line":"using the"},{"line_number":145,"context_line":"v2 Identity API), or the `Castellan library"},{"line_number":146,"context_line":"\u003chttp://docs.openstack.org/developer/castellan/\u003e`_ (when using the v3 API) to"},{"line_number":147,"context_line":"communicate with Barbican. It"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_865e9ee7","line":144,"in_reply_to":"1a95cdbc_9de2969e","updated":"2016-10-05 22:14:44.000000000","message":"This is a leftover from a previous version which used barbicanclient directly when using the v2 Identity API. I removed this text from the doc in the next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":144,"context_line":"using the"},{"line_number":145,"context_line":"v2 Identity API), or the `Castellan library"},{"line_number":146,"context_line":"\u003chttp://docs.openstack.org/developer/castellan/\u003e`_ (when using the v3 API) to"},{"line_number":147,"context_line":"communicate with Barbican. It"},{"line_number":148,"context_line":"also uses the explicitly configured username and password (and project name"},{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_b88da07d","line":147,"updated":"2016-10-05 09:03:22.000000000","message":"This final sentence is the most important info from the user\u0027s persepctive i.e. this paragraph should begin with stating what needs to be done to configure swift to access Barbican. Then possibly comment on how the implementation works (although I am not 100% sure that is needed).","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":144,"context_line":"using the"},{"line_number":145,"context_line":"v2 Identity API), or the `Castellan library"},{"line_number":146,"context_line":"\u003chttp://docs.openstack.org/developer/castellan/\u003e`_ (when using the v3 API) to"},{"line_number":147,"context_line":"communicate with Barbican. It"},{"line_number":148,"context_line":"also uses the explicitly configured username and password (and project name"},{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_da0eb633","line":147,"in_reply_to":"1a95cdbc_b88da07d","updated":"2016-10-05 22:14:44.000000000","message":"Addressed in next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":147,"context_line":"communicate with Barbican. It"},{"line_number":148,"context_line":"also uses the explicitly configured username and password (and project name"},{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":153,"context_line":"management system before it can be used by the keymaster. The following"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_3881904b","line":150,"updated":"2016-10-05 09:03:22.000000000","message":"I\u0027m not sure it is necessary to contrast with authtoken, and could be confusing.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":147,"context_line":"communicate with Barbican. It"},{"line_number":148,"context_line":"also uses the explicitly configured username and password (and project name"},{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":153,"context_line":"management system before it can be used by the keymaster. The following"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_86a13eac","line":150,"in_reply_to":"1a95cdbc_3881904b","updated":"2016-10-05 22:14:44.000000000","message":"Removed in next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":153,"context_line":"management system before it can be used by the keymaster. The following"},{"line_number":154,"context_line":"command can be user to store the currently configured encryption root secret"},{"line_number":155,"context_line":"from the `proxy-server.conf` file in Barbican::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_dd1c1e7a","line":152,"updated":"2016-10-05 09:03:22.000000000","message":"I suggest moving this paragraph ahead of the previous, so that the order of actions is:\n\n  1. create root secret in Barbican\n  2. config swift to access root secret","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":149,"context_line":"etc.) from the `keymaster.conf` file, instead of using e.g., configuration"},{"line_number":150,"context_line":"information from ``[filter:authtoken]`` in the `proxy-server.conf` file."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":153,"context_line":"management system before it can be used by the keymaster. The following"},{"line_number":154,"context_line":"command can be user to store the currently configured encryption root secret"},{"line_number":155,"context_line":"from the `proxy-server.conf` file in Barbican::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_26f6aa8f","line":152,"in_reply_to":"1a95cdbc_dd1c1e7a","updated":"2016-10-05 22:14:44.000000000","message":"Moved in next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    openstack secret store --name swift_root_secret --payload \\"},{"line_number":158,"context_line":"    \u003cexisting_root_secret\u003e --secret-type opaque --payload-content-type \\"},{"line_number":159,"context_line":"    \"text/plain\" --algorithm aes --bit-length 256 --mode cbc"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Alternatively, a new, random encryption root secret can be generated by"},{"line_number":162,"context_line":"replacing ``\u003cexisting_root_secret\u003e`` in the previous command with"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_9d7e16ad","line":159,"updated":"2016-10-05 09:03:22.000000000","message":"We need to be clear which user credentials are used for this command i.e. that they must match the credentials used in the keymaster.conf file. Do we suggest that the secret is stored under username\u003dswift project\u003dservice?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    openstack secret store --name swift_root_secret --payload \\"},{"line_number":158,"context_line":"    \u003cexisting_root_secret\u003e --secret-type opaque --payload-content-type \\"},{"line_number":159,"context_line":"    \"text/plain\" --algorithm aes --bit-length 256 --mode cbc"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Alternatively, a new, random encryption root secret can be generated by"},{"line_number":162,"context_line":"replacing ``\u003cexisting_root_secret\u003e`` in the previous command with"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a95cdbc_667fd2aa","line":159,"in_reply_to":"1a95cdbc_9d7e16ad","updated":"2016-10-05 22:14:44.000000000","message":"In the next patch I added text mentioning that the credentials used to store the secret shall match the ones configured in the keymaster.conf file. I don\u0027t know if we should suggest/recommend the username and project to store them under.\n\nWould it make sense to add documentation describing the creation of such a user, and then refer to that new text from here? Does the user creation anyway need to be done explicitly when setting up the root secret in Barbican, or do default Swift installations already set up a Swift user etc? In my dev setup, I have to create the user, but maybe it\u0027s not a \"normal\" one.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":87,"context_line":"should be consistent across all proxy servers. The minimum length of 44 has"},{"line_number":88,"context_line":"been chosen because it is the length of a base-64 encoded 32 byte value."},{"line_number":89,"context_line":"Alternatives to specifying the encryption root secret directly in the"},{"line_number":90,"context_line":"`proxy-server.conf` file are storing it in a separate file, and storing it in"},{"line_number":91,"context_line":"an :ref:`external key management system"},{"line_number":92,"context_line":"\u003cencryption_root_secret_in_external_kms\u003e` such as `Barbican"},{"line_number":93,"context_line":"\u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_."}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_208cf134","line":90,"range":{"start_line":90,"start_character":60,"end_line":90,"end_character":63},"updated":"2016-11-30 06:06:31.000000000","message":"Should be \"or\"","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":87,"context_line":"should be consistent across all proxy servers. The minimum length of 44 has"},{"line_number":88,"context_line":"been chosen because it is the length of a base-64 encoded 32 byte value."},{"line_number":89,"context_line":"Alternatives to specifying the encryption root secret directly in the"},{"line_number":90,"context_line":"`proxy-server.conf` file are storing it in a separate file, and storing it in"},{"line_number":91,"context_line":"an :ref:`external key management system"},{"line_number":92,"context_line":"\u003cencryption_root_secret_in_external_kms\u003e` such as `Barbican"},{"line_number":93,"context_line":"\u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_."}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_99029f6e","line":90,"range":{"start_line":90,"start_character":60,"end_line":90,"end_character":63},"in_reply_to":"5a74a57a_208cf134","updated":"2016-11-30 13:53:31.000000000","message":"Fixed in next patch.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that the encryption root secret may in the backend of the"},{"line_number":138,"context_line":"key management system e.g., be stored in a hardware security module (HSM) for"},{"line_number":139,"context_line":"additional security."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"The encryption root secret shall be created and stored in the external key"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_8025c50b","line":138,"range":{"start_line":137,"start_character":53,"end_line":138,"end_character":42},"updated":"2016-11-30 06:06:31.000000000","message":"Remove this part of the sentence and add something like:\n\"stored in the key management system, may be backed by an\"","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that the encryption root secret may in the backend of the"},{"line_number":138,"context_line":"key management system e.g., be stored in a hardware security module (HSM) for"},{"line_number":139,"context_line":"additional security."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"The encryption root secret shall be created and stored in the external key"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_b96cbb37","line":138,"range":{"start_line":137,"start_character":53,"end_line":138,"end_character":42},"in_reply_to":"5a74a57a_8025c50b","updated":"2016-11-30 13:53:31.000000000","message":"Reworded in next patch.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":143,"context_line":"command can be user to store the currently configured encryption root secret"},{"line_number":144,"context_line":"from the `proxy-server.conf` file in Barbican::"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    openstack secret store --name swift_root_secret --payload \\"},{"line_number":147,"context_line":"    \u003cexisting_root_secret\u003e --secret-type opaque --payload-content-type \\"},{"line_number":148,"context_line":"    \"text/plain\" --algorithm aes --bit-length 256 --mode cbc"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_e01cb9c3","line":146,"updated":"2016-11-30 06:06:31.000000000","message":"Maybe we can add how this is done using \u0027curl\u0027 as seen\n\n1. http://developer.openstack.org/api-guide/key-manager/secrets.html\n2. http://developer.openstack.org/api-guide/key-manager/orders.html\n\nor add these as a side note. Orders can be used for generating a key so the user wont have to specify a root_secret.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":143,"context_line":"command can be user to store the currently configured encryption root secret"},{"line_number":144,"context_line":"from the `proxy-server.conf` file in Barbican::"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    openstack secret store --name swift_root_secret --payload \\"},{"line_number":147,"context_line":"    \u003cexisting_root_secret\u003e --secret-type opaque --payload-content-type \\"},{"line_number":148,"context_line":"    \"text/plain\" --algorithm aes --bit-length 256 --mode cbc"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_681c0778","line":146,"in_reply_to":"5a74a57a_e01cb9c3","updated":"2016-11-30 13:53:31.000000000","message":"The idea behind using the \u0027secret store\u0027 command and specifying the payload explicitly, is to be able to migrate from the original setup with the root secret in a config file, to having the same root secret stored in Barbican. Since there is not yet any support for re-keying, using an order to create a new, random symmetric key would result in all existing objects being unreadable.\n\nI added a pointer to [1] as a link.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Note that the credentials used to store the secret in Barbican shall be the"},{"line_number":151,"context_line":"same ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":152,"context_line":"configured in the `keymaster.conf` file."},{"line_number":153,"context_line":"Alternatively, a new, random encryption root secret can be generated by"},{"line_number":154,"context_line":"replacing ``\u003cexisting_root_secret\u003e`` in the previous command with"},{"line_number":155,"context_line":"``$(openssl rand -base64 32)``. Set the ``key_id`` value in the"},{"line_number":156,"context_line":"`keymaster.conf` file with the ``\u003ckey_id\u003e`` from the output of"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_20cb1120","line":153,"updated":"2016-11-30 06:06:31.000000000","message":"Instead of doing that why not use Orders. See comment above.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Note that the credentials used to store the secret in Barbican shall be the"},{"line_number":151,"context_line":"same ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":152,"context_line":"configured in the `keymaster.conf` file."},{"line_number":153,"context_line":"Alternatively, a new, random encryption root secret can be generated by"},{"line_number":154,"context_line":"replacing ``\u003cexisting_root_secret\u003e`` in the previous command with"},{"line_number":155,"context_line":"``$(openssl rand -base64 32)``. Set the ``key_id`` value in the"},{"line_number":156,"context_line":"`keymaster.conf` file with the ``\u003ckey_id\u003e`` from the output of"}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_2803ef10","line":153,"in_reply_to":"5a74a57a_20cb1120","updated":"2016-11-30 13:53:31.000000000","message":"I agree, for generating a new key, it definitely makes sense to use orders. I added an \"openstack secret order create\" example for this, and also added a pointer to the webpage explaining how to do the same using curl, as above.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":169,"context_line":"such as Barbican, are all functionally equivalent. In case reading the"},{"line_number":170,"context_line":"encryption root secret from the external key management system fails, the"},{"line_number":171,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":172,"context_line":"successfully, it is cached in the proxy server."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":175,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_a0d721be","line":172,"range":{"start_line":172,"start_character":20,"end_line":172,"end_character":26},"updated":"2016-11-30 06:06:31.000000000","message":"Just curious, for how long?","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":169,"context_line":"such as Barbican, are all functionally equivalent. In case reading the"},{"line_number":170,"context_line":"encryption root secret from the external key management system fails, the"},{"line_number":171,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":172,"context_line":"successfully, it is cached in the proxy server."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":175,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."}],"source_content_type":"text/x-rst","patch_set":15,"id":"5a74a57a_b324d4af","line":172,"range":{"start_line":172,"start_character":20,"end_line":172,"end_character":26},"in_reply_to":"5a74a57a_a0d721be","updated":"2016-11-30 13:53:31.000000000","message":"Currently, for as long as the proxy server is running. From a security point of view this is not optimal, but the focus of the current patch is to provide the same behavior as before, just having the root secret stored in Barbican instead of in a config file. Having a cache with expiring keys is future work.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":154,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."},{"line_number":155,"context_line":"Note that the credentials used to store the secret in Barbican shall be the"},{"line_number":156,"context_line":"same ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":157,"context_line":"configured in the `keymaster.conf` file."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Instead of using an existing root secret, Barbican can also be asked to"},{"line_number":160,"context_line":"generate a new root secret::"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a74a57a_697f8866","line":157,"range":{"start_line":155,"start_character":0,"end_line":157,"end_character":40},"updated":"2016-11-30 20:26:11.000000000","message":"This comment is a big help to someone trying to use this feature.  I\u0027d put it in a .. note: section","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":154,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."},{"line_number":155,"context_line":"Note that the credentials used to store the secret in Barbican shall be the"},{"line_number":156,"context_line":"same ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":157,"context_line":"configured in the `keymaster.conf` file."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Instead of using an existing root secret, Barbican can also be asked to"},{"line_number":160,"context_line":"generate a new root secret::"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5a74a57a_e901d807","line":157,"range":{"start_line":155,"start_character":0,"end_line":157,"end_character":40},"in_reply_to":"5a74a57a_697f8866","updated":"2016-11-30 21:18:52.000000000","message":"Done.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"},{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that an encryption root secret stored in a key management"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a6eadb0_b2c25c83","line":134,"range":{"start_line":131,"start_character":0,"end_line":134,"end_character":55},"updated":"2016-12-16 17:25:07.000000000","message":"This could be omitted maybe? as we already mention this in lines#89-93","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An alternative to storing the encryption root secret in a configuration file on"},{"line_number":133,"context_line":"the proxy server, is to store it in an external key management system, such as"},{"line_number":134,"context_line":"`Barbican \u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_. The benefits of using"},{"line_number":135,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":136,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":137,"context_line":"system, and the fact that an encryption root secret stored in a key management"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a6eadb0_6134f8dd","line":134,"range":{"start_line":131,"start_character":0,"end_line":134,"end_character":55},"in_reply_to":"1a6eadb0_b2c25c83","updated":"2016-12-20 15:44:28.000000000","message":"I removed this sentence.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"e0388fb088a8b5b26173e03811b1e58488fcb17a","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":".. _encryption_root_secret_in_external_kms:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The benefits of using"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_414b7987","line":129,"updated":"2017-01-04 09:21:15.000000000","message":"There is no mention of pipeline changes required in proxy-server.conf. I think they need to be updated in proxy-server.conf-sample and also in the docs.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":".. _encryption_root_secret_in_external_kms:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Encryption Root Secret in External Key Management System"},{"line_number":130,"context_line":"--------------------------------------------------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The benefits of using"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_5d3f2ad6","line":129,"in_reply_to":"ba5201f7_414b7987","updated":"2017-01-10 10:35:19.000000000","message":"Added relevant text to proxy-server.conf-sample and overview_encryption.rst in next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":133,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":134,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":135,"context_line":"system, and the fact that an encryption root secret stored in a key management"},{"line_number":136,"context_line":"system, may be backed by a hardware security module (HSM) for additional"},{"line_number":137,"context_line":"security."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_be332c61","line":136,"updated":"2017-01-05 17:14:15.000000000","message":"nit: remove \u0027,\u0027 after \u0027system\u0027","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":133,"context_line":"a dedicated system for storing the encryption root secret include the"},{"line_number":134,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":135,"context_line":"system, and the fact that an encryption root secret stored in a key management"},{"line_number":136,"context_line":"system, may be backed by a hardware security module (HSM) for additional"},{"line_number":137,"context_line":"security."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_8cb883e7","line":136,"in_reply_to":"ba5201f7_be332c61","updated":"2017-01-10 10:35:19.000000000","message":"Fixed.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":134,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":135,"context_line":"system, and the fact that an encryption root secret stored in a key management"},{"line_number":136,"context_line":"system, may be backed by a hardware security module (HSM) for additional"},{"line_number":137,"context_line":"security."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":140,"context_line":"management system before it can be used by the keymaster. It shall be stored"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_1e6d1831","line":137,"updated":"2017-01-05 17:14:15.000000000","message":"Another significant benefit is that this method removes the concerns noted above about storing the root secret on a disk that may also be used in the object ring.\n\ni.e. Assuming the external KMS is on separate hardware then the root secret is never stored on a disk in the swift cluster.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":134,"context_line":"auditing and access control infrastructure that are already in place in such a"},{"line_number":135,"context_line":"system, and the fact that an encryption root secret stored in a key management"},{"line_number":136,"context_line":"system, may be backed by a hardware security module (HSM) for additional"},{"line_number":137,"context_line":"security."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":140,"context_line":"management system before it can be used by the keymaster. It shall be stored"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_4c35bbf5","line":137,"in_reply_to":"ba5201f7_1e6d1831","updated":"2017-01-10 10:35:19.000000000","message":"Added a sentence on this.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":140,"context_line":"management system before it can be used by the keymaster. It shall be stored"},{"line_number":141,"context_line":"as a symmetric key, with content type \"application/octet-stream\", algorithm"},{"line_number":142,"context_line":"AES, and bit length 256. The following command can be user to store the"},{"line_number":143,"context_line":"currently configured encryption root secret from the `proxy-server.conf` file"},{"line_number":144,"context_line":"in Barbican::"},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_4367e84c","line":142,"updated":"2017-01-05 17:14:15.000000000","message":"(see comment at line 161 re clarity..) perhaps make this a new paragraph (from \"The following...\") and change \"encryption root secret\" here to \"``encryption_root_secret`` value\"","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":139,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":140,"context_line":"management system before it can be used by the keymaster. It shall be stored"},{"line_number":141,"context_line":"as a symmetric key, with content type \"application/octet-stream\", algorithm"},{"line_number":142,"context_line":"AES, and bit length 256. The following command can be user to store the"},{"line_number":143,"context_line":"currently configured encryption root secret from the `proxy-server.conf` file"},{"line_number":144,"context_line":"in Barbican::"},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_2f4ce975","line":142,"in_reply_to":"ba5201f7_4367e84c","updated":"2017-01-10 10:35:19.000000000","message":"Done.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    openstack secret store --name swift_root_secret \\"},{"line_number":147,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":148,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":149,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cexisting_root_secret\u003e"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":152,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_83855008","line":149,"updated":"2017-01-05 17:14:15.000000000","message":"ok. here, existing_root_secret is the base64 encoded string, same as would be in proxy-server.conf\n\nmaybe, for clarity, change to \u003cbase64_encoded_root_secret\u003e\n\nIt\u0027s not necessary that it was pre-existing, but it does need to be base64 encoded to work with this command.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    openstack secret store --name swift_root_secret \\"},{"line_number":147,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":148,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":149,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cexisting_root_secret\u003e"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":152,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_0f48055b","line":149,"in_reply_to":"ba5201f7_83855008","updated":"2017-01-10 10:35:19.000000000","message":"Fixed.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":158,"context_line":"    configured in the `keymaster.conf` file."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Instead of using an existing root secret, Barbican can also be asked to"},{"line_number":161,"context_line":"generate a new root secret::"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"    openstack secret order create --name swift_root_secret \\"},{"line_number":164,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" --algorithm aes \\"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_630a2c7b","line":161,"updated":"2017-01-05 17:14:15.000000000","message":"here the \"root secret\" generated is a 256bit value, not base64 encoded, so we need to be careful not to confuse the terminology. I think this is ok. Earlier in the document we very clearly state that the encryption_root_secret value is a base64 encoded string, but note that we always use the option name with underscores in that definition, whereas here we use just root secret.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":158,"context_line":"    configured in the `keymaster.conf` file."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Instead of using an existing root secret, Barbican can also be asked to"},{"line_number":161,"context_line":"generate a new root secret::"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"    openstack secret order create --name swift_root_secret \\"},{"line_number":164,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" --algorithm aes \\"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_ef6101d5","line":161,"in_reply_to":"ba5201f7_630a2c7b","updated":"2017-01-10 10:35:19.000000000","message":"Added \"256-bit\" to the text.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The order can then be retrieved using ``openstack order get``, and once the"},{"line_number":168,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":169,"context_line":"root secret. As for storing an existing secret, and order can also be created"},{"line_number":170,"context_line":"using"},{"line_number":171,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`_."},{"line_number":172,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_fe56945a","line":169,"updated":"2017-01-05 17:14:15.000000000","message":"s/and/an/","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The order can then be retrieved using ``openstack order get``, and once the"},{"line_number":168,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":169,"context_line":"root secret. As for storing an existing secret, and order can also be created"},{"line_number":170,"context_line":"using"},{"line_number":171,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`_."},{"line_number":172,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"ba5201f7_af953989","line":169,"in_reply_to":"ba5201f7_fe56945a","updated":"2017-01-10 10:35:19.000000000","message":"Fixed.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"To make use of an encryption root secret stored in an external KMS,"},{"line_number":142,"context_line":"replace the keymaster middleware with the kms_keymaster middleware in the"},{"line_number":143,"context_line":"proxy server WSGI pipeline, in the order shown in this example::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  \u003cother middleware\u003e kms_keymaster encryption proxy-logging proxy-server"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_ce4dc83b","line":143,"range":{"start_line":143,"start_character":18,"end_line":143,"end_character":26},"updated":"2017-04-12 12:44:33.000000000","message":"add \n\n  in `proxy-server.conf`","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"To make use of an encryption root secret stored in an external KMS,"},{"line_number":142,"context_line":"replace the keymaster middleware with the kms_keymaster middleware in the"},{"line_number":143,"context_line":"proxy server WSGI pipeline, in the order shown in this example::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  \u003cother middleware\u003e kms_keymaster encryption proxy-logging proxy-server"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_beea1c72","line":143,"range":{"start_line":143,"start_character":18,"end_line":143,"end_character":26},"in_reply_to":"bff0334d_ce4dc83b","updated":"2017-04-19 18:26:37.000000000","message":"Added.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":143,"context_line":"proxy server WSGI pipeline, in the order shown in this example::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  \u003cother middleware\u003e kms_keymaster encryption proxy-logging proxy-server"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"  [filter:kms_keymaster]"},{"line_number":148,"context_line":"  use \u003d egg:swift#kms_keymaster"},{"line_number":149,"context_line":"  keymaster_config_path \u003d file_with_kms_keymaster_config"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_4e42d810","line":146,"updated":"2017-04-12 12:44:33.000000000","message":"nit: insert a line here\n\n  and add a section to the same file::","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":143,"context_line":"proxy server WSGI pipeline, in the order shown in this example::"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  \u003cother middleware\u003e kms_keymaster encryption proxy-logging proxy-server"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"  [filter:kms_keymaster]"},{"line_number":148,"context_line":"  use \u003d egg:swift#kms_keymaster"},{"line_number":149,"context_line":"  keymaster_config_path \u003d file_with_kms_keymaster_config"}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_7e8934c8","line":146,"in_reply_to":"bff0334d_4e42d810","updated":"2017-04-19 18:26:37.000000000","message":"Added.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  [filter:kms_keymaster]"},{"line_number":148,"context_line":"  use \u003d egg:swift#kms_keymaster"},{"line_number":149,"context_line":"  keymaster_config_path \u003d file_with_kms_keymaster_config"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"See the `keymaster.conf-sample` file for further details on the middleware"},{"line_number":152,"context_line":"configuration options."},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_6e335c63","line":150,"updated":"2017-04-12 12:44:33.000000000","message":"it might be useful to include here a summary of what the keymaster conf content would be:\n\n  Create or edit \u0027file_with_kms_keymaster_config\u0027. An example of the content of this file is::\n\n  etc","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":147,"context_line":"  [filter:kms_keymaster]"},{"line_number":148,"context_line":"  use \u003d egg:swift#kms_keymaster"},{"line_number":149,"context_line":"  keymaster_config_path \u003d file_with_kms_keymaster_config"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"See the `keymaster.conf-sample` file for further details on the middleware"},{"line_number":152,"context_line":"configuration options."},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_de34c8fd","line":150,"in_reply_to":"bff0334d_6e335c63","updated":"2017-04-19 18:26:37.000000000","message":"Added a line about creating or editing the file, and kept the text below that points to the sample file, rather than duplicating the content in this overview file.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":155,"context_line":"management system before it can be used by the keymaster. It shall be stored"},{"line_number":156,"context_line":"as a symmetric key, with content type \"application/octet-stream\", algorithm"},{"line_number":157,"context_line":"AES, and bit length 256."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"The following command can be user to store the currently configured"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_4e71b8a7","line":156,"updated":"2017-04-12 12:44:33.000000000","message":"nit use double backticks `` instead of double quote around application/octet-stream","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The encryption root secret shall be created and stored in the external key"},{"line_number":155,"context_line":"management system before it can be used by the keymaster. It shall be stored"},{"line_number":156,"context_line":"as a symmetric key, with content type \"application/octet-stream\", algorithm"},{"line_number":157,"context_line":"AES, and bit length 256."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"The following command can be user to store the currently configured"}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_1e2a308f","line":156,"in_reply_to":"bff0334d_4e71b8a7","updated":"2017-04-19 18:26:37.000000000","message":"Fixed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    openstack secret store --name swift_root_secret \\"},{"line_number":164,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":165,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":166,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cbase64_encoded_root_secret\u003e"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":169,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_2e6f942b","line":166,"updated":"2017-04-12 12:44:33.000000000","message":"does the mode need to be called out inthe preceding paragraph similar to type and algorithm?","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    openstack secret store --name swift_root_secret \\"},{"line_number":164,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":165,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":166,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cbase64_encoded_root_secret\u003e"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":169,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_3922a601","line":166,"in_reply_to":"bff0334d_2e6f942b","updated":"2017-04-19 18:26:37.000000000","message":"Clarified that some options are required (the content type, content encoding (for store), or bit length (for create)), whereas the other options (mode, algorithm) are currently for informational purposes only.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":".. note::"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"    The credentials used to store the secret in Barbican shall be the same"},{"line_number":174,"context_line":"    ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":175,"context_line":"    configured in the `keymaster.conf` file."},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_ae64c44a","line":173,"range":{"start_line":173,"start_character":4,"end_line":173,"end_character":25},"updated":"2017-04-12 12:44:33.000000000","message":"+1\n\nbut we should probably mention that the openstack command example shown above is missing the credentials options, or assumes them to be in env vars","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":170,"context_line":""},{"line_number":171,"context_line":".. note::"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"    The credentials used to store the secret in Barbican shall be the same"},{"line_number":174,"context_line":"    ones that the proxy server uses to retrieve the secret, i.e., the ones"},{"line_number":175,"context_line":"    configured in the `keymaster.conf` file."},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_99441a1d","line":173,"range":{"start_line":173,"start_character":4,"end_line":173,"end_character":25},"in_reply_to":"bff0334d_ae64c44a","updated":"2017-04-19 18:26:37.000000000","message":"Added suggested text.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The order can then be retrieved using ``openstack order get``, and once the"},{"line_number":185,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":186,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":187,"context_line":"using"},{"line_number":188,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`_."},{"line_number":189,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_8ecc6035","line":186,"updated":"2017-04-12 12:44:33.000000000","message":"I got confused by using order and erroneously taking the id of the order to be the id of the secret. Can we *stress* that the key_id must be retrieved with an order get?","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"The order can then be retrieved using ``openstack order get``, and once the"},{"line_number":185,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":186,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":187,"context_line":"using"},{"line_number":188,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`_."},{"line_number":189,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_b96d9605","line":186,"in_reply_to":"bff0334d_8ecc6035","updated":"2017-04-19 18:26:37.000000000","message":"Added a note stressing this.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":201,"context_line":"such as Barbican, are all functionally equivalent. In case reading the"},{"line_number":202,"context_line":"encryption root secret from the external key management system fails, the"},{"line_number":203,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":204,"context_line":"successfully, it is cached in the proxy server."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":207,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_8e890076","line":204,"updated":"2017-04-12 12:44:33.000000000","message":"s/cached/cached in memory/","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":201,"context_line":"such as Barbican, are all functionally equivalent. In case reading the"},{"line_number":202,"context_line":"encryption root secret from the external key management system fails, the"},{"line_number":203,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":204,"context_line":"successfully, it is cached in the proxy server."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":207,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_99709ade","line":204,"in_reply_to":"bff0334d_8e890076","updated":"2017-04-19 18:26:37.000000000","message":"Changed as suggested.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":203,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":204,"context_line":"successfully, it is cached in the proxy server."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":207,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Upgrade Considerations"}],"source_content_type":"text/x-rst","patch_set":24,"id":"bff0334d_0e017038","line":206,"range":{"start_line":206,"start_character":54,"end_line":206,"end_character":79},"updated":"2017-04-12 12:44:33.000000000","message":"or \u0027the [filter:kms_keymaster] section\u0027","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":203,"context_line":"proxy server will not start up. If the encryption root secret is retrieved"},{"line_number":204,"context_line":"successfully, it is cached in the proxy server."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"For further details on the configuration options, see ``keymaster_config_path``"},{"line_number":207,"context_line":"in the `proxy-server.conf-sample` file, and the `keymaster.conf-sample` file."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Upgrade Considerations"}],"source_content_type":"text/x-rst","patch_set":24,"id":"7ffa3b31_7925cec1","line":206,"range":{"start_line":206,"start_character":54,"end_line":206,"end_character":79},"in_reply_to":"bff0334d_0e017038","updated":"2017-04-19 18:26:37.000000000","message":"Fixed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4fc20afb1bf142e9532639653c0681df4296b5a2","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  cryptography\u003e\u003d1.6,!\u003d1.3.0               # BSD/Apache-2.0"},{"line_number":147,"context_line":"  castellan\u003e\u003d0.6.0"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"To make use of an encryption root secret stored in an external KMS,"},{"line_number":150,"context_line":"replace the keymaster middleware with the kms_keymaster middleware in the"},{"line_number":151,"context_line":"proxy server WSGI pipeline in `proxy-server.conf`, in the order shown in this"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_a6e7c412","line":148,"updated":"2017-07-04 00:40:54.000000000","message":"oslo_config is needed too, then","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"30b64708bde77d1d3e0e343fa4a69b56d670907e","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  cryptography\u003e\u003d1.6,!\u003d1.3.0               # BSD/Apache-2.0"},{"line_number":147,"context_line":"  castellan\u003e\u003d0.6.0"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"To make use of an encryption root secret stored in an external KMS,"},{"line_number":150,"context_line":"replace the keymaster middleware with the kms_keymaster middleware in the"},{"line_number":151,"context_line":"proxy server WSGI pipeline in `proxy-server.conf`, in the order shown in this"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_ee0d0336","line":148,"in_reply_to":"3f1d235d_a6e7c412","updated":"2017-07-07 15:01:25.000000000","message":"Yes, this is true. However, by requiring users to manually make the above changes regarding crypto and castellan, the need for oslo_config can be restricted to only those who want to retrieve the root encryption secret from Barbican.","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4fc20afb1bf142e9532639653c0681df4296b5a2","unresolved":false,"context_lines":[{"line_number":177,"context_line":"``base64`` content encoding. The algorithm ``AES``, bit length ``256``, mode"},{"line_number":178,"context_line":"``ctr``, and secret type ``symmetric`` may also be stored for informational"},{"line_number":179,"context_line":"purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"},{"line_number":183,"context_line":"in Barbican::"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_06931851","line":180,"updated":"2017-07-04 00:40:54.000000000","message":"AES and length are checked, see kms_keymaster.py in this patch","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"30b64708bde77d1d3e0e343fa4a69b56d670907e","unresolved":false,"context_lines":[{"line_number":177,"context_line":"``base64`` content encoding. The algorithm ``AES``, bit length ``256``, mode"},{"line_number":178,"context_line":"``ctr``, and secret type ``symmetric`` may also be stored for informational"},{"line_number":179,"context_line":"purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"},{"line_number":183,"context_line":"in Barbican::"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_63e0eccd","line":180,"in_reply_to":"3f1d235d_06931851","updated":"2017-07-07 15:01:25.000000000","message":"Changed the text to match the latest implementation.","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4fc20afb1bf142e9532639653c0681df4296b5a2","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"The ``order create`` creates an asynchronous request to create the actual"},{"line_number":210,"context_line":"secret."},{"line_number":211,"context_line":"The order can be retrieved using ``openstack order get``, and once the"},{"line_number":212,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":213,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":214,"context_line":"using"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_7bca656d","line":211,"updated":"2017-07-04 00:40:54.000000000","message":"openstack secret order get","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"30b64708bde77d1d3e0e343fa4a69b56d670907e","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"The ``order create`` creates an asynchronous request to create the actual"},{"line_number":210,"context_line":"secret."},{"line_number":211,"context_line":"The order can be retrieved using ``openstack order get``, and once the"},{"line_number":212,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":213,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":214,"context_line":"using"}],"source_content_type":"text/x-rst","patch_set":26,"id":"3f1d235d_03cff857","line":211,"in_reply_to":"3f1d235d_7bca656d","updated":"2017-07-07 15:01:25.000000000","message":"Fixed.","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":90,"context_line":"`proxy-server.conf` file are storing it in a separate file, or storing it in"},{"line_number":91,"context_line":"an :ref:`external key management system"},{"line_number":92,"context_line":"\u003cencryption_root_secret_in_external_kms\u003e` such as `Barbican"},{"line_number":93,"context_line":"\u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":".. note::"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_7a13db67","line":93,"updated":"2017-07-20 22:46:43.000000000","message":"IMO, I\u0027d link it to the official docs rather than the wiki: https://docs.openstack.org/barbican\n\nbut this is just a nit and should not be fixed now unless a new patchset is definetely needed, this can be fixed separately....","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":90,"context_line":"`proxy-server.conf` file are storing it in a separate file, or storing it in"},{"line_number":91,"context_line":"an :ref:`external key management system"},{"line_number":92,"context_line":"\u003cencryption_root_secret_in_external_kms\u003e` such as `Barbican"},{"line_number":93,"context_line":"\u003chttps://wiki.openstack.org/wiki/Barbican\u003e`_."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":".. note::"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_02d7d64d","line":93,"in_reply_to":"1f1a1f67_7a13db67","updated":"2017-07-24 19:14:04.000000000","message":"Fixed!","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":138,"context_line":"an external KMS is that it is in this case never stored on a disk in the Swift"},{"line_number":139,"context_line":"cluster."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Make sure the required dependencies are installed for retrieving an encryption"},{"line_number":142,"context_line":"root secret from an external KMS. This can be done by e.g., making sure the"},{"line_number":143,"context_line":"following lines exist in the requirements.txt file, and installing them using"},{"line_number":144,"context_line":"pip::"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  cryptography\u003e\u003d1.6,!\u003d1.3.0               # BSD/Apache-2.0"},{"line_number":147,"context_line":"  castellan\u003e\u003d0.6.0"}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_0b7a5187","line":144,"range":{"start_line":141,"start_character":0,"end_line":144,"end_character":5},"updated":"2017-07-20 22:46:43.000000000","message":"nice, I had forgotten about this note here. during community meeting we talked about adding to setup.cfg similarly to python-swiftclient. That seemed like a good idea worth investigating....","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":138,"context_line":"an external KMS is that it is in this case never stored on a disk in the Swift"},{"line_number":139,"context_line":"cluster."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Make sure the required dependencies are installed for retrieving an encryption"},{"line_number":142,"context_line":"root secret from an external KMS. This can be done by e.g., making sure the"},{"line_number":143,"context_line":"following lines exist in the requirements.txt file, and installing them using"},{"line_number":144,"context_line":"pip::"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  cryptography\u003e\u003d1.6,!\u003d1.3.0               # BSD/Apache-2.0"},{"line_number":147,"context_line":"  castellan\u003e\u003d0.6.0"}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_361fae6d","line":144,"range":{"start_line":141,"start_character":0,"end_line":144,"end_character":5},"in_reply_to":"1f1a1f67_0b7a5187","updated":"2017-07-24 19:14:04.000000000","message":"Added an [extras] section to setup.cfg and the related documentation in overview-encryption.rst.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":176,"context_line":"as a symmetric key, with content type ``application/octet-stream``,"},{"line_number":177,"context_line":"``base64`` content encoding, ``AES`` algorithm, and bit length ``256``. The"},{"line_number":178,"context_line":"mode ``ctr``, and secret type ``symmetric`` may also be stored for"},{"line_number":179,"context_line":"informational purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_0b88116f","line":179,"range":{"start_line":179,"start_character":26,"end_line":179,"end_character":72},"updated":"2017-07-20 22:46:43.000000000","message":"I actually got an error when trying to start proxy because I had forgotten to set my key as symmetric, has this check changed?","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":176,"context_line":"as a symmetric key, with content type ``application/octet-stream``,"},{"line_number":177,"context_line":"``base64`` content encoding, ``AES`` algorithm, and bit length ``256``. The"},{"line_number":178,"context_line":"mode ``ctr``, and secret type ``symmetric`` may also be stored for"},{"line_number":179,"context_line":"informational purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_bdf70ff6","line":179,"range":{"start_line":179,"start_character":26,"end_line":179,"end_character":72},"in_reply_to":"1f1a1f67_0b88116f","updated":"2017-07-24 19:14:04.000000000","message":"The check changed, changing documentation to match.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":178,"context_line":"mode ``ctr``, and secret type ``symmetric`` may also be stored for"},{"line_number":179,"context_line":"informational purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"},{"line_number":183,"context_line":"in Barbican::"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_0b9ff1b4","line":181,"range":{"start_line":181,"start_character":29,"end_line":181,"end_character":33},"updated":"2017-07-20 22:46:43.000000000","message":"used","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":178,"context_line":"mode ``ctr``, and secret type ``symmetric`` may also be stored for"},{"line_number":179,"context_line":"informational purposes - they are not currently checked by the keymaster."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following command can be user to store the currently configured"},{"line_number":182,"context_line":"``encryption_root_secret`` value from the `proxy-server.conf` file"},{"line_number":183,"context_line":"in Barbican::"},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_62ac628c","line":181,"range":{"start_line":181,"start_character":29,"end_line":181,"end_character":33},"in_reply_to":"1f1a1f67_0b9ff1b4","updated":"2017-07-24 19:14:04.000000000","message":"Fixed!","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":186,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":187,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":188,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cbase64_encoded_root_secret\u003e"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":191,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`__."},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_6b90a596","line":189,"updated":"2017-07-20 22:46:43.000000000","message":"nice, this provides instructions on how users could upgrade.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":186,"context_line":"    --payload-content-type\u003d\"application/octet-stream\" \\"},{"line_number":187,"context_line":"    --payload-content-encoding\u003d\"base64\" --algorithm aes --bit-length 256 \\"},{"line_number":188,"context_line":"    --mode ctr --secret-type symmetric --payload \u003cbase64_encoded_root_secret\u003e"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Alternatively, the existing root secret can also be stored in Barbican using"},{"line_number":191,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/secrets.html\u003e`__."},{"line_number":192,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_f8dc8219","line":189,"in_reply_to":"1f1a1f67_6b90a596","updated":"2017-07-24 19:14:04.000000000","message":"Yup!","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":210,"context_line":"secret."},{"line_number":211,"context_line":"The order can be retrieved using ``openstack secret order get``, and once the"},{"line_number":212,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":213,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":214,"context_line":"using"},{"line_number":215,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`__."},{"line_number":216,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":28,"id":"1f1a1f67_cbcfb9ae","line":213,"range":{"start_line":213,"start_character":13,"end_line":213,"end_character":46},"updated":"2017-07-20 22:46:43.000000000","message":"didn\u0027t you provide the instructions above on how to store an existing secret? This sentence confused me a bit. I thought \u0027secret order\u0027 was only used when barbican creates the key for you...","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":210,"context_line":"secret."},{"line_number":211,"context_line":"The order can be retrieved using ``openstack secret order get``, and once the"},{"line_number":212,"context_line":"order completes successfully, the output will show the key id of the generated"},{"line_number":213,"context_line":"root secret. As for storing an existing secret, an order can also be created"},{"line_number":214,"context_line":"using"},{"line_number":215,"context_line":"`curl \u003chttp://developer.openstack.org/api-guide/key-manager/orders.html\u003e`__."},{"line_number":216,"context_line":"Keys currently stored in Barbican can be listed using the"}],"source_content_type":"text/x-rst","patch_set":28,"id":"ff346bd7_02e236d6","line":213,"range":{"start_line":213,"start_character":13,"end_line":213,"end_character":46},"in_reply_to":"1f1a1f67_cbcfb9ae","updated":"2017-07-24 19:14:04.000000000","message":"Good catch! Removing this sentence since it is indeed confusing.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"}],"etc/keymaster.conf-sample":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":24,"context_line":"# The external_kms_type defines the type of external KMS that is used, which"},{"line_number":25,"context_line":"# further defines the required configuration options. Currently, the only valid"},{"line_number":26,"context_line":"# value for external_kms_type is barbican."},{"line_number":27,"context_line":"external_kms_type \u003d barbican"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"[barbican]"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_b9b90bec","line":27,"updated":"2016-10-05 09:03:22.000000000","message":"I\u0027m not sure why we need this extra level of indirection, vs. having keymaster_config_type \u003d barbican at line 20?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":24,"context_line":"# The external_kms_type defines the type of external KMS that is used, which"},{"line_number":25,"context_line":"# further defines the required configuration options. Currently, the only valid"},{"line_number":26,"context_line":"# value for external_kms_type is barbican."},{"line_number":27,"context_line":"external_kms_type \u003d barbican"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"[barbican]"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_14b1dc8f","line":27,"in_reply_to":"1a95cdbc_b9b90bec","updated":"2016-10-05 22:14:44.000000000","message":"I\u0027m trying to rework the whole configuration and will get back to you once that proposal is ready to be discussed. I agree that the current version here is sub-optimal, especially for possible future features.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":37,"context_line":"#     --mode cbc"},{"line_number":38,"context_line":"# When using the v2 Identity API, the barbican_key_id shall contain both the"},{"line_number":39,"context_line":"# barbican endpoint URL, as well as the actual key ID. When the v3 Identity"},{"line_number":40,"context_line":"# API is used, the barbican_key_id shall consist of only the key ID."},{"line_number":41,"context_line":"# barbican_key_id \u003d http://192.168.50.11:9311/v1/secrets/0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":42,"context_line":"barbican_key_id \u003d 0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":43,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_f5e658e7","line":40,"updated":"2016-10-05 09:03:22.000000000","message":"somehow this comment needs to be clearer that the key_id shown in the example must be changed to whatever the user has generated. It may not be a good idea to have the string \"0cf2ae34-337b-47d2-9ce2-026022dc40cc\" in the example.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":37,"context_line":"#     --mode cbc"},{"line_number":38,"context_line":"# When using the v2 Identity API, the barbican_key_id shall contain both the"},{"line_number":39,"context_line":"# barbican endpoint URL, as well as the actual key ID. When the v3 Identity"},{"line_number":40,"context_line":"# API is used, the barbican_key_id shall consist of only the key ID."},{"line_number":41,"context_line":"# barbican_key_id \u003d http://192.168.50.11:9311/v1/secrets/0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":42,"context_line":"barbican_key_id \u003d 0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":43,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_37e5fa08","line":40,"in_reply_to":"1a95cdbc_f5e658e7","updated":"2016-10-05 22:14:44.000000000","message":"Fixed in next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":38,"context_line":"# When using the v2 Identity API, the barbican_key_id shall contain both the"},{"line_number":39,"context_line":"# barbican endpoint URL, as well as the actual key ID. When the v3 Identity"},{"line_number":40,"context_line":"# API is used, the barbican_key_id shall consist of only the key ID."},{"line_number":41,"context_line":"# barbican_key_id \u003d http://192.168.50.11:9311/v1/secrets/0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":42,"context_line":"barbican_key_id \u003d 0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"# The username of the user used to access the key from Barbican. Shall match"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_55654cdf","line":41,"updated":"2016-10-05 09:03:22.000000000","message":"two questions:\n\n1. why is the url needed? this is the key_id that is passed to barbican, so what difference does the keystone api version make? both keystone API versions should return a catalog with the barbican endpoint, correct?\n\n2. do we need to document support for v2 API which is deprecated? we do not do that for authtoken middleware in proxy-server.conf-sample","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"# When using the v2 Identity API, the barbican_key_id shall contain both the"},{"line_number":39,"context_line":"# barbican endpoint URL, as well as the actual key ID. When the v3 Identity"},{"line_number":40,"context_line":"# API is used, the barbican_key_id shall consist of only the key ID."},{"line_number":41,"context_line":"# barbican_key_id \u003d http://192.168.50.11:9311/v1/secrets/0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":42,"context_line":"barbican_key_id \u003d 0cf2ae34-337b-47d2-9ce2-026022dc40cc"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"# The username of the user used to access the key from Barbican. Shall match"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_baee4f20","line":41,"in_reply_to":"1a95cdbc_55654cdf","updated":"2016-10-05 22:14:44.000000000","message":"1. When using barbicanclient directly and the v2 Identity API, I used the version with the url. Maybe it would have worked without it also. Anyway, I removed v2 API support now, so the url is also removed.\n2. I had an implementation using the v2 API, but after realizing that it is deprecated, I removed the code. There are still some mentions in the documentation and comments, which I will remove.\n\nI had quite some issues getting the v3 API to work. I tried both barbicanclient directly and castellan, and in the end the configuration matches what I had. It is possible that things can still be improved/simplified wrt. the configuration.\n\nI removed the url from the barbican_key_id example in patch 7.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"# the URL contains \"v2\", the v2.0 API is used; if the URL contains"},{"line_number":61,"context_line":"# \"v3\", the v3 API is used."},{"line_number":62,"context_line":"# barbican_auth_url \u003d http://keystonehost:5000/v2.0"},{"line_number":63,"context_line":"barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":66,"context_line":"# optionally be specified. If they are not specified, the default values of"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_f540180a","line":63,"range":{"start_line":63,"start_character":9,"end_line":63,"end_character":44},"updated":"2016-10-05 09:03:22.000000000","message":"in proxy-server.conf-sample authtoken section we only need the base url:\n\n  auth_url \u003d http://keystonehost:5000\n\ncan\u0027t we do the same here and have the keystone client do the api version discovery? (I don\u0027t know if it can, but that would be much better if possible)","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":60,"context_line":"# the URL contains \"v2\", the v2.0 API is used; if the URL contains"},{"line_number":61,"context_line":"# \"v3\", the v3 API is used."},{"line_number":62,"context_line":"# barbican_auth_url \u003d http://keystonehost:5000/v2.0"},{"line_number":63,"context_line":"barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":66,"context_line":"# optionally be specified. If they are not specified, the default values of"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_fa2b772e","line":63,"range":{"start_line":63,"start_character":9,"end_line":63,"end_character":44},"in_reply_to":"1a95cdbc_f540180a","updated":"2016-10-05 22:14:44.000000000","message":"As I mentioned in my earlier comment, I was having trouble with the API versions. In particular, IIRC, when using Castellan and not specifying the version, one or more requests was still being sent using v2. I added a TODO in the next patch to track this.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":66,"context_line":"# optionally be specified. If they are not specified, the default values of"},{"line_number":67,"context_line":"# \"default\" are used for both."},{"line_number":68,"context_line":"barbican_project_domain_name \u003d default"},{"line_number":69,"context_line":"barbican_user_domain_name \u003d default"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"# When using the v3 Identity API, the barbican endpoint may optionally be"},{"line_number":72,"context_line":"# explicitly specified."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_f50e58e4","line":69,"updated":"2016-10-05 09:03:22.000000000","message":"this runs into same confusion as discussed for this bug:\n\nhttps://bugs.launchpad.net/swift/+bug/1604674","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":66,"context_line":"# optionally be specified. If they are not specified, the default values of"},{"line_number":67,"context_line":"# \"default\" are used for both."},{"line_number":68,"context_line":"barbican_project_domain_name \u003d default"},{"line_number":69,"context_line":"barbican_user_domain_name \u003d default"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"# When using the v3 Identity API, the barbican endpoint may optionally be"},{"line_number":72,"context_line":"# explicitly specified."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_a0046215","line":69,"in_reply_to":"1a95cdbc_f50e58e4","updated":"2016-10-05 22:14:44.000000000","message":"Added a TODO in next patch to track this.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"# When using the v3 Identity API, the barbican endpoint may optionally be"},{"line_number":72,"context_line":"# explicitly specified."},{"line_number":73,"context_line":"barbican_endpoint \u003d http://192.168.50.11:9311/v1"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# When using the v3 Identity API, the barbican API version may optionally be"},{"line_number":76,"context_line":"# explicitly specified."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_15e2e403","line":73,"updated":"2016-10-05 09:03:22.000000000","message":"why would a user want to do this, rather than use the keystone provided endpoints? is the extra complexity here necessary?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"# When using the v3 Identity API, the barbican endpoint may optionally be"},{"line_number":72,"context_line":"# explicitly specified."},{"line_number":73,"context_line":"barbican_endpoint \u003d http://192.168.50.11:9311/v1"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# When using the v3 Identity API, the barbican API version may optionally be"},{"line_number":76,"context_line":"# explicitly specified."}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_a009c297","line":73,"in_reply_to":"1a95cdbc_15e2e403","updated":"2016-10-05 22:14:44.000000000","message":"The Castellan API allows a user to specify this as a parameter, so I propagated it up all the way to the config file. It can certainly be omitted, in which case the keystone provided endpoints will be used. This configuration could possibly be useful in the future for some kind of client managed keys/key servers, so I would like to keep it in, since it is anyway just passed through to castellan and not touched by the keymaster code.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# When using the v3 Identity API, the barbican API version may optionally be"},{"line_number":76,"context_line":"# explicitly specified."},{"line_number":77,"context_line":"barbican_api_version \u003d v1"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"# Below is a complete Barbican configuration example for use with the v3"},{"line_number":80,"context_line":"# Identity API:"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_95c5145d","line":77,"updated":"2016-10-05 09:03:22.000000000","message":"as above, why would a user do this?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"# When using the v3 Identity API, the barbican API version may optionally be"},{"line_number":76,"context_line":"# explicitly specified."},{"line_number":77,"context_line":"barbican_api_version \u003d v1"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"# Below is a complete Barbican configuration example for use with the v3"},{"line_number":80,"context_line":"# Identity API:"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a95cdbc_404abec6","line":77,"in_reply_to":"1a95cdbc_95c5145d","updated":"2016-10-05 22:14:44.000000000","message":"Same as above (Castellan allows it to be specified), but for this I don\u0027t have an answer on why the user would do this.\n\nI removed these optional parameters from the example at the end of this file for the next patch.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"554de7427dc48eed73ead19b89f9ecbb7e6a1570","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# The barbican_api_class tells Castellan which key manager to use to access the"},{"line_number":23,"context_line":"# external key management system. The default value that accesses a Barbican"},{"line_number":24,"context_line":"# KMS is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"barbican_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a629dbe_1309bb31","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":82},"updated":"2016-11-09 09:24:13.000000000","message":"There was a question at the design summit regarding where the code using Castellan becomes Barbican-specific/how Castellan is configured to talk to a Barbican backend: It is through the api_class value. The default key manager API class is the BarbicanKeyManager, and it can also be explicitly configured like this here.","commit_id":"ee8918e7c16edf2196985ac76c518bbc0be9d7f5"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":38,"context_line":"# When the v3 Identity API is used, the barbican_key_id shall consist of only"},{"line_number":39,"context_line":"# the key ID returned from the above \"openstack secret store\" command, without"},{"line_number":40,"context_line":"# the Barbican endpoint URL."},{"line_number":41,"context_line":"barbican_key_id \u003d key_id"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":44,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":15,"id":"5a74a57a_80af852a","line":41,"updated":"2016-11-30 06:06:31.000000000","message":"Should be \u003ckey_id\u003e. Defaults should be specified. Like [Default None]","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":38,"context_line":"# When the v3 Identity API is used, the barbican_key_id shall consist of only"},{"line_number":39,"context_line":"# the key ID returned from the above \"openstack secret store\" command, without"},{"line_number":40,"context_line":"# the Barbican endpoint URL."},{"line_number":41,"context_line":"barbican_key_id \u003d key_id"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":44,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":15,"id":"5a74a57a_9357d8c9","line":41,"in_reply_to":"5a74a57a_80af852a","updated":"2016-11-30 13:53:31.000000000","message":"I changed key_id to \u003ckey_id\u003e. I didn\u0027t add defaults, since I couldn\u0027t see any default in any of the other conf sample files. Are these oslo_config defaults? Swift doesn\u0027t use oslo_config, which might explain the lack of defaults.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":71,"context_line":"# barbican_user_domain_id \u003d default"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"# The barbican endpoint may optionally be explicitly specified."},{"line_number":74,"context_line":"barbican_endpoint \u003d http://barbicanhost:9311/v1"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"# The barbican API version may optionally be explicitly specified."},{"line_number":77,"context_line":"barbican_api_version \u003d v1"}],"source_content_type":"application/octet-stream","patch_set":15,"id":"5a74a57a_009455e6","line":74,"range":{"start_line":74,"start_character":44,"end_line":74,"end_character":47},"updated":"2016-11-30 06:06:31.000000000","message":"We shouldn\u0027t have to specify this since it asks for it below.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":71,"context_line":"# barbican_user_domain_id \u003d default"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"# The barbican endpoint may optionally be explicitly specified."},{"line_number":74,"context_line":"barbican_endpoint \u003d http://barbicanhost:9311/v1"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"# The barbican API version may optionally be explicitly specified."},{"line_number":77,"context_line":"barbican_api_version \u003d v1"}],"source_content_type":"application/octet-stream","patch_set":15,"id":"5a74a57a_530460c5","line":74,"range":{"start_line":74,"start_character":44,"end_line":74,"end_character":47},"in_reply_to":"5a74a57a_009455e6","updated":"2016-11-30 13:53:31.000000000","message":"Removed the v1.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# The barbican_api_class tells Castellan which key manager to use to access the"},{"line_number":23,"context_line":"# external key management system. The default value that accesses a Barbican"},{"line_number":24,"context_line":"# KMS is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"barbican_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":16,"id":"5a74a57a_e6a8277a","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":8},"updated":"2016-11-30 20:26:11.000000000","message":"key_manager_api_class ?","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# The barbican_api_class tells Castellan which key manager to use to access the"},{"line_number":23,"context_line":"# external key management system. The default value that accesses a Barbican"},{"line_number":24,"context_line":"# KMS is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"barbican_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":16,"id":"5a74a57a_9c3504dd","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":8},"in_reply_to":"5a74a57a_e6a8277a","updated":"2016-11-30 21:18:52.000000000","message":"Fixed.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"# The key_manager_api_class tells Castellan which key manager to use to access the"},{"line_number":23,"context_line":"# external key management system. The default value that accesses a Barbican"},{"line_number":24,"context_line":"# KMS is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"key_manager_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_4c25f159","line":24,"updated":"2016-12-16 17:25:07.000000000","message":"a question for my understanding: which other kms can castellan support at this point, other than barbican?","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"# The key_manager_api_class tells Castellan which key manager to use to access the"},{"line_number":23,"context_line":"# external key management system. The default value that accesses a Barbican"},{"line_number":24,"context_line":"# KMS is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"key_manager_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_e15728c8","line":24,"in_reply_to":"1a6eadb0_4c25f159","updated":"2016-12-20 15:44:28.000000000","message":"Currently only Barbican, but since Castellan is designed in a way that support for other backends may be added later (either by the Castellan developers, or as a user-created plugin), it makes sense for us to be as generic as possible. From a Swift point of view, where the root encryption secret is stored does not really matter from a technical point of view, as long as we can access it using Castellan.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":33,"context_line":"# generate a new root secret in Barbican, see the \u0027overview_encryption\u0027"},{"line_number":34,"context_line":"# documentation."},{"line_number":35,"context_line":"# When the v3 Identity API is used, the barbican_key_id shall consist of only"},{"line_number":36,"context_line":"# the key ID returned from the above \"openstack secret store\" command, without"},{"line_number":37,"context_line":"# the Barbican endpoint URL."},{"line_number":38,"context_line":"barbican_key_id \u003d \u003ckey_id\u003e"},{"line_number":39,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_aca12596","line":36,"updated":"2016-12-16 17:25:07.000000000","message":"nit:s/from the above \"openstack..\"/from an \"openstack..\" and maybe add \"refer to overview_encryption doc for more info on this command\"?","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":33,"context_line":"# generate a new root secret in Barbican, see the \u0027overview_encryption\u0027"},{"line_number":34,"context_line":"# documentation."},{"line_number":35,"context_line":"# When the v3 Identity API is used, the barbican_key_id shall consist of only"},{"line_number":36,"context_line":"# the key ID returned from the above \"openstack secret store\" command, without"},{"line_number":37,"context_line":"# the Barbican endpoint URL."},{"line_number":38,"context_line":"barbican_key_id \u003d \u003ckey_id\u003e"},{"line_number":39,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_a10450c6","line":36,"in_reply_to":"1a6eadb0_aca12596","updated":"2016-12-20 15:44:28.000000000","message":"Fixed as suggested.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":54,"context_line":"# set according to the value of auth_uri in [filter:authtoken] in"},{"line_number":55,"context_line":"# proxy-server.conf. To use the v3 Identity API, the url shall end in \"/v3\"."},{"line_number":56,"context_line":"# TODO: Check if \"/v3\" can be omitted with latest (castellan) code."},{"line_number":57,"context_line":"barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":60,"context_line":"# optionally be specified. If they are not specified, the default values of"}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_ccfbc145","line":57,"updated":"2016-12-16 17:25:07.000000000","message":"I\u0027m a bit confused, all the values we use from line#38 are named \"barbican_something\", while in practice, all the values we\u0027re picking up are related to keystone. Shouldn\u0027t we instead be naming it \"keystone_username\" etc?","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":54,"context_line":"# set according to the value of auth_uri in [filter:authtoken] in"},{"line_number":55,"context_line":"# proxy-server.conf. To use the v3 Identity API, the url shall end in \"/v3\"."},{"line_number":56,"context_line":"# TODO: Check if \"/v3\" can be omitted with latest (castellan) code."},{"line_number":57,"context_line":"barbican_auth_url \u003d http://keystonehost:5000/v3"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":60,"context_line":"# optionally be specified. If they are not specified, the default values of"}],"source_content_type":"application/octet-stream","patch_set":17,"id":"1a6eadb0_e134884b","line":57,"in_reply_to":"1a6eadb0_ccfbc145","updated":"2016-12-20 15:44:28.000000000","message":"I don\u0027t want to name it \"keystone_username\" etc., since while it is a keystone username (in practice, with a Barbican backend), it could be another username in case another Castellan backend is used. Also, it shouldn\u0027t be confused with the keystone credentials used e.g., for authtoken, since we recommend using separate credentials for accessing the root encryption secret.\n\nI renamed \"barbican_username\" to \"kms_username\" (and similarly for most other parameters), but kept \"barbican\" for kms_barbican_endpoint and kms_barbican_api_version, since those values are specific to barbican.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":17,"context_line":"#                  proxy-server.conf file."},{"line_number":18,"context_line":"#   barbican     : The root secret is stored in an external Barbican key"},{"line_number":19,"context_line":"#                  management system (KMS), accessed using Castellan."},{"line_number":20,"context_line":"keymaster_config_type \u003d barbican"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"# The kms_key_manager_api_class tells Castellan which key manager to use to"},{"line_number":23,"context_line":"# access the external key management system. The default value that accesses"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_5caec9e6","line":20,"updated":"2017-01-05 17:14:15.000000000","message":"this should be kms I think?\n\noh, now I realise I am confused. Is this sample config for kms or barbican keymaster?\n\nI was expecting another config setion here \"[kms_keymaster]\" (i.e. an indirection). Back in version 6 we had two levels of indirection but I thought we would retain one.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":17,"context_line":"#                  proxy-server.conf file."},{"line_number":18,"context_line":"#   barbican     : The root secret is stored in an external Barbican key"},{"line_number":19,"context_line":"#                  management system (KMS), accessed using Castellan."},{"line_number":20,"context_line":"keymaster_config_type \u003d barbican"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"# The kms_key_manager_api_class tells Castellan which key manager to use to"},{"line_number":23,"context_line":"# access the external key management system. The default value that accesses"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_65ae22e9","line":20,"in_reply_to":"ba5201f7_5caec9e6","updated":"2017-01-10 10:35:19.000000000","message":"In the next patch, the [keymaster] section will be for the base KeyMaster class, whereas there will be another [kms_keymaster] section for the KmsKeyMaster class. They will both still be in the same section if the configuration is all in proxy-server.conf (which we will technically allow also for the KmsKeyMaster, but we will not recommend or document it).","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# The kms_key_manager_api_class tells Castellan which key manager to use to"},{"line_number":23,"context_line":"# access the external key management system. The default value that accesses"},{"line_number":24,"context_line":"# Barbican is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"kms_key_manager_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_dc7ab987","line":25,"updated":"2017-01-05 17:14:15.000000000","message":"If this is a default value used by castellan then the convention is to comment this line in the sample conf file. Experimentally I checked that does not need to be explicitly set.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# The kms_key_manager_api_class tells Castellan which key manager to use to"},{"line_number":23,"context_line":"# access the external key management system. The default value that accesses"},{"line_number":24,"context_line":"# Barbican is castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":25,"context_line":"kms_key_manager_api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_65daa2eb","line":25,"in_reply_to":"ba5201f7_dc7ab987","updated":"2017-01-10 10:35:19.000000000","message":"Commented out as suggested.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"},{"line_number":29,"context_line":"# kms_key_manager_api_class), then other configuration options may be required."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"# The kms_key_id is the identifier of the root secret stored in the KMS. For"},{"line_number":32,"context_line":"# details of how to store an existing root secret in Barbican, or how to"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_fc9cdd0f","line":29,"updated":"2017-01-05 17:14:15.000000000","message":"that sounds like the sample config could get very messy in the future, should we use sections to separate different config schemas? or even different files?","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":28,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"},{"line_number":29,"context_line":"# kms_key_manager_api_class), then other configuration options may be required."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"# The kms_key_id is the identifier of the root secret stored in the KMS. For"},{"line_number":32,"context_line":"# details of how to store an existing root secret in Barbican, or how to"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_655d4248","line":29,"in_reply_to":"ba5201f7_fc9cdd0f","updated":"2017-01-10 10:35:19.000000000","message":"I have a feeling that could be a bridge that we cross once we get there.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":36,"context_line":"# in Barbican, the kms_key_id shall consist of only the key ID returned from"},{"line_number":37,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":38,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":39,"context_line":"kms_key_id \u003d \u003ckey_id\u003e"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":42,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_5c53296b","line":39,"updated":"2017-01-05 17:14:15.000000000","message":"with reference to https://wiki.openstack.org/wiki/Swift/ideas/keymaster_v2 , do we want a level of indirection here? e.g.\n\n  kms_key_id \u003d \u003ccurrent_key_name\u003e\n  current_key_name \u003d \u003ckey_id\u003e\n\nso that a new key id can be deployed without losing the reference to the current key id:\n\n  kms_key_id \u003d \u003cnew key name\u003e\n  current_key_name \u003d \u003ckey_id\u003e\n  new_key_name \u003d \u003cnew_key_id\u003e","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":36,"context_line":"# in Barbican, the kms_key_id shall consist of only the key ID returned from"},{"line_number":37,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":38,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":39,"context_line":"kms_key_id \u003d \u003ckey_id\u003e"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":42,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_c59b4e71","line":39,"in_reply_to":"ba5201f7_5c53296b","updated":"2017-01-10 10:35:19.000000000","message":"At this point, we only support a single root encryption secret, be it stored in the config file or in barbican. IMHO we can defer adding the indirection until we add support for key rotation, which will be in a later patch. I don\u0027t think we\u0027ve ironed out how we would refer to different keys after we have multiple of them with key rotation.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":75,"context_line":"# explicitly specified."},{"line_number":76,"context_line":"kms_barbican_api_version \u003d v1"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"# Below is a complete configuration for retrieving a root encryption secret"},{"line_number":79,"context_line":"# from a Barbican KMS, with the optional parameters omitted:"},{"line_number":80,"context_line":"# keymaster_config_type \u003d barbican"},{"line_number":81,"context_line":"# kms_key_id \u003d key_id"}],"source_content_type":"application/octet-stream","patch_set":19,"id":"ba5201f7_9a2b23eb","line":78,"updated":"2017-01-03 18:01:52.000000000","message":"this seems to be redundant repetition in this file. Good to have the condensed example in the docs though.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":9,"context_line":"# NOT be set in proxy-server.conf."},{"line_number":10,"context_line":"# encryption_root_secret \u003d changeme"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[kms_keymaster]"},{"line_number":13,"context_line":"# The api_class tells Castellan which key manager to use to access the external"},{"line_number":14,"context_line":"# key management system. The default value that accesses Barbican is"},{"line_number":15,"context_line":"# castellan.key_manager.barbican_key_manager.BarbicanKeyManager."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_ae3044a0","line":12,"updated":"2017-04-12 12:44:33.000000000","message":"do we need some introdutory text to differentiate this section from the [keymaster] section?","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":9,"context_line":"# NOT be set in proxy-server.conf."},{"line_number":10,"context_line":"# encryption_root_secret \u003d changeme"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[kms_keymaster]"},{"line_number":13,"context_line":"# The api_class tells Castellan which key manager to use to access the external"},{"line_number":14,"context_line":"# key management system. The default value that accesses Barbican is"},{"line_number":15,"context_line":"# castellan.key_manager.barbican_key_manager.BarbicanKeyManager."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_94f61ff9","line":12,"in_reply_to":"bff0334d_ae3044a0","updated":"2017-04-19 18:26:37.000000000","message":"Added introductory text for the kms_keymaster section.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":23,"context_line":"# details of how to store an existing root secret in Barbican, or how to"},{"line_number":24,"context_line":"# generate a new root secret in Barbican, see the \u0027overview_encryption\u0027"},{"line_number":25,"context_line":"# documentation."},{"line_number":26,"context_line":"# When the v3 Identity API is used and the encryption root secret is stored"},{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_0b74c2cd","line":26,"updated":"2017-04-12 12:44:33.000000000","message":"I\u0027m not sure, what is the significance of specifying the v3 Identity API?","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":23,"context_line":"# details of how to store an existing root secret in Barbican, or how to"},{"line_number":24,"context_line":"# generate a new root secret in Barbican, see the \u0027overview_encryption\u0027"},{"line_number":25,"context_line":"# documentation."},{"line_number":26,"context_line":"# When the v3 Identity API is used and the encryption root secret is stored"},{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_747ef319","line":26,"in_reply_to":"bff0334d_0b74c2cd","updated":"2017-04-19 18:26:37.000000000","message":"Originally, the code supported both v2 and v3 Identity API versions (different code for each). In the meantime, the v2 API has been deprecated, and it is no longer supported by the code in this patch. I removed the mention of v3 here.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":25,"context_line":"# documentation."},{"line_number":26,"context_line":"# When the v3 Identity API is used and the encryption root secret is stored"},{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":30,"context_line":"key_id \u003d \u003ckey_id\u003e"},{"line_number":31,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_ce2ee88a","line":28,"updated":"2017-04-12 12:44:33.000000000","message":"openstack secret store returns a secret href, so more precisely:\n\n  the key_id is the final part of the secret href returned from an openstack secret store command\n\nstrictly, the endoint does not have the /secrets part, so its the href without the \u0027endpoint + /secrets/\u0027 :/ it\u0027s a shame secret store does not include the raw id in its output.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":25,"context_line":"# documentation."},{"line_number":26,"context_line":"# When the v3 Identity API is used and the encryption root secret is stored"},{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":30,"context_line":"key_id \u003d \u003ckey_id\u003e"},{"line_number":31,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_541d370d","line":28,"in_reply_to":"bff0334d_ce2ee88a","updated":"2017-04-19 18:26:37.000000000","message":"Modified the text along the lines of the suggestion.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":30,"context_line":"key_id \u003d \u003ckey_id\u003e"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":33,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_cb8b7abd","line":30,"updated":"2017-04-12 12:44:33.000000000","message":"s/\u003ckey_id/changeme/ for consistency with other values that the user must change and have no default","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":27,"context_line":"# in Barbican, the key_id shall consist of only the key ID returned from"},{"line_number":28,"context_line":"# an \"openstack secret store\" command, without the Barbican endpoint URL. See"},{"line_number":29,"context_line":"# the \u0027overview_encryption\u0027 documentation for more information on this command."},{"line_number":30,"context_line":"key_id \u003d \u003ckey_id\u003e"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":33,"context_line":"# username shall be set to match an existing user."}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_ce7c1385","line":30,"in_reply_to":"bff0334d_cb8b7abd","updated":"2017-04-19 18:26:37.000000000","message":"Changed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":33,"context_line":"# username shall be set to match an existing user."},{"line_number":34,"context_line":"username \u003d swift"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# The password to go with the Keystone username above."},{"line_number":37,"context_line":"password \u003d password"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_aea3a4b1","line":34,"updated":"2017-04-12 12:44:33.000000000","message":"I *think* we should comment out all these options so that if the sample is copied then no values are actually set.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The Keystone username of the user used to access the key from the KMS. The"},{"line_number":33,"context_line":"# username shall be set to match an existing user."},{"line_number":34,"context_line":"username \u003d swift"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"# The password to go with the Keystone username above."},{"line_number":37,"context_line":"password \u003d password"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_d4ca6718","line":34,"in_reply_to":"bff0334d_aea3a4b1","updated":"2017-04-19 18:26:37.000000000","message":"Done.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":37,"context_line":"password \u003d password"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"# The Keystone project name. It is recommended to set the project_name to a"},{"line_number":40,"context_line":"# project separate from the service project used by other OpenStack services."},{"line_number":41,"context_line":"project_name \u003d swift"},{"line_number":42,"context_line":"# Instead of the project name, the project id may also be used."},{"line_number":43,"context_line":"# project_id \u003d project_id"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_2e24345d","line":40,"updated":"2017-04-12 12:44:33.000000000","message":"be worth saying why, or rewording to emphasize the goal, which is that the project should be one for which only the swift user has a role.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":37,"context_line":"password \u003d password"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"# The Keystone project name. It is recommended to set the project_name to a"},{"line_number":40,"context_line":"# project separate from the service project used by other OpenStack services."},{"line_number":41,"context_line":"project_name \u003d swift"},{"line_number":42,"context_line":"# Instead of the project name, the project id may also be used."},{"line_number":43,"context_line":"# project_id \u003d project_id"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_0e455b43","line":40,"in_reply_to":"bff0334d_2e24345d","updated":"2017-04-19 18:26:37.000000000","message":"Added wording on the goal as suggested.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":50,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":51,"context_line":"# optionally be specified. If they are not specified, the default values of"},{"line_number":52,"context_line":"# \"default\" are used for both."},{"line_number":53,"context_line":"# TODO: See https://bugs.launchpad.net/swift/+bug/1604674"},{"line_number":54,"context_line":"project_domain_name \u003d default"},{"line_number":55,"context_line":"user_domain_name \u003d default"},{"line_number":56,"context_line":"# Instead of the project domain name and user domain name, the project domain"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_0bf7228d","line":53,"updated":"2017-04-12 12:44:33.000000000","message":"I just updated bug 1604674, and we have another related bug report now https://bugs.launchpad.net/swift/+bug/1682059\n\nSummary: we are likely to settle on *_domain_id\u003ddefault or *_domain_name\u003dDefault (note capitilisation) once those bugs and linked patches are resolved.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":50,"context_line":"# When using the v3 Identity API, the project and user domain names may"},{"line_number":51,"context_line":"# optionally be specified. If they are not specified, the default values of"},{"line_number":52,"context_line":"# \"default\" are used for both."},{"line_number":53,"context_line":"# TODO: See https://bugs.launchpad.net/swift/+bug/1604674"},{"line_number":54,"context_line":"project_domain_name \u003d default"},{"line_number":55,"context_line":"user_domain_name \u003d default"},{"line_number":56,"context_line":"# Instead of the project domain name and user domain name, the project domain"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_ee00ef03","line":53,"in_reply_to":"bff0334d_0bf7228d","updated":"2017-04-19 18:26:37.000000000","message":"Added text regarding the capitalization for *name and *id, added pointer to the second bug report.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":64,"context_line":"# username \u003d swift"},{"line_number":65,"context_line":"# password \u003d password"},{"line_number":66,"context_line":"# project_name \u003d swift"},{"line_number":67,"context_line":"# auth_endpoint \u003d http://keystonehost:5000/v3"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_abf2766e","line":67,"updated":"2017-04-12 12:44:33.000000000","message":"I would prefer not to have this summary in the sample conf because it means there are two places to maintain these example/default values, and the second is easy to miss.\n\nAlso the convention for sample configs implies (here) that the default key_id is \u0027key_id\u0027\n\nIt would be ok to have this condensed summary in the docs however.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":64,"context_line":"# username \u003d swift"},{"line_number":65,"context_line":"# password \u003d password"},{"line_number":66,"context_line":"# project_name \u003d swift"},{"line_number":67,"context_line":"# auth_endpoint \u003d http://keystonehost:5000/v3"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_f4be8363","line":67,"in_reply_to":"bff0334d_abf2766e","updated":"2017-04-19 18:26:37.000000000","message":"Moved the summary to the overview_encryption doc.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"}],"etc/proxy-server.conf-sample":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":852,"context_line":"# in the pipeline in order for existing encrypted data to be read."},{"line_number":853,"context_line":"# disable_encryption \u003d False"},{"line_number":854,"context_line":""},{"line_number":855,"context_line":"# To store the encryption root secret in a remote key management system (KMS)"},{"line_number":856,"context_line":"# such as Barbican, replace the keymaster middleware with the kms_keymaster"},{"line_number":857,"context_line":"# middleware in the proxy-server pipeline. They should be to the right of all"},{"line_number":858,"context_line":"# other middleware apart from the final proxy-logging middleware, and in the"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"bff0334d_e133fdf4","line":855,"updated":"2017-04-12 12:44:33.000000000","message":"might be more obvious for this section to be inserted after the keymaster and before encryption, as an alternative","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":852,"context_line":"# in the pipeline in order for existing encrypted data to be read."},{"line_number":853,"context_line":"# disable_encryption \u003d False"},{"line_number":854,"context_line":""},{"line_number":855,"context_line":"# To store the encryption root secret in a remote key management system (KMS)"},{"line_number":856,"context_line":"# such as Barbican, replace the keymaster middleware with the kms_keymaster"},{"line_number":857,"context_line":"# middleware in the proxy-server pipeline. They should be to the right of all"},{"line_number":858,"context_line":"# other middleware apart from the final proxy-logging middleware, and in the"}],"source_content_type":"application/octet-stream","patch_set":24,"id":"7ffa3b31_6eb05f44","line":855,"in_reply_to":"bff0334d_e133fdf4","updated":"2017-04-19 18:26:37.000000000","message":"Moved.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":899,"context_line":"use \u003d egg:swift#kms_keymaster"},{"line_number":900,"context_line":""},{"line_number":901,"context_line":"# Sets the path from which the keymaster config options should be read. This"},{"line_number":902,"context_line":"# allows multiple processes which need to be encryption-aware (for example,"},{"line_number":903,"context_line":"# proxy-server and container-sync) to share the same config file, ensuring"},{"line_number":904,"context_line":"# that the encryption keys used are the same. The format expected is similar"},{"line_number":905,"context_line":"# to other config files, with a single [kms_keymaster] section. See the"},{"line_number":906,"context_line":"# keymaster.conf-sample file for details on the kms_keymaster configuration"}],"source_content_type":"application/octet-stream","patch_set":28,"id":"1f1a1f67_e8168055","line":903,"range":{"start_line":902,"start_character":63,"end_line":903,"end_character":33},"updated":"2017-07-20 22:46:43.000000000","message":"just a question:\nwhy doesn\u0027t container_sync also need this option? I checked the current container_sync config and could not find any mention to keymaster_config_path for the existing keymaster middleware.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":899,"context_line":"use \u003d egg:swift#kms_keymaster"},{"line_number":900,"context_line":""},{"line_number":901,"context_line":"# Sets the path from which the keymaster config options should be read. This"},{"line_number":902,"context_line":"# allows multiple processes which need to be encryption-aware (for example,"},{"line_number":903,"context_line":"# proxy-server and container-sync) to share the same config file, ensuring"},{"line_number":904,"context_line":"# that the encryption keys used are the same. The format expected is similar"},{"line_number":905,"context_line":"# to other config files, with a single [kms_keymaster] section. See the"},{"line_number":906,"context_line":"# keymaster.conf-sample file for details on the kms_keymaster configuration"}],"source_content_type":"application/octet-stream","patch_set":28,"id":"ff346bd7_78553250","line":903,"range":{"start_line":902,"start_character":63,"end_line":903,"end_character":33},"in_reply_to":"1f1a1f67_e8168055","updated":"2017-07-24 19:14:04.000000000","message":"This text is the same as the one above for the [keymaster] section. I\u0027m not sure why container-sync is mentioned here - is it because it may at some point (need to) be explicitly encryption enabled?","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"}],"setup.cfg":[{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"55187de4025ca2b1b36485daa4bc6f93755de2c4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_19ee1a22","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"updated":"2017-07-24 20:42:04.000000000","message":"this is different than what\u0027s in requirements.txt, couldn\u0027t we just have it in one place?","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"bfec0813b50a9a060420f37f4c5a7805bc4a6172","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_4e6dd202","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_07b9012d","updated":"2017-07-25 17:19:13.000000000","message":"Given that castellan (since 0.6.0) lists\n\n cryptography\u003e\u003d1.6\n\ndo we need really need to list it here at all? Are *we* (in the swift codebase) doing anything with cryptography directly that would use features introduced since 1.0, or can we just let castellan manage their own dependencies?\n\nOr is this because pip\u0027s requirements solver doesn\u0027t handle transitive deps well?\n\nWhat are we doing with pyOpenSSL?","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"11a30e529e4a119a924f6bdf8a58214eb9021940","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_07b9012d","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_19ee1a22","updated":"2017-07-25 07:43:40.000000000","message":"We certainly could, and the \u0027cryptography\u003e\u003d1.6\u0027 requirement does match the latest global requirements (see e.g., https://review.openstack.org/#/c/88736/747/requirements.txt ), but bumping the version in requirements.txt would, to quote notmyname, \"force operators to repackage a lot of stuff\", even if they do not plan to use the Barbican functionality, and therefore don\u0027t necessarily need the newer cryptography version. So since we put all other new requirements (e.g., castellan) here in [extras] anyway, I thought it was more consistent to also have the updated cryptography requirement here.\n\nThe gate tests are already running with the global requirements (i.e., cryptography\u003e\u003d1.6), so bumping it in requirements.txt should be safe(ish), and if that\u0027s the preferred approach, I have no problem making that change.","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"28e4a75de34378004c4ef168c4ab77b8f6d22630","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_35509632","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_1af4a1f1","updated":"2017-07-25 20:40:03.000000000","message":"my vote would be to keep it simple and less confusing to users: just update requirements.txt with cryptography\u003e\u003d1.6. \nIt won\u0027t break crypto (without kms_keymaster) and if they do decide to use kms_keymaster, they are good to go.\n\nAlso, just to bring back Tim\u0027s question:\nWhat about pyOpenSSL, is that needed here too?","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"fe173f4490f2e4501c2c8cc7185612df2287e076","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_fb3e7fd8","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_35509632","updated":"2017-07-25 21:46:51.000000000","message":"I was hitting some pip \"AttributeError: \u0027module\u0027 object has no attribute \u0027SSL_ST_INIT\u0027\" errors after upgrading cryptography to 2.0 and with pyOpenSSL\u003c16.2, but it may have been an isolated issue on my particular system that does not warrant including it here. We don\u0027t do anything with pyOpenSSL directly, and the problems I was seeing were pip-related. IIRC, we don\u0027t do anything directly with cryptography\u003e\u003d1.6 either. I\u0027ll run some further tests and see if we could just let castellan manage their own dependencies.","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"5a4d3e8e4b5bce9b14a105848cb4de0ff49b58e2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"ff346bd7_1af4a1f1","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_4e6dd202","updated":"2017-07-25 19:44:33.000000000","message":"I probably should mention that when I wanted all the dependencies in the doc (including recursive ones), I meant it for the benefit of humans who have to plan/debug. This segment is different because it\u0027s processed by machine, so it\u0027s fine to list just what\u0027s strictly necessary. IMHO of course.","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"ea4d1776b728a13a0368c5c8f31143a2846fa9fa","unresolved":false,"context_lines":[{"line_number":66,"context_line":"[extras]"},{"line_number":67,"context_line":"kms_keymaster \u003d"},{"line_number":68,"context_line":"    pyOpenSSL\u003e\u003d16.2"},{"line_number":69,"context_line":"    cryptography\u003e\u003d1.6"},{"line_number":70,"context_line":"    castellan"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"[entry_points]"}],"source_content_type":"text/x-ttcn-cfg","patch_set":29,"id":"df3967d1_b3037673","line":69,"range":{"start_line":69,"start_character":4,"end_line":69,"end_character":21},"in_reply_to":"ff346bd7_fb3e7fd8","updated":"2017-08-02 10:18:44.000000000","message":"The latest updates from global requirements lists \u0027cryptography!\u003d2.0,\u003e1.6\u0027, and since it was with 2.0 that I hit the pyOpenSSL issues, I will just bump cryptography in requirements.txt with the versions from global requirements, and drop pyOpenSSL from here. I\u0027ll also specify the castellan version here in setup.cfg (\u003e\u003d0.7.0, as in the global requirements), and also add oslo.config\u003e\u003d4.0.0,!\u003d4.3.0,!\u003d4.4.0 here from global requirements (see timburke\u0027s comment in kms_keymaster.py).","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"}],"swift/common/middleware/crypto/barbican_keymaster.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    The middleware accesses the encryption root secret from a Barbican external"},{"line_number":25,"context_line":"    key management system (KMS) using Castellan. The BarbicanKeyMaster class,"},{"line_number":26,"context_line":"    which extends the generic KmsKeyMaster class, parses Barbican-specific"},{"line_number":27,"context_line":"    configuration parameters, which are then passed to Castellan."},{"line_number":28,"context_line":"    \"\"\""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    def __init__(self, app, conf):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_9e36bae5","line":27,"updated":"2017-01-03 18:01:52.000000000","message":"what is the use case for this vs Kms Keymaster? Can this be left as a follow up patch to support an additional use case? That would make for simpler review, simpler testing etc","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    The middleware accesses the encryption root secret from a Barbican external"},{"line_number":25,"context_line":"    key management system (KMS) using Castellan. The BarbicanKeyMaster class,"},{"line_number":26,"context_line":"    which extends the generic KmsKeyMaster class, parses Barbican-specific"},{"line_number":27,"context_line":"    configuration parameters, which are then passed to Castellan."},{"line_number":28,"context_line":"    \"\"\""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    def __init__(self, app, conf):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_021c6c76","line":27,"in_reply_to":"ba5201f7_9e36bae5","updated":"2017-01-10 10:35:19.000000000","message":"Removed BarbicanKeyMaster class from this patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    def __init__(self, app, conf):"},{"line_number":31,"context_line":"        try:"},{"line_number":32,"context_line":"            self.supported_config_types.update("},{"line_number":33,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_kms})"},{"line_number":34,"context_line":"        except AttributeError:"},{"line_number":35,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":36,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_83cf457e","line":33,"updated":"2017-01-03 18:01:52.000000000","message":"is this necessary? the call to super().__init__ does the same thing. SO I think there is no need for this __init__ method override.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"e0388fb088a8b5b26173e03811b1e58488fcb17a","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    def __init__(self, app, conf):"},{"line_number":31,"context_line":"        try:"},{"line_number":32,"context_line":"            self.supported_config_types.update("},{"line_number":33,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_kms})"},{"line_number":34,"context_line":"        except AttributeError:"},{"line_number":35,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":36,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_eb91ae53","line":33,"in_reply_to":"ba5201f7_83cf457e","updated":"2017-01-04 09:21:15.000000000","message":"This won\u0027t be needed if you set the value CRYPTO_CONFIG_KMS \u003d \u0027barbican\u0027 in kms_keymaster. I don\u0027t understand the usecase of setting the value to \u0027kms\u0027 since we are not supposed to expect any value other than \u0027config_file\u0027 or \u0027barbican\u0027 (or other future backend names for castellan)","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    def __init__(self, app, conf):"},{"line_number":31,"context_line":"        try:"},{"line_number":32,"context_line":"            self.supported_config_types.update("},{"line_number":33,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_kms})"},{"line_number":34,"context_line":"        except AttributeError:"},{"line_number":35,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":36,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a533aaf5","line":33,"in_reply_to":"ba5201f7_eb91ae53","updated":"2017-01-10 10:35:19.000000000","message":"The configuration has been changed according to discussion in the videoconf, so this code goes away in the next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":37,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_kms})"},{"line_number":38,"context_line":"        super(BarbicanKeyMaster, self).__init__(app, conf)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def _set_backend_specific_options(self, conf, kms_conf):"},{"line_number":41,"context_line":"        options.set_defaults("},{"line_number":42,"context_line":"            conf,"},{"line_number":43,"context_line":"            # The following two parameters are specific to Barbican backends:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_234e9996","line":40,"updated":"2017-01-03 18:01:52.000000000","message":"I wonder if this could override _get_root_secret_from_kms(), set the specific options in a self.conf instance, then call super._get_root_secret_from_kms?\n\nThat would avoid the extra _set_backend_specific_options method","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":37,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_kms})"},{"line_number":38,"context_line":"        super(BarbicanKeyMaster, self).__init__(app, conf)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def _set_backend_specific_options(self, conf, kms_conf):"},{"line_number":41,"context_line":"        options.set_defaults("},{"line_number":42,"context_line":"            conf,"},{"line_number":43,"context_line":"            # The following two parameters are specific to Barbican backends:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_6540e236","line":40,"in_reply_to":"ba5201f7_234e9996","updated":"2017-01-10 10:35:19.000000000","message":"This goes away in the next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"e0388fb088a8b5b26173e03811b1e58488fcb17a","unresolved":false,"context_lines":[{"line_number":42,"context_line":"            conf,"},{"line_number":43,"context_line":"            # The following two parameters are specific to Barbican backends:"},{"line_number":44,"context_line":"            barbican_endpoint\u003dkms_conf.get(\u0027kms_barbican_endpoint\u0027),"},{"line_number":45,"context_line":"            barbican_api_version\u003dkms_conf.get(\u0027kms_barbican_api_version\u0027)"},{"line_number":46,"context_line":"        )"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_4e2c8802","line":45,"updated":"2017-01-04 09:21:15.000000000","message":"turns out, I ignored this specific file in my review :) my bad.\n\nAs Alistair was pointing out, maybe we can defer this separation of barbican_keymaster and kms_keymaster to a follow-up. It doesn\u0027t seem necessary *at this point*. I\u0027m also unsure if we should do this separation in anticipation of a future castellan backend, because IMHO, when the need arises, it shouldn\u0027t be difficult to pull out the two barbican config options out of kms_keymaster.\n\nAlso, you\u0027re setting the values (line#44, 45) here and also doing the same in kms_keymaster.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"            conf,"},{"line_number":43,"context_line":"            # The following two parameters are specific to Barbican backends:"},{"line_number":44,"context_line":"            barbican_endpoint\u003dkms_conf.get(\u0027kms_barbican_endpoint\u0027),"},{"line_number":45,"context_line":"            barbican_api_version\u003dkms_conf.get(\u0027kms_barbican_api_version\u0027)"},{"line_number":46,"context_line":"        )"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_e57212b0","line":45,"in_reply_to":"ba5201f7_4e2c8802","updated":"2017-01-10 10:35:19.000000000","message":"This goes away in the next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"}],"swift/common/middleware/crypto/crypto_utils.py":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"CRYPTO_KEY_CALLBACK \u003d \u0027swift.callback.fetch_crypto_keys\u0027"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"CRYPTO_CONFIG_FILE \u003d \u0027config_file\u0027"},{"line_number":35,"context_line":"CRYPTO_CONFIG_BARBICAN \u003d \u0027barbican\u0027"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_204eb196","line":34,"range":{"start_line":34,"start_character":22,"end_line":34,"end_character":33},"updated":"2016-11-30 06:06:31.000000000","message":"Name is to generic. Shouldn\u0027t we be using oslo.config to specify configuration files. Also these are not being used anywhere in this file.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"CRYPTO_KEY_CALLBACK \u003d \u0027swift.callback.fetch_crypto_keys\u0027"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"CRYPTO_CONFIG_FILE \u003d \u0027config_file\u0027"},{"line_number":35,"context_line":"CRYPTO_CONFIG_BARBICAN \u003d \u0027barbican\u0027"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":""}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_b37134e3","line":34,"range":{"start_line":34,"start_character":22,"end_line":34,"end_character":33},"in_reply_to":"5a74a57a_204eb196","updated":"2016-11-30 13:53:31.000000000","message":"I moved CRYPTO_CONFIG_FILE to keymaster.py, and CRYPTO_CONFIG_BARBICAN to kms_keymaster.py. These are the values that can be set for \u0027keymaster_config_type\u0027 either in the \u0027proxy-server.conf\u0027 file, or in the keymaster configuration file pointed to from the \u0027proxy-server.conf\u0027 file. They are not configuration filenames themselves, but they are used to determine the configuration type (either key in config file, or key in barbican). As mentioned in another comment, Swift doesn\u0027t use oslo.config, so for this patch I\u0027m just following the established conventions.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"}],"swift/common/middleware/crypto/keymaster.py":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"8a47e2f0405b9ef4aa99922ecb70d6bbc0c90c94","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":143,"context_line":"                                 \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":144,"context_line":"                                 \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":145,"context_line":"                                 config_type)"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"        if config_type \u003d\u003d CRYPTO_CONFIG_EXTERNAL_KMS:"},{"line_number":148,"context_line":"            \"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_dec2d933","line":145,"updated":"2016-09-07 00:35:00.000000000","message":"IME, for these kinds of case conditionals python tends to prefer a dictionary pattern\n\n    SUPPORTED_CONFIG_TYPES \u003d {\n       \u0027extral_kms\u0027: self._get_key_from_extral_kms,\n       \u0027config_file\u0027: self._get_key_from_config,\n    }\n\n    try:\n        config_f \u003d SUPPORTED_CONFIG_TYPES.get(\u0027config_type\u0027, DEFAULT_TYPE)\n    except KeyError:\n        raise ValueError(\u0027Unknown config_type\u0027)\n\n    self.root_secret \u003d config_f(conf)","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"d6c4ff874cd6a3a05ad1ed98c6a882a2bc011add","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":143,"context_line":"                                 \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":144,"context_line":"                                 \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":145,"context_line":"                                 config_type)"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"        if config_type \u003d\u003d CRYPTO_CONFIG_EXTERNAL_KMS:"},{"line_number":148,"context_line":"            \"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_ea231f03","line":145,"in_reply_to":"9a89bdaa_dec2d933","updated":"2016-09-13 15:04:54.000000000","message":"Addressed in patch5.","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"8a47e2f0405b9ef4aa99922ecb70d6bbc0c90c94","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                    barbican_api_version)"},{"line_number":201,"context_line":"            else:"},{"line_number":202,"context_line":"                raise ValueError(\u0027barbican_auth_url must explicitly state \u0027"},{"line_number":203,"context_line":"                                 \u0027the API version, e.g., v2.0 or v3\u0027)"},{"line_number":204,"context_line":"            if self.root_secret is None:"},{"line_number":205,"context_line":"                raise ValueError(\u0027Root secret retrieved from external \u0027"},{"line_number":206,"context_line":"                                 \u0027kms is None\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_3ee4a5df","line":203,"updated":"2016-09-07 00:35:00.000000000","message":"probably another dict dispatch pattern here for the various v* api\u0027s","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"d6c4ff874cd6a3a05ad1ed98c6a882a2bc011add","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                    barbican_api_version)"},{"line_number":201,"context_line":"            else:"},{"line_number":202,"context_line":"                raise ValueError(\u0027barbican_auth_url must explicitly state \u0027"},{"line_number":203,"context_line":"                                 \u0027the API version, e.g., v2.0 or v3\u0027)"},{"line_number":204,"context_line":"            if self.root_secret is None:"},{"line_number":205,"context_line":"                raise ValueError(\u0027Root secret retrieved from external \u0027"},{"line_number":206,"context_line":"                                 \u0027kms is None\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_ad585132","line":203,"in_reply_to":"9a89bdaa_3ee4a5df","updated":"2016-09-13 15:04:54.000000000","message":"Addressed in patch5: Removed support for v2 of the Identity API, since it is deprecated. Since now only one API version is supported, a dict dispatch is no longer needed.","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"8a47e2f0405b9ef4aa99922ecb70d6bbc0c90c94","unresolved":false,"context_lines":[{"line_number":203,"context_line":"                                 \u0027the API version, e.g., v2.0 or v3\u0027)"},{"line_number":204,"context_line":"            if self.root_secret is None:"},{"line_number":205,"context_line":"                raise ValueError(\u0027Root secret retrieved from external \u0027"},{"line_number":206,"context_line":"                                 \u0027kms is None\u0027)"},{"line_number":207,"context_line":"        else:"},{"line_number":208,"context_line":"            \"\"\""},{"line_number":209,"context_line":"            Root secret is stored in proxy-server.conf, or in an external file"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_de9d7967","line":206,"updated":"2016-09-07 00:35:00.000000000","message":"pretty sure most of this if branch should be in a helper method?","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"d6c4ff874cd6a3a05ad1ed98c6a882a2bc011add","unresolved":false,"context_lines":[{"line_number":203,"context_line":"                                 \u0027the API version, e.g., v2.0 or v3\u0027)"},{"line_number":204,"context_line":"            if self.root_secret is None:"},{"line_number":205,"context_line":"                raise ValueError(\u0027Root secret retrieved from external \u0027"},{"line_number":206,"context_line":"                                 \u0027kms is None\u0027)"},{"line_number":207,"context_line":"        else:"},{"line_number":208,"context_line":"            \"\"\""},{"line_number":209,"context_line":"            Root secret is stored in proxy-server.conf, or in an external file"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a89bdaa_0d613dd3","line":206,"in_reply_to":"9a89bdaa_de9d7967","updated":"2016-09-13 15:04:54.000000000","message":"Addressed in patch5: Refactored this, as well as some other functionality, into helper methods.","commit_id":"d9997e0c8d1a8aedbfd9b4ba7443923c2db562bd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":143,"context_line":"            configuration type is specified, assume the encryption_root_secret"},{"line_number":144,"context_line":"            is stored in the keymaster configuration file."},{"line_number":145,"context_line":"            \"\"\""},{"line_number":146,"context_line":"            config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"        get_root_secret_f \u003d SUPPORTED_CONFIG_TYPES.get(config_type)"},{"line_number":149,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_39f09b90","line":146,"updated":"2016-10-05 09:03:22.000000000","message":"Using a separate keymaster config file is a good idea. However, it seems that this line 146 could be de-indented and external key manager options could be specified in proxy-server.conf if a user wanted to do that?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":143,"context_line":"            configuration type is specified, assume the encryption_root_secret"},{"line_number":144,"context_line":"            is stored in the keymaster configuration file."},{"line_number":145,"context_line":"            \"\"\""},{"line_number":146,"context_line":"            config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"        get_root_secret_f \u003d SUPPORTED_CONFIG_TYPES.get(config_type)"},{"line_number":149,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_7d12fcb5","line":146,"in_reply_to":"1a95cdbc_39f09b90","updated":"2016-10-05 22:14:44.000000000","message":"I added a TODO in the next patch. I\u0027m reworking the whole configuration and will take this into account when making the next round of proposed changes for that.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _get_root_secret_from_external_kms(self, conf, keymaster_config_path):"},{"line_number":173,"context_line":"        \"\"\""},{"line_number":174,"context_line":"        Root secret is stored in an external key management system, which"},{"line_number":175,"context_line":"        is accessed through barbican."},{"line_number":176,"context_line":"        \"\"\""},{"line_number":177,"context_line":"        if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_194f5fbe","line":174,"updated":"2016-10-05 09:03:22.000000000","message":"In general Barbican seems to sometimes be referred to as a key-manager and sometimes as a secret store. There is potential for confusion - here we have a keymaster, which manages keys for swift encryption, calling out to an external key manager, but not for keys - just for a root secret which is NOT a key.\n\nI don\u0027t know what the answer to that confusion is. I am just mentioning it in case there is a better way to label these services.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _get_root_secret_from_external_kms(self, conf, keymaster_config_path):"},{"line_number":173,"context_line":"        \"\"\""},{"line_number":174,"context_line":"        Root secret is stored in an external key management system, which"},{"line_number":175,"context_line":"        is accessed through barbican."},{"line_number":176,"context_line":"        \"\"\""},{"line_number":177,"context_line":"        if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_28c57d8d","line":174,"in_reply_to":"1a95cdbc_194f5fbe","updated":"2016-10-05 22:14:44.000000000","message":"To me the root secret looks like a key, and we pass it to the hmac function as a key. In my understanding, a secret store is a subset of a (general) key manager, but I do see that there is potential for confusion. I\u0027ll keep your comment in mind and try to have clearer definitions and more streamlined descriptions and comments.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        are optional parameters."},{"line_number":212,"context_line":"        \u0027\u0027\u0027"},{"line_number":213,"context_line":"        project_domain_name \u003d barbican_conf.get("},{"line_number":214,"context_line":"            \u0027barbican_project_domain_name\u0027, \u0027default\u0027)"},{"line_number":215,"context_line":"        user_domain_name \u003d barbican_conf.get("},{"line_number":216,"context_line":"            \u0027barbican_user_domain_name\u0027, \u0027default\u0027)"},{"line_number":217,"context_line":"        barbican_endpoint \u003d barbican_conf.get(\u0027barbican_endpoint\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_61ad3288","line":214,"updated":"2016-10-05 09:03:22.000000000","message":"there seems to be some confusion about what these default domain values should be [1]. Do we have to set defaults in swift code? what happens if the keystone client code is called without the domain params - does it apply its own default that we could defer to?\n\nActually, it feels like we would ideally take the conf dict and pass it to a keystone interface that would parse the conf and do the checking for us? authtoken must have similar functionality since these options mirror those in authtoken.\n\n[1] https://bugs.launchpad.net/swift/+bug/1604674","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        are optional parameters."},{"line_number":212,"context_line":"        \u0027\u0027\u0027"},{"line_number":213,"context_line":"        project_domain_name \u003d barbican_conf.get("},{"line_number":214,"context_line":"            \u0027barbican_project_domain_name\u0027, \u0027default\u0027)"},{"line_number":215,"context_line":"        user_domain_name \u003d barbican_conf.get("},{"line_number":216,"context_line":"            \u0027barbican_user_domain_name\u0027, \u0027default\u0027)"},{"line_number":217,"context_line":"        barbican_endpoint \u003d barbican_conf.get(\u0027barbican_endpoint\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_6856a5d3","line":214,"in_reply_to":"1a95cdbc_61ad3288","updated":"2016-10-05 22:14:44.000000000","message":"I agree that we shouldn\u0027t be setting the defaults in the swift code, and I have removed them for the next patch.\nI will look into passing the conf to a keystone interface, that sounds like a much better approach.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":232,"context_line":"        \"\"\""},{"line_number":233,"context_line":"        return conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    def _get_key_from_barbican_v3("},{"line_number":236,"context_line":"            self, username, password, project_name, auth_url, key_id,"},{"line_number":237,"context_line":"            project_domain_name, user_domain_name, barbican_endpoint,"},{"line_number":238,"context_line":"            barbican_api_version):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_c7bb7174","line":235,"updated":"2016-10-05 09:03:22.000000000","message":"I see *four* requests to get the secret in my Barbican logs. This partly explained by the fact that the swift start uip process actually loads the proxy pipeline twice so this method is called twice, but that still leaves each call to this method making two calls to get the secret from barbican??\n\n[1] http://paste.openstack.org/show/584246/","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":232,"context_line":"        \"\"\""},{"line_number":233,"context_line":"        return conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    def _get_key_from_barbican_v3("},{"line_number":236,"context_line":"            self, username, password, project_name, auth_url, key_id,"},{"line_number":237,"context_line":"            project_domain_name, user_domain_name, barbican_endpoint,"},{"line_number":238,"context_line":"            barbican_api_version):"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_08e1a1fe","line":235,"in_reply_to":"1a95cdbc_c7bb7174","updated":"2016-10-05 22:14:44.000000000","message":"Thanks for pointing this out, I\u0027ll investigate.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":241,"context_line":"        oslo_config and oslo_context unless we actually want to retrieve the"},{"line_number":242,"context_line":"        encryption_root_secret from an external KMS."},{"line_number":243,"context_line":"        \u0027\u0027\u0027"},{"line_number":244,"context_line":"        from castellan import key_manager, options"},{"line_number":245,"context_line":"        from oslo_config import cfg"},{"line_number":246,"context_line":"        from oslo_context import context"},{"line_number":247,"context_line":"        auth \u003d v3.Password("}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_79f30374","line":244,"updated":"2016-10-05 09:03:22.000000000","message":"so we\u0027re using castellan to get to barbican. Is the code hjere specific to barbican? or should the methods be called _get_key_from_castellan?","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":241,"context_line":"        oslo_config and oslo_context unless we actually want to retrieve the"},{"line_number":242,"context_line":"        encryption_root_secret from an external KMS."},{"line_number":243,"context_line":"        \u0027\u0027\u0027"},{"line_number":244,"context_line":"        from castellan import key_manager, options"},{"line_number":245,"context_line":"        from oslo_config import cfg"},{"line_number":246,"context_line":"        from oslo_context import context"},{"line_number":247,"context_line":"        auth \u003d v3.Password("}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_48cac96f","line":244,"in_reply_to":"1a95cdbc_79f30374","updated":"2016-10-05 22:14:44.000000000","message":"At the moment, neither we nor Castellan support anything else than Barbican, so I\u0027m not sure if this method would be different for other backends, but I would assume so.\nIn my understanding, Castellan is the library and Barbican is the service. A better name might be _get_key_from_barbican_using_castellan, but that\u0027s getting a bit long.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"302121611bc3381890335eeb283c032101fba16a","unresolved":false,"context_lines":[{"line_number":244,"context_line":"        from castellan import key_manager, options"},{"line_number":245,"context_line":"        from oslo_config import cfg"},{"line_number":246,"context_line":"        from oslo_context import context"},{"line_number":247,"context_line":"        auth \u003d v3.Password("},{"line_number":248,"context_line":"            username\u003dusername, password\u003dpassword, project_name\u003dproject_name,"},{"line_number":249,"context_line":"            auth_url\u003dauth_url, project_domain_name\u003dproject_domain_name,"},{"line_number":250,"context_line":"            user_domain_name\u003duser_domain_name)"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_b972ebe3","line":247,"updated":"2016-10-05 09:03:22.000000000","message":"I don\u0027t know the answer, but I would have assumed that keystone had a way to get an auth context without specifying the API version i.e. that the keystone library would perform API version discovery somehow.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":244,"context_line":"        from castellan import key_manager, options"},{"line_number":245,"context_line":"        from oslo_config import cfg"},{"line_number":246,"context_line":"        from oslo_context import context"},{"line_number":247,"context_line":"        auth \u003d v3.Password("},{"line_number":248,"context_line":"            username\u003dusername, password\u003dpassword, project_name\u003dproject_name,"},{"line_number":249,"context_line":"            auth_url\u003dauth_url, project_domain_name\u003dproject_domain_name,"},{"line_number":250,"context_line":"            user_domain_name\u003duser_domain_name)"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_4878092c","line":247,"in_reply_to":"1a95cdbc_b972ebe3","updated":"2016-10-05 22:14:44.000000000","message":"As I mentioned in another comment, I was having problems with the API versions, authentication and castellan (and barbican), but I\u0027ll go back and iterate through the code and try to get it to a more generic shape that\u0027s closer to the castellan usage examples.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7f2e522d4e69a21f68e5b6d95470891c93b40c3","unresolved":false,"context_lines":[{"line_number":252,"context_line":"        keystone \u003d keystone_client.Client(session\u003dsess)"},{"line_number":253,"context_line":"        token \u003d keystone.get_raw_token_from_identity_service("},{"line_number":254,"context_line":"            auth_url\u003dauth_url, username\u003dusername, password\u003dpassword,"},{"line_number":255,"context_line":"            project_domain_name\u003dproject_domain_name,"},{"line_number":256,"context_line":"            user_domain_name\u003duser_domain_name)"},{"line_number":257,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dtoken.auth_token)"},{"line_number":258,"context_line":"        conf \u003d cfg.ConfigOpts()"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_1cf2cc6f","line":255,"updated":"2016-10-05 18:33:22.000000000","message":"project_name is missing from the args here, and as  a consequence I believe the token will be scoped to the user\u0027s default project, which may not be what is intended.","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"685c32b3b25a5ff3b7a64330705e0274dc3364c0","unresolved":false,"context_lines":[{"line_number":252,"context_line":"        keystone \u003d keystone_client.Client(session\u003dsess)"},{"line_number":253,"context_line":"        token \u003d keystone.get_raw_token_from_identity_service("},{"line_number":254,"context_line":"            auth_url\u003dauth_url, username\u003dusername, password\u003dpassword,"},{"line_number":255,"context_line":"            project_domain_name\u003dproject_domain_name,"},{"line_number":256,"context_line":"            user_domain_name\u003duser_domain_name)"},{"line_number":257,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dtoken.auth_token)"},{"line_number":258,"context_line":"        conf \u003d cfg.ConfigOpts()"}],"source_content_type":"text/x-python","patch_set":6,"id":"1a95cdbc_a88fcd21","line":255,"in_reply_to":"1a95cdbc_1cf2cc6f","updated":"2016-10-05 22:14:44.000000000","message":"Good catch, thanks!","commit_id":"d19d4bc57d706b1436e3daf0e3be7bfc307f57ec"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"554de7427dc48eed73ead19b89f9ecbb7e6a1570","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        from keystoneauth1 import identity, session"},{"line_number":183,"context_line":"        from oslo_config import cfg"},{"line_number":184,"context_line":"        from oslo_context import context"},{"line_number":185,"context_line":"        auth \u003d identity.Password("},{"line_number":186,"context_line":"            auth_url\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":187,"context_line":"            password\u003dbarbican_conf.get(\u0027barbican_password\u0027),"},{"line_number":188,"context_line":"            username\u003dbarbican_conf.get(\u0027barbican_username\u0027),"},{"line_number":189,"context_line":"            user_domain_id\u003dbarbican_conf.get(\u0027barbican_user_domain_id\u0027),"},{"line_number":190,"context_line":"            user_domain_name\u003dbarbican_conf.get(\u0027barbican_user_domain_name\u0027),"},{"line_number":191,"context_line":"            project_id\u003dbarbican_conf.get(\u0027barbican_project_id\u0027),"},{"line_number":192,"context_line":"            project_name\u003dbarbican_conf.get(\u0027barbican_project_name\u0027),"},{"line_number":193,"context_line":"            project_domain_id\u003dbarbican_conf.get("},{"line_number":194,"context_line":"                \u0027barbican_project_domain_id\u0027),"},{"line_number":195,"context_line":"            project_domain_name\u003dbarbican_conf.get("},{"line_number":196,"context_line":"                \u0027barbican_project_domain_name\u0027))"},{"line_number":197,"context_line":"        sess \u003d session.Session()"},{"line_number":198,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":199,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a629dbe_8e512211","line":196,"range":{"start_line":185,"start_character":0,"end_line":196,"end_character":48},"updated":"2016-11-09 09:24:13.000000000","message":"I couldn\u0027t find any way to pass a config dict to Castellan/keystoneauth. I removed the extra parsing and checking of parameters, but to create the auth object, the values are still queried individually from the swift barbican configuration dict.","commit_id":"ee8918e7c16edf2196985ac76c518bbc0be9d7f5"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"554de7427dc48eed73ead19b89f9ecbb7e6a1570","unresolved":false,"context_lines":[{"line_number":195,"context_line":"            project_domain_name\u003dbarbican_conf.get("},{"line_number":196,"context_line":"                \u0027barbican_project_domain_name\u0027))"},{"line_number":197,"context_line":"        sess \u003d session.Session()"},{"line_number":198,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":199,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":200,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":201,"context_line":"        options.set_defaults("},{"line_number":202,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a629dbe_cea95ae1","line":199,"range":{"start_line":198,"start_character":0,"end_line":199,"end_character":71},"updated":"2016-11-09 09:24:13.000000000","message":"The code to authenticate with keystone, create the context etc. is now updated according to the latest keystone and castellan usage examples. I could not see double requests to keystone anymore, but this should still be confirmed as I might have looked in the wrong place/with insufficient logging details enabled.","commit_id":"ee8918e7c16edf2196985ac76c518bbc0be9d7f5"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"import six"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"from swift.common.middleware.crypto.crypto_utils import CRYPTO_KEY_CALLBACK, \\"},{"line_number":24,"context_line":"    CRYPTO_CONFIG_FILE"},{"line_number":25,"context_line":"from swift.common.swob import Request, HTTPException"},{"line_number":26,"context_line":"from swift.common.utils import readconf"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_7b121c5a","line":23,"updated":"2016-11-30 06:06:31.000000000","message":"Since these variables are used here and not in the file they are declared, why not just declare them here?","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"import six"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"from swift.common.middleware.crypto.crypto_utils import CRYPTO_KEY_CALLBACK, \\"},{"line_number":24,"context_line":"    CRYPTO_CONFIG_FILE"},{"line_number":25,"context_line":"from swift.common.swob import Request, HTTPException"},{"line_number":26,"context_line":"from swift.common.utils import readconf"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_13582856","line":23,"in_reply_to":"5a74a57a_7b121c5a","updated":"2016-11-30 13:53:31.000000000","message":"CRYPTO_KEY_CALLBACK is also used in crypto_utils.py where it is currently declared, so I will leave it there, as it is anyway not part of the Barbican keymaster patch. I moved the CRYPTO_CONFIG_FILE variable to the keymaster.py file.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        \"\"\""},{"line_number":143,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":146,"context_line":"        if get_root_secret_f is None:"},{"line_number":147,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":148,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_1b2a087f","line":145,"range":{"start_line":145,"start_character":23,"end_line":145,"end_character":25},"updated":"2016-11-30 06:06:31.000000000","message":"consider renaming.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        \"\"\""},{"line_number":143,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":146,"context_line":"        if get_root_secret_f is None:"},{"line_number":147,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":148,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_6e2a4f80","line":145,"range":{"start_line":145,"start_character":23,"end_line":145,"end_character":25},"in_reply_to":"5a74a57a_1b2a087f","updated":"2016-11-30 13:53:31.000000000","message":"As the dictionary pattern and the current naming scheme was suggested in an earlier review comment, I will keep it as-is, at least for now.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":146,"context_line":"        if get_root_secret_f is None:"},{"line_number":147,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":148,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":149,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_3b1fc45c","line":146,"range":{"start_line":146,"start_character":26,"end_line":146,"end_character":28},"updated":"2016-11-30 06:06:31.000000000","message":"consider renaming","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":146,"context_line":"        if get_root_secret_f is None:"},{"line_number":147,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":148,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":149,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_ae2467af","line":146,"range":{"start_line":146,"start_character":26,"end_line":146,"end_character":28},"in_reply_to":"5a74a57a_3b1fc45c","updated":"2016-11-30 13:53:31.000000000","message":"Same as above.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"2293cbdaa3a6a4b4873faffa832741a48d941472","unresolved":false,"context_lines":[{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"},{"line_number":152,"context_line":"        self.root_secret \u003d get_root_secret_f(conf, keymaster_config_path)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"    def _get_root_secret_from_config(self, conf, keymaster_config_path):"},{"line_number":155,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_7b49258e","line":152,"range":{"start_line":152,"start_character":0,"end_line":152,"end_character":73},"updated":"2016-11-30 14:20:09.000000000","message":"The get_root_secret_f() function shall now return the root encryption secret in binary form, instead of base64 as before (to avoid encoding and decoding when retrieving from Barbican).","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"},{"line_number":152,"context_line":"        self.root_secret \u003d get_root_secret_f(conf, keymaster_config_path)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"    def _get_root_secret_from_config(self, conf, keymaster_config_path):"},{"line_number":155,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_a98440b1","line":152,"range":{"start_line":152,"start_character":0,"end_line":152,"end_character":73},"in_reply_to":"5a74a57a_064a8383","updated":"2016-11-30 21:18:52.000000000","message":"The root_secret is used in KeyMaster.create() to derive keys for the container and object, and it is called from KeyMasterContext.fetch_crypto_keys().","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"},{"line_number":152,"context_line":"        self.root_secret \u003d get_root_secret_f(conf, keymaster_config_path)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"    def _get_root_secret_from_config(self, conf, keymaster_config_path):"},{"line_number":155,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_064a8383","line":152,"range":{"start_line":152,"start_character":0,"end_line":152,"end_character":73},"in_reply_to":"5a74a57a_7b49258e","updated":"2016-11-30 20:26:11.000000000","message":"Is the root_secret used anywhere yet?","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"2293cbdaa3a6a4b4873faffa832741a48d941472","unresolved":false,"context_lines":[{"line_number":157,"context_line":"        referenced from proxy-server.conf."},{"line_number":158,"context_line":"        \"\"\""},{"line_number":159,"context_line":"        b64_root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":160,"context_line":"        try:"},{"line_number":161,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":162,"context_line":"            # treat them as an error"},{"line_number":163,"context_line":"            if not isinstance(b64_root_secret, six.string_types) or any("},{"line_number":164,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":165,"context_line":"                    for c in b64_root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":166,"context_line":"                raise ValueError"},{"line_number":167,"context_line":"            binary_root_secret \u003d base64.b64decode(b64_root_secret)"},{"line_number":168,"context_line":"            if len(binary_root_secret) \u003c 32:"},{"line_number":169,"context_line":"                raise ValueError"},{"line_number":170,"context_line":"            return binary_root_secret"},{"line_number":171,"context_line":"        except (TypeError, ValueError):"},{"line_number":172,"context_line":"            raise ValueError("},{"line_number":173,"context_line":"                \u0027encryption_root_secret option in %s must be a base64 \u0027"},{"line_number":174,"context_line":"                \u0027encoding of at least 32 raw bytes\u0027 % ("},{"line_number":175,"context_line":"                    keymaster_config_path or \u0027proxy-server.conf\u0027))"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    def __call__(self, env, start_response):"},{"line_number":178,"context_line":"        req \u003d Request(env)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_3b2fada2","line":175,"range":{"start_line":160,"start_character":0,"end_line":175,"end_character":66},"updated":"2016-11-30 14:20:09.000000000","message":"Since having a base64-encoded root encryption secret now only applies to secrets stored in a config file, the check was moved to the respective getter function.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":157,"context_line":"        referenced from proxy-server.conf."},{"line_number":158,"context_line":"        \"\"\""},{"line_number":159,"context_line":"        b64_root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":160,"context_line":"        try:"},{"line_number":161,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":162,"context_line":"            # treat them as an error"},{"line_number":163,"context_line":"            if not isinstance(b64_root_secret, six.string_types) or any("},{"line_number":164,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":165,"context_line":"                    for c in b64_root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":166,"context_line":"                raise ValueError"},{"line_number":167,"context_line":"            binary_root_secret \u003d base64.b64decode(b64_root_secret)"},{"line_number":168,"context_line":"            if len(binary_root_secret) \u003c 32:"},{"line_number":169,"context_line":"                raise ValueError"},{"line_number":170,"context_line":"            return binary_root_secret"},{"line_number":171,"context_line":"        except (TypeError, ValueError):"},{"line_number":172,"context_line":"            raise ValueError("},{"line_number":173,"context_line":"                \u0027encryption_root_secret option in %s must be a base64 \u0027"},{"line_number":174,"context_line":"                \u0027encoding of at least 32 raw bytes\u0027 % ("},{"line_number":175,"context_line":"                    keymaster_config_path or \u0027proxy-server.conf\u0027))"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    def __call__(self, env, start_response):"},{"line_number":178,"context_line":"        req \u003d Request(env)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_c6588b59","line":175,"range":{"start_line":160,"start_character":0,"end_line":175,"end_character":66},"in_reply_to":"5a74a57a_3b2fada2","updated":"2016-11-30 20:26:11.000000000","message":"This should have unit tests.  I don\u0027t see any, sorry if I overlooked them.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":157,"context_line":"        referenced from proxy-server.conf."},{"line_number":158,"context_line":"        \"\"\""},{"line_number":159,"context_line":"        b64_root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":160,"context_line":"        try:"},{"line_number":161,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":162,"context_line":"            # treat them as an error"},{"line_number":163,"context_line":"            if not isinstance(b64_root_secret, six.string_types) or any("},{"line_number":164,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":165,"context_line":"                    for c in b64_root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":166,"context_line":"                raise ValueError"},{"line_number":167,"context_line":"            binary_root_secret \u003d base64.b64decode(b64_root_secret)"},{"line_number":168,"context_line":"            if len(binary_root_secret) \u003c 32:"},{"line_number":169,"context_line":"                raise ValueError"},{"line_number":170,"context_line":"            return binary_root_secret"},{"line_number":171,"context_line":"        except (TypeError, ValueError):"},{"line_number":172,"context_line":"            raise ValueError("},{"line_number":173,"context_line":"                \u0027encryption_root_secret option in %s must be a base64 \u0027"},{"line_number":174,"context_line":"                \u0027encoding of at least 32 raw bytes\u0027 % ("},{"line_number":175,"context_line":"                    keymaster_config_path or \u0027proxy-server.conf\u0027))"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    def __call__(self, env, start_response):"},{"line_number":178,"context_line":"        req \u003d Request(env)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_0931b40b","line":175,"range":{"start_line":160,"start_character":0,"end_line":175,"end_character":66},"in_reply_to":"5a74a57a_c6588b59","updated":"2016-11-30 21:18:52.000000000","message":"The existing tests test_invalid_root_secret() and test_root_secret_path_invalid_secret() in  test.unit.common.middleware.crypto.test_keymaster.py should cover this code (which is not new - it was just moved from one place to another).","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":135,"context_line":"                                 \u0027are other config options specified!\u0027)"},{"line_number":136,"context_line":"            conf \u003d readconf(keymaster_config_path, \u0027keymaster\u0027)"},{"line_number":137,"context_line":"        \"\"\""},{"line_number":138,"context_line":"        Check encryption_config_type variable that can be used to"},{"line_number":139,"context_line":"        explicitly specify the scheme used for the encryption root secret"},{"line_number":140,"context_line":"        (and, in the future, for other keymasters etc). By default, if no"},{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_dacc4a8b","line":138,"range":{"start_line":138,"start_character":14,"end_line":138,"end_character":36},"updated":"2016-12-16 17:25:07.000000000","message":"s/encryption_config_type/keymaster_config_type","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":135,"context_line":"                                 \u0027are other config options specified!\u0027)"},{"line_number":136,"context_line":"            conf \u003d readconf(keymaster_config_path, \u0027keymaster\u0027)"},{"line_number":137,"context_line":"        \"\"\""},{"line_number":138,"context_line":"        Check encryption_config_type variable that can be used to"},{"line_number":139,"context_line":"        explicitly specify the scheme used for the encryption root secret"},{"line_number":140,"context_line":"        (and, in the future, for other keymasters etc). By default, if no"},{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_fccc2bbd","line":138,"range":{"start_line":138,"start_character":14,"end_line":138,"end_character":36},"in_reply_to":"1a6eadb0_dacc4a8b","updated":"2016-12-20 15:44:28.000000000","message":"Fixed.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"},{"line_number":142,"context_line":"        is stored in the keymaster configuration file."},{"line_number":143,"context_line":"        \"\"\""},{"line_number":144,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_ce1482a1","line":144,"updated":"2016-12-16 17:25:07.000000000","message":"What if this value returns \u0027barbican\u0027? wouldn\u0027t it throw a \"keyerror\"?","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"},{"line_number":142,"context_line":"        is stored in the keymaster configuration file."},{"line_number":143,"context_line":"        \"\"\""},{"line_number":144,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_dc820fc8","line":144,"in_reply_to":"1a6eadb0_ce1482a1","updated":"2016-12-20 15:44:28.000000000","message":"Since we use conf.get(\u0027keymaster_config_type\u0027) instead of conf.get[\u0027keymaster_config_type\u0027], a \"keyerror\" should not be thrown even if \"barbican\" is returned. The same should apply to the self.supported_config_types.get(config_type) below.\n\nIf we set the keymaster class in the pipeline, but the proxy-server.conf has \"keymaster_config_type\u003dbarbican\", then it would result at startup, since \"barbican\" is only added to the list of supported_config_types by the kms_keymaster class.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"},{"line_number":148,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_50c01b50","line":148,"range":{"start_line":148,"start_character":38,"end_line":148,"end_character":60},"updated":"2016-12-16 17:25:07.000000000","message":"s/encryption_config_type/keymaster_config_type","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"},{"line_number":148,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_3ce22302","line":148,"range":{"start_line":148,"start_character":38,"end_line":148,"end_character":60},"in_reply_to":"1a6eadb0_50c01b50","updated":"2016-12-20 15:44:28.000000000","message":"Fixed.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"},{"line_number":148,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"},{"line_number":152,"context_line":"        self.root_secret \u003d get_root_secret_f(conf, keymaster_config_path)"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_d0cc2b8b","line":149,"range":{"start_line":149,"start_character":38,"end_line":149,"end_character":54},"updated":"2016-12-16 17:25:07.000000000","message":"s/CryptoConfigType/KeymasterConfigType I believe? I don\u0027t think there\u0027s anything with CryptoConfigType reference in the code.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"},{"line_number":148,"context_line":"            raise ValueError(\u0027Invalid encryption_config_type specified: \u0027"},{"line_number":149,"context_line":"                             \u0027%s. See CryptoConfigType in common.\u0027"},{"line_number":150,"context_line":"                             \u0027middleware.crypto for valid values.\u0027 %"},{"line_number":151,"context_line":"                             config_type)"},{"line_number":152,"context_line":"        self.root_secret \u003d get_root_secret_f(conf, keymaster_config_path)"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_fcdfcb37","line":149,"range":{"start_line":149,"start_character":38,"end_line":149,"end_character":54},"in_reply_to":"1a6eadb0_d0cc2b8b","updated":"2016-12-20 15:44:28.000000000","message":"Removed the second sentence.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    therefore it should be set to a high-entropy value. For example, a suitable"},{"line_number":111,"context_line":"    value may be obtained by base-64 encoding a 32 byte (or longer) value"},{"line_number":112,"context_line":"    generated by a cryptographically secure random number generator. Changing"},{"line_number":113,"context_line":"    the root secret is likely to result in data loss."},{"line_number":114,"context_line":"    \"\"\""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def __init__(self, app, conf):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_17b7aff5","line":113,"updated":"2017-01-05 17:14:15.000000000","message":"This comment is no longer applicable to subclasses and should probably be reworded to talk about \u003e\u003d 256 bit values.\n\nThen the specific _get_root_secret method that reads from file should have a doctstring that talks about base64 encoded values.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    therefore it should be set to a high-entropy value. For example, a suitable"},{"line_number":111,"context_line":"    value may be obtained by base-64 encoding a 32 byte (or longer) value"},{"line_number":112,"context_line":"    generated by a cryptographically secure random number generator. Changing"},{"line_number":113,"context_line":"    the root secret is likely to result in data loss."},{"line_number":114,"context_line":"    \"\"\""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def __init__(self, app, conf):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_9c7d22b4","line":113,"in_reply_to":"ba5201f7_17b7aff5","updated":"2017-01-10 10:35:19.000000000","message":"Descriptions changed as suggested.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        \u0027\u0027\u0027"},{"line_number":123,"context_line":"        try:"},{"line_number":124,"context_line":"            self.supported_config_types.update("},{"line_number":125,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":126,"context_line":"        except AttributeError:"},{"line_number":127,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":128,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_834ca543","line":125,"updated":"2017-01-03 18:01:52.000000000","message":"I\u0027m not convinced by the need for this pattern of subclasses registering config getters. Why does a barbican keymaster subclass need to be able to load a root secret from config? Is that a use case we want to support?\n\nA simpler pattern would be for each subclass to override a method _get_root_secret(conf). So each subclass supports one and only source of root_secret based on options in a keymaster conf file (apart from legacy config-file keymaster which supports root_secret in the proxy-server.conf).","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        \u0027\u0027\u0027"},{"line_number":123,"context_line":"        try:"},{"line_number":124,"context_line":"            self.supported_config_types.update("},{"line_number":125,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":126,"context_line":"        except AttributeError:"},{"line_number":127,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":128,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_dc340afd","line":125,"in_reply_to":"ba5201f7_211d95bd","updated":"2017-01-10 10:35:19.000000000","message":"Changed according to videoconf discussion. The base Keymaster class will have a _get_root_secret() method, that is overridden by subclasses such as the KmsKeymaster class.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"e0388fb088a8b5b26173e03811b1e58488fcb17a","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        \u0027\u0027\u0027"},{"line_number":123,"context_line":"        try:"},{"line_number":124,"context_line":"            self.supported_config_types.update("},{"line_number":125,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":126,"context_line":"        except AttributeError:"},{"line_number":127,"context_line":"            self.supported_config_types \u003d {}"},{"line_number":128,"context_line":"            self.supported_config_types.update("}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_211d95bd","line":125,"in_reply_to":"ba5201f7_834ca543","updated":"2017-01-04 09:21:15.000000000","message":"+1 I believe this suggested pattern would also make exception handling better.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self.supported_config_types.update("},{"line_number":129,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":132,"context_line":"        if keymaster_config_path:"},{"line_number":133,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":134,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a88fd3ca","line":131,"updated":"2017-01-03 13:36:13.000000000","message":"You can make this a class attribute by defining it as self.keymaster_config_path and then use it directly in line#173 - you can then not pass that value in line#150 - which is not used in kms_keymaster.\n\nPlease also refer to the corresponding comment in kms_keymaster.py line#61.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self.supported_config_types.update("},{"line_number":129,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":132,"context_line":"        if keymaster_config_path:"},{"line_number":133,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":134,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a2572025","line":131,"in_reply_to":"ba5201f7_8ea03045","updated":"2017-01-10 10:35:19.000000000","message":"I set keymaster_config_path as an attribute of the base KeyMaster class, from where it can be used by subclasses.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self.supported_config_types.update("},{"line_number":129,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":132,"context_line":"        if keymaster_config_path:"},{"line_number":133,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":134,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_e860f037","line":131,"in_reply_to":"ba5201f7_a88fd3ca","updated":"2017-01-03 18:01:52.000000000","message":"But equally,if it\u0027s not used in subclasses then why make it a class attribute?\n\nMaybe it would be useful for subclasses to specify the source of config if they raise exceptions, so perhaps the question is why is the keymaster_config_path not being used in the subclass exception messages?\n\nOR, catch any exception raised from subclasses and add the source of config to the exception message here?\n\nHowever, I also wonder if for new keymaster subclasses we should mandate that config is in a separate file, to simplify things. The reason for the separate file was so that both proxy and internal client could share the same config.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"e0388fb088a8b5b26173e03811b1e58488fcb17a","unresolved":false,"context_lines":[{"line_number":128,"context_line":"            self.supported_config_types.update("},{"line_number":129,"context_line":"                {CRYPTO_CONFIG_FILE: self._get_root_secret_from_config})"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":132,"context_line":"        if keymaster_config_path:"},{"line_number":133,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":134,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_8ea03045","line":131,"in_reply_to":"ba5201f7_e860f037","updated":"2017-01-04 09:21:15.000000000","message":"Considering keymaster.conf-sample has substantial amount of config settings, I think it\u0027d be best to have it in a separate file for simplicity.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"},{"line_number":142,"context_line":"        is stored in the keymaster configuration file."},{"line_number":143,"context_line":"        \"\"\""},{"line_number":144,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_f7a22bfb","line":144,"updated":"2017-01-05 17:14:15.000000000","message":"I think this becomes unnecessary if we make each subclass load only from one source.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":141,"context_line":"        configuration type is specified, assume the encryption_root_secret"},{"line_number":142,"context_line":"        is stored in the keymaster configuration file."},{"line_number":143,"context_line":"        \"\"\""},{"line_number":144,"context_line":"        config_type \u003d conf.get(\u0027keymaster_config_type\u0027, CRYPTO_CONFIG_FILE)"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        get_root_secret_f \u003d self.supported_config_types.get(config_type)"},{"line_number":147,"context_line":"        if get_root_secret_f is None:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_4213d40d","line":144,"in_reply_to":"ba5201f7_f7a22bfb","updated":"2017-01-10 10:35:19.000000000","message":"The config type is now specified in the filter, not as a configuration parameter in the proxy-server.conf or keymaster.conf configuration file.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        try:"},{"line_number":159,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":160,"context_line":"            # treat them as an error"},{"line_number":161,"context_line":"            if not isinstance(b64_root_secret, six.string_types) or any("},{"line_number":162,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":163,"context_line":"                    for c in b64_root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":164,"context_line":"                raise ValueError"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_d788c773","line":161,"updated":"2017-01-05 17:14:15.000000000","message":"+1 fro clarity in naming","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        try:"},{"line_number":159,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":160,"context_line":"            # treat them as an error"},{"line_number":161,"context_line":"            if not isinstance(b64_root_secret, six.string_types) or any("},{"line_number":162,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":163,"context_line":"                    for c in b64_root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":164,"context_line":"                raise ValueError"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_425cb4ed","line":161,"in_reply_to":"ba5201f7_d788c773","updated":"2017-01-10 10:35:19.000000000","message":"Thx","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":25,"context_line":"from swift.common.utils import readconf"},{"line_number":26,"context_line":"from swift.common.wsgi import WSGIContext"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"CRYPTO_CONFIG_FILE \u003d \u0027config_file\u0027"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"class KeyMasterContext(WSGIContext):"}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_e152dddd","line":28,"updated":"2017-04-12 12:44:33.000000000","message":"I could not find a usage of this","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":25,"context_line":"from swift.common.utils import readconf"},{"line_number":26,"context_line":"from swift.common.wsgi import WSGIContext"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"CRYPTO_CONFIG_FILE \u003d \u0027config_file\u0027"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"class KeyMasterContext(WSGIContext):"}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_2eb6d73f","line":28,"in_reply_to":"bff0334d_e152dddd","updated":"2017-04-19 18:26:37.000000000","message":"Removed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4fc20afb1bf142e9532639653c0681df4296b5a2","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        :return: the encryption root secret binary bytes"},{"line_number":132,"context_line":"        :rtype: bytearray"},{"line_number":133,"context_line":"        \"\"\""},{"line_number":134,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":135,"context_line":"        if keymaster_config_path:"},{"line_number":136,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":137,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"3f1d235d_4617d0ee","line":134,"updated":"2017-07-04 00:40:54.000000000","message":"I think it\u0027s better to use self.keymaster_config_path in the same way KmsKeyMaster._get_root_secret() does. At least then it\u0027s evident how it\u0027s supposed to be used. Or maybe make it a parameter for _get_root_secret(). Or, derive it from conf there. Either way, fewer magic members and more consistency is what I would like to see.","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"30b64708bde77d1d3e0e343fa4a69b56d670907e","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        :return: the encryption root secret binary bytes"},{"line_number":132,"context_line":"        :rtype: bytearray"},{"line_number":133,"context_line":"        \"\"\""},{"line_number":134,"context_line":"        keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":135,"context_line":"        if keymaster_config_path:"},{"line_number":136,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":137,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":26,"id":"3f1d235d_83bae8de","line":134,"in_reply_to":"3f1d235d_4617d0ee","updated":"2017-07-07 15:01:25.000000000","message":"Changed to use self.keymaster_config_path","commit_id":"5e9108ae445ea809f520ad896c16e7fb2986e592"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"e9b31943f81ff3dea6e5d4c83c78f11d3f6e95a3","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        :return: the encryption root secret binary bytes"},{"line_number":132,"context_line":"        :rtype: bytearray"},{"line_number":133,"context_line":"        \"\"\""},{"line_number":134,"context_line":"        self.keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":135,"context_line":"        if self.keymaster_config_path:"},{"line_number":136,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":137,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"3f1d235d_463df42a","line":134,"updated":"2017-07-07 20:59:36.000000000","message":"_Setting_ self.keymaster_config_path is unnecessary in this new version, right?\n\nBasically the question is if self.keymaster_config_path is a part of the _get_root_secret\u0027s protocol, or not. You have 2 of them and their implementations differ.","commit_id":"35d6137d152143e7bbe802406b894e0c8f8f807c"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6119863214d87a37c62240bae97a23acb78a54dd","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        :return: the encryption root secret binary bytes"},{"line_number":132,"context_line":"        :rtype: bytearray"},{"line_number":133,"context_line":"        \"\"\""},{"line_number":134,"context_line":"        self.keymaster_config_path \u003d conf.get(\u0027keymaster_config_path\u0027)"},{"line_number":135,"context_line":"        if self.keymaster_config_path:"},{"line_number":136,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":137,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"}],"source_content_type":"text/x-python","patch_set":27,"id":"3f1d235d_ed828900","line":134,"in_reply_to":"3f1d235d_463df42a","updated":"2017-07-10 07:13:18.000000000","message":"You\u0027re absolutely right! I was too quick to push the last round of changes and forgot to remove this line.","commit_id":"35d6137d152143e7bbe802406b894e0c8f8f807c"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        if self.keymaster_config_path:"},{"line_number":135,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":136,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"},{"line_number":137,"context_line":"                                 \u0027are other config options specified!\u0027)"},{"line_number":138,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027keymaster\u0027)"},{"line_number":139,"context_line":"        b64_root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":140,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":28,"id":"1f1a1f67_83b6cf3d","line":137,"range":{"start_line":137,"start_character":38,"end_line":137,"end_character":43},"updated":"2017-07-20 22:46:43.000000000","message":"looks like this already existed like this before, but why not call out exactly what \u0027other config option\u0027 is specified? This would not be a helpful error to give to an operator, it\u0027s the same as saying \"You did something wrong\"","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        if self.keymaster_config_path:"},{"line_number":135,"context_line":"            if any(opt in conf for opt in (\u0027encryption_root_secret\u0027,)):"},{"line_number":136,"context_line":"                raise ValueError(\u0027keymaster_config_path is set, but there \u0027"},{"line_number":137,"context_line":"                                 \u0027are other config options specified!\u0027)"},{"line_number":138,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027keymaster\u0027)"},{"line_number":139,"context_line":"        b64_root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":140,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":28,"id":"ff346bd7_4454c3ca","line":137,"range":{"start_line":137,"start_character":38,"end_line":137,"end_character":43},"in_reply_to":"1f1a1f67_83b6cf3d","updated":"2017-07-24 19:14:04.000000000","message":"I made the suggested change here in keymaster.py and in kms_keymaster.py. I also modified the unit test, since the error message now (slightly) changed.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"}],"swift/common/middleware/crypto/kms_keymaster.py":[{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"93901a9009252dd81e7fe8f82042696e51866560","unresolved":false,"context_lines":[{"line_number":20,"context_line":"from keymaster import KeyMaster"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"class KmsKeyMaster(KeyMaster):"},{"line_number":24,"context_line":"    \"\"\"Middleware for retrieving a encryption root secret from an external KMS."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    The middleware accesses the encryption root secret from an external key"}],"source_content_type":"text/x-python","patch_set":11,"id":"7a77a97e_fe9e23b7","line":23,"updated":"2016-11-21 14:57:25.000000000","message":"I extracted the Barbican-functionality to a separate class as per jrichli\u0027s suggestion, and this also allows avoiding conditionally importing castellan, oslo, and keystoneauth modules.","commit_id":"dc6ee818d0684cc630e697874402f9c2c0806aa6"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"93901a9009252dd81e7fe8f82042696e51866560","unresolved":false,"context_lines":[{"line_number":69,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":70,"context_line":"        options.enable_logging()"},{"line_number":71,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":72,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"},{"line_number":73,"context_line":"        return key.get_encoded()"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"7a77a97e_5e39d7d7","line":72,"updated":"2016-11-21 14:57:25.000000000","message":"acoles: I saw the four requests to the Barbican server as per your comment on patch set #6, and they seem to be two pairs of requests for metadata + data (payload). If I add some printouts in _get_root_secret_from_barbican() they only appear once in the logs, so I\u0027m still not sure if that matches your explanation of the pipeline being started twice, and if not, where the second pair of requests is coming from.","commit_id":"dc6ee818d0684cc630e697874402f9c2c0806aa6"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"fcadaa62d1dac37ec63b04cb608f8eed86ab64eb","unresolved":false,"context_lines":[{"line_number":40,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_barbican})"},{"line_number":41,"context_line":"        super(KmsKeyMaster, self).__init__(app, conf)"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    def _get_root_secret_from_barbican(self, barbican_conf):"},{"line_number":44,"context_line":"        \u0027\u0027\u0027"},{"line_number":45,"context_line":"        Only perform imports here, since we don\u0027t want to require castellan,"},{"line_number":46,"context_line":"        oslo_config and oslo_context unless we actually want to retrieve the"}],"source_content_type":"text/x-python","patch_set":12,"id":"5a74a57a_e01759eb","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":60},"updated":"2016-11-23 12:52:29.000000000","message":"I added traceback printouts [1] to see where this is called, and it looks like it is due to the swift start up process loading the proxy pipeline twice, as mentioned by acoles [2]. The two pairs of requests include one request for the secret metadata, and one request for the payload.\n[1] http://paste.openstack.org/show/590202/\n[2] https://review.openstack.org/#/c/364878/6/swift/common/middleware/crypto/keymaster.py@235","commit_id":"ee4e3150c57a8e8c04cfe3d86c5ff191ca3d1e89"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"167a7c2f8ea4e08a73539fe694072dac17d7160f","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        oslo_config and oslo_context unless we actually want to retrieve the"},{"line_number":47,"context_line":"        encryption_root_secret from an external KMS."},{"line_number":48,"context_line":"        \u0027\u0027\u0027"},{"line_number":49,"context_line":"        auth \u003d identity.Password("},{"line_number":50,"context_line":"            auth_url\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":51,"context_line":"            password\u003dbarbican_conf.get(\u0027barbican_password\u0027),"},{"line_number":52,"context_line":"            username\u003dbarbican_conf.get(\u0027barbican_username\u0027),"},{"line_number":53,"context_line":"            user_domain_id\u003dbarbican_conf.get(\u0027barbican_user_domain_id\u0027),"},{"line_number":54,"context_line":"            user_domain_name\u003dbarbican_conf.get(\u0027barbican_user_domain_name\u0027),"},{"line_number":55,"context_line":"            project_id\u003dbarbican_conf.get(\u0027barbican_project_id\u0027),"},{"line_number":56,"context_line":"            project_name\u003dbarbican_conf.get(\u0027barbican_project_name\u0027),"},{"line_number":57,"context_line":"            project_domain_id\u003dbarbican_conf.get("},{"line_number":58,"context_line":"                \u0027barbican_project_domain_id\u0027),"},{"line_number":59,"context_line":"            project_domain_name\u003dbarbican_conf.get("},{"line_number":60,"context_line":"                \u0027barbican_project_domain_name\u0027))"},{"line_number":61,"context_line":"        sess \u003d session.Session()"},{"line_number":62,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":63,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":64,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":65,"context_line":"        options.set_defaults("},{"line_number":66,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a74a57a_01ed84b6","line":63,"range":{"start_line":49,"start_character":0,"end_line":63,"end_character":71},"updated":"2016-11-28 20:20:45.000000000","message":"Here, instead of creating a context object, you should be able to use a password directly. That was added to support the Swift integration, since it was our understanding that Swift didn\u0027t use oslo context.\n\n\n        from castellan.common.credentials import keystone_password\n \n        username \u003d \u003cget from conf\u003e\n        password \u003d \u003cget from conf\u003e\n        project_name \u003d \u003cget from conf\u003e\n        user_domain_name \u003d \u003cget from conf\u003e\n        project_domain_name \u003d \u003cget from conf\u003e\n\n        ctxt \u003d keystone_password.KeystonePassword(\n            username\u003dusername, password\u003dpassword,\n            project_name\u003dproject_name,\n            user_domain_name\u003duser_domain_name,\n            project_domain_name\u003dproject_domain_name)","commit_id":"37ebf963daf3bca921ec3fe59d47366d61df16b7"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"bd46d4353a3fbea0a4c2f775459b5fcb0418ea1e","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        oslo_config and oslo_context unless we actually want to retrieve the"},{"line_number":47,"context_line":"        encryption_root_secret from an external KMS."},{"line_number":48,"context_line":"        \u0027\u0027\u0027"},{"line_number":49,"context_line":"        auth \u003d identity.Password("},{"line_number":50,"context_line":"            auth_url\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":51,"context_line":"            password\u003dbarbican_conf.get(\u0027barbican_password\u0027),"},{"line_number":52,"context_line":"            username\u003dbarbican_conf.get(\u0027barbican_username\u0027),"},{"line_number":53,"context_line":"            user_domain_id\u003dbarbican_conf.get(\u0027barbican_user_domain_id\u0027),"},{"line_number":54,"context_line":"            user_domain_name\u003dbarbican_conf.get(\u0027barbican_user_domain_name\u0027),"},{"line_number":55,"context_line":"            project_id\u003dbarbican_conf.get(\u0027barbican_project_id\u0027),"},{"line_number":56,"context_line":"            project_name\u003dbarbican_conf.get(\u0027barbican_project_name\u0027),"},{"line_number":57,"context_line":"            project_domain_id\u003dbarbican_conf.get("},{"line_number":58,"context_line":"                \u0027barbican_project_domain_id\u0027),"},{"line_number":59,"context_line":"            project_domain_name\u003dbarbican_conf.get("},{"line_number":60,"context_line":"                \u0027barbican_project_domain_name\u0027))"},{"line_number":61,"context_line":"        sess \u003d session.Session()"},{"line_number":62,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":63,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":64,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":65,"context_line":"        options.set_defaults("},{"line_number":66,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a74a57a_7f4dd5c2","line":63,"range":{"start_line":49,"start_character":0,"end_line":63,"end_character":71},"in_reply_to":"5a74a57a_01ed84b6","updated":"2016-11-29 11:20:21.000000000","message":"Thanks for the suggestion! I changed this in the latest patch.","commit_id":"37ebf963daf3bca921ec3fe59d47366d61df16b7"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"167a7c2f8ea4e08a73539fe694072dac17d7160f","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        sess \u003d session.Session()"},{"line_number":62,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":63,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":64,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":65,"context_line":"        options.set_defaults("},{"line_number":66,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":67,"context_line":"            barbican_endpoint\u003dbarbican_conf.get(\u0027barbican_endpoint\u0027),"},{"line_number":68,"context_line":"            barbican_api_version\u003dbarbican_conf.get(\u0027barbican_api_version\u0027),"},{"line_number":69,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":70,"context_line":"        options.enable_logging()"},{"line_number":71,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":72,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a74a57a_015d8414","line":69,"range":{"start_line":64,"start_character":8,"end_line":69,"end_character":62},"updated":"2016-11-28 20:20:45.000000000","message":"You should be able to have a [barbican] section in the keymaster config file, so that it looks like this:\n\n   [barbican]\n   auth_endpoint\u003d...\n   barbican_endpoint\u003d...\n   \n\nand pass the barbican_conf directly to castellan, and it should read the correct opts.\n\nThat way, it\u0027ll automatically expose any new future Castellan options automatically.\n\nYou could even have this in the swift config file, though I\u0027m assuming the barbican options were separated out on purpose for security reasons?","commit_id":"37ebf963daf3bca921ec3fe59d47366d61df16b7"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"038ab182c1dbc64ac6272425255ef3637da11b36","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        sess \u003d session.Session()"},{"line_number":62,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":63,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":64,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":65,"context_line":"        options.set_defaults("},{"line_number":66,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":67,"context_line":"            barbican_endpoint\u003dbarbican_conf.get(\u0027barbican_endpoint\u0027),"},{"line_number":68,"context_line":"            barbican_api_version\u003dbarbican_conf.get(\u0027barbican_api_version\u0027),"},{"line_number":69,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":70,"context_line":"        options.enable_logging()"},{"line_number":71,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":72,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a74a57a_70436013","line":69,"range":{"start_line":64,"start_character":8,"end_line":69,"end_character":62},"in_reply_to":"5a74a57a_015d8414","updated":"2016-11-28 22:08:00.000000000","message":"Looks like barbican_conf is a dict, and not an oslo_config object like I thought.  Please disregard this comment, seems like this is the best way to handle it for now","commit_id":"37ebf963daf3bca921ec3fe59d47366d61df16b7"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"bd46d4353a3fbea0a4c2f775459b5fcb0418ea1e","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        sess \u003d session.Session()"},{"line_number":62,"context_line":"        ctxt \u003d context.RequestContext(auth_token\u003dauth.get_token(sess),"},{"line_number":63,"context_line":"                                      tenant\u003dauth.get_project_id(sess))"},{"line_number":64,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":65,"context_line":"        options.set_defaults("},{"line_number":66,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":67,"context_line":"            barbican_endpoint\u003dbarbican_conf.get(\u0027barbican_endpoint\u0027),"},{"line_number":68,"context_line":"            barbican_api_version\u003dbarbican_conf.get(\u0027barbican_api_version\u0027),"},{"line_number":69,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":70,"context_line":"        options.enable_logging()"},{"line_number":71,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":72,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":14,"id":"5a74a57a_5fd9f9f1","line":69,"range":{"start_line":64,"start_character":8,"end_line":69,"end_character":62},"in_reply_to":"5a74a57a_70436013","updated":"2016-11-29 11:20:21.000000000","message":"I was hoping to be able to pass the whole conf to castellan, but like you said, since it\u0027s not an oslo_config object it doesn\u0027t seem to be possible currently.","commit_id":"37ebf963daf3bca921ec3fe59d47366d61df16b7"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_barbican})"},{"line_number":40,"context_line":"        super(KmsKeyMaster, self).__init__(app, conf)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    def _get_root_secret_from_barbican(self, barbican_conf):"},{"line_number":43,"context_line":"        \"\"\""},{"line_number":44,"context_line":"        Retrieves the root encryption secret from a Barbican key management"},{"line_number":45,"context_line":"        system using Castellan."}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_fb99ccd1","line":42,"updated":"2016-11-30 06:06:31.000000000","message":"Note castellan has a credential factory (https://github.com/openstack/castellan/blob/master/castellan/common/utils.py#L94) that already picks up those values from a file, so you won\u0027t need to do the \"conf.get\"","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":39,"context_line":"                {CRYPTO_CONFIG_BARBICAN: self._get_root_secret_from_barbican})"},{"line_number":40,"context_line":"        super(KmsKeyMaster, self).__init__(app, conf)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    def _get_root_secret_from_barbican(self, barbican_conf):"},{"line_number":43,"context_line":"        \"\"\""},{"line_number":44,"context_line":"        Retrieves the root encryption secret from a Barbican key management"},{"line_number":45,"context_line":"        system using Castellan."}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_2e8db77b","line":42,"in_reply_to":"5a74a57a_fb99ccd1","updated":"2016-11-30 13:53:31.000000000","message":"That\u0027s what Kaitlin suggested in her comments also (https://review.openstack.org/#/c/364878/14/swift/common/middleware/crypto/kms_keymaster.py@69), but since barbican_conf is a dict and not an oslo_config object, it doesn\u0027t seem possible to pass the options directly to castellan to be parsed? So (unfortunately) I think this will stay as it is for now.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":72,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":73,"context_line":"            barbican_endpoint\u003dbarbican_conf.get(\u0027barbican_endpoint\u0027),"},{"line_number":74,"context_line":"            barbican_api_version\u003dbarbican_conf.get(\u0027barbican_api_version\u0027),"},{"line_number":75,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":76,"context_line":"        options.enable_logging()"},{"line_number":77,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":78,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_46dd5b41","line":75,"range":{"start_line":75,"start_character":41,"end_line":75,"end_character":49},"updated":"2016-11-30 20:26:11.000000000","message":"I would call this key_manager_api_class because someone could theoretically change the value to something non-barbican related.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":72,"context_line":"            conf, auth_endpoint\u003dbarbican_conf.get(\u0027barbican_auth_url\u0027),"},{"line_number":73,"context_line":"            barbican_endpoint\u003dbarbican_conf.get(\u0027barbican_endpoint\u0027),"},{"line_number":74,"context_line":"            barbican_api_version\u003dbarbican_conf.get(\u0027barbican_api_version\u0027),"},{"line_number":75,"context_line":"            api_class\u003dbarbican_conf.get(\u0027barbican_api_class\u0027))"},{"line_number":76,"context_line":"        options.enable_logging()"},{"line_number":77,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":78,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_1c7734a0","line":75,"range":{"start_line":75,"start_character":41,"end_line":75,"end_character":49},"in_reply_to":"5a74a57a_46dd5b41","updated":"2016-11-30 21:18:52.000000000","message":"Fixed.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"2293cbdaa3a6a4b4873faffa832741a48d941472","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        options.enable_logging()"},{"line_number":77,"context_line":"        manager \u003d key_manager.API(conf)"},{"line_number":78,"context_line":"        key \u003d manager.get(ctxt, barbican_conf.get(\u0027barbican_key_id\u0027))"},{"line_number":79,"context_line":"        if (key.bit_length \u003c 256) or (key.algorithm.lower() !\u003d \"aes\"):"},{"line_number":80,"context_line":"            raise ValueError(\u0027encryption root secret stored in Barbican must \u0027"},{"line_number":81,"context_line":"                             \u0027be an AES key of at least 256 bits (provided key\u0027"},{"line_number":82,"context_line":"                             \u0027 length: %d, provided key algorithm: %s)\u0027"},{"line_number":83,"context_line":"                             % (key.bit_length, key.algorithm))"},{"line_number":84,"context_line":"        encoded_key \u003d key.get_encoded()"},{"line_number":85,"context_line":"        return encoded_key"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_dbba396e","line":83,"range":{"start_line":79,"start_character":0,"end_line":83,"end_character":63},"updated":"2016-11-30 14:20:09.000000000","message":"The documentation in overview_encryption.rst was modified to indicate that the format for storing the root secret in Barbican shall be:\n-in binary format (\"application/octet-stream\" instead of \"text/plain\")\n-as a symmetric key (previously \"opaque\")\n-CTR mode (previously \"CBC\")\n-256 bit length, AES (as before)\nThe bit length and algorithm are now checked here.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    \"\"\"Middleware for retrieving a encryption root secret from an external KMS."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    The middleware accesses the encryption root secret from an external key"},{"line_number":27,"context_line":"    management system (KMS), e.g., a Barbican service, using Castellan. To be"},{"line_number":28,"context_line":"    able to do so, the appropriate configuration options shall be set in the"},{"line_number":29,"context_line":"    proxy-server.conf file, or in the configuration pointed to using the"},{"line_number":30,"context_line":"    keymaster_config_path configuration value in the proxy-server.conf file."}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_7b496e30","line":27,"range":{"start_line":27,"start_character":29,"end_line":27,"end_character":34},"updated":"2016-12-16 17:25:07.000000000","message":"\"i.e.\" is more appropriate, since all over the code we\u0027re specific that it\u0027s barbican","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    \"\"\"Middleware for retrieving a encryption root secret from an external KMS."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    The middleware accesses the encryption root secret from an external key"},{"line_number":27,"context_line":"    management system (KMS), e.g., a Barbican service, using Castellan. To be"},{"line_number":28,"context_line":"    able to do so, the appropriate configuration options shall be set in the"},{"line_number":29,"context_line":"    proxy-server.conf file, or in the configuration pointed to using the"},{"line_number":30,"context_line":"    keymaster_config_path configuration value in the proxy-server.conf file."}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_e2564605","line":27,"range":{"start_line":27,"start_character":29,"end_line":27,"end_character":34},"in_reply_to":"1a6eadb0_7b496e30","updated":"2016-12-20 15:44:28.000000000","message":"I actually left this as-is, but changed most other Barbican references to a more generic \"KMS\". I also moved the handling of the only two Barbican-specific configuration parameters to a new, separate BarbicanKmsKeymaster class","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"CRYPTO_CONFIG_KMS \u003d \u0027kms\u0027"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"class KmsKeyMaster(KeyMaster):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_ea9392a1","line":20,"updated":"2017-01-03 13:36:13.000000000","message":"I think this value should be \u0027barbican\u0027","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"CRYPTO_CONFIG_KMS \u003d \u0027kms\u0027"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"class KmsKeyMaster(KeyMaster):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_449b1c18","line":20,"in_reply_to":"ba5201f7_79a8f477","updated":"2017-01-10 10:35:19.000000000","message":"I will keep the naming generic, since the only two barbican-specific (at least by name) variables have been removed in the next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"CRYPTO_CONFIG_KMS \u003d \u0027kms\u0027"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"class KmsKeyMaster(KeyMaster):"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_79a8f477","line":20,"in_reply_to":"ba5201f7_ea9392a1","updated":"2017-01-05 17:14:15.000000000","message":"or..should the docs show the  sample config as using \"kms\"...either way there is an inconsistency.\n\nIMHO If this class is generic (may be used with backends other than barbican, then keep its naming generic.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        system using Castellan."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        :param kms_conf: the KMS client configuration options"},{"line_number":61,"context_line":"        :type kms_conf: dict"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        :return encoded_key: binary root encryption secret"},{"line_number":64,"context_line":"        :rtype encoded_key: bytearray"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_38c182e5","line":61,"updated":"2017-01-03 13:36:13.000000000","message":"keymaster_config_path is not being used, this can be removed after changes mentioned in keymaster.py line#131","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        system using Castellan."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        :param kms_conf: the KMS client configuration options"},{"line_number":61,"context_line":"        :type kms_conf: dict"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        :return encoded_key: binary root encryption secret"},{"line_number":64,"context_line":"        :rtype encoded_key: bytearray"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_c148a58d","line":61,"in_reply_to":"ba5201f7_38c182e5","updated":"2017-01-10 10:35:19.000000000","message":"Removed in next patch.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        :return encoded_key: binary root encryption secret"},{"line_number":64,"context_line":"        :rtype encoded_key: bytearray"},{"line_number":65,"context_line":"        \"\"\""},{"line_number":66,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":67,"context_line":"            username\u003dkms_conf.get(\u0027kms_username\u0027),"},{"line_number":68,"context_line":"            password\u003dkms_conf.get(\u0027kms_password\u0027),"},{"line_number":69,"context_line":"            project_name\u003dkms_conf.get(\u0027kms_project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_f9a14447","line":66,"updated":"2017-01-05 17:14:15.000000000","message":"Ideally we would drop all the knm_prefixes and take kms_conf (a dict) and pass it\u0027s members to KeystonePassword so that we could transparently handle any \"special\" options iwhout having to enumerate them all here.\n\n ctxt \u003d keystone_password.KeystonePassword(**kms_conf)\n\nHowever, I\u0027m not sure if that is supported by KeytsonePassword since it does not have a **kwargs arg and would I expect raise an error due to unexpected items in kms_conf","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        :return encoded_key: binary root encryption secret"},{"line_number":64,"context_line":"        :rtype encoded_key: bytearray"},{"line_number":65,"context_line":"        \"\"\""},{"line_number":66,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":67,"context_line":"            username\u003dkms_conf.get(\u0027kms_username\u0027),"},{"line_number":68,"context_line":"            password\u003dkms_conf.get(\u0027kms_password\u0027),"},{"line_number":69,"context_line":"            project_name\u003dkms_conf.get(\u0027kms_project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_b924f10c","line":66,"in_reply_to":"ba5201f7_f9a14447","updated":"2017-01-10 10:35:19.000000000","message":"Passing the dict (or an oslo config object) parsed from the keymaster config file to KeystonePassword would definitely be the easiest approach for us, for being able to support possible new parameters in KeystonePassword without having to modify our code.\n\nHowever, I see two issues:\n1) KeystonePassword does not currently support this (as you point out)\n2) We should ideally only pass KeystonePassword-related options to KeystonePassword - currently our dict contains options for i) KeystonePassword, ii) options for the castellan backend (api_class etc.), and iii) the kms_key_id\n\nFor 2), if we pass everything to all the components, we need to make sure that they only handle what they need and don\u0027t complain about extra parameters. On the other hand, if we just want to pass them the parameters they care about, we need to know which ones to pass where. Having them in different sections would I suppose be one alternative, or having different prefixes for the different value (which we would strip off) would be another alternative.\n\nFor the moment, I am leaning towards keeping things as-is, apart from dropping the kms_ prefixes as you suggested (so that our parameters have the same names as the ones in castellan etc.). If/when the functionality is added to castellan KeystonePassword and options, we could revisit this topic.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":78,"context_line":"            project_id\u003dkms_conf.get(\u0027kms_project_id\u0027),"},{"line_number":79,"context_line":"            project_domain_id\u003dkms_conf.get(\u0027kms_project_domain_id\u0027),"},{"line_number":80,"context_line":"            reauthenticate\u003dkms_conf.get(\u0027kms_reauthenticate\u0027))"},{"line_number":81,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":82,"context_line":"        options.set_defaults("},{"line_number":83,"context_line":"            conf, auth_endpoint\u003dkms_conf.get(\u0027kms_auth_url\u0027),"},{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_c3078d1a","line":81,"updated":"2017-01-03 18:01:52.000000000","message":"(see comment in barbican_keymaster...) If this is a self.conf assigned in the __init__ then a subclass can add specific options in an override of _get_root_secret_from_kms - then no need for _set_backend_specific_options.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":78,"context_line":"            project_id\u003dkms_conf.get(\u0027kms_project_id\u0027),"},{"line_number":79,"context_line":"            project_domain_id\u003dkms_conf.get(\u0027kms_project_domain_id\u0027),"},{"line_number":80,"context_line":"            reauthenticate\u003dkms_conf.get(\u0027kms_reauthenticate\u0027))"},{"line_number":81,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":82,"context_line":"        options.set_defaults("},{"line_number":83,"context_line":"            conf, auth_endpoint\u003dkms_conf.get(\u0027kms_auth_url\u0027),"},{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_849b4465","line":81,"in_reply_to":"ba5201f7_c3078d1a","updated":"2017-01-10 10:35:19.000000000","message":"Since we\u0027re going to back to a single kms_keymaster, this is no longer relevant.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":79,"context_line":"            project_domain_id\u003dkms_conf.get(\u0027kms_project_domain_id\u0027),"},{"line_number":80,"context_line":"            reauthenticate\u003dkms_conf.get(\u0027kms_reauthenticate\u0027))"},{"line_number":81,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":82,"context_line":"        options.set_defaults("},{"line_number":83,"context_line":"            conf, auth_endpoint\u003dkms_conf.get(\u0027kms_auth_url\u0027),"},{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"},{"line_number":85,"context_line":"            # The following two parameters are specific to Barbican backends:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_dc9c6e10","line":82,"updated":"2017-01-05 17:14:15.000000000","message":"again, it would be nice here if we could just pass our kms_conf dict to the method and have the appropriate options transperently applied. But I don\u0027t yet see  way to do that.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":79,"context_line":"            project_domain_id\u003dkms_conf.get(\u0027kms_project_domain_id\u0027),"},{"line_number":80,"context_line":"            reauthenticate\u003dkms_conf.get(\u0027kms_reauthenticate\u0027))"},{"line_number":81,"context_line":"        conf \u003d cfg.ConfigOpts()"},{"line_number":82,"context_line":"        options.set_defaults("},{"line_number":83,"context_line":"            conf, auth_endpoint\u003dkms_conf.get(\u0027kms_auth_url\u0027),"},{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"},{"line_number":85,"context_line":"            # The following two parameters are specific to Barbican backends:"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_84b264e3","line":82,"in_reply_to":"ba5201f7_dc9c6e10","updated":"2017-01-10 10:35:19.000000000","message":"Comment addressed in reply above.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5eb5cc523a5884f6a721774d85a048543c607cfe","unresolved":false,"context_lines":[{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"},{"line_number":85,"context_line":"            # The following two parameters are specific to Barbican backends:"},{"line_number":86,"context_line":"            barbican_endpoint\u003dkms_conf.get(\u0027kms_barbican_endpoint\u0027),"},{"line_number":87,"context_line":"            barbican_api_version\u003dkms_conf.get(\u0027kms_barbican_api_version\u0027)"},{"line_number":88,"context_line":"        )"},{"line_number":89,"context_line":"        self._set_backend_specific_options(conf, kms_conf)"},{"line_number":90,"context_line":"        options.enable_logging()"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_5e0d3236","line":87,"updated":"2017-01-03 18:01:52.000000000","message":"should these be here? they get set in the barbican keymaster too and the comment implies they don\u0027t belong here.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":84,"context_line":"            api_class\u003dkms_conf.get(\u0027kms_key_manager_api_class\u0027),"},{"line_number":85,"context_line":"            # The following two parameters are specific to Barbican backends:"},{"line_number":86,"context_line":"            barbican_endpoint\u003dkms_conf.get(\u0027kms_barbican_endpoint\u0027),"},{"line_number":87,"context_line":"            barbican_api_version\u003dkms_conf.get(\u0027kms_barbican_api_version\u0027)"},{"line_number":88,"context_line":"        )"},{"line_number":89,"context_line":"        self._set_backend_specific_options(conf, kms_conf)"},{"line_number":90,"context_line":"        options.enable_logging()"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_24637843","line":87,"in_reply_to":"ba5201f7_5e0d3236","updated":"2017-01-10 10:35:19.000000000","message":"These will be remove, since for the regular case, the barbican endpoint and api version will be retrieved from Keystone.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3ed11f543fe703c2c78406657e16eb2fedc4d062","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                             \u0027KMS must be an AES key of at least 256 bits \u0027"},{"line_number":96,"context_line":"                             \u0027(provided key length: %d, provided key \u0027"},{"line_number":97,"context_line":"                             \u0027algorithm: %s)\u0027"},{"line_number":98,"context_line":"                             % (key.bit_length, key.algorithm))"},{"line_number":99,"context_line":"        encoded_key \u003d key.get_encoded()"},{"line_number":100,"context_line":"        return encoded_key"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_f754ebfe","line":98,"updated":"2017-01-05 17:14:15.000000000","message":"when i first tried this version I saw an AttributeError from OpaqueData - the reason was that I still had a base64 encoded string stored as the secret (from version 6 of the patchset) rather than 256 bit binary.\n\nIt took me a while to debug, so might be worth adding a check that we have the right type of secret returned.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                             \u0027KMS must be an AES key of at least 256 bits \u0027"},{"line_number":96,"context_line":"                             \u0027(provided key length: %d, provided key \u0027"},{"line_number":97,"context_line":"                             \u0027algorithm: %s)\u0027"},{"line_number":98,"context_line":"                             % (key.bit_length, key.algorithm))"},{"line_number":99,"context_line":"        encoded_key \u003d key.get_encoded()"},{"line_number":100,"context_line":"        return encoded_key"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_1c5cd2ec","line":98,"in_reply_to":"ba5201f7_f754ebfe","updated":"2017-01-10 10:35:19.000000000","message":"Added a check, and also a new test.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    def __init__(self, app, conf):"},{"line_number":33,"context_line":"        # Call the superclass __init__() method, which calls the overridden"},{"line_number":34,"context_line":"        # self._get_root_secret() below."},{"line_number":35,"context_line":"        super(KmsKeyMaster, self).__init__(app, conf)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    def _get_root_secret(self, conf):"}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_c1a4794d","line":34,"updated":"2017-04-12 12:44:33.000000000","message":"+1 for the comment","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    def __init__(self, app, conf):"},{"line_number":33,"context_line":"        # Call the superclass __init__() method, which calls the overridden"},{"line_number":34,"context_line":"        # self._get_root_secret() below."},{"line_number":35,"context_line":"        super(KmsKeyMaster, self).__init__(app, conf)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    def _get_root_secret(self, conf):"}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_5102e63e","line":34,"in_reply_to":"bff0334d_c1a4794d","updated":"2017-04-19 18:26:37.000000000","message":"Thx!","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        options.enable_logging()"},{"line_number":74,"context_line":"        manager \u003d key_manager.API(oslo_conf)"},{"line_number":75,"context_line":"        key \u003d manager.get(ctxt, conf.get(\u0027key_id\u0027))"},{"line_number":76,"context_line":"        if (key.bit_length \u003c 256) or (key.algorithm.lower() !\u003d \"aes\"):"},{"line_number":77,"context_line":"            raise ValueError(\u0027encryption root secret stored in the external \u0027"},{"line_number":78,"context_line":"                             \u0027KMS must be an AES key of at least 256 bits \u0027"},{"line_number":79,"context_line":"                             \u0027(provided key length: %d, provided key \u0027"}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_8bc1f256","line":76,"updated":"2017-04-12 12:44:33.000000000","message":"I saw an error here:\n\n  AttributeError: \u0027OpaqueData\u0027 object has no attribute \u0027bit_length\u0027\n\nbecause the secret I was specifying had been stored using secret-type plain.\n\nThis was my mistake - the doc does say that the secret type should be symmetric and the example shows that, I just happened to have an older secret stored. However, I wonder if it is possible to wrap this in a try/except and provide a more useful error message? Or is it possible to test the type of key?","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        options.enable_logging()"},{"line_number":74,"context_line":"        manager \u003d key_manager.API(oslo_conf)"},{"line_number":75,"context_line":"        key \u003d manager.get(ctxt, conf.get(\u0027key_id\u0027))"},{"line_number":76,"context_line":"        if (key.bit_length \u003c 256) or (key.algorithm.lower() !\u003d \"aes\"):"},{"line_number":77,"context_line":"            raise ValueError(\u0027encryption root secret stored in the external \u0027"},{"line_number":78,"context_line":"                             \u0027KMS must be an AES key of at least 256 bits \u0027"},{"line_number":79,"context_line":"                             \u0027(provided key length: %d, provided key \u0027"}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_7105e245","line":76,"in_reply_to":"bff0334d_8bc1f256","updated":"2017-04-19 18:26:37.000000000","message":"I added a check for the key type, and also if the key is none. In both cases a ValueError will be raised, with a hopefully more informative message. I will work on adding the corresponding unit tests also.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            user_domain_name\u003dconf.get(\u0027user_domain_name\u0027),"},{"line_number":58,"context_line":"            project_domain_name\u003dconf.get("},{"line_number":59,"context_line":"                \u0027project_domain_name\u0027),"},{"line_number":60,"context_line":"            user_id\u003dconf.get(\u0027user_id\u0027),"},{"line_number":61,"context_line":"            user_domain_id\u003dconf.get(\u0027user_domain_id\u0027),"},{"line_number":62,"context_line":"            trust_id\u003dconf.get(\u0027trust_id\u0027),"},{"line_number":63,"context_line":"            domain_id\u003dconf.get(\u0027domain_id\u0027),"}],"source_content_type":"text/x-python","patch_set":28,"id":"1f1a1f67_c3ac99ee","line":60,"range":{"start_line":60,"start_character":12,"end_line":60,"end_character":39},"updated":"2017-07-20 22:46:43.000000000","message":"sample config does not detail some of these options, should it?","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            user_domain_name\u003dconf.get(\u0027user_domain_name\u0027),"},{"line_number":58,"context_line":"            project_domain_name\u003dconf.get("},{"line_number":59,"context_line":"                \u0027project_domain_name\u0027),"},{"line_number":60,"context_line":"            user_id\u003dconf.get(\u0027user_id\u0027),"},{"line_number":61,"context_line":"            user_domain_id\u003dconf.get(\u0027user_domain_id\u0027),"},{"line_number":62,"context_line":"            trust_id\u003dconf.get(\u0027trust_id\u0027),"},{"line_number":63,"context_line":"            domain_id\u003dconf.get(\u0027domain_id\u0027),"}],"source_content_type":"text/x-python","patch_set":28,"id":"ff346bd7_ab5902ff","line":60,"range":{"start_line":60,"start_character":12,"end_line":60,"end_character":39},"in_reply_to":"1f1a1f67_c3ac99ee","updated":"2017-07-24 19:14:04.000000000","message":"Modified the sample config to include the options that were not previously mentioned, and pointed to Keystone docs for descriptions and usage information.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":86,"context_line":"            if (key.format !\u003d \u0027RAW\u0027):"},{"line_number":87,"context_line":"                raise ValueError(\u0027encryption root secret stored in the \u0027"},{"line_number":88,"context_line":"                                 \u0027external KMS must be in RAW format and not \u0027"},{"line_number":89,"context_line":"                                 \u0027e.g., as a base64 encoded string (format of \u0027"},{"line_number":90,"context_line":"                                 \u0027key with uuid %s: %s)\u0027 %"},{"line_number":91,"context_line":"                                 (conf.get(\u0027key_id\u0027), key.format))"},{"line_number":92,"context_line":"        except Exception:"}],"source_content_type":"text/x-python","patch_set":28,"id":"1f1a1f67_0ba5b1b5","line":89,"range":{"start_line":89,"start_character":45,"end_line":89,"end_character":51},"updated":"2017-07-20 22:46:43.000000000","message":"this could be confusing to users since the docs we tell them to create key with \u0027--payload-content-encoding\u003d\"base64\"\u0027 option","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":86,"context_line":"            if (key.format !\u003d \u0027RAW\u0027):"},{"line_number":87,"context_line":"                raise ValueError(\u0027encryption root secret stored in the \u0027"},{"line_number":88,"context_line":"                                 \u0027external KMS must be in RAW format and not \u0027"},{"line_number":89,"context_line":"                                 \u0027e.g., as a base64 encoded string (format of \u0027"},{"line_number":90,"context_line":"                                 \u0027key with uuid %s: %s)\u0027 %"},{"line_number":91,"context_line":"                                 (conf.get(\u0027key_id\u0027), key.format))"},{"line_number":92,"context_line":"        except Exception:"}],"source_content_type":"text/x-python","patch_set":28,"id":"ff346bd7_557a3724","line":89,"range":{"start_line":89,"start_character":45,"end_line":89,"end_character":51},"in_reply_to":"1f1a1f67_0ba5b1b5","updated":"2017-07-24 19:14:04.000000000","message":"For the scenario of migrating an existing root secret from the config file to Barbican, the key material is in base64 format. The \u0027payload-content-encoding\u0027 is used to tell Barbican the format of the key material we are providing, but the \u0027payload-content-type\u0027 of \u0027application/octet-stream\u0027 tells Barbican to store the key material as binary data. This also follows the example in https://docs.openstack.org/barbican/latest/api/reference/secret_types.html","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"eb684ac7baccfbeaaf36afde64a7a2448b0d2ddf","unresolved":false,"context_lines":[{"line_number":90,"context_line":"                                 \u0027key with uuid %s: %s)\u0027 %"},{"line_number":91,"context_line":"                                 (conf.get(\u0027key_id\u0027), key.format))"},{"line_number":92,"context_line":"        except Exception:"},{"line_number":93,"context_line":"            raise ValueError(\"Secret with key_id \u0027%s\u0027 is not a symmetric key \""},{"line_number":94,"context_line":"                             \"(type: %s)\" % (conf.get(\u0027key_id\u0027),"},{"line_number":95,"context_line":"                                             str(type(key))))"},{"line_number":96,"context_line":"        return key.get_encoded()"}],"source_content_type":"text/x-python","patch_set":28,"id":"1f1a1f67_2b898d25","line":93,"range":{"start_line":93,"start_character":30,"end_line":93,"end_character":76},"updated":"2017-07-20 22:46:43.000000000","message":"this! I think we said in the docs that this is not checked....","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"307bf3c3b350255abeeeac1480e14bbdc0e1cf47","unresolved":false,"context_lines":[{"line_number":90,"context_line":"                                 \u0027key with uuid %s: %s)\u0027 %"},{"line_number":91,"context_line":"                                 (conf.get(\u0027key_id\u0027), key.format))"},{"line_number":92,"context_line":"        except Exception:"},{"line_number":93,"context_line":"            raise ValueError(\"Secret with key_id \u0027%s\u0027 is not a symmetric key \""},{"line_number":94,"context_line":"                             \"(type: %s)\" % (conf.get(\u0027key_id\u0027),"},{"line_number":95,"context_line":"                                             str(type(key))))"},{"line_number":96,"context_line":"        return key.get_encoded()"}],"source_content_type":"text/x-python","patch_set":28,"id":"ff346bd7_1574af34","line":93,"range":{"start_line":93,"start_character":30,"end_line":93,"end_character":76},"in_reply_to":"1f1a1f67_2b898d25","updated":"2017-07-24 19:14:04.000000000","message":"Fixed the docs.","commit_id":"a8fa7373dcdbe784aa1449f389f4cc475e308a30"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"bfec0813b50a9a060420f37f4c5a7805bc4a6172","unresolved":false,"context_lines":[{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":"from castellan import key_manager, options"},{"line_number":16,"context_line":"from castellan.common.credentials import keystone_password"},{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":"from swift.common.utils import readconf"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"ff346bd7_c9541ccd","line":17,"range":{"start_line":17,"start_character":5,"end_line":17,"end_character":16},"updated":"2017-07-25 17:19:13.000000000","message":"Given that we now import from oslo_config, we might want to list *that* in setup.cfg\u0027s extras, too. Then even if castellan drops oslo.config as a dep in some future release (as unlikely as that seems), we won\u0027t hit import errors.","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"fe173f4490f2e4501c2c8cc7185612df2287e076","unresolved":false,"context_lines":[{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":"from castellan import key_manager, options"},{"line_number":16,"context_line":"from castellan.common.credentials import keystone_password"},{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":"from swift.common.utils import readconf"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"ff346bd7_fb179f50","line":17,"range":{"start_line":17,"start_character":5,"end_line":17,"end_character":16},"in_reply_to":"ff346bd7_c9541ccd","updated":"2017-07-25 21:46:51.000000000","message":"That makes sense.","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"bfec0813b50a9a060420f37f4c5a7805bc4a6172","unresolved":false,"context_lines":[{"line_number":15,"context_line":"from castellan import key_manager, options"},{"line_number":16,"context_line":"from castellan.common.credentials import keystone_password"},{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":"from swift.common.utils import readconf"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"ff346bd7_ce2e62a4","line":18,"range":{"start_line":18,"start_character":5,"end_line":18,"end_character":14},"updated":"2017-07-25 17:19:13.000000000","message":"What\u0027s this package? Do we mean\n\n from .keymaster import KeyMaster\n\n? Or maybe\n\n from swift.common.middleware.crypto.keymaster import KeyMaster\n\n? Eh, I guess if it works...","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"ea4d1776b728a13a0368c5c8f31143a2846fa9fa","unresolved":false,"context_lines":[{"line_number":15,"context_line":"from castellan import key_manager, options"},{"line_number":16,"context_line":"from castellan.common.credentials import keystone_password"},{"line_number":17,"context_line":"from oslo_config import cfg"},{"line_number":18,"context_line":"from keymaster import KeyMaster"},{"line_number":19,"context_line":"from swift.common.utils import readconf"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""}],"source_content_type":"text/x-python","patch_set":29,"id":"df3967d1_33730650","line":18,"range":{"start_line":18,"start_character":5,"end_line":18,"end_character":14},"in_reply_to":"ff346bd7_ce2e62a4","updated":"2017-08-02 10:18:44.000000000","message":"I\u0027ll go with the second option!","commit_id":"a0105767b84d25d7fd5be82b3e8f9f1279376bd2"}],"test-requirements.txt":[{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"93901a9009252dd81e7fe8f82042696e51866560","unresolved":false,"context_lines":[{"line_number":22,"context_line":"bandit\u003e\u003d1.1.0 # Apache-2.0"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# Tests for root encryption secret in Barbican"},{"line_number":25,"context_line":"castellan"}],"source_content_type":"text/plain","patch_set":11,"id":"7a77a97e_1ef2ff06","line":25,"updated":"2016-11-21 14:57:25.000000000","message":"After removing the conditional imports for the barbican functionality, castellan is required for tests. The barbican client, oslo config etc. are mocked in the unit tests, so there is no need to add them here.","commit_id":"dc6ee818d0684cc630e697874402f9c2c0806aa6"}],"test/functional/mock_swift_key_manager.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    This mock key manager implementation extends the Castellan mock key"},{"line_number":23,"context_line":"    manager with support for a pre-existing key that the Swift proxy server"},{"line_number":24,"context_line":"    can used as the root encryption secret. The actual key material bytes"},{"line_number":25,"context_line":"    for the root encryption secret changes each time this mock key manager is"},{"line_number":26,"context_line":"    instantiated, meaning that data written earlier is no longer accessible"},{"line_number":27,"context_line":"    once the proxy server is restarted."}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_616b6df0","line":24,"updated":"2017-04-12 12:44:33.000000000","message":"nit: s/used/use/","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    This mock key manager implementation extends the Castellan mock key"},{"line_number":23,"context_line":"    manager with support for a pre-existing key that the Swift proxy server"},{"line_number":24,"context_line":"    can used as the root encryption secret. The actual key material bytes"},{"line_number":25,"context_line":"    for the root encryption secret changes each time this mock key manager is"},{"line_number":26,"context_line":"    instantiated, meaning that data written earlier is no longer accessible"},{"line_number":27,"context_line":"    once the proxy server is restarted."}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_6ee85fe1","line":24,"in_reply_to":"bff0334d_616b6df0","updated":"2017-04-19 18:26:37.000000000","message":"Fixed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    setting it in the PYTHONPATH environment variable before starting the"},{"line_number":40,"context_line":"    proxy server."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    This key manager is not suitable for use in production deployments."},{"line_number":43,"context_line":"    \"\"\""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    def __init__(self, configuration\u003dNone):"}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_c100f904","line":42,"updated":"2017-04-12 12:44:33.000000000","message":"!! lol","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    setting it in the PYTHONPATH environment variable before starting the"},{"line_number":40,"context_line":"    proxy server."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    This key manager is not suitable for use in production deployments."},{"line_number":43,"context_line":"    \"\"\""},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    def __init__(self, configuration\u003dNone):"}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_4ee5a308","line":42,"in_reply_to":"bff0334d_c100f904","updated":"2017-04-19 18:26:37.000000000","message":"A new random root encryption secret is generated each time the mock keymaster is started, so you effectively get secure deletion (of everything!) by restarting the keymaster.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"}],"test/unit/common/middleware/crypto/test_barbican.py":[{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"554de7427dc48eed73ead19b89f9ecbb7e6a1570","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        return dict()"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"class TestBarbican(unittest.TestCase):"},{"line_number":140,"context_line":"    \"\"\""},{"line_number":141,"context_line":"    Unit tests for storing the encryption root secret in a Barbican external"},{"line_number":142,"context_line":"    key management system accessed using Castellan."}],"source_content_type":"text/x-python","patch_set":8,"id":"9a629dbe_2e5736cf","line":139,"range":{"start_line":139,"start_character":0,"end_line":139,"end_character":38},"updated":"2016-11-09 09:24:13.000000000","message":"I (temporarily) removed a bunch of error path tests that no longer worked due to the reworking of the keymaster. I will work on adding them back after getting some feedback on the keymaster changes.","commit_id":"ee8918e7c16edf2196985ac76c518bbc0be9d7f5"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"cc0ab6d175842a568f354592e849a99689b17249","unresolved":false,"context_lines":[{"line_number":48,"context_line":"    return start_response, calls"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"def MockCastellanApi_side_effect(*args, **kwargs):"},{"line_number":52,"context_line":"    return MockBarbicanKeyManager(args[0])"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"def MockOptionsSetDefaults_side_effect(*args, **kwargs):"},{"line_number":56,"context_line":"    \u0027\u0027\u0027"},{"line_number":57,"context_line":"    Add options from kwargs into args dict."},{"line_number":58,"context_line":"    \u0027\u0027\u0027"},{"line_number":59,"context_line":"    args[0].update(kwargs)"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"def MockConfigOpts_side_effect(*args, **kwargs):"},{"line_number":63,"context_line":"    return dict()"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"def MockKeystonePassword_side_effect(username, password, project_name,"},{"line_number":67,"context_line":"                                     user_domain_name, project_domain_name,"},{"line_number":68,"context_line":"                                     user_id, user_domain_id, trust_id,"},{"line_number":69,"context_line":"                                     domain_id, domain_name, project_id,"},{"line_number":70,"context_line":"                                     project_domain_id, reauthenticate):"},{"line_number":71,"context_line":"    return MockPassword(username, password, project_name, user_domain_name,"},{"line_number":72,"context_line":"                        project_domain_name, user_id, user_domain_id, trust_id,"},{"line_number":73,"context_line":"                        domain_id, domain_name, project_id, project_domain_id,"},{"line_number":74,"context_line":"                        reauthenticate)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"class MockBarbicanKeyManager(object):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_5b800047","line":74,"range":{"start_line":51,"start_character":0,"end_line":74,"end_character":39},"updated":"2016-11-30 06:06:31.000000000","message":"All these function names can be cleaned up to look nicer. Don\u0027t need to e in capital since not class names.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"8bc6f0874677a8a365786762566483f579d59675","unresolved":false,"context_lines":[{"line_number":48,"context_line":"    return start_response, calls"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"def MockCastellanApi_side_effect(*args, **kwargs):"},{"line_number":52,"context_line":"    return MockBarbicanKeyManager(args[0])"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"def MockOptionsSetDefaults_side_effect(*args, **kwargs):"},{"line_number":56,"context_line":"    \u0027\u0027\u0027"},{"line_number":57,"context_line":"    Add options from kwargs into args dict."},{"line_number":58,"context_line":"    \u0027\u0027\u0027"},{"line_number":59,"context_line":"    args[0].update(kwargs)"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"def MockConfigOpts_side_effect(*args, **kwargs):"},{"line_number":63,"context_line":"    return dict()"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"def MockKeystonePassword_side_effect(username, password, project_name,"},{"line_number":67,"context_line":"                                     user_domain_name, project_domain_name,"},{"line_number":68,"context_line":"                                     user_id, user_domain_id, trust_id,"},{"line_number":69,"context_line":"                                     domain_id, domain_name, project_id,"},{"line_number":70,"context_line":"                                     project_domain_id, reauthenticate):"},{"line_number":71,"context_line":"    return MockPassword(username, password, project_name, user_domain_name,"},{"line_number":72,"context_line":"                        project_domain_name, user_id, user_domain_id, trust_id,"},{"line_number":73,"context_line":"                        domain_id, domain_name, project_id, project_domain_id,"},{"line_number":74,"context_line":"                        reauthenticate)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"class MockBarbicanKeyManager(object):"}],"source_content_type":"text/x-python","patch_set":15,"id":"5a74a57a_39dc2b18","line":74,"range":{"start_line":51,"start_character":0,"end_line":74,"end_character":39},"in_reply_to":"5a74a57a_5b800047","updated":"2016-11-30 13:53:31.000000000","message":"Renamed in next patch.","commit_id":"f9b178f9b29d732728b86c1d48923add30f2d941"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"2e25bcd018f22e0cbcf48df543688c0f25785aa8","unresolved":false,"context_lines":[{"line_number":130,"context_line":"            from castellan.common.exception. To avoid this import, raising a"},{"line_number":131,"context_line":"            general Exception."},{"line_number":132,"context_line":"            \u0027\u0027\u0027"},{"line_number":133,"context_line":"#             raise ManagedObjectNotFoundError(message)"},{"line_number":134,"context_line":"            raise Exception(message)"},{"line_number":135,"context_line":"        elif key_id \u003d\u003d TEST_BARBICAN_INVALID_KEY_ID:"},{"line_number":136,"context_line":"            raise ValueError(\u0027Secret incorrectly specified.\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_a668ef22","line":133,"updated":"2016-11-30 20:26:11.000000000","message":"I think you can delete this commented code now?","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"923b952ccd3a1f1b7399167dc0739f17b6edfd37","unresolved":false,"context_lines":[{"line_number":130,"context_line":"            from castellan.common.exception. To avoid this import, raising a"},{"line_number":131,"context_line":"            general Exception."},{"line_number":132,"context_line":"            \u0027\u0027\u0027"},{"line_number":133,"context_line":"#             raise ManagedObjectNotFoundError(message)"},{"line_number":134,"context_line":"            raise Exception(message)"},{"line_number":135,"context_line":"        elif key_id \u003d\u003d TEST_BARBICAN_INVALID_KEY_ID:"},{"line_number":136,"context_line":"            raise ValueError(\u0027Secret incorrectly specified.\u0027)"}],"source_content_type":"text/x-python","patch_set":16,"id":"5a74a57a_dc5dbc16","line":133,"in_reply_to":"5a74a57a_a668ef22","updated":"2016-11-30 21:18:52.000000000","message":"Deleted.","commit_id":"864515b12024f405ad8cde5a3089db67b3339b21"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or"},{"line_number":13,"context_line":"# implied."},{"line_number":14,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":15,"context_line":"# limitations under the License."},{"line_number":16,"context_line":"import base64"},{"line_number":17,"context_line":"import mock"},{"line_number":18,"context_line":"import unittest"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_cea3a2b0","line":15,"updated":"2016-12-16 17:25:07.000000000","message":"not sure where to put this comment - How about renaming this file test_kms_keymaster? or maybe test_keymaster_barbican? or something on those lines. Just want to be more explicit that we\u0027re testing keymaster with barbican.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"04504a4f547e576e83a1e5ac98d252c5bffc7712","unresolved":false,"context_lines":[{"line_number":12,"context_line":"# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or"},{"line_number":13,"context_line":"# implied."},{"line_number":14,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":15,"context_line":"# limitations under the License."},{"line_number":16,"context_line":"import base64"},{"line_number":17,"context_line":"import mock"},{"line_number":18,"context_line":"import unittest"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_5bbc0ebb","line":15,"in_reply_to":"1a6eadb0_cea3a2b0","updated":"2016-12-21 10:00:38.000000000","message":"I renamed the file to test_barbican_keymaster.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f048696851af605448c5a7c216fdc2f3b9a4e452","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    def get(self, ctxt, key_id):"},{"line_number":97,"context_line":"        \u0027\u0027\u0027"},{"line_number":98,"context_line":"        If authentication fails, raise an exception here."},{"line_number":99,"context_line":"        \u0027\u0027\u0027"},{"line_number":100,"context_line":"        if (TEST_KEYMASTER_BARBICAN_CONF[\u0027barbican_username\u0027] !\u003d"},{"line_number":101,"context_line":"                ctxt.username"},{"line_number":102,"context_line":"                or TEST_KEYMASTER_BARBICAN_CONF[\u0027barbican_password\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_2e289632","line":99,"updated":"2016-12-16 17:25:07.000000000","message":"using \u0027\u0027\u0027 or \"\"\" for func docstrings in a test will display the nosetests output as - in this case - \"If authentication fails, raise an exception here...ok\"\n\nI think it\u0027s useful to have the test details printed out, like we do in rest of the swift code. We use just #comment for docstrings within a test function, for e.g. https://github.com/openstack/swift/blob/master/test/unit/common/middleware/crypto/test_encrypter.py#L47","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"0f8aa997922c32dad1c51d7f625b8121bd219bb3","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    def get(self, ctxt, key_id):"},{"line_number":97,"context_line":"        \u0027\u0027\u0027"},{"line_number":98,"context_line":"        If authentication fails, raise an exception here."},{"line_number":99,"context_line":"        \u0027\u0027\u0027"},{"line_number":100,"context_line":"        if (TEST_KEYMASTER_BARBICAN_CONF[\u0027barbican_username\u0027] !\u003d"},{"line_number":101,"context_line":"                ctxt.username"},{"line_number":102,"context_line":"                or TEST_KEYMASTER_BARBICAN_CONF[\u0027barbican_password\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":17,"id":"1a6eadb0_3f4a0bc6","line":99,"in_reply_to":"1a6eadb0_2e289632","updated":"2016-12-20 15:44:28.000000000","message":"Fixed.","commit_id":"4b857e2ac2016a5cfbced01c5bcfbc1f6e378fb8"}],"test/unit/common/middleware/crypto/test_barbican_keymaster.py":[{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":39,"context_line":"TEST_BARBICAN_INVALID_USER_DOMAIN_NAME \u003d \"baduserdomainname\""},{"line_number":40,"context_line":"TEST_BARBICAN_CONNECT_FAILURE_URL \u003d \u0027http://endpoint_url_connect_error:45621\u0027"},{"line_number":41,"context_line":"TEST_BARBICAN_NON_BARBICAN_URL \u003d \u0027http://endpoint_url_nonbarbican:45621\u0027"},{"line_number":42,"context_line":"TEST_KEYMASTER_BARBICAN_CONF \u003d {"},{"line_number":43,"context_line":"    \u0027keymaster_config_path\u0027: \u0027PATH_TO_KEYMASTER_CONFIG_FILE\u0027,"},{"line_number":44,"context_line":"    \u0027keymaster_config_type\u0027: CRYPTO_CONFIG_KMS,"},{"line_number":45,"context_line":"    \u0027kms_auth_url\u0027: \u0027barbicanauthurlv3\u0027,"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_1145666f","line":42,"updated":"2017-01-03 13:36:13.000000000","message":"test invalid keymaster_config_type as well - throw an error if the value is not \"config_file\" or \"barbican\"","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":39,"context_line":"TEST_BARBICAN_INVALID_USER_DOMAIN_NAME \u003d \"baduserdomainname\""},{"line_number":40,"context_line":"TEST_BARBICAN_CONNECT_FAILURE_URL \u003d \u0027http://endpoint_url_connect_error:45621\u0027"},{"line_number":41,"context_line":"TEST_BARBICAN_NON_BARBICAN_URL \u003d \u0027http://endpoint_url_nonbarbican:45621\u0027"},{"line_number":42,"context_line":"TEST_KEYMASTER_BARBICAN_CONF \u003d {"},{"line_number":43,"context_line":"    \u0027keymaster_config_path\u0027: \u0027PATH_TO_KEYMASTER_CONFIG_FILE\u0027,"},{"line_number":44,"context_line":"    \u0027keymaster_config_type\u0027: CRYPTO_CONFIG_KMS,"},{"line_number":45,"context_line":"    \u0027kms_auth_url\u0027: \u0027barbicanauthurlv3\u0027,"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_861f93b6","line":42,"in_reply_to":"ba5201f7_1145666f","updated":"2017-01-10 10:35:19.000000000","message":"The keymaster_config_type will be removed in the next patch, and the way to configure keymasters will be using the filter.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            raise DiscoveryFailure("},{"line_number":113,"context_line":"                \u0027Could not determine a suitable URL for the plugin\u0027)"},{"line_number":114,"context_line":"        elif (TEST_KEYMASTER_BARBICAN_CONF[\u0027kms_auth_url\u0027] !\u003d"},{"line_number":115,"context_line":"              self.conf[\u0027auth_endpoint\u0027]):"},{"line_number":116,"context_line":"            raise Unauthorized("},{"line_number":117,"context_line":"                message\u003d\u0027Cannot authorize API client.\u0027)"},{"line_number":118,"context_line":"        elif (self.conf[\u0027barbican_endpoint\u0027] \u003d\u003d"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_1e0ae726","line":115,"updated":"2017-01-03 13:36:13.000000000","message":"the other way round? i.e.\n\nself.conf[\u0027auth_endpoint\u0027] !\u003d    TEST_KEYMASTER_BARBICAN_CONF[\u0027kms_auth_url\u0027]","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"46ff93f4ce6dae6ec11f165e61c2d2acecbd6cd8","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            raise DiscoveryFailure("},{"line_number":113,"context_line":"                \u0027Could not determine a suitable URL for the plugin\u0027)"},{"line_number":114,"context_line":"        elif (TEST_KEYMASTER_BARBICAN_CONF[\u0027kms_auth_url\u0027] !\u003d"},{"line_number":115,"context_line":"              self.conf[\u0027auth_endpoint\u0027]):"},{"line_number":116,"context_line":"            raise Unauthorized("},{"line_number":117,"context_line":"                message\u003d\u0027Cannot authorize API client.\u0027)"},{"line_number":118,"context_line":"        elif (self.conf[\u0027barbican_endpoint\u0027] \u003d\u003d"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a530d102","line":115,"in_reply_to":"ba5201f7_1e0ae726","updated":"2017-01-03 15:43:54.000000000","message":"My guess is that he was following the idiom described here: https://en.wikipedia.org/wiki/Yoda_conditions","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":112,"context_line":"            raise DiscoveryFailure("},{"line_number":113,"context_line":"                \u0027Could not determine a suitable URL for the plugin\u0027)"},{"line_number":114,"context_line":"        elif (TEST_KEYMASTER_BARBICAN_CONF[\u0027kms_auth_url\u0027] !\u003d"},{"line_number":115,"context_line":"              self.conf[\u0027auth_endpoint\u0027]):"},{"line_number":116,"context_line":"            raise Unauthorized("},{"line_number":117,"context_line":"                message\u003d\u0027Cannot authorize API client.\u0027)"},{"line_number":118,"context_line":"        elif (self.conf[\u0027barbican_endpoint\u0027] \u003d\u003d"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_4653eb6c","line":115,"in_reply_to":"ba5201f7_a530d102","updated":"2017-01-10 10:35:19.000000000","message":"I was not consciously following that idiom, and have swapped the values as suggested.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":307,"context_line":"            self.app \u003d kms_keymaster.KmsKeyMaster(self.swift,"},{"line_number":308,"context_line":"                                                  TEST_KEYMASTER_BARBICAN_CONF)"},{"line_number":309,"context_line":"            self.verify_keys_for_path("},{"line_number":310,"context_line":"                \u0027/a/c/o\u0027, expected_keys\u003d(\u0027object\u0027, \u0027container\u0027))"},{"line_number":311,"context_line":"            raise Exception(\u0027Success even though key id invalid\u0027)"},{"line_number":312,"context_line":"        except ValueError as e:"},{"line_number":313,"context_line":"            print(\u0027ValueError, as expected\u0027)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_b7ff2aa9","line":310,"updated":"2017-01-03 13:36:13.000000000","message":"self.verify_keys_for_path is never called here as we encounter an exception before that. If you\u0027re intending to call it, you could modify the above code into: http://paste.openstack.org/show/593781/\n\nBut I don\u0027t think it makes sense to verify keys while the idea here is to test exception?","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":307,"context_line":"            self.app \u003d kms_keymaster.KmsKeyMaster(self.swift,"},{"line_number":308,"context_line":"                                                  TEST_KEYMASTER_BARBICAN_CONF)"},{"line_number":309,"context_line":"            self.verify_keys_for_path("},{"line_number":310,"context_line":"                \u0027/a/c/o\u0027, expected_keys\u003d(\u0027object\u0027, \u0027container\u0027))"},{"line_number":311,"context_line":"            raise Exception(\u0027Success even though key id invalid\u0027)"},{"line_number":312,"context_line":"        except ValueError as e:"},{"line_number":313,"context_line":"            print(\u0027ValueError, as expected\u0027)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a62bb793","line":310,"in_reply_to":"ba5201f7_b7ff2aa9","updated":"2017-01-10 10:35:19.000000000","message":"Removed call to self.verify_keys_for_path().","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            raise Exception(\u0027Success even though key id invalid\u0027)"},{"line_number":312,"context_line":"        except ValueError as e:"},{"line_number":313,"context_line":"            print(\u0027ValueError, as expected\u0027)"},{"line_number":314,"context_line":"            print(\u0027Message: %s\u0027 % (e.message))"},{"line_number":315,"context_line":"        except Exception:"},{"line_number":316,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":317,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_37241aae","line":314,"updated":"2017-01-03 13:36:13.000000000","message":"Instead of using Print, you could maybe assert the exception message:\n\nself.assertEqual(e.message, \u0027Secret incorrectly specified.\u0027)","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            raise Exception(\u0027Success even though key id invalid\u0027)"},{"line_number":312,"context_line":"        except ValueError as e:"},{"line_number":313,"context_line":"            print(\u0027ValueError, as expected\u0027)"},{"line_number":314,"context_line":"            print(\u0027Message: %s\u0027 % (e.message))"},{"line_number":315,"context_line":"        except Exception:"},{"line_number":316,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":317,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_c19985d2","line":314,"in_reply_to":"ba5201f7_37241aae","updated":"2017-01-10 10:35:19.000000000","message":"Changed as suggested.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":395,"context_line":"            self.app \u003d kms_keymaster.KmsKeyMaster(self.swift,"},{"line_number":396,"context_line":"                                                  TEST_KEYMASTER_BARBICAN_CONF)"},{"line_number":397,"context_line":"            self.verify_keys_for_path("},{"line_number":398,"context_line":"                \u0027/a/c/o\u0027, expected_keys\u003d(\u0027object\u0027, \u0027container\u0027))"},{"line_number":399,"context_line":"            raise Exception(\u0027Success even though username invalid\u0027)"},{"line_number":400,"context_line":"        except Unauthorized as e:"},{"line_number":401,"context_line":"            print(\u0027Unauthorized, as expected\u0027)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_971b061b","line":398,"updated":"2017-01-03 13:36:13.000000000","message":"I think you could remove this call and further calls in tests below, if you agree with comment in line#310","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":395,"context_line":"            self.app \u003d kms_keymaster.KmsKeyMaster(self.swift,"},{"line_number":396,"context_line":"                                                  TEST_KEYMASTER_BARBICAN_CONF)"},{"line_number":397,"context_line":"            self.verify_keys_for_path("},{"line_number":398,"context_line":"                \u0027/a/c/o\u0027, expected_keys\u003d(\u0027object\u0027, \u0027container\u0027))"},{"line_number":399,"context_line":"            raise Exception(\u0027Success even though username invalid\u0027)"},{"line_number":400,"context_line":"        except Unauthorized as e:"},{"line_number":401,"context_line":"            print(\u0027Unauthorized, as expected\u0027)"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_e1ecc92b","line":398,"in_reply_to":"ba5201f7_971b061b","updated":"2017-01-10 10:35:19.000000000","message":"Changed as suggested.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":399,"context_line":"            raise Exception(\u0027Success even though username invalid\u0027)"},{"line_number":400,"context_line":"        except Unauthorized as e:"},{"line_number":401,"context_line":"            print(\u0027Unauthorized, as expected\u0027)"},{"line_number":402,"context_line":"            print(\u0027Status: %d, Message: %s\u0027 % (e.http_status, e.message))"},{"line_number":403,"context_line":"        except Exception:"},{"line_number":404,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":405,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_9735c6db","line":402,"updated":"2017-01-03 13:36:13.000000000","message":"ditto comment as line#314, also in tests below as well.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":399,"context_line":"            raise Exception(\u0027Success even though username invalid\u0027)"},{"line_number":400,"context_line":"        except Unauthorized as e:"},{"line_number":401,"context_line":"            print(\u0027Unauthorized, as expected\u0027)"},{"line_number":402,"context_line":"            print(\u0027Status: %d, Message: %s\u0027 % (e.http_status, e.message))"},{"line_number":403,"context_line":"        except Exception:"},{"line_number":404,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":405,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_a57b837a","line":402,"in_reply_to":"ba5201f7_9735c6db","updated":"2017-01-10 10:35:19.000000000","message":"Fixed.","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":629,"context_line":"            self.assertEqual(e.message,"},{"line_number":630,"context_line":"                             \u0027The request you have made \u0027"},{"line_number":631,"context_line":"                             \u0027requires authentication.\u0027)"},{"line_number":632,"context_line":"            self.assertEqual(e.http_status, 401)"},{"line_number":633,"context_line":"        except Exception:"},{"line_number":634,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":635,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_37eb3ab2","line":632,"updated":"2017-01-03 13:36:13.000000000","message":"okay, you are asserting the exception msg here :)","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"6cb0ee76723728b8b5e65158dc73116cd832cfd6","unresolved":false,"context_lines":[{"line_number":629,"context_line":"            self.assertEqual(e.message,"},{"line_number":630,"context_line":"                             \u0027The request you have made \u0027"},{"line_number":631,"context_line":"                             \u0027requires authentication.\u0027)"},{"line_number":632,"context_line":"            self.assertEqual(e.http_status, 401)"},{"line_number":633,"context_line":"        except Exception:"},{"line_number":634,"context_line":"            print(\"Unexpected error: %s\" % sys.exc_info()[0])"},{"line_number":635,"context_line":"            raise"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_61c0d97d","line":632,"in_reply_to":"ba5201f7_37eb3ab2","updated":"2017-01-10 10:35:19.000000000","message":"Asserting elsewhere also now!","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"52f7dd5ccfb15fc459b2b02aa589360c9fc1533a","unresolved":false,"context_lines":[{"line_number":706,"context_line":"            self.assertIn(\u0027id\u0027, keys)"},{"line_number":707,"context_line":"            id \u003d keys.pop(\u0027id\u0027)"},{"line_number":708,"context_line":"            self.assertEqual(path, id[\u0027path\u0027])"},{"line_number":709,"context_line":"            self.assertEqual(\u00271\u0027, id[\u0027v\u0027])"},{"line_number":710,"context_line":"            self.assertListEqual(sorted(expected_keys), sorted(keys.keys()),"},{"line_number":711,"context_line":"                                 \u0027%s %s got keys %r, but expected %r\u0027"},{"line_number":712,"context_line":"                                 % (method, path, keys.keys(), expected_keys))"}],"source_content_type":"text/x-python","patch_set":19,"id":"ba5201f7_3116ea55","line":709,"updated":"2017-01-03 13:36:13.000000000","message":"could add:\n\nself.assertEqual(CRYPTO_CONFIG_KMS, \u0027barbican\u0027)","commit_id":"3c25051b74fcc1e0c60bb0b9a2ec0cac621c1cac"}],"test/unit/common/middleware/crypto/test_kms_keymaster.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"93dbef19661ced73e9c837a18cacb31e4061bb96","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        print(ctxt)"},{"line_number":100,"context_line":"        print(\"key_id: %s\" % key_id)"},{"line_number":101,"context_line":"        print(\"username: %s\" % ctxt.username)"},{"line_number":102,"context_line":"        print(\"password: %s\" % ctxt.password)"},{"line_number":103,"context_line":"        if (TEST_KMS_KEYMASTER_CONF[\u0027username\u0027] !\u003d"},{"line_number":104,"context_line":"                ctxt.username"},{"line_number":105,"context_line":"                or TEST_KMS_KEYMASTER_CONF[\u0027password\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":24,"id":"bff0334d_243e93c0","line":102,"updated":"2017-04-12 12:44:33.000000000","message":"the prints need to be removed","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"cc7aaabd9d6b3801fb4af9b469cd577b6a81c543","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        print(ctxt)"},{"line_number":100,"context_line":"        print(\"key_id: %s\" % key_id)"},{"line_number":101,"context_line":"        print(\"username: %s\" % ctxt.username)"},{"line_number":102,"context_line":"        print(\"password: %s\" % ctxt.password)"},{"line_number":103,"context_line":"        if (TEST_KMS_KEYMASTER_CONF[\u0027username\u0027] !\u003d"},{"line_number":104,"context_line":"                ctxt.username"},{"line_number":105,"context_line":"                or TEST_KMS_KEYMASTER_CONF[\u0027password\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":24,"id":"7ffa3b31_eebd8fd8","line":102,"in_reply_to":"bff0334d_243e93c0","updated":"2017-04-19 18:26:37.000000000","message":"Removed.","commit_id":"7cdc62e6cafe3d6999c5bc5a5dd32f4d7dda3bad"}]}