)]}'
{"tempest/config.py":[{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"43903d00ce05922f6685338b412e48bc70502616","unresolved":false,"context_lines":[{"line_number":421,"context_line":"    cfg.BoolOpt(\u0027verify_glance_signatures\u0027,"},{"line_number":422,"context_line":"                default\u003dFalse,"},{"line_number":423,"context_line":"                help\u003d\u0027Is the compute service configured to verify Glance \u0027"},{"line_number":424,"context_line":"                     \u0027image signatures?\u0027),"},{"line_number":425,"context_line":"]"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_71d4ac46","line":424,"updated":"2016-10-31 21:44:37.000000000","message":"If we make an option to represent if a key manager is enabled, it\u0027ll be more generic and can apply to other encryption tests.  Such an option could be added here: https://github.com/openstack/tempest/blob/master/tempest/config.py#L947-L972","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3a9cc05dcebcef62f6762708493a399dba2ffc3b","unresolved":false,"context_lines":[{"line_number":421,"context_line":"    cfg.BoolOpt(\u0027verify_glance_signatures\u0027,"},{"line_number":422,"context_line":"                default\u003dFalse,"},{"line_number":423,"context_line":"                help\u003d\u0027Is the compute service configured to verify Glance \u0027"},{"line_number":424,"context_line":"                     \u0027image signatures?\u0027),"},{"line_number":425,"context_line":"]"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_3c6599b4","line":424,"in_reply_to":"ba5da102_71d4ac46","updated":"2016-11-01 13:20:49.000000000","message":"I will add the key manager service abstraction like you suggest, but we still do need that option, since other key manager tests could be enabled in a gate without testing image signature verification.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"}],"tempest/scenario/test_signed_image_upload.py":[{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"43903d00ce05922f6685338b412e48bc70502616","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2016 OpenStack Foundation"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_11e9b014","line":1,"updated":"2016-10-31 21:44:37.000000000","message":"APL?","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3a9cc05dcebcef62f6762708493a399dba2ffc3b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2016 OpenStack Foundation"},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_5c56cdce","line":1,"in_reply_to":"ba5da102_11e9b014","updated":"2016-11-01 13:20:49.000000000","message":"I\u0027ll update this in the next patchset.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"43903d00ce05922f6685338b412e48bc70502616","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        return signature_b64"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    @test.idempotent_id(\u00277fff3fb3-91d9-4fd0-bc7c-0204f1f180bb\u0027)"},{"line_number":125,"context_line":"    @test.services(\u0027compute\u0027, \u0027image\u0027, \u0027identity\u0027)"},{"line_number":126,"context_line":"    def test_signed_image_upload_and_boot(self):"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"        \"\"\"This test case attempts to produce the following steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_b1f724f4","line":125,"updated":"2016-10-31 21:44:37.000000000","message":"If we added a \u0027key-manager\u0027 service here (and in the volume encryption test later) we can run this test only if the key manager has been configured. Additional changes will be needed here: https://github.com/openstack/tempest/blob/master/tempest/test.py#L63-L102","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"a6b74e38d61fb5208a562e77c31807e53e0dae0a","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        return signature_b64"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    @test.idempotent_id(\u00277fff3fb3-91d9-4fd0-bc7c-0204f1f180bb\u0027)"},{"line_number":125,"context_line":"    @test.services(\u0027compute\u0027, \u0027image\u0027, \u0027identity\u0027)"},{"line_number":126,"context_line":"    def test_signed_image_upload_and_boot(self):"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"        \"\"\"This test case attempts to produce the following steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_a4f5fd57","line":125,"in_reply_to":"ba5da102_1cbc55db","updated":"2016-11-01 23:53:31.000000000","message":"I guess this test requires Barbican as the backend of Nova and Glance, right?\n\nNow Tempest scope is only for 6 core projects, and there is not any place to put the other projects(Barbican also) in Tempest.\n(Baremetal will be remove soon anyways)\n\nSo https://github.com/openstack/tempest/blob/master/tempest/test.py#L63-L102 should not be changed.\n\nI guess this test doesn\u0027t require Barbican API operation, right?\nIf not requiring, only a new option (verify_glance_signatures, etc) seems enough for this without adding more services on the list. We will just test it as the optional backend.\n\nBTW, do we have some jobs or Devstack patches for enabling this environment on the gate? I\u0027d like to see this test result on the gate before merging.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"65832ede0f97101a377e4722e9f777b925c06cfb","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        return signature_b64"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    @test.idempotent_id(\u00277fff3fb3-91d9-4fd0-bc7c-0204f1f180bb\u0027)"},{"line_number":125,"context_line":"    @test.services(\u0027compute\u0027, \u0027image\u0027, \u0027identity\u0027)"},{"line_number":126,"context_line":"    def test_signed_image_upload_and_boot(self):"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"        \"\"\"This test case attempts to produce the following steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_5a9146f0","line":125,"in_reply_to":"ba5da102_a4f5fd57","updated":"2016-11-02 13:06:15.000000000","message":"In order to test security functionality in Nova, Cinder and Glance, we need to support a gate which includes an ACTUAL key manager in its Tempest tests. Simply setting the verify_glance_signatures option in Nova is not sufficient to test this functionality since Nova must access a key manager in order to retrieve the certificate needed to verify the disc image\u0027s signature.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3a9cc05dcebcef62f6762708493a399dba2ffc3b","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        return signature_b64"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"    @test.idempotent_id(\u00277fff3fb3-91d9-4fd0-bc7c-0204f1f180bb\u0027)"},{"line_number":125,"context_line":"    @test.services(\u0027compute\u0027, \u0027image\u0027, \u0027identity\u0027)"},{"line_number":126,"context_line":"    def test_signed_image_upload_and_boot(self):"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"        \"\"\"This test case attempts to produce the following steps:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_1cbc55db","line":125,"in_reply_to":"ba5da102_b1f724f4","updated":"2016-11-01 13:20:49.000000000","message":"I\u0027ll add this. I agree that it is necessary.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"43903d00ce05922f6685338b412e48bc70502616","unresolved":false,"context_lines":[{"line_number":161,"context_line":"        self.servers_client.delete_server(self.instance[\u0027id\u0027])"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"    @test.idempotent_id(\u00277fff3fb3-91d9-4fd0-bc7c-0204f1f180bc\u0027)"},{"line_number":164,"context_line":"    @test.services(\u0027image\u0027, \u0027identity\u0027)"},{"line_number":165,"context_line":"    def test_signed_image_upload_glance_fail(self):"},{"line_number":166,"context_line":"        \"\"\"This test case attempts to produce the following steps:"},{"line_number":167,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_d1de586c","line":164,"updated":"2016-10-31 21:44:37.000000000","message":"See above","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":7012,"name":"Brianna Poulos","email":"Brianna.Poulos@jhuapl.edu","username":"brianna-poulos"},"change_message_id":"c4a2f12a2f209d5e6142509c527ebed081e3d6a6","unresolved":false,"context_lines":[{"line_number":185,"context_line":"        )"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        resp_body \u003d self.image_client.show_image(img_uuid)"},{"line_number":188,"context_line":"        self.AssertEqual(\u0027killed\u0027, resp_body[\u0027status\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_ce4787ba","line":188,"updated":"2016-11-01 12:41:19.000000000","message":"There should also be a test that covers the following steps:\n\n* Upload an image to Glance with valid signature metadata\n* Confirm upload succeeds\n* Modify signature metadata to make it invalid\n* Boot an instance with the now-invalidly-signed image\n* Confirm instance boot fails","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"3a9cc05dcebcef62f6762708493a399dba2ffc3b","unresolved":false,"context_lines":[{"line_number":185,"context_line":"        )"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        resp_body \u003d self.image_client.show_image(img_uuid)"},{"line_number":188,"context_line":"        self.AssertEqual(\u0027killed\u0027, resp_body[\u0027status\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba5da102_1ca375b3","line":188,"in_reply_to":"ba5da102_ce4787ba","updated":"2016-11-01 13:20:49.000000000","message":"Agreed. I\u0027ll add it.","commit_id":"46bf39d3d7cb7bbb573db8839481785587ae7f62"}]}