)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"8f7e2b23a1c2866bbac36444c1cb5d7ce43b1ac3","unresolved":false,"context_lines":[{"line_number":13,"context_line":"When using fingergw for inter region log streaming it can be desirable"},{"line_number":14,"context_line":"to support ssl encrypted connections with client auth just like we do"},{"line_number":15,"context_line":"with gearman. This will also make it easy to route traffic to the"},{"line_number":16,"context_line":"finger gateway via an openshift route using SNI and pass-through."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Ia5c739a3fcf229da140c4e2ebbe1a771c63b0489"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"c5bdd5a7_b620b2c0","line":16,"updated":"2021-03-29 23:06:37.000000000","message":"How do we handle the case where we want SSL between zones (ie, from on-premises to a remote cloud) but still want the main fingergw to not require SSL (so people on-prem can still \"finger uuid@zuul\")?","commit_id":"e5a7edf0e55ee4a7d2af5b6bce9b4437f4788f41"},{"author":{"_account_id":16068,"name":"Tobias Henkel","email":"tobias.henkel@bmw.de","username":"tobias.henkel"},"change_message_id":"2a2523a91de13c16d4a6f6efe51fdff029093d32","unresolved":false,"context_lines":[{"line_number":13,"context_line":"When using fingergw for inter region log streaming it can be desirable"},{"line_number":14,"context_line":"to support ssl encrypted connections with client auth just like we do"},{"line_number":15,"context_line":"with gearman. This will also make it easy to route traffic to the"},{"line_number":16,"context_line":"finger gateway via an openshift route using SNI and pass-through."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: Ia5c739a3fcf229da140c4e2ebbe1a771c63b0489"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"5305d3d7_fac21cdf","line":16,"in_reply_to":"c5bdd5a7_b620b2c0","updated":"2021-03-31 07:49:00.000000000","message":"I\u0027d handle that by deploying a separate fingergw for user access and use the ssl enabled ones only for cross zone traffic.","commit_id":"e5a7edf0e55ee4a7d2af5b6bce9b4437f4788f41"}],"tests/unit/test_streaming.py":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"2df9a510c69166b0846574559ddc889beca567c8","unresolved":false,"context_lines":[{"line_number":805,"context_line":""},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"class TestStreamingZonesSSL(TestStreamingZones):"},{"line_number":808,"context_line":"    use_ssl \u003d True"}],"source_content_type":"text/x-python","patch_set":24,"id":"43c68602_3ae0071b","line":808,"updated":"2021-05-30 00:21:05.000000000","message":"We don\u0027t have gearman working with py39 yet, so I\u0027m going to rename this variable so we can specify we want to use ssl for the fingergw without invoking gearman ssl.","commit_id":"28b9d685d4067b737292bade7c5984194779f189"},{"author":{"_account_id":4146,"name":"Clark Boylan","email":"cboylan@sapwetik.org","username":"cboylan"},"change_message_id":"09b8ccae1a9e3120b300e2aedf80be5c509acba9","unresolved":true,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    tenant_config_file \u003d \u0027config/streamer/main.yaml\u0027"},{"line_number":102,"context_line":"    log \u003d logging.getLogger(\"zuul.test_streaming\")"},{"line_number":103,"context_line":"    fingergw_use_ssl \u003d True"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def setUp(self):"},{"line_number":106,"context_line":"        super().setUp()"}],"source_content_type":"text/x-python","patch_set":28,"id":"f8b10d70_4894062b","line":103,"range":{"start_line":103,"start_character":23,"end_line":103,"end_character":27},"updated":"2021-07-27 22:34:20.000000000","message":"I think this may want to be False then in TestStreamingZonesSSL we override this to true to test ssl. Currently we test with only ssl if I read this correctly.","commit_id":"7304c31c2f6827bb467525baa8a4c7679c252c68"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"bbcd4ae46f09ccff8065d9864cf5a82b3789e58b","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    tenant_config_file \u003d \u0027config/streamer/main.yaml\u0027"},{"line_number":102,"context_line":"    log \u003d logging.getLogger(\"zuul.test_streaming\")"},{"line_number":103,"context_line":"    fingergw_use_ssl \u003d True"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def setUp(self):"},{"line_number":106,"context_line":"        super().setUp()"}],"source_content_type":"text/x-python","patch_set":28,"id":"a2e93382_9b446535","line":103,"updated":"2021-07-27 22:37:40.000000000","message":"Yup.","commit_id":"7304c31c2f6827bb467525baa8a4c7679c252c68"}],"zuul/cmd/web.py":[{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"e733a44d54a95719385dbe0310578330c2d563d4","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        params[\u0027ssl_cert\u0027] \u003d get_default(self.config, \u0027gearman\u0027, \u0027ssl_cert\u0027)"},{"line_number":69,"context_line":"        params[\u0027ssl_ca\u0027] \u003d get_default(self.config, \u0027gearman\u0027, \u0027ssl_ca\u0027)"},{"line_number":70,"context_line":"        params[\u0027finger_ssl_key\u0027] \u003d get_default("},{"line_number":71,"context_line":"            self.config, \u0027fingergw\u0027, \u0027client_ssl_key\u0027)"},{"line_number":72,"context_line":"        params[\u0027finger_ssl_cert\u0027] \u003d get_default("},{"line_number":73,"context_line":"            self.config, \u0027fingergw\u0027, \u0027client_ssl_cert\u0027)"},{"line_number":74,"context_line":"        params[\u0027finger_ssl_ca\u0027] \u003d get_default("}],"source_content_type":"text/x-python","patch_set":8,"id":"7faddb67_85d8f91d","line":71,"range":{"start_line":71,"start_character":26,"end_line":71,"end_character":34},"updated":"2019-08-02 18:41:45.000000000","message":"shouldn\u0027t the section be named \"stream\" ? (iiuc, these options are used between fingergw or zuul-web and the executor).","commit_id":"3cc84d4a5d8e128c78926a16349bc8a328231058"}],"zuul/lib/fingergw.py":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"f6418c1c62aba61fd52dd920318808ad99c2d9eb","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        self.finger_client_ssl_cert \u003d get_default("},{"line_number":183,"context_line":"            config, \u0027fingergw\u0027, \u0027client_ssl_cert\u0027)"},{"line_number":184,"context_line":"        self.finger_client_ssl_ca \u003d get_default("},{"line_number":185,"context_line":"            config, \u0027fingergw\u0027, \u0027client_ssl_ca\u0027)"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        self.command_map \u003d dict("},{"line_number":188,"context_line":"            stop\u003dself.stop,"}],"source_content_type":"text/x-python","patch_set":24,"id":"8e01b6ff_36ffe9fa","line":185,"updated":"2021-05-30 00:52:16.000000000","message":"Oh, but related to my other question, that would make it difficult to have a fingergw with client ssl but no server ssl.  Maybe we should add a boolean for that?","commit_id":"28b9d685d4067b737292bade7c5984194779f189"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"2df9a510c69166b0846574559ddc889beca567c8","unresolved":false,"context_lines":[{"line_number":182,"context_line":"        self.finger_client_ssl_cert \u003d get_default("},{"line_number":183,"context_line":"            config, \u0027fingergw\u0027, \u0027client_ssl_cert\u0027)"},{"line_number":184,"context_line":"        self.finger_client_ssl_ca \u003d get_default("},{"line_number":185,"context_line":"            config, \u0027fingergw\u0027, \u0027client_ssl_ca\u0027)"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"        self.command_map \u003d dict("},{"line_number":188,"context_line":"            stop\u003dself.stop,"}],"source_content_type":"text/x-python","patch_set":24,"id":"d3f10c2f_97a07216","line":185,"updated":"2021-05-30 00:21:05.000000000","message":"Why do we need separate client/server certs?  It seems like one cert would be appropriate for both.","commit_id":"28b9d685d4067b737292bade7c5984194779f189"}]}