| *** rellerreller has quit IRC | 00:04 | |
| *** kgriffs is now known as kgriffs|afk | 00:26 | |
| mjg59 | Is there any existing support in Barbican for clustered secret storage? | 00:26 |
|---|---|---|
| *** dave-mccowan has joined #openstack-barbican | 00:34 | |
| *** lisaclark1 has joined #openstack-barbican | 00:39 | |
| *** atiwari has quit IRC | 00:44 | |
| *** atiwari has joined #openstack-barbican | 00:44 | |
| *** atiwari has quit IRC | 00:44 | |
| *** kebray has quit IRC | 00:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/150199 | 01:08 |
| *** gyee has quit IRC | 01:15 | |
| *** crc32 has quit IRC | 01:25 | |
| *** bdpayne has quit IRC | 01:29 | |
| *** lisaclark1 has quit IRC | 01:37 | |
| *** tkelsey has joined #openstack-barbican | 01:42 | |
| *** tkelsey has quit IRC | 01:46 | |
| *** lisaclark1 has joined #openstack-barbican | 02:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/150199 | 02:15 |
| *** kgriffs|afk is now known as kgriffs | 02:26 | |
| *** kgriffs is now known as kgriffs|afk | 02:35 | |
| *** dave-mccowan has quit IRC | 02:41 | |
| *** kgriffs|afk is now known as kgriffs | 02:50 | |
| *** kgriffs is now known as kgriffs|afk | 02:54 | |
| *** jkf has quit IRC | 03:14 | |
| *** kebray has joined #openstack-barbican | 03:42 | |
| *** kebray has quit IRC | 03:44 | |
| *** ayoung is now known as ayoung_ZZzz__ | 03:49 | |
| *** lisaclark1 has quit IRC | 03:54 | |
| *** kgriffs|afk is now known as kgriffs | 03:54 | |
| *** kebray has joined #openstack-barbican | 03:57 | |
| *** kgriffs is now known as kgriffs|afk | 04:03 | |
| *** kgriffs|afk is now known as kgriffs | 04:54 | |
| *** kgriffs is now known as kgriffs|afk | 05:04 | |
| *** Nirupama has joined #openstack-barbican | 05:09 | |
| *** woodster_ has quit IRC | 06:23 | |
| *** kgriffs|afk is now known as kgriffs | 06:43 | |
| *** kgriffs is now known as kgriffs|afk | 06:53 | |
| *** greghaynes has quit IRC | 07:24 | |
| *** greghaynes has joined #openstack-barbican | 07:26 | |
| *** jamielennox is now known as jamielennox|away | 07:29 | |
| *** tkelsey has joined #openstack-barbican | 07:38 | |
| *** kebray has quit IRC | 08:05 | |
| *** kgriffs|afk is now known as kgriffs | 08:32 | |
| *** kgriffs is now known as kgriffs|afk | 08:42 | |
| *** jaosorior has joined #openstack-barbican | 09:25 | |
| *** kgriffs|afk is now known as kgriffs | 10:21 | |
| *** kgriffs is now known as kgriffs|afk | 10:30 | |
| *** tkelsey has quit IRC | 10:35 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Switch Python's json to the OpenStack's json wrapper https://review.openstack.org/150357 | 10:50 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Use drop old namespace for some oslo libraries https://review.openstack.org/150372 | 11:40 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Drop old namespace for some oslo libraries https://review.openstack.org/150372 | 11:43 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Drop old namespace for some oslo libraries https://review.openstack.org/150372 | 11:50 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-barbicanclient: Drop old namespace for some oslo libraries https://review.openstack.org/150386 | 12:03 |
| *** kgriffs|afk is now known as kgriffs | 12:09 | |
| *** kgriffs is now known as kgriffs|afk | 12:19 | |
| *** woodster_ has joined #openstack-barbican | 12:31 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Fix symmetric/asymmetric key order meta validation https://review.openstack.org/150396 | 12:48 |
| *** Nirupama has quit IRC | 12:52 | |
| *** tkelsey has joined #openstack-barbican | 13:13 | |
| *** darrenmoffat has quit IRC | 13:41 | |
| *** darrenmoffat has joined #openstack-barbican | 13:42 | |
| *** alee has quit IRC | 13:43 | |
| *** rellerreller has joined #openstack-barbican | 13:48 | |
| *** kgriffs|afk is now known as kgriffs | 13:58 | |
| *** rellerreller has quit IRC | 14:05 | |
| *** kgriffs is now known as kgriffs|afk | 14:08 | |
| *** nkinder has quit IRC | 14:22 | |
| *** rellerreller has joined #openstack-barbican | 14:28 | |
| *** kgriffs|afk is now known as kgriffs | 14:38 | |
| *** kgriffs is now known as kgriffs|afk | 14:47 | |
| *** david-lyle_afk is now known as david-lyle | 14:49 | |
| *** dimtruck is now known as zz_dimtruck | 14:54 | |
| *** paul_glass has joined #openstack-barbican | 14:57 | |
| *** alee has joined #openstack-barbican | 14:58 | |
| *** ametts has quit IRC | 15:01 | |
| jaosorior | woodster_ jvrbanac: Should I mark this as invalid then? https://bugs.launchpad.net/barbican/+bug/1365131 | 15:04 |
| *** paul_glass has quit IRC | 15:05 | |
| openstackgerrit | Merged openstack/barbican-specs: Snakeoil CA https://review.openstack.org/141981 | 15:06 |
| *** paul_glass has joined #openstack-barbican | 15:06 | |
| *** ayoung_ZZzz__ is now known as ayoung_snowedin | 15:07 | |
| alee | jaosorior, ping | 15:12 |
| jaosorior | alee | 15:12 |
| jaosorior | sup | 15:12 |
| jaosorior | reviewing this CR from you https://review.openstack.org/#/c/147323/6/barbican/model/models.py ATM | 15:12 |
| alee | jaosorior, cool | 15:13 |
| alee | jaosorior, when did "mode" become a required attribute? | 15:13 |
| alee | what does it mean in the context of symmetric key orders? | 15:13 |
| alee | jaosorior, I'm looking at https://review.openstack.org/#/c/150396/1 | 15:14 |
| jaosorior | Well, I did take that from the bug description https://bugs.launchpad.net/barbican/+bug/1376902 and it is implied from the API https://github.com/cloudkeep/barbican/wiki/Application-Programming-Interface#post-1 but now that I think about it... it could be kind of ambiguous. So that should be fixed | 15:16 |
| *** nkinder has joined #openstack-barbican | 15:19 | |
| alee | jaosorior, algorithm might make sense. But I have no idea whats supposed to be in mode. | 15:20 |
| alee | jaosorior, certainly its not something that is used by the plugins as far as I know. | 15:20 |
| alee | I'll make a note on the CR and let others comment | 15:20 |
| jaosorior | That would actually be a good idea | 15:21 |
| jaosorior | Reading a bit more into it... seems to me that the mode would probably make more sense as optional. But I would like there to be more input on the CR. If that's the case I need to start updating the Documentation, to both make this less ambiguous and reflect the change. | 15:23 |
| *** kebray has joined #openstack-barbican | 15:26 | |
| *** kebray has quit IRC | 15:26 | |
| *** kebray has joined #openstack-barbican | 15:27 | |
| openstackgerrit | Merged openstack/barbican: Updated from global requirements https://review.openstack.org/150199 | 15:27 |
| *** rellerreller has quit IRC | 15:29 | |
| *** zz_dimtruck is now known as dimtruck | 15:30 | |
| alee | jvrbanac, jaosorior , woodster_, redrobot - quick question -- I have added some code that requires python-ldap, so I added it to requirements.txt. Now when I run tox, it says it cannot find ldap module. | 15:34 |
| *** rellerreller has joined #openstack-barbican | 15:34 | |
| alee | How do I update tox ? | 15:34 |
| jaosorior | tox -r | 15:34 |
| jaosorior | needs to recreate the environments | 15:34 |
| alee | jaosorior, cool - thanks -- trying | 15:35 |
| alee | jaosorior, yup - looks like its doing just that | 15:35 |
| jaosorior | if it again says that it cannot find it, then you might have misspelled the module in the txt | 15:35 |
| alee | yup | 15:36 |
| jaosorior | did it work? :O | 15:43 |
| alee | jaosorior, yes and no -- it found the next module I need to add (pyOpenSSL) :) | 15:44 |
| jaosorior | lol, alright | 15:45 |
| *** SheenaG1 has joined #openstack-barbican | 16:14 | |
| *** kgriffs|afk is now known as kgriffs | 16:41 | |
| *** SheenaG1 has quit IRC | 16:41 | |
| *** lisaclark1 has joined #openstack-barbican | 16:43 | |
| *** SheenaG1 has joined #openstack-barbican | 16:43 | |
| *** lisaclark1 has quit IRC | 16:53 | |
| *** lisaclark1 has joined #openstack-barbican | 16:59 | |
| *** lisaclark1 has joined #openstack-barbican | 17:01 | |
| *** lisaclark1 has quit IRC | 17:02 | |
| *** lisaclark1 has joined #openstack-barbican | 17:04 | |
| *** lisaclark1 has quit IRC | 17:06 | |
| *** lisaclark1 has joined #openstack-barbican | 17:06 | |
| *** rm_work is now known as rm_work|away | 17:10 | |
| *** bdpayne has joined #openstack-barbican | 17:10 | |
| *** d0ugal has left #openstack-barbican | 17:11 | |
| *** d0ugal has joined #openstack-barbican | 17:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/150495 | 17:16 |
| bdpayne | Is there an expected deployment model for clustered secret storage with Barbican today? | 17:19 |
| redrobot | bdpayne I'm not sure what you mean by "clustered" ? | 17:21 |
| bdpayne | Or is the idea to just push that problem back to something like Dogtag? | 17:21 |
| bdpayne | Well, I'd like to have HA with my secrets | 17:21 |
| redrobot | oh, well it depends on the choice of backend | 17:21 |
| bdpayne | So each one is copied to multiple machines | 17:21 |
| bdpayne | I could do this with the db backend | 17:21 |
| bdpayne | (assuming the db is clustered) | 17:21 |
| redrobot | we're planning to deploy with Luna SAs in HA mode. | 17:22 |
| bdpayne | but, that has shortcomings in terms of protecting the secrets (mainly a password in the config) | 17:22 |
| bdpayne | ah... so in your case the HSM handles this for you? | 17:22 |
| redrobot | bdpayne yes... we'll have two hsms. we'll be able to replicate the master key from one hsm to the other. | 17:23 |
| bdpayne | do the HSMs replicate the encrypted secret blobs too? | 17:23 |
| redrobot | such that we'll have a load balancer in front of N api nodes, then the api nodes will talk to a postgres db, and pick an hsm for the crypto work | 17:23 |
| bdpayne | (assuming those are stored on the HSM in your model?) | 17:24 |
| redrobot | bdpayne nope, as of now we're planning on just having a posgresql server with a hot backup in case we need to fail over | 17:24 |
| redrobot | for our load, we think a single postgres node will be enough. | 17:24 |
| redrobot | we still have to think through the different datacenter backup strategy, so some of this may change. | 17:25 |
| redrobot | or multiple datacenter, rather | 17:25 |
| bdpayne | so you aren't worried about losing secrets? | 17:25 |
| bdpayne | oh, I see, a hot backup could help there | 17:25 |
| bdpayne | hrm, interesting | 17:25 |
| bdpayne | ok, we'll need to so some thinking about this | 17:25 |
| bdpayne | I think that our use case here is somewhat different | 17:26 |
| bdpayne | so we're trying to figure the path of least resistance | 17:26 |
| bdpayne | we have some ideas... but are still flushing them out | 17:26 |
| *** atiwari has joined #openstack-barbican | 17:27 | |
| bdpayne | we were thinking about just storing the master key in an HSM and then dropping the encrypted secrets into a clustered db | 17:27 |
| redrobot | bdpayne yeah, it will definitely be something to talk about at the next summit. | 17:27 |
| bdpayne | rather than holding that master key in a file (like the driver does today) we'd boot strap it so that barbican retrieves it after startup and only holds it in memory. | 17:28 |
| redrobot | I think that may work right now... but I think the HSM will be a bottleneck | 17:28 |
| bdpayne | we thought about forcing all encryption / decryption to go through the HSM | 17:28 |
| bdpayne | but that seems like it doesn't buy much for the typical threat model at play with Barbican (mainly stolen disks) | 17:28 |
| bdpayne | HSM a bottleneck? how so? | 17:29 |
| redrobot | interesting... yeah, we don't want the master key to leave the hsm, so they are doing all the crypto work for us... Barbican never sees anything but the actual secret in plaintext | 17:29 |
| bdpayne | sure, and I can see the argument for doing that | 17:30 |
| redrobot | unfortunately now, that means 2 or 3 trips to the hsm per secret on retrieval | 17:30 |
| bdpayne | just not sure if it is qualitatively different from a security viewpoint (losing the master secret is clearly bad, but anyone on the system could just request all of the secrets too) | 17:30 |
| bdpayne | at that point, it really just comes down to auditability | 17:31 |
| bdpayne | redrobot thanks for the input... we'll be at the OSSG mid-cycle meeting which I think will be somewhat linked into the Barbican meetup, so we may have some questions for you guys at that time. In the interim, we'll keep exploring design options at this end. | 17:33 |
| redrobot | bdpayne sure thing. Yeah, I'm hoping we can at least do some Google Hangout coordination during the mid-cycles | 17:34 |
| alee | bdpayne, of course, you get the HA with dogtag already. | 17:36 |
| bdpayne | yes, but I don't think that dogtag is going to fit into our deployment model | 17:36 |
| alee | bdpayne, how so? | 17:37 |
| bdpayne | too complicated | 17:37 |
| bdpayne | too many new failure points | 17:37 |
| alee | bdpayne, interesting -- meaning that you'd prefer barbican -> hsm, rather than barbican -> dogtag -> hsm ? | 17:38 |
| bdpayne | yes | 17:38 |
| bdpayne | What does dogtag add that makes the extra complexity worth it? | 17:39 |
| bdpayne | (I could just be missing something here) | 17:39 |
| alee | well - lets see .. | 17:39 |
| bdpayne | b/c it isn't just dogtag, but dogtag + deps | 17:39 |
| alee | 1) you get a CA at the same time | 17:40 |
| alee | 2) you get all the audit functionality that isn't there in barbican yet | 17:40 |
| alee | 3) you get HA | 17:40 |
| alee | 4) because of the way dogtag stores things, you don't have to worry about HSM being a bottleneck | 17:41 |
| bdpayne | dogtag's HA model is based on an LDAP backend setup with clustered support, right? | 17:41 |
| alee | pretty much | 17:42 |
| alee | replication agreements between ldap backends | 17:42 |
| bdpayne | If I could setup dogtag HA backed by cassandra (or perhaps mysql), then I would be much more interested | 17:42 |
| bdpayne | I think the LDAP thing remains my biggest obstacle... just one more clustered service to setup | 17:43 |
| bdpayne | And those are traditionally the places where things get hairy and fail at the worst times | 17:43 |
| alee | bdpayne, well - we set it up for you, but sure .. | 17:43 |
| bdpayne | I do agree that some of those other benefits would be nice | 17:43 |
| bdpayne | "we set it up for you" ?? | 17:43 |
| bdpayne | would you like to come work for Nebula? ;-) | 17:44 |
| alee | :) | 17:44 |
| alee | that is -- the dogtag install scrtipts set up all the repication agreements etc. | 17:44 |
| bdpayne | ah, I see | 17:44 |
| bdpayne | but the ldap service does need to be there | 17:44 |
| bdpayne | and when it fails, we'll need to understand it all deeply | 17:45 |
| alee | bdpayne, I'm hoping over the next couple of months to set up something like devstack with barbican and dogtag/ipa | 17:45 |
| alee | bdpayne, and have it all working in one foul swoop | 17:46 |
| bdpayne | interesting | 17:46 |
| alee | bdpayne, we already do a lot of this with freeipa | 17:46 |
| alee | ie. it sets up dogtag + ldap etc. | 17:46 |
| alee | the idea would be to have barbican + freeipa (which includes the ca and dogtag kra) | 17:47 |
| alee | and have a simple script that sets all this up | 17:47 |
| alee | most of that is already there actually - its just a matter of tying it all together | 17:48 |
| alee | bdpayne, anyways - maybe if I could demonstrate that, the deployment option would be more appealing | 17:49 |
| alee | bdpayne, I understand the concern about complexity but taking the whole package together might make it worthwhile | 17:50 |
| bdpayne | tbh, it is less about setting it up and more about maintaining it | 17:51 |
| alee | bdpayne, and if things do go wrong, there is Red Hat support for the underlying bits (as well as the whole thing in RDO) | 17:51 |
| bdpayne | well, yes | 17:51 |
| bdpayne | that is probably useful for some | 17:51 |
| alee | bdpayne, yeah - depends on who your customers are .. | 17:52 |
| -openstackstatus- NOTICE: Gerrit and Zuul will be offline for a few minutes for a security update | 17:53 | |
| alee | bdpayne, and how much support you want to do yourself. | 17:53 |
| bdpayne | ok, thanks for the discussion, I need to run for now | 17:53 |
| bdpayne | cheers | 17:53 |
| alee | me too -- cheers :) | 17:53 |
| *** alee is now known as alee_lunch | 17:53 | |
| *** bdpayne has quit IRC | 17:54 | |
| *** ayoung_snowedin is now known as ayoung | 17:55 | |
| *** openstack` has joined #openstack-barbican | 18:03 | |
| -sendak.freenode.net- [freenode-info] please register your nickname...don't forget to auto-identify! http://freenode.net/faq.shtml#nicksetup | 18:03 | |
| *** openstack` is now known as openstack | 18:06 | |
| *** kebray has quit IRC | 18:09 | |
| *** kebray has joined #openstack-barbican | 18:10 | |
| *** bdpayne has joined #openstack-barbican | 18:12 | |
| *** bdpayne_ has joined #openstack-barbican | 18:14 | |
| *** bdpayne has quit IRC | 18:17 | |
| *** rm_you| has joined #openstack-barbican | 18:21 | |
| *** alee_lunch is now known as alee | 18:24 | |
| *** rm_you has quit IRC | 18:24 | |
| *** jroll has quit IRC | 18:24 | |
| *** jroll has joined #openstack-barbican | 18:26 | |
| *** jorge_munoz has joined #openstack-barbican | 18:28 | |
| *** lisaclark1 has quit IRC | 18:29 | |
| *** jroll has quit IRC | 18:30 | |
| *** jroll has joined #openstack-barbican | 18:30 | |
| *** openstackgerrit has quit IRC | 18:30 | |
| *** openstackgerrit has joined #openstack-barbican | 18:32 | |
| *** lisaclark1 has joined #openstack-barbican | 18:32 | |
| *** jaosorior has quit IRC | 18:34 | |
| *** rellerreller has joined #openstack-barbican | 18:40 | |
| *** lisaclark1 has quit IRC | 18:56 | |
| *** rm_work|away is now known as rm_work | 19:03 | |
| alee | rellerreller, did you see this? https://polarssl.org/kb/cryptography/asn1-key-structures-in-der-and-pem | 19:12 |
| rellerreller | alee I had not seen this. I'll check it out. | 19:14 |
| *** nkinder has quit IRC | 19:30 | |
| *** kebray has quit IRC | 19:35 | |
| *** lisaclark1 has joined #openstack-barbican | 19:42 | |
| *** nkinder has joined #openstack-barbican | 19:44 | |
| reaperhulk | rellerreller: It's possible to unambiguously identify unencrypted DER structures for DSA/EC as well. We had some serious discussion around this in cryptography land on this PR: https://github.com/pyca/cryptography/pull/1610 | 19:52 |
| *** kebray has joined #openstack-barbican | 19:54 | |
| rellerreller | reaperhulk that is good to hear. Thanks for the info. | 19:55 |
| *** dimtruck is now known as zz_dimtruck | 19:57 | |
| *** zz_dimtruck is now known as dimtruck | 19:58 | |
| rellerreller | rm_work redrobot We have pushed the code Castellan. Have you guys seen the CR https://review.openstack.org/#/c/148742/ ? | 19:59 |
| *** lisaclark1 has quit IRC | 20:00 | |
| *** paul_glass has quit IRC | 20:02 | |
| *** lisaclark1 has joined #openstack-barbican | 20:04 | |
| *** atiwari1 has joined #openstack-barbican | 20:07 | |
| *** atiwari has quit IRC | 20:10 | |
| *** openstack has joined #openstack-barbican | 20:37 | |
| *** openstackgerrit has quit IRC | 20:38 | |
| *** jvrbanac_ has quit IRC | 20:38 | |
| *** kgriffs has quit IRC | 20:38 | |
| *** tdink_ has quit IRC | 20:38 | |
| *** russell_h has quit IRC | 20:38 | |
| *** jroll has quit IRC | 20:38 | |
| *** codekobe has quit IRC | 20:38 | |
| *** darrenmoffat has quit IRC | 20:38 | |
| *** bdpayne_ has quit IRC | 20:38 | |
| *** nkinder has quit IRC | 20:38 | |
| *** alpha_ori has quit IRC | 20:38 | |
| *** rm_work has quit IRC | 20:38 | |
| *** jamielennox has quit IRC | 20:38 | |
| *** rm_you| has quit IRC | 20:38 | |
| *** ayoung has quit IRC | 20:38 | |
| *** david-lyle has quit IRC | 20:38 | |
| *** dougwig has quit IRC | 20:38 | |
| *** atiwari1 has quit IRC | 20:38 | |
| *** lisaclark1 has quit IRC | 20:38 | |
| *** chlong has quit IRC | 20:38 | |
| *** reaperhulk has quit IRC | 20:38 | |
| *** elmiko has quit IRC | 20:38 | |
| *** mordred has quit IRC | 20:38 | |
| *** jkf has quit IRC | 20:38 | |
| *** alee has quit IRC | 20:38 | |
| *** mjg59 has quit IRC | 20:38 | |
| *** tkelsey has quit IRC | 20:38 | |
| *** rellerreller has quit IRC | 20:38 | |
| *** dimtruck has quit IRC | 20:38 | |
| *** jorge_munoz has quit IRC | 20:38 | |
| *** SheenaG1 has quit IRC | 20:38 | |
| *** greghaynes has quit IRC | 20:38 | |
| *** jraim has quit IRC | 20:38 | |
| *** d0ugal has quit IRC | 20:38 | |
| *** lbragstad has quit IRC | 20:38 | |
| *** jillysciarilly has quit IRC | 20:38 | |
| *** chellygel has quit IRC | 20:38 | |
| *** lisaclark has quit IRC | 20:38 | |
| *** insequent has quit IRC | 20:38 | |
| *** hockeynut has quit IRC | 20:38 | |
| *** anteaya has quit IRC | 20:38 | |
| *** arunkant has quit IRC | 20:38 | |
| *** woodster_ has quit IRC | 20:38 | |
| *** redrobot has quit IRC | 20:38 | |
| *** morganfainberg has quit IRC | 20:38 | |
| *** erw has quit IRC | 20:38 | |
| *** dstufft has quit IRC | 20:38 | |
| *** jvrbanac_ has joined #openstack-barbican | 20:44 | |
| *** dimtruck has joined #openstack-barbican | 20:44 | |
| *** kgriffs has joined #openstack-barbican | 20:44 | |
| *** tdink_ has joined #openstack-barbican | 20:44 | |
| *** russell_h has joined #openstack-barbican | 20:44 | |
| *** rm_work has joined #openstack-barbican | 20:44 | |
| *** jamielennox has joined #openstack-barbican | 20:44 | |
| *** atiwari1 has joined #openstack-barbican | 20:44 | |
| *** lisaclark1 has joined #openstack-barbican | 20:44 | |
| *** nkinder has joined #openstack-barbican | 20:44 | |
| *** rellerreller has joined #openstack-barbican | 20:44 | |
| *** openstackgerrit has joined #openstack-barbican | 20:44 | |
| *** jorge_munoz has joined #openstack-barbican | 20:44 | |
| *** jroll has joined #openstack-barbican | 20:44 | |
| *** rm_you| has joined #openstack-barbican | 20:44 | |
| *** bdpayne_ has joined #openstack-barbican | 20:44 | |
| *** jkf has joined #openstack-barbican | 20:44 | |
| *** d0ugal has joined #openstack-barbican | 20:44 | |
| *** alee has joined #openstack-barbican | 20:44 | |
| *** darrenmoffat has joined #openstack-barbican | 20:44 | |
| *** tkelsey has joined #openstack-barbican | 20:44 | |
| *** woodster_ has joined #openstack-barbican | 20:44 | |
| *** greghaynes has joined #openstack-barbican | 20:44 | |
| *** chlong has joined #openstack-barbican | 20:44 | |
| *** mjg59 has joined #openstack-barbican | 20:44 | |
| *** codekobe has joined #openstack-barbican | 20:44 | |
| *** jraim has joined #openstack-barbican | 20:44 | |
| *** alpha_ori has joined #openstack-barbican | 20:44 | |
| *** redrobot has joined #openstack-barbican | 20:44 | |
| *** ayoung has joined #openstack-barbican | 20:44 | |
| *** anteaya has joined #openstack-barbican | 20:44 | |
| *** lbragstad has joined #openstack-barbican | 20:44 | |
| *** reaperhulk has joined #openstack-barbican | 20:44 | |
| *** elmiko has joined #openstack-barbican | 20:44 | |
| *** arunkant has joined #openstack-barbican | 20:44 | |
| *** david-lyle has joined #openstack-barbican | 20:44 | |
| *** mordred has joined #openstack-barbican | 20:44 | |
| *** morganfainberg has joined #openstack-barbican | 20:44 | |
| *** dougwig has joined #openstack-barbican | 20:44 | |
| *** erw has joined #openstack-barbican | 20:44 | |
| *** hockeynut has joined #openstack-barbican | 20:44 | |
| *** insequent has joined #openstack-barbican | 20:44 | |
| *** lisaclark has joined #openstack-barbican | 20:44 | |
| *** chellygel has joined #openstack-barbican | 20:44 | |
| *** jillysciarilly has joined #openstack-barbican | 20:44 | |
| *** dstufft has joined #openstack-barbican | 20:44 | |
| rellerreller | alee ping | 20:48 |
| alee | rellerreller, yo | 20:48 |
| rellerreller | I saw your comment about transport wrapped keys in the content types spec | 20:48 |
| rellerreller | alee What encoding/format are you using? | 20:49 |
| rellerreller | Or how are you doing the encryption? | 20:49 |
| alee | rellerreller, looking -- so we have an asn.1 structure that includes the encrypted bits. iirc, this structure is then base 64 encoded | 20:50 |
| rellerreller | alee Do you recall the asn.1 structure or is it something you created? | 20:51 |
| alee | yeah - let me find a ref | 20:51 |
| alee | its the crmf structure | 20:51 |
| rellerreller | alee Do you have to know the RFC for that? | 20:52 |
| alee | 2511 -- hang on - getting link | 20:53 |
| rellerreller | alee I found it. I think it was then replaced with 4211? | 20:54 |
| alee | rellerreller, https://tools.ietf.org/html/rfc2511 section 6.4 | 20:54 |
| alee | the pkiArchiveOptions structure | 20:54 |
| rellerreller | alee Thanks! | 20:54 |
| alee | np | 20:55 |
| *** kebray has joined #openstack-barbican | 20:56 | |
| *** kebray has quit IRC | 20:56 | |
| *** lisaclark1 has quit IRC | 21:00 | |
| rm_work | rellerreller: I'm +1 now on the first castellan CR | 21:02 |
| rellerreller | rm_work Thanks! Hopefully that can be merged soon, and then we can merge in your stuff. | 21:02 |
| rm_work | yeah, wish I had as much free time for that this week as I did two weeks ago | 21:03 |
| rm_work | we had production stuff kinda come to a head recently | 21:03 |
| *** lisaclark1 has joined #openstack-barbican | 21:05 | |
| *** kebray has joined #openstack-barbican | 21:12 | |
| *** atiwari1 has quit IRC | 21:17 | |
| *** atiwari1 has joined #openstack-barbican | 21:18 | |
| *** jkf has quit IRC | 21:32 | |
| *** jkf has joined #openstack-barbican | 21:39 | |
| *** nkinder has quit IRC | 21:43 | |
| *** ametts has joined #openstack-barbican | 21:47 | |
| *** nkinder has joined #openstack-barbican | 21:56 | |
| *** tkelsey has quit IRC | 22:00 | |
| *** lisaclark1 has quit IRC | 22:00 | |
| *** lisaclark1 has joined #openstack-barbican | 22:09 | |
| *** jkf has quit IRC | 22:19 | |
| *** alee has quit IRC | 22:23 | |
| *** lisaclark2 has joined #openstack-barbican | 22:35 | |
| *** paul_glass has joined #openstack-barbican | 22:37 | |
| *** lisaclark2 has quit IRC | 22:38 | |
| *** lisaclark1 has quit IRC | 22:38 | |
| *** atiwari2 has joined #openstack-barbican | 22:39 | |
| *** atiwari1 has quit IRC | 22:42 | |
| *** nkinder has quit IRC | 22:45 | |
| *** paul_glass has quit IRC | 23:00 | |
| *** rellerreller has quit IRC | 23:06 | |
| *** jkf has joined #openstack-barbican | 23:37 | |
| greghaynes | Hey, can someone cut a release of python-barbicanclient? It just plain does not work after installing from pip and the fix has been merged for over a month | 23:41 |
| greghaynes | http://git.openstack.org/cgit/openstack/python-barbicanclient/commit/?id=586e4ba0cc4458fc5fcb720562544d470e816898 being the bug making it not work | 23:41 |
| rm_work | redrobot usually does that | 23:43 |
| redrobot | greghaynes rm_work I definitely can. | 23:44 |
| greghaynes | awesome, ty! | 23:44 |
| openstackgerrit | Merged openstack/barbican: Updated from global requirements https://review.openstack.org/150495 | 23:44 |
| redrobot | greghaynes https://pypi.python.org/pypi/python-barbicanclient/3.0.2 | 23:51 |
| greghaynes | w00t | 23:52 |
| openstackgerrit | John Wood proposed openstack/barbican-specs: Change GET decrypted secrets to unique URI https://review.openstack.org/125798 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!