| *** dimtruck is now known as zz_dimtruck | 00:09 | |
| *** woodster_ has quit IRC | 00:20 | |
| *** woodster_ has joined #openstack-barbican | 00:30 | |
| *** dave-mccowan has quit IRC | 00:33 | |
| *** dave-mccowan has joined #openstack-barbican | 00:50 | |
| *** bdpayne has quit IRC | 00:51 | |
| *** zz_dimtruck is now known as dimtruck | 01:09 | |
| *** dave-mccowan has quit IRC | 01:33 | |
| openstackgerrit | Merged openstack/barbican: Add missing alembic migration script for CA tables https://review.openstack.org/163607 | 01:57 |
|---|---|---|
| *** xaeth_afk is now known as xaeth | 02:18 | |
| *** xaeth is now known as xaeth_afk | 02:36 | |
| *** tkelsey has joined #openstack-barbican | 02:46 | |
| *** tkelsey has quit IRC | 02:50 | |
| *** bdpayne has joined #openstack-barbican | 03:05 | |
| *** bdpayne has quit IRC | 03:06 | |
| *** gyee has quit IRC | 03:23 | |
| *** dimtruck is now known as zz_dimtruck | 03:24 | |
| *** kebray has joined #openstack-barbican | 03:24 | |
| *** kebray has quit IRC | 03:28 | |
| *** kebray has joined #openstack-barbican | 03:29 | |
| *** xaeth_afk is now known as xaeth | 03:30 | |
| *** xaeth is now known as xaeth_afk | 03:46 | |
| *** zz_dimtruck is now known as dimtruck | 04:36 | |
| *** woodster_ has quit IRC | 04:40 | |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Porting more tests to test_secrets https://review.openstack.org/164074 | 04:55 |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Consumer resources https://review.openstack.org/164075 | 05:00 |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Container resources https://review.openstack.org/164076 | 05:07 |
| *** dimtruck is now known as zz_dimtruck | 05:28 | |
| *** gitorres has joined #openstack-barbican | 06:48 | |
| *** tkelsey has joined #openstack-barbican | 07:17 | |
| *** jamielennox has quit IRC | 07:31 | |
| *** jamielennox has joined #openstack-barbican | 07:34 | |
| *** jamielennox has quit IRC | 07:39 | |
| *** jamielennox|away has joined #openstack-barbican | 07:55 | |
| *** jamielennox|away is now known as jamielennox | 07:55 | |
| *** nickrmc84 has joined #openstack-barbican | 08:07 | |
| *** nickrmc83 has quit IRC | 08:07 | |
| *** chlong has quit IRC | 08:09 | |
| *** openstackgerrit has quit IRC | 08:21 | |
| *** openstackgerrit has joined #openstack-barbican | 08:21 | |
| *** kebray has quit IRC | 08:56 | |
| *** tkelsey has quit IRC | 09:04 | |
| *** tkelsey has joined #openstack-barbican | 09:11 | |
| *** jamielennox has quit IRC | 10:55 | |
| *** jamielennox|away has joined #openstack-barbican | 11:02 | |
| *** jamielennox|away is now known as jamielennox | 11:02 | |
| *** jamielennox has quit IRC | 11:14 | |
| *** jamielennox|away has joined #openstack-barbican | 11:24 | |
| *** jamielennox|away is now known as jamielennox | 11:24 | |
| *** dave-mccowan has joined #openstack-barbican | 11:32 | |
| *** darrenmoffat has quit IRC | 11:48 | |
| *** darrenmoffat has joined #openstack-barbican | 11:49 | |
| *** rellerreller has joined #openstack-barbican | 12:05 | |
| *** chlong has joined #openstack-barbican | 12:25 | |
| openstackgerrit | Merged openstack/barbican: Remove extra v1 from override uri https://review.openstack.org/163595 | 13:33 |
| *** dave-mccowan has quit IRC | 13:42 | |
| openstackgerrit | Ade Lee proposed openstack/barbican: Added new repository classes and controller classes for CAs https://review.openstack.org/147981 | 13:48 |
| *** dave-mccowan has joined #openstack-barbican | 13:56 | |
| *** paul_glass has joined #openstack-barbican | 14:05 | |
| openstackgerrit | Nathan Reller proposed openstack/barbican: Standardized Secret Encoding https://review.openstack.org/160444 | 14:54 |
| alee | dave-mccowan, ping | 15:02 |
| alee | redrobot, jvrbanac - https://review.openstack.org/147981 has mostly the same stuff as was reviewed at the mid cycle. | 15:03 |
| alee | rellerreller, ping | 15:09 |
| *** xaeth_afk is now known as xaeth | 15:09 | |
| dave-mccowan | alee pong | 15:11 |
| alee | dave-mccowan, hey - we discussed making some changes for validations etc. on the cert api side of things at the midcycle .. | 15:11 |
| alee | dave-mccowan, so - where are we on this effort? | 15:11 |
| rellerreller | alee pong | 15:12 |
| alee | rellerreller, nm - I figured out what you were doing .. | 15:12 |
| rellerreller | alee I'm glad you know what I'm doing. Sometimes I don't. | 15:13 |
| dave-mccowan | alee i haven't done anything yet since validate_subject_dn, but I'd still like too. | 15:13 |
| alee | rellerreller, well I didn't say I knew what I was doing - maybe you know | 15:14 |
| alee | dave-mccowan, ok - I want to try and wrap up as much of the cert api stuff as we can soon. | 15:14 |
| alee | dave-mccowan, let me look at the code and we can discuss what patches need to go in. | 15:14 |
| alee | dave-mccowan, so if I recall correctly, we wanted to not require a container_ref for the stored key case? | 15:19 |
| alee | dave-mccowan, and rather make that a reference to a private key? | 15:20 |
| openstackgerrit | Adam Harwell proposed openstack/barbican: Fix functionaltest keystone URL fetch bug for v2 https://review.openstack.org/164217 | 15:22 |
| rm_work | ^^ fixes the bug I mentioned yesterday, where the functionaltests wouldn't work with v2 auth | 15:22 |
| rm_work | jvrbanac: ^^ | 15:23 |
| dave-mccowan | alee my notes say "really need a secret ref validator", under _validate_certificate_container() | 15:25 |
| alee | dave-mccowan, right -- I think the original idea was that I thought I needed the public key - then I realized I needed the private key, so I made it a container ref | 15:27 |
| alee | dave-mccowan, but then I realized I only needed the private key | 15:27 |
| alee | dave-mccowan, well - except that I might need a passphrase too .. hmm | 15:29 |
| rm_work | alee: I believe the decision was made to make no part of a Cert container required | 15:29 |
| rm_work | right? :P | 15:29 |
| dave-mccowan | alee i'll follow your lead | 15:30 |
| rm_work | is that actually done yet? I missed a lot of CRs | 15:30 |
| alee | rm_work, that sounds familiar -- you'll have to bear with me, it was more than a week ago .. | 15:30 |
| rm_work | hehe | 15:30 |
| alee | rm_work, no - I think thats the next CR .. | 15:30 |
| rm_work | ah, so they still REQUIRE a cert and a PK right now? | 15:31 |
| jvrbanac | rm_work, awesome thx | 15:31 |
| alee | rm_work, right now it requires a container_ref | 15:31 |
| *** zz_dimtruck is now known as dimtruck | 15:31 | |
| rm_work | alee: I mean, the cert_container requires a cert and PK | 15:32 |
| alee | rm_work, I dont think so | 15:32 |
| rm_work | alee: ah, that was what i was asking | 15:33 |
| *** david-lyle_afk is now known as david-lyle | 15:33 | |
| rm_work | it *used to* | 15:33 |
| rm_work | via the validator | 15:33 |
| alee | I'd have to look but I thought we made those optional | 15:33 |
| rm_work | but I didn't know if the patch to remove that validation went in yet | 15:33 |
| rm_work | i can look | 15:33 |
| rm_work | AH lol | 15:34 |
| rm_work | ooor it used to, then there was the validator re-write | 15:34 |
| rm_work | and now it does nothing :P | 15:34 |
| rm_work | def _validate_certificate_container(self, public_key_ref): | 15:34 |
| rm_work | TODO(alee-3) complete this function | 15:34 |
| rm_work | and a `pass` :P | 15:35 |
| alee | rm_work, maybe you're looking at a different function. Thast something that I added | 15:35 |
| rm_work | yeah | 15:35 |
| alee | for the stored key cert case | 15:35 |
| rm_work | hmm, thought this file was where the other validation had been before | 15:36 |
| rm_work | ah i see | 15:36 |
| rm_work | just the wrong class | 15:37 |
| rm_work | yeah ok cert is required, PK/PKP/intermediates optional | 15:37 |
| rm_work | was the plan to make cert optional as well? | 15:37 |
| alee | rm_work, line? | 15:37 |
| alee | redrobot, where are the notes deom the midcycle? | 15:38 |
| rm_work | 664 | 15:40 |
| rm_work | alee: ^^ | 15:40 |
| *** arunkant has joined #openstack-barbican | 15:43 | |
| alee | rm_work, when do these validators run? | 15:46 |
| rm_work | on container creation | 15:46 |
| rm_work | I believe | 15:47 |
| alee | rm_work, right - so you want to create certificate containers without the certificate? | 15:47 |
| rm_work | alee: *I* don't | 15:47 |
| rm_work | but I thought we agreed that we could at the midcycle >_> | 15:47 |
| rm_work | I was actually against making so much stuff optional | 15:48 |
| openstackgerrit | Merged openstack/barbican: Upping process-timeout and fixing posargs in tox.ini https://review.openstack.org/163926 | 15:48 |
| rm_work | but now we're coding super defensively (which is probably the best approach anyway) so it doesn't matter | 15:48 |
| alee | does anyone remember who wants this? | 15:48 |
| alee | (and why) | 15:48 |
| alee | dave-mccowan, so it seems like we have two options here .. | 15:49 |
| alee | dave-mccowan, for the stored key cert issuance case, we can either require a contaiiner_ref to a RSA container (which contains public_key, private_key and optionally passphrase) | 15:51 |
| alee | dave-mccowan, or we can require a reference to a secret for the private key (and optionally passphrase) directly | 15:52 |
| alee | dave-mccowan, before I had said reference to a certificate container - which is incorrect - the certificate container is the result of the cert issuance operation | 15:53 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Test functionality of generated asymmetric keys https://review.openstack.org/162425 | 15:55 |
| alee | dave-mccowan, my inclination is to require a container_ref because 1) thats what the container was originally designed to do (2) we have some kind of assurance that the data in the container is valid keys | 15:55 |
| alee | especially of the container has been generated by asking barbican to generate the keys | 15:57 |
| alee | and we can always add a validator for rsa containers later to check that public_key/private_key/passphrase are related | 15:58 |
| alee | and contain valid data | 15:58 |
| alee | in case someone wants to create their own container. | 15:58 |
| alee | like rm_work might | 15:58 |
| alee | (of course rm_work is just going to go ahead and create the cert container directly) | 15:59 |
| *** igueths has joined #openstack-barbican | 16:01 | |
| alee | dave-mccowan, ? | 16:01 |
| *** igueths has quit IRC | 16:03 | |
| alee | jvrbanac, ping | 16:04 |
| jvrbanac | alee, pong | 16:08 |
| alee | jvrbanac, I was looking for the functional tests - and seeing if there was anything there for certs. (which there isn't) | 16:09 |
| alee | jvrbanac, seems like we need something there now .. | 16:09 |
| jvrbanac | alee, yeah. I noticed that. | 16:10 |
| alee | jvrbanac, https://review.openstack.org/#/c/147981/ in case you're looking for code to review :) | 16:10 |
| alee | jvrbanac, its what we discussed at the midcycle -- only with newer spiffier tests | 16:11 |
| jvrbanac | alee, awesome I'll try to take a look here in a bit. | 16:11 |
| jvrbanac | alee, today is a bit crazy | 16:11 |
| alee | jvrbanac, thanks | 16:11 |
| alee | (it always is) | 16:11 |
| redrobot | alee https://etherpad.openstack.org/p/barbican-kilo-sprint | 16:15 |
| *** woodster_ has joined #openstack-barbican | 16:16 | |
| redrobot | alee can I get a quick workflow on https://review.openstack.org/#/c/161466/4 | 16:20 |
| alee | redrobot, done -- I'll trade you for a review of https://review.openstack.org/147981 :) | 16:22 |
| alee | woodster_, you around? | 16:23 |
| *** jkf has joined #openstack-barbican | 16:24 | |
| redrobot | alee sounds good | 16:27 |
| *** gitorres has quit IRC | 16:36 | |
| *** kebray has joined #openstack-barbican | 16:38 | |
| alee | dave-mccowan, ping? | 16:55 |
| *** xaeth is now known as xaeth_afk | 17:04 | |
| dave-mccowan | alee pong | 17:06 |
| alee | dave-mccowan, sorry - in another meeting. when done we can discuss what needs to be done for cert api | 17:11 |
| openstackgerrit | Merged openstack/python-barbicanclient: Use functional_test.conf for devstack gate https://review.openstack.org/161466 | 17:13 |
| alee | dave-mccowan, there? | 17:18 |
| dave-mccowan | alee yes, i'm back | 17:19 |
| alee | dave-mccowan, so there are a bunch of things that need to be done for cert api | 17:19 |
| alee | here is my list .. | 17:19 |
| alee | dave-mccowan, http://www.fpaste.org/197681/26720614/ | 17:20 |
| alee | dave-mccowan, you can choose to work on whichever ones you like. | 17:20 |
| alee | dave-mccowan, I think I will work on #1 today | 17:20 |
| alee | that way we can test everything from end-to-end | 17:21 |
| alee | and have a target for things that both work and should not work | 17:21 |
| alee | dave-mccowan, I think originally, you were going to work on #2 | 17:21 |
| alee | and #3 | 17:22 |
| alee | #4 needs to be done with/by woodster | 17:23 |
| alee | #5,6 will be done by me | 17:23 |
| dave-mccowan | i got #7 :-) | 17:23 |
| alee | dave-mccowan, I need to think about whether we need to actually do any work for #7 :) | 17:24 |
| dave-mccowan | alee I'll start with #2 today | 17:24 |
| alee | ok great -- I think most of the checks in there should be pretty straightforward | 17:24 |
| alee | the hard part is determining if the user has access to the secrets | 17:25 |
| alee | given that we're doing the whole acl thing. | 17:25 |
| alee | for now, though, lets assume that having access means that the secret is in the same project as the user - and we can revisit later when the acl thing lands | 17:26 |
| alee | dave-mccowan, does that all make sense? | 17:27 |
| *** bdpayne has joined #openstack-barbican | 17:31 | |
| *** kfarr has joined #openstack-barbican | 17:32 | |
| *** xaeth_afk is now known as xaeth | 17:33 | |
| dave-mccowan | alee yes. i'm looking at the code now. i'll come back ASAP with any questions. other than your list, the rest of the certificate API code has been merged and can be driven by unit test? | 17:33 |
| alee | yup | 17:33 |
| *** rellerreller has quit IRC | 17:34 | |
| alee | dave-mccowan, when you do 2 , there will be validator tests that can be un-skipped (and updated_ | 17:34 |
| dave-mccowan | alee did something change w.r.t. oslo_log recently? | 17:38 |
| *** tkelsey has quit IRC | 17:41 | |
| alee | dave-mccowan, yeah | 17:42 |
| alee | dave-mccowan, you probably need to do a tox -r to recreate your environment | 17:43 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Porting more tests to test_secrets https://review.openstack.org/164074 | 17:49 |
| dave-mccowan | alee, yep, thanks! | 17:50 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Third round of refactoring secrets tests https://review.openstack.org/164286 | 18:05 |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets paging tests in parallel https://review.openstack.org/141138 | 18:09 |
| openstackgerrit | Paul Kehrer proposed openstack/barbican: add another missing status code check in functional tests https://review.openstack.org/164288 | 18:10 |
| openstackgerrit | John Vrbanac proposed openstack/barbican: Making sure we allow all content-types for delete calls https://review.openstack.org/163968 | 18:14 |
| openstackgerrit | John Vrbanac proposed openstack/barbican: Making sure we allow all content-types for delete calls https://review.openstack.org/163968 | 18:16 |
| *** woodster_ has quit IRC | 18:20 | |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Porting more tests to test_secrets https://review.openstack.org/164074 | 18:31 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-barbicanclient: Enable usage of 'payload' path to fetch decrypted secrets https://review.openstack.org/161643 | 18:38 |
| *** kebray has quit IRC | 18:40 | |
| *** igueths has joined #openstack-barbican | 18:42 | |
| igueths | Hi all. | 18:42 |
| *** kebray has joined #openstack-barbican | 18:52 | |
| *** kebray has quit IRC | 19:01 | |
| *** xaeth is now known as xaeth_afk | 19:01 | |
| *** kebray has joined #openstack-barbican | 19:05 | |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Second set of negative secrets tests. https://review.openstack.org/163556 | 19:08 |
| *** jaosorior has joined #openstack-barbican | 19:10 | |
| redrobot | welcome back jamielennox | 19:20 |
| redrobot | derp | 19:20 |
| redrobot | i mean | 19:20 |
| redrobot | welcome back jaosorior | 19:20 |
| jaosorior | redrobot: thanks man! | 19:21 |
| redrobot | jaosorior how was the vacation? | 19:21 |
| jaosorior | it was brilliant | 19:21 |
| jaosorior | decadent | 19:21 |
| jaosorior | yet brilliant :P | 19:21 |
| jaosorior | got back today | 19:21 |
| elmiko | where did you go? | 19:21 |
| jaosorior | and now I have a pretty annoying flu | 19:21 |
| jaosorior | but didn't get sick while on the trip, so fuck yeh :P | 19:21 |
| jaosorior | I was in Madrid for a week | 19:21 |
| *** xaeth_afk is now known as xaeth | 19:21 | |
| elmiko | oooh, nice =) | 19:22 |
| jaosorior | barely made it back to the airport today. it was a pretty crazy trip | 19:22 |
| elmiko | sometimes those are the best though | 19:23 |
| jaosorior | and food is so awesome there | 19:24 |
| jaosorior | damn | 19:24 |
| elmiko | only thing i know about spanish food is tapas, paella, and sangria =) | 19:26 |
| elmiko | not sure if that's a madrid thing though | 19:26 |
| *** atiwari has joined #openstack-barbican | 19:27 | |
| jaosorior | well, they do have those, but they have a lot broader cuisine | 19:27 |
| jaosorior | such as a stew made out of a bull's tail, and fried calamari tapas | 19:28 |
| jaosorior | good stuff! | 19:28 |
| elmiko | nice | 19:28 |
| igueths | Wb jaosorior | 19:32 |
| jaosorior | igueths: thanks mr.! | 19:33 |
| openstackgerrit | Merged openstack/barbican: Fix functionaltest keystone URL fetch bug for v2 https://review.openstack.org/164217 | 19:34 |
| *** rellerreller has joined #openstack-barbican | 19:36 | |
| chellygel | rellerreller, you are too nice :P | 19:56 |
| chellygel | rellerreller, i'll fix the nits, they are good observations | 19:56 |
| rellerreller | alee You want to check out the content types patch now? Doug gave +2, so you might want to take a look since you have the Dogtag SecretStore. | 19:57 |
| alee | rellerreller, yup -on my list of crs to review today :/ | 19:57 |
| alee | today is cr -review day | 19:57 |
| rellerreller | chellygel I don't want to be too pedantic. I try to keep it positive. | 19:58 |
| rellerreller | alee me too | 19:59 |
| alee | rellerreller, feel free to look at https://review.openstack.org/#/c/147981/ then :) | 20:00 |
| rellerreller | alee I'm on it | 20:00 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 20:04 |
| *** kfarr has quit IRC | 20:06 | |
| *** kgriffs|afk is now known as kgriffs | 20:09 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes only (Part 1) https://review.openstack.org/164334 | 20:18 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with controller layer changes (Part 2) https://review.openstack.org/164335 | 20:19 |
| openstackgerrit | Douglas Mendizábal proposed openstack/python-barbicanclient: Don't use tempest log https://review.openstack.org/164336 | 20:21 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with policy layer changes (Part 3) https://review.openstack.org/164337 | 20:25 |
| arunkant | woodster_, alee, redrobot: I have splitted per secret policy change in three patches. Is it in revieweable state now? | 20:31 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Porting more tests to test_secrets https://review.openstack.org/164074 | 20:31 |
| alee | arunkant, sounds good - I'll get on it soon - prob mon morning | 20:32 |
| openstackgerrit | Merged openstack/python-barbicanclient: Deprecate setting the payload type and encoding https://review.openstack.org/162777 | 20:33 |
| chellygel | rellerreller, fixed, try again and check me :D | 20:33 |
| chellygel | also, would love the reviews for those 2 crs before monday | 20:34 |
| rellerreller | chellygel I'm on it. What are the other 2 CRs? | 20:35 |
| chellygel | oh there are just 2 of the secret refactors, no more | 20:35 |
| chellygel | https://review.openstack.org/#/c/164074/ and https://review.openstack.org/#/c/164286/ rellerreller | 20:35 |
| chellygel | scratch that on the 2nd link i need to flip around the asserts on that cr too, forgot about that | 20:36 |
| chellygel | derp. | 20:36 |
| *** kgriffs is now known as kgriffs|afk | 20:38 | |
| elmiko | rellerreller: you know, i had wondered about the order of those values to assertEqual, but i didn't want to rock the boat ;) | 20:41 |
| rellerreller | elmiko the boat was rocked by redrobot. He pointed it out in my code, so I did the same to the code reviews I did. | 20:42 |
| rellerreller | I guess it's ok for him to rock the boat since he is the PTL. | 20:43 |
| rellerreller | I do like it. I looked up in the documentation the preferred order, but I could not find anything. I'm glad we're being consistent now. | 20:43 |
| elmiko | agreed =) | 20:46 |
| elmiko | it looked odd to me refactoring the containers tests because we do it the other way in sahara (the normal way) | 20:46 |
| openstackgerrit | Michael McCune proposed openstack/barbican: Moving containers tests to separate module https://review.openstack.org/162504 | 20:48 |
| *** dave-mccowan has quit IRC | 21:02 | |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Third round of refactoring secrets tests https://review.openstack.org/164286 | 21:04 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Third round of refactoring secrets tests https://review.openstack.org/164286 | 21:05 |
| chellygel | sorry for spam | 21:05 |
| chellygel | :( | 21:05 |
| chellygel | but it should be done now! | 21:05 |
| chellygel | \o/ plz gimme some reviews when you can | 21:05 |
| elmiko | that's the spam of *progress* ! | 21:06 |
| chellygel | ^ | 21:06 |
| chellygel | how i feel right now: http://4.bp.blogspot.com/-vhxulNpk5aY/VCRN3AzZp7I/AAAAAAABdVU/8W342aVHzUc/s1600/tumblr_mlpy1k2aD61sonquko1_500.gif | 21:07 |
| elmiko | hehe | 21:07 |
| elmiko | i hate to be the kryptonite in the punchbowl, but you missed an assertEqual =( | 21:07 |
| chellygel | fuuuuuu lol | 21:08 |
| chellygel | line num? | 21:08 |
| elmiko | i know the feels | 21:08 |
| elmiko | 350 & 352 | 21:08 |
| elmiko | er 351 | 21:08 |
| *** kgriffs|afk is now known as kgriffs | 21:09 | |
| elmiko | otherwise lgtm | 21:09 |
| chellygel | i seez it | 21:09 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Porting more tests to test_secrets https://review.openstack.org/164074 | 21:10 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Third round of refactoring secrets tests https://review.openstack.org/164286 | 21:10 |
| chellygel | okay, no but really this time | 21:11 |
| rm_work | what, done already?! | 21:11 |
| * rm_work demands more progress | 21:11 | |
| chellygel | how about that for quick delivery 8) | 21:11 |
| chellygel | tuturu~ | 21:11 |
| elmiko | chellygel: nice | 21:12 |
| elmiko | although you did deny me that sweet sweet -1 stat ;) | 21:13 |
| elmiko | how thorough do we want to get with this assertEqual stuff? | 21:14 |
| elmiko | chellygel: 49,50,108,206,258,300 could also be swapped | 21:17 |
| *** tkelsey has joined #openstack-barbican | 21:18 | |
| *** igueths has quit IRC | 21:19 | |
| *** tkelsey has quit IRC | 21:22 | |
| *** paul_glass has quit IRC | 21:39 | |
| *** dave-mccowan has joined #openstack-barbican | 21:48 | |
| alee | rellerreller, you there? | 21:54 |
| rellerreller | alee here | 21:54 |
| alee | rellerreller, so just tryint to understand your patch | 21:54 |
| alee | rellerreller, lets look at translations.py | 21:54 |
| rellerreller | OK | 21:54 |
| alee | thats pretty much the meat of it .. | 21:55 |
| alee | so -- secrets can come in in various formats | 21:55 |
| alee | if plaintext , then they are base 64 encoded and sent to the plugin | 21:56 |
| alee | and on the way back, I see the reverse encoding is done in the normalize_afetr_decryption function | 21:57 |
| rellerreller | True | 21:57 |
| alee | now - if binary and containing PEM headers , then this is passed as <pem header> + base64 encoded payload + <pem footer> to lugin | 21:59 |
| alee | on the way back .. | 21:59 |
| rellerreller | All private, public, and certificate types are base64 encoded with PEM headers before being sent to secret store and are expected to be returned from secret store in that format. | 22:00 |
| alee | sure .. we'll ignore encrypted private keys for the moment | 22:01 |
| rellerreller | That is if in binary format then convert and send to secret store. If already in PEM format then pass through. | 22:01 |
| alee | right -- I see that .. what happens on the way back? | 22:02 |
| rellerreller | The secret store receives a get call. That returns the data in base64 encoding. If secret is private, public, or certificate then includes PEM headers. | 22:02 |
| rellerreller | The secret API calls resources to get secret. That is what calls secret store get call. | 22:03 |
| rellerreller | Then resources calls denormalize. That converts all data to its binary format. | 22:03 |
| alee | stripping off all PEM headers? | 22:03 |
| rellerreller | All data returned from Secrets API is in binary format, except for plaintext, which is utf-8. | 22:04 |
| rellerreller | Stripping off PEM headers and returning in DER format | 22:04 |
| *** xaeth is now known as xaeth_afk | 22:05 | |
| rellerreller | The API says that all secrets are returned in binary format. | 22:05 |
| rellerreller | I had to abide by that. I was hoping for an Accepts-Encoding or something like that, but we do not have support for that at the moment. | 22:06 |
| alee | rellerreller, this maybe a silly question but why are we adding PEM headers before storage in the secret store to begin with -- if we just plan to remove them later? | 22:06 |
| rellerreller | alee That is not silly. I actually wondered the same thing. | 22:07 |
| rellerreller | What surprised me was that all secrets are returned in binary format. I only found that out at the end. | 22:08 |
| alee | rellerreller, yeah - that surprises me too | 22:09 |
| rellerreller | If I would have known that then I would have stored everything in binary format and transferred everything in binary format. | 22:09 |
| alee | but if we have that restriction, then I'm not sure I see the point of all this messing around with PEM headers | 22:09 |
| alee | yeah | 22:10 |
| rellerreller | I still think it is useful. I would like to support PEM and DER retrieval in the future. | 22:10 |
| rellerreller | So I don't think it is a total loss. I'm just building for the future :) | 22:10 |
| alee | rellerreller, lets talk about encrypted private keys | 22:12 |
| rellerreller | I feel like the most common use case will be for users to give us public keys in PEM format and retrieve them in PEM format, that is after we enable support for PEM format on retrieval | 22:12 |
| rellerreller | Transport wrapped or passphrase encrypted? | 22:12 |
| alee | passphrase | 22:12 |
| alee | rellerreller, even if we supported returning PEM, there is no reason to send the data to the secret store in PEM format. | 22:14 |
| alee | rellerreller, just a sec .. need to turn on tv for munchkins | 22:14 |
| rellerreller | ok | 22:15 |
| alee | rellerreller, so I see two formats for passphrase encrypted private keys .. | 22:17 |
| rellerreller | I'm expecting PKCS8 | 22:17 |
| rellerreller | That is also what the store_crypto plugin is using | 22:18 |
| alee | ok - so thats going to have headers like -- -----BEGIN ENCRYPTED PRIVATE KEY----- | 22:19 |
| alee | rellerreller, how is your code goign to be modified to handle this? | 22:19 |
| rellerreller | It will at least say BEGIN PRIVATE KEY | 22:19 |
| alee | eh? | 22:19 |
| alee | BEGIN ENCRYPTED ... ? right? | 22:20 |
| rellerreller | So from our point of view it does not really matter. Both are PKCS8. | 22:20 |
| rellerreller | All I'm going to do is tell KMIP to store it. The same with store_crypto. I assume similar for you. | 22:20 |
| rellerreller | That is the problem I had with the PEM headers. You can have headers like BEGIN PRIVATE KEY, BEGIN PRIVATE RSA KEY, BEGIN PRIVATE ENCRYPTED KEY. In the end it does not matter. It's a private key. | 22:21 |
| rellerreller | If you want to know what it really is then you have to parse the PKCS8 structure. | 22:22 |
| rellerreller | I should note that all those headers I listed are acceptable. For instance openssl just has BEGIN PRIVATE KEY. It does not include the RSA algorithm. | 22:23 |
| alee | rellerreller, so the way the code is now, if someone sends in something to be stored and it has a head ("BEGIN ENCRYPTED .." etc) it will be sent tot he plugin and stored as is. | 22:23 |
| alee | rellerreller, and when retrieved, we strip the header off anyways | 22:24 |
| rellerreller | alee are you proposing that we store everything in binary format? | 22:25 |
| alee | rellerreller, I was going to say it matters if someone sends in something without a header and we need to add one to send to the store, and we may append the wong one. | 22:25 |
| rellerreller | I mean pass everything to secret store in binary format. | 22:25 |
| alee | rellerreller, but it doesn't matter, because we strip the pem header off anywyas | 22:25 |
| alee | rellerreller, I see no reason to add pem headers if we are going to strip them off | 22:26 |
| alee | we can pass everything to secret store as binary and simply it all. | 22:26 |
| rellerreller | alee I agree, but we have said for a long time now that everything will be passed to secret store in base64 encoding. | 22:27 |
| rellerreller | And I already wrote all of this code :( | 22:27 |
| alee | well I guess we can base64 encode everything -- just not add pem headers | 22:27 |
| alee | and anything generated by the plugin will be DER encoded | 22:28 |
| rellerreller | What don't you like about the headers? | 22:28 |
| rellerreller | and anything generated by the plugin will be DER encoded? | 22:28 |
| alee | ok - so the question I has was this .. | 22:29 |
| alee | lets say someone sends us an encrypted private key with a header -- we keep the header and store the base 64 encoded contents. | 22:30 |
| openstackgerrit | Merged openstack/barbican: add another missing status code check in functional tests https://review.openstack.org/164288 | 22:30 |
| alee | thats fine. | 22:30 |
| *** dimtruck is now known as zz_dimtruck | 22:30 | |
| alee | lets say someone sends the same encrypted key as binary with no headers | 22:30 |
| alee | as it is right now - we have to add a header -- which in this case will be PRIVATE_KEY | 22:31 |
| alee | and which would be wrong. | 22:31 |
| rellerreller | I don't think it is wrong. It is a private key. | 22:31 |
| rellerreller | I have not seen any specs that detail the PEM headers. | 22:32 |
| rellerreller | It really seems like a convenience for people. | 22:32 |
| alee | yeah - but isn't the point to eventually return the keys with pem headers -- and therefore actually use whats stored in the secret store | 22:33 |
| rellerreller | Like I said some libraries include RSA PRIVATE KEY. It is not wrong to omit the RSA and just say PRIVATE KEY. | 22:33 |
| alee | rellerreller, ok - so the encrypted part is not required | 22:33 |
| alee | ok -- we'll keep it as is for now - and add headers etc. | 22:34 |
| *** igueths has joined #openstack-barbican | 22:34 | |
| rellerreller | alee I think that is good, and not just because I don't want to change my code. | 22:34 |
| alee | I agree that eventually we'll want to return secrets in actual pem format | 22:35 |
| rellerreller | alee one benefit of base64 is that we do not have Python's binary different representations in Py2 and Py3. | 22:35 |
| alee | yup | 22:35 |
| rellerreller | I think returning in PEM format should be easy. We just need to specify encoding in get call. | 22:36 |
| rellerreller | Apparently Accept-Encoding is not the right header. | 22:36 |
| alee | rellerreller, need to go eat dinner. I had some minor nits otherwise. I just wanted to make sure I understood correctly that we were just throwing away the headers on retrieval. | 22:37 |
| rellerreller | I have been looking through RFCs to find out how to specify this in a request. I'm not familiar with that stuff, so I'm hoping someone else knows. | 22:37 |
| rellerreller | alee np | 22:37 |
| rellerreller | My wife has been calling me for dinner for 10 minutes now :) | 22:37 |
| alee | rellerreller, I'l finish up the review later tonight .. | 22:37 |
| rellerreller | alee Enjoy your dinner. | 22:37 |
| alee | me too .. later -- have a good weekend | 22:37 |
| alee | you too | 22:37 |
| rellerreller | Thanks! You too. | 22:38 |
| *** rellerreller has quit IRC | 22:46 | |
| *** jkf has quit IRC | 22:48 | |
| *** ametts has quit IRC | 22:53 | |
| *** igueths has quit IRC | 23:03 | |
| *** kebray has quit IRC | 23:04 | |
| *** tkelsey has joined #openstack-barbican | 23:19 | |
| *** tkelsey has quit IRC | 23:23 | |
| *** david-lyle is now known as david-lyle_afk | 23:29 | |
| *** zz_dimtruck is now known as dimtruck | 23:32 | |
| *** jaosorior has quit IRC | 23:32 | |
| *** bdpayne has quit IRC | 23:41 | |
| *** bdpayne has joined #openstack-barbican | 23:41 | |
| *** dimtruck is now known as zz_dimtruck | 23:42 | |
| *** dave-mccowan has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
