| *** woodster_ has quit IRC | 00:10 | |
| *** tkelsey has joined #openstack-barbican | 00:42 | |
| *** zz_dimtruck is now known as dimtruck | 00:47 | |
| *** tkelsey has quit IRC | 00:47 | |
| *** dimtruck is now known as zz_dimtruck | 01:32 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets and container paging tests in parallel https://review.openstack.org/141138 | 03:49 |
|---|---|---|
| *** zz_dimtruck is now known as dimtruck | 03:50 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets and order paging tests in parallel https://review.openstack.org/141138 | 03:53 |
| openstackgerrit | John Wood proposed openstack/barbican: Add sub-status logic to worker/task processing https://review.openstack.org/157565 | 04:11 |
| *** tkelsey has joined #openstack-barbican | 04:43 | |
| *** tkelsey has quit IRC | 04:47 | |
| *** dimtruck is now known as zz_dimtruck | 05:12 | |
| openstackgerrit | Joshua Hesketh proposed openstack/barbican: Add pip-check-reqs tox environment https://review.openstack.org/164576 | 05:54 |
| openstackgerrit | Joshua Hesketh proposed openstack/barbican: Add pip-check-reqs tox environment https://review.openstack.org/164576 | 05:58 |
| *** gitorres has joined #openstack-barbican | 06:27 | |
| openstackgerrit | John Vrbanac proposed openstack/barbican: Splitting out remaining order tests from test_resources https://review.openstack.org/164588 | 07:13 |
| *** gitorres has left #openstack-barbican | 07:15 | |
| *** tkelsey has joined #openstack-barbican | 08:26 | |
| *** jorge_munoz has quit IRC | 08:28 | |
| *** jorge_munoz has joined #openstack-barbican | 08:29 | |
| *** gitorres has joined #openstack-barbican | 10:17 | |
| *** gitorres has quit IRC | 10:29 | |
| *** rellerreller has joined #openstack-barbican | 10:43 | |
| openstackgerrit | Nathan Reller proposed openstack/barbican: Standardized Secret Encoding https://review.openstack.org/160444 | 11:10 |
| *** rellerreller has quit IRC | 11:33 | |
| *** gitorres has joined #openstack-barbican | 11:42 | |
| *** darrenmoffat has quit IRC | 11:52 | |
| *** darrenmoffat has joined #openstack-barbican | 11:53 | |
| *** rm_work is now known as rm_work|away | 12:14 | |
| *** woodster_ has joined #openstack-barbican | 12:27 | |
| woodster_ | alee: can you look at the sub-types CR again? | 12:28 |
| *** dave-mccowan has quit IRC | 12:36 | |
| *** openstackgerrit has quit IRC | 12:50 | |
| *** openstackgerrit has joined #openstack-barbican | 12:50 | |
| alee | woodster_, looking | 12:57 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Test functionality of generated asymmetric keys https://review.openstack.org/162425 | 12:57 |
| *** gitorres has left #openstack-barbican | 12:59 | |
| *** dave-mccowan has joined #openstack-barbican | 13:10 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Deprecate old secret decrypt path both in code and docs https://review.openstack.org/164540 | 13:13 |
| *** jaosorior has joined #openstack-barbican | 13:43 | |
| alee | woodster_, ping | 13:56 |
| *** paul_glass has joined #openstack-barbican | 14:11 | |
| *** rellerreller has joined #openstack-barbican | 14:16 | |
| *** zz_dimtruck is now known as dimtruck | 14:21 | |
| openstackgerrit | Ade Lee proposed openstack/barbican: Added new repository classes and controller classes for CAs https://review.openstack.org/147981 | 14:27 |
| jaosorior | alee: commented on your CR | 14:45 |
| alee | jaosorior, thanks checking | 14:45 |
| jaosorior | it's only regarding the tests now | 14:46 |
| jaosorior | the rest looks good to me | 14:46 |
| alee | jaosorior, ok - so replace with assertListEqual at lines 80, 95, 107, 178, 195, 215, 228, 324, 346, 362, 371 | 14:51 |
| jaosorior | alee: uhm I guess that should be alright | 14:53 |
| alee | :) | 14:53 |
| alee | jaosorior, there might be some in test_cas.py too - I'll look. | 14:54 |
| *** atiwari has joined #openstack-barbican | 14:54 | |
| jaosorior | alee: wait up, verifying something | 14:54 |
| alee | ok | 14:55 |
| jaosorior | cause there exists assertListEqual and assertItemsEqual | 14:56 |
| jaosorior | aaaand again python 3 issues... | 14:57 |
| *** kebray has quit IRC | 14:57 | |
| alee | jaosorior, http://stackoverflow.com/questions/930995/assertequals-vs-assertequal-in-python ? | 14:57 |
| jaosorior | alee, nevermind, lets leave those list-related asserts as they are | 14:58 |
| alee | jaosorior, I'm ok with that :) | 14:58 |
| jaosorior | but lets use those assertIn's, assertNotIn's, and assertEqual's | 15:00 |
| alee | jaosorior, so self.assertTrue('next' not in resp.namespace) --> self.assertNotIn('next', resp.namespace) ? | 15:03 |
| jaosorior | yup | 15:03 |
| alee | ok | 15:03 |
| dave-mccowan | hello barbicaneers. https://review.openstack.org/164425 in support of the certificate-order-api blueprint could use some more reviews please. | 15:06 |
| jaosorior | dave-moccowan: you can also add barbican-core as a reviewer and it will add all the core devs there | 15:07 |
| openstackgerrit | Ade Lee proposed openstack/barbican: Added new repository classes and controller classes for CAs https://review.openstack.org/147981 | 15:11 |
| alee | jaosorior, ok done | 15:11 |
| jaosorior | alee: there you go | 15:12 |
| alee | jaosorior, thanks! | 15:13 |
| *** david-lyle_afk is now known as david-lyle | 15:15 | |
| alee | rellerreller, ping | 15:20 |
| rellerreller | alee pong | 15:20 |
| alee | rellerreller, hey -- so just to clarify | 15:20 |
| alee | rellerreller, with your cr, when a private key/ public key etc. get stored - we pass base 64 + pem headers | 15:21 |
| alee | and this is what would be passed to the crypto store plugin too. | 15:21 |
| rellerreller | All private, public, and certificate objects to and from secret stores must be base 64 + pem headers | 15:22 |
| rellerreller | That is the same for store_crypto, which is 99% a secret store | 15:22 |
| alee | now in simple_crypto - we have a case where we are generating public/private keys etc. | 15:22 |
| alee | why do this not need to be generated with pem headers? | 15:23 |
| rellerreller | store_crypto is storing everything in binary format. All secrets passed to it are decoded into binary, wrapped, and then stored in DB. | 15:23 |
| rellerreller | The only exception to this was the generation of public/private key pairs. For some reason they were in Base64 format. | 15:24 |
| rellerreller | That's why I changed that one to binary format. Now store_crypto is consistent with how it stores all of its secrets. | 15:25 |
| *** kebray has joined #openstack-barbican | 15:26 | |
| *** xaeth_afk is now known as xaeth | 15:27 | |
| alee | rellerreller, ok | 15:28 |
| rellerreller | alee I am reviewing your CR. | 15:29 |
| alee | rellerreller, cool thanks | 15:29 |
| *** rm_work|away is now known as rm_work | 15:30 | |
| rellerreller | What do you think about throwing a 400 error when CA not found for delete operations? | 15:30 |
| alee | rellerreller, I dont have a strong feeling either way. | 15:31 |
| rellerreller | alee Like when user tries to remove CA from project but project is not a member of the project's CAs. | 15:31 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican: Fix container example secret refs https://review.openstack.org/164739 | 15:31 |
| rellerreller | alee I feel like there should be something because otherwise the user cannot know if action succeeded. | 15:32 |
| alee | rellerreller, at this point , I dont think there are any other examples we have of this .. | 15:32 |
| rellerreller | It's not like adding a CA when a CA is already a member of a project. | 15:32 |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Container negative tests https://review.openstack.org/163985 | 15:32 |
| alee | rellerreller, well - he does not know if any action occurred or not. | 15:32 |
| rellerreller | alee I looked through the orders and secrets APIs to see what they do. | 15:32 |
| alee | rellerreller, but the end result is the same | 15:32 |
| alee | the ca is not part of the project | 15:33 |
| rellerreller | That is true | 15:33 |
| alee | rellerreller, I think its exactly like adding a ca to project when it already exists | 15:33 |
| rellerreller | Maybe we just leave it then and we can fix later if that is a requested feature. I don't know what the standard is on these things. | 15:34 |
| alee | sounds good to me | 15:34 |
| rellerreller | Normally in code I return a boolean as to whether or not it was found and deleted. It's a bit different for web service. | 15:34 |
| alee | right - I can see arguments both ways | 15:35 |
| *** arunkant has quit IRC | 15:35 | |
| alee | redrobot, jvrbanac https://review.openstack.org/#/c/147981/ and https://review.openstack.org/#/c/160444/ looking for reviews/workflow | 15:42 |
| woodster_ | rellerreller: I updated the retry CR, please take a look when you can: https://review.openstack.org/#/c/157565/3 | 15:43 |
| * jvrbanac gets hit over the head with alee's large CR | 15:43 | |
| rellerreller | OK, looking at the decrypt payload one now. Will look at that one next. | 15:44 |
| alee | woodster_, I'll need your help in figuring out whats wrong with the update function in my CR later | 15:44 |
| alee | maybe later today | 15:45 |
| alee | jvrbanac, I made it smaller :) | 15:45 |
| jaosorior | reaperhulk: HALP | 15:49 |
| reaperhulk | ? | 15:51 |
| reaperhulk | I am at a doctor's appt right now but can help with whatever later :) | 15:51 |
| jaosorior | nah, it's not urgent | 15:51 |
| jaosorior | don't worry about it | 15:51 |
| jaosorior | I'll ping you later then | 15:51 |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets and order paging tests in parallel https://review.openstack.org/141138 | 15:53 |
| *** arunkant has joined #openstack-barbican | 15:54 | |
| *** dave-mccowan has quit IRC | 15:56 | |
| *** gyee has joined #openstack-barbican | 15:59 | |
| jaosorior | dave-mccowan: reviewed | 16:08 |
| woodster_ | alee, ok. I'm still 'officially' on ETO today, so might be sporadically on my phone this afternoon until this evening | 16:09 |
| alee | woodster_, ETO = extra time off ? :) | 16:10 |
| alee | woodster_, no worries it can wait till you're officially back | 16:10 |
| alee | woodster_, which is tomorrow? | 16:11 |
| woodster_ | alee, yes, for the past week+ I was starting to forget what day of the week it was :) | 16:11 |
| *** igueths has joined #openstack-barbican | 16:11 | |
| *** openstackgerrit has quit IRC | 16:11 | |
| *** openstackgerrit has joined #openstack-barbican | 16:12 | |
| woodster_ | alee, yep tomorrow. I'm feeling the weight of Kilo-3 though | 16:12 |
| arunkant | alee, can you please review per secret changes as now its split into 3 reviews | 16:13 |
| alee | arunkant, I'm reviewing the first one right now | 16:14 |
| alee | arunkant, you do realize the functional test gate jobs failed though, right? | 16:14 |
| arunkant | alee, great thanks. | 16:14 |
| alee | not sure why - maybe it will go away when you resubmit | 16:14 |
| arunkant | alee, Yes its fixed in part 2 and part 3..so need to move a test change from part 2 to part 1 | 16:15 |
| alee | ok | 16:15 |
| *** jkf has joined #openstack-barbican | 16:22 | |
| *** kfarr has joined #openstack-barbican | 16:29 | |
| *** xaeth is now known as xaeth_afk | 16:37 | |
| *** kfarr has quit IRC | 16:40 | |
| *** kfarr has joined #openstack-barbican | 16:41 | |
| *** openstackgerrit has quit IRC | 16:54 | |
| *** openstackgerrit has joined #openstack-barbican | 16:54 | |
| alee | arunkant, reviewed first patch | 17:12 |
| *** bdpayne has joined #openstack-barbican | 17:19 | |
| *** ametts has joined #openstack-barbican | 17:26 | |
| *** dave-mccowan has joined #openstack-barbican | 17:28 | |
| kfarr | alee quick question: When you run the functional tests against dogtag, what do you change in the config files to activate the dogtag plugin? | 17:35 |
| alee | kfarr, I end up changing the barbican-api.conf file to set the dogtag plugins | 17:37 |
| *** kfarr has quit IRC | 17:44 | |
| rm_work | hey -- one of us was seeing a bug with storing text/plain secrets | 17:44 |
| rm_work | seems to not like that the content-encoding isn't base64 or something | 17:44 |
| rm_work | I am trying to reproduce now, as this is second-hand from someone on my team | 17:44 |
| rm_work | but was curious if that rings a bell with anyone | 17:45 |
| rm_work | hockeynut / jvrbanac : which one of you was it that discovered the kmip change issue this weekend? | 17:52 |
| chellygel | rm_work, i believe hockeynut discovered the issue and jvrbanac fixed it | 18:01 |
| *** xaeth_afk is now known as xaeth | 18:11 | |
| rm_work | chellygel: do you know if the fix CR is merged yet? | 18:13 |
| rm_work | I am still having the issue on master | 18:13 |
| rm_work | not that it really impedes my work | 18:13 |
| rm_work | but it's errors i have to filter out when i'm looking for other things | 18:13 |
| jvrbanac | rm_work, it was merged over the weekend | 18:14 |
| rm_work | hmm... ok | 18:14 |
| rm_work | File "barbican/tests/plugin/test_kmip.py", line 61, in setUp | 18:14 |
| rm_work | self.sample_secret = secrets.SecretFactory().create( | 18:14 |
| rm_work | AttributeError: 'SecretFactory' object has no attribute 'create' | 18:14 |
| rm_work | still getting that ^^ | 18:14 |
| rm_work | pulled 10 min ago | 18:14 |
| jvrbanac | You're using an old version of PyKMIP | 18:14 |
| rm_work | ah | 18:14 |
| rm_work | ok | 18:14 |
| rm_work | got it, yep | 18:15 |
| rm_work | thanks | 18:15 |
| jvrbanac | rm_work, w00t | 18:15 |
| rm_work | wonder why that didn't update | 18:15 |
| chellygel | lawl, sorry missed the message | 18:15 |
| rm_work | chellygel: np resolved :P | 18:15 |
| jvrbanac | redrobot, here is that update in requirements for PyKMIP you were asking about earlier: https://review.openstack.org/#/c/164449 | 18:27 |
| arunkant | alee, can you look into response comments on part 1 of per secret change. | 18:29 |
| redrobot | jvrbanac sweet! | 18:33 |
| jvrbanac | redrobot, also, did you see my comment about asserts? | 18:33 |
| jvrbanac | redrobot, I just posted it a couple minutes ago | 18:33 |
| redrobot | jvrbanac yeah.... now I'm confused about the standard. | 18:33 |
| redrobot | jvrbanac and if I have it backwards, I'm going to have to apologize profusely to rellerreller | 18:34 |
| chellygel | and chellygel ^ | 18:35 |
| jvrbanac | redrobot, which standard are you thinking about? | 18:35 |
| openstackgerrit | Merged openstack/barbican: Added new repository classes and controller classes for CAs https://review.openstack.org/147981 | 18:36 |
| redrobot | jvrbanac http://www.nag.co.za/wp-content/uploads/2013/11/I-have-no-idea-what-Im-doing.jpg | 18:37 |
| jvrbanac | redrobot, lol | 18:37 |
| redrobot | jvrbanac yes! found a stack overflow question to support my stance :D http://stackoverflow.com/questions/9331259/unit-testing-why-is-the-expected-argument-always-first-in-equality-tests | 18:40 |
| redrobot | I have no idea where I picked up having the expected value be the first one. | 18:41 |
| jaosorior | redrobot: I got that from somewhere also... don't remember where it was from though | 18:41 |
| jaosorior | redrobot, jvrbanac, what, is it wrong? | 18:41 |
| *** paul_glass has quit IRC | 18:42 | |
| *** paul_glass has joined #openstack-barbican | 18:43 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican: Use unique refs for RSA container example https://review.openstack.org/164739 | 18:45 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican: Use unique refs for RSA container example https://review.openstack.org/164739 | 18:45 |
| redrobot | jaosorior question: what's the reason you only give +1 to https://review.openstack.org/#/c/140575/ ? | 18:52 |
| jaosorior | cause if you read the above conversation I was arguing against the way it's being tested, in favor of test names that actually reflect whats meant to be tested | 18:54 |
| jaosorior | well, by the above conversation I meant in the commit | 18:54 |
| redrobot | jaosorior ah, fair enough | 18:55 |
| jaosorior | cause to be honest for me the way things are named doesn't really mean much | 18:55 |
| jaosorior | but if people don't share the opinion, then fair enough. It could be changed later I guess | 18:56 |
| *** atiwari has quit IRC | 19:12 | |
| *** kfarr has joined #openstack-barbican | 19:13 | |
| *** xaeth is now known as xaeth_afk | 19:14 | |
| *** xaeth_afk is now known as xaeth | 19:21 | |
| jvrbanac | redrobot, jaosorior, so if I recall correctly, outside of my own preference, I believe that testtools asserts as (actual, expected) | 19:31 |
| jaosorior | oho | 19:32 |
| jaosorior | well, fair enough :O | 19:32 |
| redrobot | jvrbanac jaosorior sounds like an agenda item for today's meeting | 19:32 |
| jvrbanac | redrobot, :D | 19:32 |
| rm_work | ok yeah, reproducable: '{"code": 400, "description": "Provided object does not match schema \\'Secret\\': None is not one of [\\'base64\\']", "title": "Bad Request"}' | 19:42 |
| rm_work | barbican secret store -p "hello" -t "text/plain" -n "test_secret" | 19:42 |
| rm_work | digging into why | 19:43 |
| rm_work | payload_content_encoding is None | 19:44 |
| rm_work | but that should be correct if it's a text/plain right? | 19:44 |
| rm_work | barbican.api.controllers HTTPClientError: Provided object does not match schema 'Secret': None is not one of ['base64'] | 19:44 |
| jvrbanac | rm_work, I don't think payload_content_encoding should be included if it's text/plain | 19:45 |
| rm_work | http://pastebin.com/wwsf4hjd | 19:45 |
| rm_work | jvrbanac: so, this worked until recently | 19:45 |
| rm_work | trying to pinpoint the exact patch that broke it | 19:46 |
| elmiko | redrobot: probably not gonna make meeting today, but if there's an outcome of the great (actual, expected) debate i'll adjust my patch ;) | 19:49 |
| jvrbanac | rm_work, does it have something to do with https://github.com/openstack/python-barbicanclient/commit/46ef634de8c6867fa0d18fb4c3618cfca8516038 ? | 19:49 |
| rm_work | looking at 2e708318e998e1adfe12b547fab8414ad0a34952 right now | 19:49 |
| redrobot | elmiko hehe, i'll let you know what we decide on. | 19:49 |
| rm_work | ah could be a client change too though, good point | 19:50 |
| rm_work | jvrbanac: exactly right | 19:53 |
| rm_work | jvrbanac: that commit did it | 19:53 |
| rm_work | thanks, redrobot T_T | 19:53 |
| redrobot | rm_work I fail to see how my change introduced "None" into the request. | 19:55 |
| redrobot | rm_work I'm pretty sure it was https://github.com/openstack/python-barbicanclient/commit/92b53a749d6d363b51271a796d24d6f9642d1b91 | 19:55 |
| rm_work | redrobot: i just verified, it was this change | 19:55 |
| rm_work | redrobot: works before, fails after | 19:56 |
| redrobot | rm_work or maybe https://github.com/openstack/python-barbicanclient/commit/8c9024337c67f2dbf1a851f12209cb6bdf6f1e7c | 19:56 |
| rm_work | redrobot: it is most definitely https://github.com/openstack/python-barbicanclient/commit/46ef634de8c6867fa0d18fb4c3618cfca8516038#diff-073a17c22fd1f1db47fc75411685e9ebR244 | 19:56 |
| rm_work | i am fixing it | 19:56 |
| redrobot | rm_work oh I see... we need to filter empty keys after, not before | 19:56 |
| * redrobot derps | 19:56 | |
| redrobot | rm_work good thing is chellygel is working on getting the functional gate up and running | 19:57 |
| redrobot | we could have totally found this bug with the functional gate | 19:57 |
| rm_work | heh | 19:57 |
| rm_work | and apparently i'm the only one actually USING the client | 19:57 |
| rm_work | T_T | 19:57 |
| * chellygel is trying to figure out her head from her bottom in this code base right now | 19:57 | |
| chellygel | rm_work, wanna be buddies :D | 19:58 |
| redrobot | weekly meeting starting now in #openstack-meeting-alt | 20:01 |
| openstackgerrit | Merged openstack/barbican: Standardized Secret Encoding https://review.openstack.org/160444 | 20:04 |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Refactor secrets functional tests for readability https://review.openstack.org/163564 | 20:08 |
| hockeynut | jaosorior I agree that the commit msg for ^ needed to be updated...new one is up now | 20:08 |
| *** rm_you|wtf has joined #openstack-barbican | 20:09 | |
| jaosorior | hockeynut: funny thing is, my review was wrongly written, I meant +2 and not +1 haha | 20:09 |
| rm_work | chellygel: heh, you're doing the client tests? I can help with that possibly, if you have questions :) | 20:10 |
| jaosorior | hockeynut: but there you go, +2 | 20:10 |
| chellygel | yeah we have 7 total errors right now rm_work. so i'm trying to deduce if they are code or test related and fix them | 20:10 |
| rm_work | well, secret create | 20:10 |
| rm_work | does not work presently :P | 20:10 |
| rm_work | so there's at least one | 20:11 |
| igueths | ifconfig eth2:0 | 20:11 |
| igueths | oops | 20:11 |
| *** rm_you| has quit IRC | 20:13 | |
| hockeynut | jaosorior I got the point :-) | 20:14 |
| hockeynut | jaosorior are you going to push up any more patchsets for https://review.openstack.org/#/c/164540/ ? I see a few comments in there so I'm hesitating from workflowing it | 20:15 |
| jaosorior | hockeynut: to be honest... it is not clear to me what to do there :/ | 20:16 |
| hockeynut | I see rellerreller had a few nuts and the question about modulo over format | 20:17 |
| jaosorior | usually for nits I can submit a subsequent patchset, if it already has a couple of +2, but I have left it like it is cause the modulo over format discussion didn't seem to have a conclusion | 20:18 |
| *** dimtruck is now known as zz_dimtruck | 20:18 | |
| jaosorior | hockeynut: if you have an opinion, and someone else, I guess I'll just take the majority opinion there and implement that haha, to be honest I have no preference over module or format for log messages | 20:19 |
| hockeynut | jaosorior woodster_ may since he's been int hat area...I haven't | 20:19 |
| *** zz_dimtruck is now known as dimtruck | 20:20 | |
| rm_work | q | 20:23 |
| rm_work | ... whoops | 20:23 |
| chellygel | Q_Q rm_work | 20:23 |
| woodster_ | Sorry sketchy time to do things....the modulo format for logging is for deferring localizing messages in case logging levels are set above the logged message...so avoids taking proc time to localize messages | 20:26 |
| igueths | Interesting writeup, thankfully it doesn't apply to us directly though https://freedom-to-tinker.com/blog/dwallach/on-compromising-app-developers-to-go-after-their-users/ | 20:33 |
| jaosorior | woodster_: so... should I switch to that then? | 20:34 |
| woodster_ | jaosorior: sorry just on phone now, but in general the modulo approach is only needed if the message is localized, so with one of those _u functions | 20:36 |
| openstackgerrit | Adam Harwell proposed openstack/python-barbicanclient: Fix secret-store empty-key filtering bug https://review.openstack.org/164861 | 20:36 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Deprecate old secret decrypt path both in code and docs https://review.openstack.org/164540 | 20:41 |
| rm_work | ^^ redrobot fixed | 20:42 |
| redrobot | rm_work Closes-Bug: #??????? | 20:46 |
| rm_work | redrobot: closes bug: I'll cut you | 20:46 |
| redrobot | rm_work lmao... nice Sheena_ throwback | 20:49 |
| igueths | Lol rm_work | 20:49 |
| Sheena_ | rm_work, redrobot: this is excellent news! I knew the Barbican team had picked up my crazy, but this is proof it's infected Neutron too! | 20:51 |
| Sheena_ | Well, besides insequent | 20:54 |
| chellygel | is this what unemployed people do Sheena_ ? just troll irc channels | 20:54 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 20:55 |
| hockeynut | redrobot is there a way to block these unwashed heathen? | 20:57 |
| Sheena_ | chellygel: I think this is a higher vocation than mere employment. Don't worry, I will make special time in my day one I'm at the new job to harass you guys, too. Priorities. | 20:57 |
| chellygel | +1 :D | 20:57 |
| redrobot | I think I have the power to /kick | 20:57 |
| redrobot | but I refuse to /kick Sheena_ for fear of stabbings | 20:57 |
| hockeynut | but sheena can /stab | 20:57 |
| redrobot | hockeynut exactly! | 20:58 |
| igueths | She might also be able to do an /teleport && /stab | 20:58 |
| Sheena_ | Oh man, how things have changed in 72 hours... Now I know how you all really feel! | 20:58 |
| rm_work | heh | 20:59 |
| Sheena_ | Unlimited time to carve shanks and nap here, thanks unemployment! | 20:59 |
| *** jkf has quit IRC | 20:59 | |
| redrobot | "fun"employment | 20:59 |
| *** jkf has joined #openstack-barbican | 21:00 | |
| Sheena_ | Definitely the best kind. | 21:00 |
| *** kebray has quit IRC | 21:04 | |
| *** rellerreller has quit IRC | 21:05 | |
| *** xaeth is now known as xaeth_afk | 21:06 | |
| igueths | woodster_: Ping. | 21:09 |
| *** kebray has joined #openstack-barbican | 21:13 | |
| woodster_ | igueths: I'm getting 5 min here and there to look at IRC | 21:16 |
| igueths | woodster_: Ah ok, had a question pertaining to your reply to the latest bug I dropped in...Can discuss when you're here next since that's likely easier. | 21:18 |
| woodster_ | igueths: oh for the unlimited consumers? Yeah tsv 's quota feature will handle this | 21:19 |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Consumer resources https://review.openstack.org/164075 | 21:20 |
| woodster_ | Sheena_: good to see you in the channel again! | 21:20 |
| igueths | woodster_: So at the time I looked at that blueprint, I understood it to mean that it would be a limit on the number of secrets/containers/registered consumers/etc that could be associated at any given time. However, I didn't see anything about validating the input lengths. | 21:21 |
| *** kebray has quit IRC | 21:25 | |
| Sheena_ | woodster_: thanks sir. irccloud is awesome? | 21:25 |
| Sheena_ | !* | 21:25 |
| openstack | Sheena_: Error: "*" is not a valid command. | 21:25 |
| Sheena_ | I'm Ron Burgundy? | 21:26 |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Container resources https://review.openstack.org/164875 | 21:30 |
| woodster_ | igueths: oh sorry I thought the bug was no limits on number of consumers. If instead in the size of each consumer than yes that's a validation issue | 21:33 |
| igueths | woodster_: Yeah it's definitely the latter, hence my confusion with your reply lol | 21:34 |
| *** kebray has joined #openstack-barbican | 21:43 | |
| *** xaeth_afk is now known as xaeth | 21:43 | |
| *** kebray has quit IRC | 21:46 | |
| *** kebray has joined #openstack-barbican | 21:46 | |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Order resources https://review.openstack.org/164879 | 21:54 |
| *** dimtruck is now known as zz_dimtruck | 22:03 | |
| *** tkelsey has quit IRC | 22:03 | |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Secret resources https://review.openstack.org/164882 | 22:05 |
| *** xaeth is now known as xaeth_afk | 22:08 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Implement validate_pkcs10_data https://review.openstack.org/164425 | 22:10 |
| dave-mccowan | adee ping | 22:14 |
| dave-mccowan | alee ping | 22:14 |
| alee | dave-mccowan, yo | 22:15 |
| dave-mccowan | i think i'm in good shape on #3 from your list. i'll work on #2 next. how's the functional tests looking? i can add functional tests for the validators after you've merged yours if you want. | 22:16 |
| alee | dave-mccowan, that sounds good -- I'm hoping to have a first patch for functional tests by tommorow morning | 22:16 |
| alee | dave-mccowan, I will include some basic bad validation cases | 22:17 |
| alee | but any addtional ones will certainly help | 22:17 |
| dave-mccowan | cool. you might be able to use the functions in tests/cert_utils.py to help write the test cases. | 22:18 |
| alee | dave-mccowan, yup - I defintely plan to | 22:20 |
| alee | dave-mccowan, of course we have to get those merged in then :) | 22:20 |
| dave-mccowan | nova-cores ^^ :-) | 22:21 |
| alee | dave-mccowan, you may be asking for the wrong cores .. | 22:21 |
| dave-mccowan | gack. flashbacks from last week. s/nova/barican-cores | 22:22 |
| elmiko | redrobot: so... (expected, observed) ? | 22:23 |
| redrobot | elmiko indeed | 22:23 |
| mjg59 | Quick question about deployment - I have cinder integration working to the extent that as an admin I can create a volume, but as a user I'm getting a 403 with PolicyNotAuthorized: Policy doesn't allow orders:post to be performed. | 22:23 |
| dave-mccowan | alee time for my commute. ttyl | 22:24 |
| alee | dave-mccowan, later - thanks! | 22:24 |
| *** dave-mccowan has quit IRC | 22:24 | |
| mjg59 | The policy file has orders:post as rule:admin_or_creator | 22:24 |
| elmiko | redrobot: sweet, that makes it easy for me. hehe. was there anything more about castellan or just the oslo_log stuff? | 22:24 |
| mjg59 | How are the roles assigned? | 22:25 |
| redrobot | elmiko just the oslo_log stuff... we'll cut the initial release after that. | 22:26 |
| elmiko | redrobot: awesome! looking forward to it =) | 22:27 |
| redrobot | mjg59 hi! | 22:27 |
| redrobot | mjg59 Barbican defines 4 roles (admin, observer, creator, audit) at the project level | 22:28 |
| *** paul_glass has quit IRC | 22:28 | |
| redrobot | mjg59 oslo.policy allows you to map those built in roles to whatever your cloud deployment uses as the actual roles. | 22:28 |
| mjg59 | Ah, ok | 22:28 |
| redrobot | mjg59 you can take a look at the sample policy.json in /etc/barbican | 22:28 |
| redrobot | mjg59 https://github.com/cloudkeep/barbican/blob/master/etc/barbican/policy.json#L22-L25 | 22:28 |
| mjg59 | Yeah, I've just deployed the sample policy | 22:29 |
| mjg59 | I'll figure out what our deployment uses | 22:29 |
| mjg59 | Thanks! | 22:30 |
| openstackgerrit | Chelsea Winfree proposed openstack/python-barbicanclient: Fixed max payload size error https://review.openstack.org/164894 | 22:43 |
| *** igueths has quit IRC | 22:45 | |
| *** dave-mccowan has joined #openstack-barbican | 22:50 | |
| *** kfarr has quit IRC | 22:52 | |
| chellygel | \o/ vote for test fixes | 22:58 |
| *** dave-mccowan has quit IRC | 23:09 | |
| *** jaosorior has quit IRC | 23:12 | |
| rm_work | chellygel: comments on your last CR | 23:14 |
| chellygel | ty! :D | 23:14 |
| *** gyee has quit IRC | 23:16 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with policy layer changes (Part 3) https://review.openstack.org/164337 | 23:21 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with controller layer changes (Part 2) https://review.openstack.org/164335 | 23:21 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 23:21 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 23:26 |
| *** jkf has quit IRC | 23:31 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with controller layer changes (Part 2) https://review.openstack.org/164335 | 23:31 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 23:31 |
| *** atiwari has joined #openstack-barbican | 23:33 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 23:43 |
| openstackgerrit | Chelsea Winfree proposed openstack/python-barbicanclient: Added new exception and adjusted functional test. https://review.openstack.org/164898 | 23:45 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
