| *** crc32 has quit IRC | 00:01 | |
| *** kebray has joined #openstack-barbican | 00:02 | |
| *** crc32 has joined #openstack-barbican | 00:12 | |
| *** rm_you|wtf is now known as rm_you | 00:20 | |
| *** dave-mccowan has joined #openstack-barbican | 00:34 | |
| openstackgerrit | Merged openstack/python-barbicanclient: Fixes tests on invalid payload secret creation and adds new exception https://review.openstack.org/164980 | 00:36 |
|---|---|---|
| *** kebray has quit IRC | 00:52 | |
| *** crc32 has quit IRC | 02:11 | |
| *** crc32 has joined #openstack-barbican | 02:20 | |
| *** xaeth_afk is now known as xaeth | 02:39 | |
| *** kebray has joined #openstack-barbican | 02:49 | |
| *** tkelsey has joined #openstack-barbican | 02:56 | |
| *** tkelsey has quit IRC | 03:01 | |
| *** xaeth is now known as xaeth_afk | 03:05 | |
| *** gyee has quit IRC | 03:15 | |
| *** xaeth_afk is now known as xaeth | 03:23 | |
| *** crc32 has quit IRC | 03:27 | |
| *** crc32 has joined #openstack-barbican | 03:29 | |
| *** alee has quit IRC | 04:11 | |
| *** alee has joined #openstack-barbican | 04:12 | |
| *** dave-mccowan has quit IRC | 04:14 | |
| openstackgerrit | Ade Lee proposed openstack/barbican: Add code to populate CA tables and select plugin based on ca_id https://review.openstack.org/150070 | 04:23 |
| *** kebray has quit IRC | 04:30 | |
| *** kebray has joined #openstack-barbican | 04:31 | |
| *** xaeth is now known as xaeth_afk | 04:41 | |
| *** tkelsey has joined #openstack-barbican | 04:57 | |
| *** tkelsey has quit IRC | 05:02 | |
| openstackgerrit | Adam Harwell proposed openstack/python-barbicanclient: Removing assertItemsEqual workaround, fixed upstream https://review.openstack.org/165303 | 06:05 |
| *** gitorres has joined #openstack-barbican | 06:25 | |
| *** kebray has quit IRC | 06:51 | |
| openstackgerrit | Joshua Hesketh proposed openstack/barbican: Add pip-check-reqs tox environment https://review.openstack.org/164576 | 07:42 |
| *** woodster_ has quit IRC | 08:00 | |
| *** tkelsey has joined #openstack-barbican | 08:25 | |
| *** crc32 has quit IRC | 10:01 | |
| *** crc32 has joined #openstack-barbican | 10:40 | |
| *** usimha has joined #openstack-barbican | 11:33 | |
| usimha | Hello! I'm getting the following error when I try starting barbican. Could anyone please help me? This is the error : http://pastebin.com/5kcM4HdF | 11:35 |
| *** darrenmoffat has quit IRC | 11:55 | |
| *** darrenmoffat has joined #openstack-barbican | 11:56 | |
| *** woodster_ has joined #openstack-barbican | 12:00 | |
| *** david-lyle_afk is now known as david-lyle | 12:00 | |
| nickrmc84 | Are you trying to upgrade from a previous version? | 12:36 |
| *** nickrmc84 is now known as nickrmc83 | 12:37 | |
| *** jaosorior has joined #openstack-barbican | 12:38 | |
| jaosorior | woodster_: ping | 12:42 |
| jaosorior | or redrobot | 12:43 |
| woodster_ | jaosorior: morning (well for us over here anyway) | 12:43 |
| jaosorior | woodster_: Hey man... I finally got clearance to work on this blueprint http://specs.openstack.org/openstack/barbican-specs/specs/kilo/data-remove-tenant-secret-assoc.html do you know if it's still possible? | 12:47 |
| jaosorior | I was also told that I still don't have clearance to work on the ACL-related stuff... but I told them to drop that since it was taken by Arun already | 12:47 |
| *** usimha has quit IRC | 12:53 | |
| woodster_ | jaosorior, yeah redrobot is working with the TC to determine what gets in for Kilo (so past Thursday or not) so ping him later this morning. That said, even if that didn't land for Kilo I'd think it would be great to have that CR go in first thing for Liberty. | 12:54 |
| jaosorior | woodster_: Alright, I'll talk to him | 12:55 |
| jaosorior | either way... damn, I have no clue how it took so long :/ | 12:55 |
| jaosorior | woodster_: anyway, how are things there? | 12:55 |
| woodster_ | jaosorior CRs not merged for Kilo (a specific commit/SHA) will just merge into Liberty. I'd say do the work anyway while you have the blessing to do so. Do you think you'd have it done by RC1 (April 6th I think)? | 12:56 |
| woodster_ | jaosorior, I'm still trying to catch up after being off for 11 days :) | 12:56 |
| jaosorior | woodster_: vacations? | 12:57 |
| jaosorior | I think I can do it by April 6 | 12:57 |
| woodster_ | jaosorior, yeah, they are making us take all vacation during the year now, no carry over. Not a bad policy really | 13:00 |
| woodster_ | jaosorior, even if you don't finish by April 6th I'd say still do it so we have it starting in Liberty | 13:01 |
| jaosorior | alright | 13:01 |
| openstackgerrit | Michael McCune proposed openstack/barbican: Moving containers tests to separate module https://review.openstack.org/162504 | 13:15 |
| elmiko | if anyone is looking for an ice softball review, ^^ =) | 13:17 |
| elmiko | *nice | 13:17 |
| *** crc32 has quit IRC | 13:38 | |
| alee | jaosorior, woodster_ https://review.openstack.org/#/c/150070/ all ready for a re-review | 13:41 |
| *** gitorres has left #openstack-barbican | 13:42 | |
| *** usimha has joined #openstack-barbican | 13:49 | |
| usimha | nickrmc83: Yes, I am. | 13:49 |
| nickrmc83 | ushima: Is it a live system you're updating? See this page http://docs.openstack.org/developer/barbican/contribute/database_migrations.html | 13:53 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 14:15 |
| *** dave-mccowan has joined #openstack-barbican | 14:29 | |
| *** kebray has joined #openstack-barbican | 14:35 | |
| *** usimha has quit IRC | 14:38 | |
| *** usimha has joined #openstack-barbican | 14:38 | |
| *** rellerreller has joined #openstack-barbican | 14:42 | |
| *** zz_dimtruck is now known as dimtruck | 14:42 | |
| *** xaeth_afk is now known as xaeth | 15:00 | |
| *** kebray has quit IRC | 15:06 | |
| *** kfarr has joined #openstack-barbican | 15:13 | |
| jvrbanac | elmiko, got a couple of really minor changes for you, but other than that it looks good! | 15:14 |
| elmiko | jvrbanac: cool, thanks for taking a look =) | 15:15 |
| *** dave-mccowan has quit IRC | 15:17 | |
| *** dave-mccowan has joined #openstack-barbican | 15:20 | |
| *** crc32 has joined #openstack-barbican | 15:26 | |
| *** crc32 has quit IRC | 15:30 | |
| *** administrait0r has joined #openstack-barbican | 15:36 | |
| *** usimha has quit IRC | 15:36 | |
| *** kebray has joined #openstack-barbican | 15:39 | |
| elmiko | i'm seeing a test error in WhenTestingSimpleCMOrderValidator, but didn't touch that test. anyone else seeing this paste.openstack.org/show/193156/ | 15:40 |
| alee | woodster_, https://review.openstack.org/#/c/150070/ just needs a workflow :) | 15:43 |
| openstackgerrit | Michael McCune proposed openstack/barbican: Moving containers tests to separate module https://review.openstack.org/162504 | 15:44 |
| *** xaeth is now known as xaeth_afk | 15:46 | |
| *** SheenaG has joined #openstack-barbican | 15:48 | |
| jvrbanac | elmiko, ping | 15:50 |
| elmiko | jvrbanac: hey | 15:51 |
| jvrbanac | elmiko, thanks for the change. Is there a reason why on line 167 you're only asserting the last create_container ? | 15:53 |
| * elmiko looks | 15:53 | |
| elmiko | jvrbanac: oops, oversite. i missed the indent | 15:54 |
| elmiko | thanks | 15:54 |
| openstackgerrit | Michael McCune proposed openstack/barbican: Moving containers tests to separate module https://review.openstack.org/162504 | 15:55 |
| jvrbanac | elmiko, np. I was looking at that and was like "am I missing something" | 15:55 |
| elmiko | jvrbanac: no, i was missing something lol | 15:56 |
| jvrbanac | elmiko, thx | 15:58 |
| elmiko | jvrbanac: np, thanks again for the reviews | 15:59 |
| *** kebray has quit IRC | 16:06 | |
| *** kebray has joined #openstack-barbican | 16:07 | |
| openstackgerrit | Merged openstack/barbican: Remove unused etc/dev_tempest.conf file https://review.openstack.org/165172 | 16:12 |
| openstackgerrit | Chelsea Winfree proposed openstack/python-barbicanclient: Fixed deprecated type and encoding test and encoding bug https://review.openstack.org/165215 | 16:26 |
| openstackgerrit | Nathan Reller proposed openstack/barbican: Removed get_secret_type https://review.openstack.org/165497 | 16:35 |
| openstackgerrit | Chelsea Winfree proposed openstack/python-barbicanclient: Fix smoke test for client with bad data set https://review.openstack.org/165221 | 16:41 |
| *** gyee has joined #openstack-barbican | 16:43 | |
| dave-mccowan | elmiko i was the last one to touch _validate_pkcs10_data, but i'm not seeing that error in WhenTestingSimpleCMOrderValidator. are you still seeing that? | 16:44 |
| elmiko | dave-mccowan: i'll run it again. | 16:45 |
| elmiko | dave-mccowan: rebuilding the tox env too | 16:45 |
| elmiko | dave-mccowan: yea, same error | 16:47 |
| dave-mccowan | elmiko do you see the error on master? or just with your changes? | 16:49 |
| elmiko | dave-mccowan: running against master now | 16:50 |
| elmiko | dave-mccowan: yep, i see it on master too. i'll try a fresh checkout just to make completely sure | 16:50 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 16:51 |
| *** administrait0r has left #openstack-barbican | 16:51 | |
| dave-mccowan | elmiko i'm also doing a fresh clone now | 16:52 |
| elmiko | dave-mccowan: i see it on fresh clone as well | 16:53 |
| *** kebray has quit IRC | 16:55 | |
| alee | woodster_, redrobot -- https://review.openstack.org/#/c/150070/ is just waiting for a workflow .. | 16:57 |
| *** openstackgerrit has quit IRC | 16:59 | |
| *** openstackgerrit has joined #openstack-barbican | 16:59 | |
| *** darrenmoffat has quit IRC | 17:02 | |
| dave-mccowan | elmiko. it works for me. :-( alee: any ideas? elmiko's _validate_pkcs10_data fails during csr.get_pubkey() or csr.verify(), but works for others. different version of OpenSSL? | 17:04 |
| elmiko | dave-mccowan: huh, weird. | 17:04 |
| alee | dave-mccowan, elmiko - its been working for me so far | 17:05 |
| dave-mccowan | alee, elmiko works in the gate too | 17:05 |
| alee | elmiko, what platform are you running this on? | 17:05 |
| elmiko | alee: f21 | 17:05 |
| alee | elmiko, yeah I'm running on f21 too. | 17:06 |
| elmiko | weird... | 17:06 |
| alee | elmiko, did you do a tox -r | 17:06 |
| alee | ? | 17:06 |
| elmiko | yea | 17:06 |
| elmiko | and i tried a fresh clonse as well | 17:06 |
| *** darrenmoffat has joined #openstack-barbican | 17:06 | |
| hockeynut | I would love to get some comments on https://review.openstack.org/#/c/141138/ pleez.... | 17:08 |
| elmiko | alee, dave-mccowan, as long as gate works and it's just me seeing errors i'm not gonna worry too much. thanks for the help | 17:08 |
| alee | elmiko, maybe your version of the openssl libs? | 17:09 |
| alee | whats the error you are seeing? | 17:09 |
| alee | dave-mccowan, hows it going on the patch? | 17:10 |
| elmiko | alee: http://paste.openstack.org/show/193156/ | 17:10 |
| dave-mccowan | elmiko "openssl version" for me gives: "OpenSSL 1.0.2 22 Jan 2015" | 17:10 |
| elmiko | dave-mccowan: OpenSSL 1.0.1k-fips 8 Jan 2015 | 17:10 |
| elmiko | maybe that's the issue | 17:11 |
| arunkant | any idea..why I see this error locally and not in openstack build.. ./functionaltests/api/v1/models/order_models.py:16:1: H302 import only modules.'from functionaltests.api.v1.models.base_models import BaseModel' does not import a module | 17:11 |
| elmiko | dave-mccowan: unfortunately, that's the latest openssl that yum is providing me | 17:12 |
| dave-mccowan | elmiko if you want to spend the time, maybe add some print statements in that test? | 17:12 |
| elmiko | dave-mccowan: maybe this afternoon, weird thing is that test was working about a week ago | 17:12 |
| dave-mccowan | elmiko: i added the code for that test within the last week. before that it was just "pass". | 17:14 |
| elmiko | heh lol | 17:14 |
| dave-mccowan | elmiko: if you're running in fips mode some how that could be an issue. i'm using md5 in unit test which is not fips-allowed. | 17:15 |
| elmiko | dave-mccowan: how would i know if i'm in fips mode? | 17:15 |
| alee | elmiko, I'm running OpenSSL 1.0.1e-fips 11 Feb 2013 | 17:17 |
| elmiko | alee: sounds like you need a yum update ;) | 17:18 |
| alee | elmiko, or maybe not :) | 17:18 |
| elmiko | ha! | 17:18 |
| kfarr | arunkant, to fix that, you'd need to do: from functionaltests.api.v1.models import base_models, then in your code, say base_models.BaseModel | 17:18 |
| alee | elmiko, let me update and see if it breaks me .. | 17:18 |
| elmiko | alee: no, i can't handle that negative karma | 17:19 |
| arunkant | kfarr, thanks. This is upstream code and it works fine in upstream build but it fails only in local build. That's why wondering what is different from upstream, checked pep8, hacking version etc. in local env and its same as upstream version | 17:21 |
| dave-mccowan | elmiko when you get a chance to play, you could comment out the try/except in _validate_pkcs10_data so we can see the exception raised by OpenSSL | 17:21 |
| elmiko | dave-mccowan: ack | 17:21 |
| alee | dave-mccowan, whats interesting is that the error is not being propagated up | 17:21 |
| alee | it just says "reason" | 17:21 |
| kfarr | oh, arunkant, it's one of the extra hacking rules | 17:21 |
| alee | elmiko, actually I'm on f20 | 17:22 |
| arunkant | kfarr, where its excluded or defined? don't see in tox.ini . | 17:22 |
| alee | so that is the latest openssl there | 17:22 |
| elmiko | alee: ah, makes sense | 17:23 |
| alee | elmiko, it might be worth changing the test to use sha-256 instead of md5 | 17:23 |
| alee | and seeing if that makes a difference | 17:23 |
| alee | but yeah seeing what openssl is complaining about will help | 17:24 |
| elmiko | dave-mccowan: there are 2 try/excepts in there, should i remove both? | 17:27 |
| kfarr | arunkant, hmm maybe you have a version installed that isn't supported? | 17:28 |
| dave-mccowan | elmiko. sure. but from the line number, we know it's the second block failing. | 17:28 |
| elmiko | ah, gotcha | 17:29 |
| dave-mccowan | alee: agreed on missing reason string. i must have dorked up the exception handling. i'll fix and submit a patch. | 17:29 |
| elmiko | dave-mccowan: OpenSSL.crypto.Error: [('asn1 encoding routines', 'ASN1_item_verify', 'unknown message digest algorithm')] | 17:30 |
| openstackgerrit | Nathan Reller proposed openstack/barbican: Removed get_secret_type https://review.openstack.org/165497 | 17:31 |
| dave-mccowan | elmiko swapping sha-256 for md5 sounds like the next thing to try | 17:32 |
| elmiko | dave-mccowan: ok, is that a code change or a local config thing? | 17:32 |
| *** rellerreller has quit IRC | 17:33 | |
| dave-mccowan | elmiko barbican/tests/certificate_utils.py:32 change "md5" to "sha256" | 17:33 |
| elmiko | dave-mccowan: thanks! | 17:34 |
| elmiko | dave-mccowan: same error | 17:35 |
| openstackgerrit | Merged openstack/barbican: Add code to populate CA tables and select plugin based on ca_id https://review.openstack.org/150070 | 17:37 |
| alee | woohoo! | 17:37 |
| elmiko | nice, grats alee | 17:37 |
| alee | woodster_, thanks woodster -- I feel like my team just beat the other guys by 9 wickets ! | 17:38 |
| *** rellerreller has joined #openstack-barbican | 17:42 | |
| elmiko | dave-mccowan: so, fyi. i ran the tests on my fedora-20 machine and they worked fine. fedora-21 may be the issue | 17:44 |
| dave-mccowan | elmiko if it is a fips problem, the other thing to change is certificate_utils.py:27. change 1024 to 2048. if you can print the return string from create_good_csr() and paste it to me, i'll take a look. | 17:44 |
| elmiko | dave-mccowan: k | 17:44 |
| elmiko | dave-mccowan: should i leave the sha256 in place? | 17:45 |
| dave-mccowan | elmiko yes | 17:45 |
| elmiko | k | 17:45 |
| alee | dave-mccowan, seems like the problem is in the specification of the message digest algorithm -- is sha256 a valid identifier? | 17:45 |
| alee | elmiko, good to know about f21/f20 | 17:46 |
| elmiko | ;) | 17:46 |
| alee | elmiko, means openssl libs changes likely the problem | 17:46 |
| dave-mccowan | elmiko, alee: https://bugzilla.redhat.com/show_bug.cgi?id=1157260 | 17:46 |
| openstack | bugzilla.redhat.com bug 1157260 in openssl "openvpn/openssl certificate verify failed" [Unspecified,Closed: wontfix] - Assigned to tmraz | 17:46 |
| alee | dave-mccowan, if so, we need something that works for both | 17:46 |
| elmiko | dave-mccowan: ah, so perhaps this is a known issue | 17:47 |
| chellygel | redrobot, https://review.openstack.org/165534 | 17:47 |
| dave-mccowan | elmiko, alee. known working-as-designed in f21. i'll research and fix by using secure algorithms in the unit tests. | 17:48 |
| alee | dave-mccowan, elmiko what it means is that we should not be using md5 in the unit tetss | 17:48 |
| elmiko | dave-mccowan: ok, so changing 1024->2048 fails as well. the output from create_good_csr() looks like a normal certificate | 17:49 |
| elmiko | well, cert request | 17:49 |
| alee | dave-mccowan, I was actually going to flag that in the review before but forgot | 17:49 |
| alee | elmiko, I think we need the right representation of sha256 | 17:49 |
| elmiko | alee: ok, cool | 17:49 |
| alee | sha256? sha-256?? | 17:49 |
| elmiko | i used sha256 | 17:50 |
| reaperhulk | sha256 should map properly for the EVP interfaces inside openssl | 17:50 |
| reaperhulk | what's the problem here :) | 17:50 |
| dave-mccowan | reaperhulk i used md5 to sign a csr in a unit test script. fedora21 fails to verify, since it knows better. | 17:51 |
| elmiko | reaperhulk: i've run into an issue running the tox unit tests on my fedora21 machine | 17:51 |
| reaperhulk | Ah, yeah, not surprising | 17:51 |
| dave-mccowan | reaperhulk barbican/tests/certificate_utils.py:25 what parameters do you recommend for create_good_csr() in unit test? | 17:52 |
| reaperhulk | is this in an open CR or landed on master? | 17:52 |
| dave-mccowan | reaperhulk landed. | 17:53 |
| reaperhulk | ah there we go, found it | 17:53 |
| reaperhulk | That should be sha256 | 17:55 |
| reaperhulk | sha1 would also be fine (CSR signatures aren't hugely relevant except to prevent tampering from submitter to the CA) but sha256 is more modern obviously | 17:55 |
| alee | reaperhulk, the problem is that does not appear to be working for elmiko | 17:58 |
| elmiko | yea | 17:58 |
| elmiko | alee: also, "sha-256" was no good | 17:58 |
| elmiko | that made it worse lol | 17:59 |
| alee | well at least it was different :) | 17:59 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding per secret ACL support with db layer changes (Part 1) https://review.openstack.org/164334 | 18:00 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Secret ACL controller layer changes (Part 2) https://review.openstack.org/164335 | 18:00 |
| reaperhulk | elmiko: send me a CSR generated that triggers that ASN1_item_verify failure | 18:00 |
| *** crc32 has joined #openstack-barbican | 18:00 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Container ACL controller layer changes (Part 3) https://review.openstack.org/165205 | 18:01 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding policy layer changes for ACL support (Part 4) https://review.openstack.org/165207 | 18:01 |
| reaperhulk | That error should only happen when it doesn't know the NID for the given digest OID | 18:02 |
| elmiko | MIIBWjCBxAIBADAbMRkwFwYDVQQDDBBob3N0LmV4YW1wbGUubmV0MIGfMA0GCSqG | 18:02 |
| elmiko | SIb3DQEBAQUAA4GNADCBiQKBgQCo2ypQZkNa8yJybbgJY/2K8DEWrdvshgW+oJGu | 18:02 |
| elmiko | qF66fHtxy0EAqAS5kttHy3vC7uGPMFtwP3R1sP8xFPyaadD5mfOhWXbKDu6yE5Jt | 18:02 |
| elmiko | y1/j5ncjbvk1CMgPaonxDsBRkntpvpuV/7XfPzqsET4lDFXV3j3ga+UIQyP4cJnG | 18:02 |
| *** kebray has joined #openstack-barbican | 18:02 | |
| elmiko | noVlwQIDAQABoAAwDQYJKoZIhvcNAQELBQADgYEAmgEIYneZxXPmeIIWppNaS2v7 | 18:02 |
| elmiko | BIbeS5Gh+TLiQ2nppky3+4Odi4JMJJqWKPZoNwaEAa/016EVG23M4jAAZSsjdnFW | 18:02 |
| elmiko | 6uHaPStC5/R9PVFxFCXjhUxmWngrFJq+rIwDfvKA+i4Czr5nw5HXUgpNp02dT7OR | 18:02 |
| elmiko | f/WVlYGnifTKWE7jgcU= | 18:02 |
| elmiko | -----END CERTIFICATE REQUEST----- | 18:03 |
| elmiko | oops, meant to priv msg | 18:03 |
| arunkant | woodster_, alee, jaosorior ..can use your review comments on above per secret related 4 patches | 18:03 |
| elmiko | sry | 18:03 |
| reaperhulk | elmiko: mind dropping that in a gist or pastebin? | 18:03 |
| elmiko | reaperhulk: yes, sorry | 18:03 |
| elmiko | reaperhulk: https://gist.github.com/elmiko/927b12f8adf7d750a0fc | 18:04 |
| reaperhulk | huh, looks like a totally normal CSR | 18:05 |
| reaperhulk | what happens if you do this on the CLI in fedora 21 | 18:05 |
| reaperhulk | openssl req -in <that csr> -verify | 18:05 |
| elmiko | i'll give it a try, would i need to make that csr a single string? (no linebreaks) | 18:06 |
| reaperhulk | no, save it to a file and pass the file name to the -in parameter. | 18:06 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 18:06 |
| elmiko | reaperhulk: ack, thanks | 18:06 |
| elmiko | reaperhulk: i get "verify OK" and the csr | 18:08 |
| reaperhulk | the plot thickens... | 18:09 |
| reaperhulk | elmiko: which test fails for you? | 18:11 |
| elmiko | reaperhulk: http://paste.openstack.org/show/193156/ | 18:13 |
| elmiko | ok, got a successful run | 18:13 |
| * reaperhulk blinks | 18:14 | |
| elmiko | reaperhulk, alee, dave-mccowan, using this patch http://paste.openstack.org/show/193219/ | 18:14 |
| reaperhulk | and if you change it back to 1024 it fails still? | 18:14 |
| elmiko | basically, dave-mccowan suggestions | 18:14 |
| elmiko | i'll try again, but i think so | 18:15 |
| reaperhulk | Somebody needs to remind Fedora's OpenSSL packagers that making changes like this does not improve security materially but does cause massive confusion. Convince upstream to do it so all OpenSSL works that way and you're fine... | 18:15 |
| reaperhulk | This is going to cause me no end of trouble in pyca/cryptography, ugh | 18:15 |
| *** rellerreller has quit IRC | 18:16 | |
| elmiko | reaperhulk: it does work with 1024 | 18:16 |
| elmiko | i think had the try/except removed before when i tried with 1024 | 18:16 |
| reaperhulk | Ah | 18:16 |
| elmiko | so, just changing to sha256 seems to work | 18:16 |
| reaperhulk | well it should still change to 2048 if we're going to talk about best practice (although that will significantly slow down the unit test) | 18:16 |
| reaperhulk | but I'm fine either way | 18:16 |
| reaperhulk | glad it's working | 18:16 |
| elmiko | sorry for the extended boon-doggle | 18:17 |
| alee | elmiko, good catch though | 18:17 |
| elmiko | i only saw it because of the rebase | 18:17 |
| dave-mccowan | thanks all. i can take it from here and fix. | 18:17 |
| elmiko | thanks again for all the help/hand-holding, i gotta grab some lunch. bbl | 18:18 |
| *** jkf has joined #openstack-barbican | 18:18 | |
| alee | jvrbanac, redrobot so - how do I run the functional tests? | 18:26 |
| *** igueths has joined #openstack-barbican | 18:27 | |
| redrobot | alee which project? | 18:27 |
| alee | redrobot, barbican server? | 18:27 |
| igueths | Hi all. | 18:27 |
| redrobot | alee ... I think you need a working Keystone, then configure your Barbican in test to use it | 18:27 |
| redrobot | alee after that tox -e functional | 18:28 |
| jvrbanac | alee, yep | 18:28 |
| *** kebray has quit IRC | 18:29 | |
| alee | redrobot, jvrbanac seems simple enough - do you guys have any scripts you run to set up a vm? | 18:29 |
| redrobot | alee my dev box is a mac, so I use a Vagrant box to run linux and run Postgres + Keystone in docker containers https://github.com/rackerlabs/dockerstack | 18:30 |
| reaperhulk | redrobot why not boot2docker for that? | 18:31 |
| redrobot | reaperhulk dunno... I've been doing it longer than boot2docker has been around. | 18:31 |
| reaperhulk | that's a pretty good reason ;) | 18:32 |
| *** rellerreller has joined #openstack-barbican | 18:37 | |
| alee | redrobot, so how do I use this -- download the repo and run something like "vagrant up" or something like that? | 18:37 |
| redrobot | alee you use a Fedora box for dev right? I would just run the containers there | 18:39 |
| alee | yeah | 18:39 |
| openstackgerrit | John Vrbanac proposed openstack/barbican: Fixing errors and warnings on the sphinx docs https://review.openstack.org/165556 | 18:48 |
| redrobot | alee give me a sec, I'll send you the commands to run | 18:48 |
| *** kebray has joined #openstack-barbican | 18:50 | |
| *** jaosorior has quit IRC | 18:52 | |
| *** xaeth_afk is now known as xaeth | 18:53 | |
| redrobot | alee https://gist.github.com/dmend/e6c5b3f0bc6913d766f6 | 18:55 |
| redrobot | alee then you just change the barbican paste config to use the keystone authentication block | 18:55 |
| alee | redrobot, cool - thanks | 18:57 |
| alee | redrobot, fyi - I'm working on a bunch of functional tests for the cert api | 18:57 |
| alee | redrobot, once those run correctly, I think we can say that the cert api is "finished" | 18:58 |
| redrobot | alee awesome! | 18:58 |
| alee | redrobot, which is not going to happen in the next day or two. | 18:58 |
| redrobot | yeah, I figured a few things are going to slip past Kilo-3 | 18:58 |
| redrobot | :( | 18:59 |
| alee | redrobot, but "identify ca" is done - with the exception of a bug that I need woodster_ to help resolve | 18:59 |
| redrobot | alee nice! | 18:59 |
| redrobot | I think I'll call the cert API done as well, and we'll just iterate on any bugs found during the RC cycle | 18:59 |
| alee | :) | 19:00 |
| alee | done-ish ? | 19:00 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 19:00 |
| redrobot | alee it's done, but not done done | 19:00 |
| *** xaeth is now known as xaeth_afk | 19:04 | |
| *** xaeth_afk is now known as xaeth | 19:11 | |
| kfarr | Hey everyone, if you have a chance, please review KMIP's asymmetric key support https://review.openstack.org/#/c/163989/ :) I'll be reviewing other Barbican patches for a little while, too | 19:12 |
| redrobot | kfarr will do! | 19:14 |
| *** tkelsey has quit IRC | 19:17 | |
| alee | redrobot, so if I understand the above scripts and commands then - I 'm setting up a container with the latest ubuntu on it with a postgres db and a keystone instance | 19:28 |
| alee | redrobot, I then need to go onto the instance and set up barbican? or will those scripts do that too? | 19:28 |
| alee | redrobot, ah nm -- I think I got it | 19:33 |
| alee | :q | 19:34 |
| *** rm_you| has joined #openstack-barbican | 19:36 | |
| *** Sheena_ has quit IRC | 19:37 | |
| *** Sheena_ has joined #openstack-barbican | 19:38 | |
| *** tdink has quit IRC | 19:39 | |
| *** tdink_ has joined #openstack-barbican | 19:39 | |
| *** rm_you has quit IRC | 19:39 | |
| *** lbragstad has quit IRC | 19:39 | |
| *** lbragstad has joined #openstack-barbican | 19:40 | |
| redrobot | redrobot sorry was afk. yeah, one container runs postgres, the other runs keystone, and the stand alone script just adds barbican users to keystone | 19:40 |
| redrobot | alee ^^ | 19:40 |
| alee | redrobot, yup - very nice | 19:41 |
| rellerreller | redrobot when is the freeze? | 19:41 |
| redrobot | rellerreller anything not merged by tonight will get booted to RC1 | 19:41 |
| *** gyee has quit IRC | 19:41 | |
| rellerreller | The asymmetric key support is almost done. kfarr is wrapping up the test code. | 19:41 |
| rellerreller | We can have a final version out in the next 1-2 hours. | 19:42 |
| redrobot | rellerreller I saw that... I owe her a review | 19:42 |
| rellerreller | redrobot thanks! | 19:42 |
| *** crc32 has quit IRC | 19:53 | |
| *** tdink_ has quit IRC | 19:57 | |
| *** tdink has joined #openstack-barbican | 19:58 | |
| *** kgriffs|afk has quit IRC | 19:58 | |
| *** kgriffs|afk has joined #openstack-barbican | 19:59 | |
| *** kgriffs|afk is now known as kgriffs | 19:59 | |
| alee | redrobot, ping | 20:03 |
| alee | redrobot, so to get the functional tests running -- what needs to be changed in the config files | 20:04 |
| alee | redrobot, I see for example that I need to change the port for the keystone server in barbican-functional.conf | 20:05 |
| alee | to uri=http://localhost:35357/v3 | 20:05 |
| alee | redrobot, but what else? | 20:05 |
| alee | redrobot, at this point it looks like all my keystone requests are failing with 401s | 20:07 |
| hockeynut | alee 1) update etc/barbican/barbican-api-paste.ini (comment out unauth path, uncomment authenticated path) then change IP addr for keystone. Depending on your keystone setup you will need to update id/pw too | 20:07 |
| hockeynut | alee also update etc/barbican/barbican-functional.conf to point to your keystone and barbican (which may be localhost) and check ids/passwords | 20:08 |
| hockeynut | alee after that, "bin/barbican.sh install" (which will install the updated etc/barbican/barbican-api-paste.ini to /etc | 20:08 |
| hockeynut | then you can "tox -e functional" to run the functional tests | 20:08 |
| rm_work | hockeynut: that last step isn't necessary to run the functional tests with tox, is it? | 20:09 |
| rm_work | the barbian.sh install | 20:09 |
| rm_work | you can just "run it" | 20:09 |
| rm_work | barbican.sh start ? | 20:09 |
| hockeynut | rm_work in general I do an install if I have grabbed new base code...but yes, you can do start | 20:09 |
| rm_work | k just checking | 20:09 |
| hockeynut | if things look odd then do install :-) | 20:09 |
| rm_work | since IIRC you said it pulls from ./etc before /etc | 20:10 |
| rm_work | yeah k | 20:10 |
| hockeynut | I also zap my database before each start - but that's just me | 20:10 |
| rm_work | i often do too >_> | 20:10 |
| hockeynut | rm /var/lib/barbican/barbican.sqlite | 20:10 |
| hockeynut | one less thing to worry about - I have no personal SLA for data loss on my local server :-D | 20:10 |
| rm_work | BTW what is config.py | 20:11 |
| rm_work | it has a sqlalchemy URL pointing to sqlite:////tmp/barbican.db | 20:11 |
| rm_work | which seems odd, is that cruft? | 20:11 |
| *** kebray has quit IRC | 20:11 | |
| hockeynut | that might be a good Q for woodster_ | 20:11 |
| hockeynut | sqlalchemy is black magic to me | 20:11 |
| rm_work | I have to assume this file isn't actually used for anything | 20:12 |
| hockeynut | I wouldn't go that far | 20:12 |
| rm_work | well, if it were... that file would exist at some point, which it doesn't seem to, but yeah maybe it's a mock thing or something | 20:13 |
| hockeynut | but if true then it should be removed. woodster_ is that file used? | 20:13 |
| hockeynut | redrobot might know as well. or jvrbanac or reaperhulk or chellygel | 20:13 |
| hockeynut | basically barbicaneer.* :-) | 20:13 |
| rm_work | heh | 20:13 |
| rm_work | alee: yeah the issue i had with 401s was mostly that it doesn't read from /etc/barbican config files if ./etc/barbican config files exist | 20:14 |
| rm_work | alee: which seems like a weird cascading to me, but yeah | 20:14 |
| *** openstackgerrit has quit IRC | 20:14 | |
| *** openstackgerrit has joined #openstack-barbican | 20:15 | |
| hockeynut | rellerreller about the ccneil security CR - I think both tagging *and* putting them into a new class (at the same level as SecretsTestCase) would make sense - yes? | 20:15 |
| woodster_ | rm_work, not sure what that config.py is for actually...redrobot, do you know? I think we could remove that one] | 20:15 |
| *** kfarr has quit IRC | 20:15 | |
| alee | rm_work, so it reads from ./etc/barbican config files? | 20:15 |
| rm_work | alee: yes | 20:15 |
| alee | which is fine actually | 20:15 |
| rm_work | alee: it chooses ./etc before /etc T_T | 20:16 |
| alee | I'm still getting 404s though | 20:16 |
| alee | 401 | 20:16 |
| rm_work | hmm | 20:16 |
| hockeynut | alee I always do the install after any change to etc/barbican/barbican* just to be sure they're in sync | 20:16 |
| hockeynut | alee what are you using for keystone? | 20:16 |
| rellerreller | hockeynut I would be good with your suggestion | 20:16 |
| rm_work | yeah alee what is the keystone url | 20:16 |
| woodster_ | rm_work...it shouldn't read ./etc/.... (where . is the cwd inside a barbican local repo). I recall it will read ~/barbican-api.conf if you have one though. | 20:17 |
| alee | identity_uri = http://localhost:35357 | 20:17 |
| alee | rm_work, thats whats in the paste.ini | 20:17 |
| rm_work | woodster_: it definitely will chose /home/adam/barbican/etc/barbican/ configs before it reads from /etc/barbican/ configs | 20:17 |
| woodster_ | rm_work, yeah I faintly recall that :) | 20:18 |
| rm_work | alee: for the functional tests you need it specified in the functional config with /v3 | 20:18 |
| *** kfarr has joined #openstack-barbican | 20:18 | |
| *** kebray has joined #openstack-barbican | 20:18 | |
| hockeynut | alee or at least they have to match (I use both v2 and v3) | 20:18 |
| alee | uri=http://localhost:35357/v3 | 20:18 |
| rm_work | etc/barbican/barbican-functional.conf | 20:18 |
| rm_work | uri=http://localhost:5000/v3 | 20:19 |
| rm_work | is what I use | 20:19 |
| hockeynut | alee the 35357 port is specified in the etc/barbican/barbican-api-paste.ini. 5000 goes in the etc/barbican/barbican-functional.conf | 20:20 |
| alee | hockeynut, so there are two ports? | 20:20 |
| hockeynut | alee yes, one for barbican admin stuff, the other for the real work from the test | 20:21 |
| hockeynut | alee I use a docker image (thanks to jvrbanac) for my identity - so my barbican-api-paste.ini file has: identity_uri = http://192.168.59.104:35357 | 20:21 |
| jvrbanac | alee, hockeynut that is only because you're using boot2docker right? | 20:22 |
| alee | hockeynut, I used redrobot scripts to set up my keystone instance --- so the commands look something like this .. | 20:22 |
| hockeynut | jvrbanac yes, that IP addr is from boot2docker | 20:22 |
| alee | https://gist.github.com/dmend/e6c5b3f0bc6913d766f6 | 20:23 |
| hockeynut | alee an easy test is to postman/curl to your identity with the id/pw you're using for the tests and be sure that works | 20:23 |
| woodster_ | jvrbanac, hockeynut, what sequence do you use with boot2docker to set up a local Barbican network? | 20:24 |
| jvrbanac | woodster_, I don't use boot2docker. I run Linux, so I don't need that | 20:24 |
| hockeynut | boot2docker destroy | 20:25 |
| hockeynut | boot2docker init | 20:25 |
| hockeynut | boot2docker start | 20:25 |
| hockeynut | $(boot2docker shellinit) then docker run similiar to what dmend gist said | 20:25 |
| *** tkelsey has joined #openstack-barbican | 20:25 | |
| woodster_ | jvrbanac, ha! A real man's OS | 20:25 |
| alee | hockeynut, jvrbanac so -- the auth requests should be going to 5000? | 20:25 |
| hockeynut | c'mon woodster_ you know CP/M is the real mans OS | 20:26 |
| hockeynut | alee yes. 35357 is used by barbican server | 20:27 |
| jvrbanac | alee, yeah | 20:27 |
| alee | keystoneclient.auth.identity.v3: DEBUG: Making authentication request to http://localhost:5000/v3/auth/tokens | 20:27 |
| alee | requests.packages.urllib3.connectionpool: INFO: Starting new HTTP connection (1): localhost | 20:27 |
| alee | requests.packages.urllib3.connectionpool: DEBUG: "POST /v3/auth/tokens HTTP/1.1" 401 114 | 20:27 |
| alee | keystoneclient.session: DEBUG: Request returned failure status: 401 | 20:27 |
| alee | so it looks like its going to the right place | 20:27 |
| alee | hmm .. so in the functional tests config it says .. | 20:28 |
| alee | username=admin | 20:28 |
| alee | project_name=admin | 20:28 |
| alee | password=secretadmin | 20:28 |
| alee | domain_name=Default | 20:28 |
| hockeynut | depending on how you have it setup that id/pw may be wrong. I use jvrbanac stuff so password=password for me | 20:29 |
| hockeynut | alee your URL does look fine, so it must be the id/pw | 20:29 |
| alee | yeah -- I think thats what redrobot script does .. | 20:29 |
| *** tkelsey has quit IRC | 20:29 | |
| rm_work | alee: yeah mine is password=password as well | 20:30 |
| jvrbanac | alee, hockeynut, woodster_, we should probably have a something in our docs that gives some instructions around this stuff | 20:30 |
| rm_work | at first i was like "why are they setting it to NOT the default devstack password" and then realized there is no default, i've just been using the same scripts for so long that I assume it's 'password' | 20:31 |
| hockeynut | jvrbanac absolutely. will also cover this in our google hangout on functionaltests | 20:31 |
| alee | yeah -- that works a little better | 20:31 |
| woodster_ | hockeynut that sounds good | 20:31 |
| alee | at least now I'm getting tokens | 20:31 |
| hockeynut | alee doing the programmer dance... | 20:31 |
| rm_work | alee: you using my barbican devstack script by chance? | 20:31 |
| alee | although the functional tests are still failing | 20:31 |
| *** kebray has quit IRC | 20:31 | |
| alee | rm_work, nope -- where is that ? | 20:32 |
| jvrbanac | hockeynut, we probably need to update this as well: http://docs.openstack.org/developer/barbican/setup/keystone.html | 20:32 |
| hockeynut | jvrbanac yes! | 20:32 |
| rm_work | alee: https://wiki.openstack.org/wiki/BarbicanDevStack | 20:32 |
| rm_work | alee: at the bottom, "The Easy Way" | 20:32 |
| jvrbanac | rm_work, http://docs.openstack.org/developer/barbican/setup/devstack.html | 20:33 |
| jvrbanac | lol | 20:33 |
| rm_work | jvrbanac: heh | 20:33 |
| jvrbanac | soooo many docs! | 20:33 |
| rm_work | vagrant is good | 20:34 |
| hockeynut | jvrbanac + oo | 20:34 |
| alee | rm_work, cool - I may try "the easy way" | 20:34 |
| rm_work | i don't have it set up though, so a simple batch script is easier | 20:34 |
| alee | I like the sound of that | 20:34 |
| *** xaeth is now known as xaeth_afk | 20:34 | |
| alee | like the "easy button" | 20:34 |
| rm_work | alee: yeah, though I haven't modified that since the functional tests changed a little, so the file still needs to be updated with the different password I think | 20:35 |
| *** kebray has joined #openstack-barbican | 20:35 | |
| rm_work | might do that now | 20:35 |
| alee | ok guys -- need to step out for a bit - thanks for the help -- will be trying this out later tonight | 20:35 |
| *** alee is now known as alee_afk | 20:36 | |
| dave-mccowan | hockeynut Hangout on functional tests? Sounds interesting. When is that? | 20:38 |
| rm_work | ah | 20:38 |
| rm_work | so yeah | 20:38 |
| rm_work | hockeynut: the default barbican devstack password IS set to "password" | 20:38 |
| hockeynut | dave-mccowan I'm actually on vacation this week - will schedule it for early next week | 20:38 |
| rm_work | per barbican/contrib/devstack/local.conf | 20:38 |
| chellygel | https://review.openstack.org/#/c/165221/ o/ could use a +1 workflow~ | 20:38 |
| hockeynut | rm_work cool - that's what I thought/hoped :-) | 20:38 |
| rm_work | so the fact that the functional config defaults to something ELSE is weird | 20:38 |
| rm_work | and should probably be changed :P | 20:39 |
| hockeynut | OMG chellygel so demanding! | 20:39 |
| rm_work | screw it, i'll submit that | 20:39 |
| chellygel | hahaha | 20:39 |
| chellygel | ive got 4 hours and counting waiting for the juno vm to run devstack gate on the last thing | 20:39 |
| chellygel | tempest juno is da best vm o/ 4 hours and 13 min | 20:40 |
| rm_work | chances of making gate: low :P | 20:40 |
| hockeynut | chellygel werkflo done | 20:40 |
| openstackgerrit | Adam Harwell proposed openstack/barbican: Make the default functional config use the right password https://review.openstack.org/165591 | 20:41 |
| rm_work | did it before I forgot | 20:41 |
| *** elmiko_ has joined #openstack-barbican | 20:42 | |
| *** elmiko has quit IRC | 20:45 | |
| *** elmiko_ is now known as elmiko | 20:46 | |
| rm_work | alee_afk: updated my script to fix the issue until the CR fix lands, so should be all green for now :) | 20:58 |
| openstackgerrit | John Wood proposed openstack/barbican: Allow business logic and plugins to retry tasks https://review.openstack.org/165594 | 20:59 |
| woodster_ | redrobot, jvrbanac, hockeynut: can one of you take a look at this?: https://review.openstack.org/#/c/157565 | 21:02 |
| *** rellerreller has quit IRC | 21:07 | |
| *** jamielennox is now known as jamielennox|away | 21:31 | |
| hockeynut | woodster_ a few questions on ^ | 21:33 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 21:37 |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 21:40 |
| *** dave-mccowan has quit IRC | 22:04 | |
| *** jamielennox|away is now known as jamielennox | 22:12 | |
| openstackgerrit | Kaitlin Farr proposed openstack/barbican: Add asymmetric key support to KMIP plugin https://review.openstack.org/163989 | 22:21 |
| *** igueths has quit IRC | 22:23 | |
| *** kfarr has quit IRC | 22:24 | |
| *** dimtruck is now known as zz_dimtruck | 22:30 | |
| *** gyee has joined #openstack-barbican | 22:48 | |
| openstackgerrit | Merged openstack/python-barbicanclient: Fixed deprecated type and encoding test and encoding bug https://review.openstack.org/165215 | 23:11 |
| openstackgerrit | Merged openstack/python-barbicanclient: Fix smoke test for client with bad data set https://review.openstack.org/165221 | 23:11 |
| *** kebray has quit IRC | 23:21 | |
| *** SheenaG has quit IRC | 23:49 | |
| *** SheenaG has joined #openstack-barbican | 23:51 | |
| *** dave-mccowan has joined #openstack-barbican | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!