| *** dave-mccowan has joined #openstack-barbican | 00:00 | |
| *** everjeje has quit IRC | 00:16 | |
| openstackgerrit | Merged openstack/python-barbicanclient: Negative tests for orders https://review.openstack.org/168150 | 01:09 |
|---|---|---|
| *** nkinder has joined #openstack-barbican | 01:30 | |
| *** kebray has quit IRC | 02:33 | |
| alee | redrobot, whoop whoop for https://review.openstack.org/#/c/166497/ ? | 02:42 |
| redrobot | alee haha, indeed | 02:42 |
| *** crc32 has quit IRC | 02:44 | |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Introducing container types and examples to quickstart guide https://review.openstack.org/169151 | 03:17 |
| openstackgerrit | John Wood proposed openstack/barbican: Restore worker tasks processing catching exceptions https://review.openstack.org/168039 | 03:38 |
| openstackgerrit | John Wood proposed openstack/barbican: Add more info on setting up Dockerized Keystone https://review.openstack.org/169114 | 03:49 |
| *** alee has quit IRC | 04:12 | |
| woodster_ | Curses Devstack!!!!: | 04:12 |
| woodster_ | https://www.irccloud.com/pastebin/Q7GrB0gs | 04:12 |
| *** alee has joined #openstack-barbican | 04:12 | |
| *** kebray has joined #openstack-barbican | 04:19 | |
| *** kebray has quit IRC | 04:19 | |
| *** kebray has joined #openstack-barbican | 04:20 | |
| rm_work | woodster_: i hope you're testing changes in your own devstack first so you can quickly catch issues :P | 04:40 |
| woodster_ | Will it quickly check zuul issues which I'm guessing is what that is? | 04:41 |
| woodster_ | ...or hoping that is | 04:41 |
| rm_work | hmm | 04:43 |
| rm_work | you think that one is a zuul issue? | 04:44 |
| rm_work | I think that error COULD be caused by a barbican issue. but, maybe it is just an SSH/pypi timeout bug or something | 04:44 |
| woodster_ | well if a barbican issue then it slipped past the gate and then infected the rest of the CRs | 04:45 |
| rm_work | T_T | 04:45 |
| rm_work | ah that was on your non-code change | 04:46 |
| rm_work | sucktastic | 04:46 |
| woodster_ | sad panda for sure | 04:46 |
| woodster_ | just in time for release week | 04:46 |
| rm_work | ugh | 04:47 |
| rm_work | 2015-03-31 04:21:13.173 | HTTP error 404 while getting http://pypi.ORD.openstack.org/packages/source/X/XStatic-Angular-Irdragndrop/XStatic-Angular-Irdragndrop-1.0.2.1.tar.gz#md5=7f57941bb72f83fe01875152ddb24ce1 (from http://pypi.ORD.openstack.org/simple/xstatic-angular-irdragndrop/) | 04:47 |
| rm_work | 2015-03-31 04:21:13.174 | Could not install requirement XStatic-Angular-Irdragndrop>=1.0.2.1 (from horizon==2015.1.dev110) because of error 404 Client Error: Not Found | 04:47 |
| rm_work | so | 04:48 |
| rm_work | just hitting that URL in a browser gives a 404 | 04:48 |
| rm_work | does not seem great | 04:48 |
| rm_work | The requested URL /packages/source/X/XStatic-Angular-Irdragndrop/XStatic-Angular-Irdragndrop-1.0.2.1.tar.gz was not found on this server. | 04:48 |
| rm_work | something got f'ed up in the openstack pypi mirror for that package | 04:49 |
| woodster_ | did you get all of that from the devstack logs, or did you have to run it locally? | 04:52 |
| rm_work | devstack logs | 04:54 |
| rm_work | interesting that horizon uses Angular.js :P | 04:56 |
| rm_work | nice, infra is aware of the issue, and is working on fixing it | 05:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Imported Translations from Transifex https://review.openstack.org/169181 | 06:07 |
| *** jamielennox is now known as jamielennox|away | 06:49 | |
| *** tkelsey has joined #openstack-barbican | 06:58 | |
| *** tkelsey has quit IRC | 07:05 | |
| *** jaosorior has joined #openstack-barbican | 07:28 | |
| *** woodster_ has quit IRC | 07:40 | |
| *** kebray has quit IRC | 08:13 | |
| -openstackstatus- NOTICE: CI Check/Gate pipelines currently stuck due to a bad dependency creeping in the system. No need to recheck your patches at the moment. | 08:52 | |
| *** ChanServ changes topic to "CI Check/Gate pipelines currently stuck due to a bad dependency creeping in the system. No need to recheck your patches at the moment." | 08:52 | |
| *** tkelsey has joined #openstack-barbican | 09:00 | |
| *** everjeje has joined #openstack-barbican | 09:10 | |
| *** jamielennox|away is now known as jamielennox | 09:41 | |
| *** jamielennox is now known as jamielennox|away | 09:47 | |
| *** darrenmoffat has joined #openstack-barbican | 10:12 | |
| *** ChanServ changes topic to "Kilo RC1 due April 9 https://launchpad.net/barbican/+milestone/kilo-rc1" | 11:48 | |
| -openstackstatus- NOTICE: Check/Gate unstuck, feel free to recheck your abusively-failed changes. | 11:48 | |
| *** woodster_ has joined #openstack-barbican | 12:01 | |
| *** alee has quit IRC | 12:21 | |
| *** nkinder has quit IRC | 13:12 | |
| *** alee has joined #openstack-barbican | 13:35 | |
| dave-mccowan | alee ping | 13:46 |
| alee | dave-mccowan, good morning | 13:46 |
| dave-mccowan | alee good morning :-) | 13:47 |
| dave-mccowan | alee did something change in the code with retrieving containers? after rebasing and fixing code review comments, my validator can't get stored containers from the repo using the code that used to work. | 13:48 |
| alee | dave-mccowan, not sure -- I have been using your code but have not rebased in a couple of days. Let me rebase and see whats there. | 13:49 |
| dave-mccowan | alee if i upload my current code to gerrit, can you take a look? | 13:51 |
| alee | dave-mccowan, yup | 13:51 |
| dave-mccowan | alee cool. thanks! | 13:52 |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Implement validators and tests for stored key certificate orders https://review.openstack.org/167291 | 13:54 |
| alee | woodster_, redrobot - any idea whats going on in the devstack gate? | 13:57 |
| dave-mccowan | alee ^^ validate_refs_in_order() doesn't find the stored container in the two functional tests that fail running with this patch. maybe something changed with how project_id is used? | 13:57 |
| alee | I've been waiting for woodster_ patch to land. | 13:57 |
| dave-mccowan | alee the openstackstatus bot sent the all clear and said to "recheck" | 13:58 |
| *** nkinder has joined #openstack-barbican | 13:58 | |
| alee | dave-mccowan, ok - let me set those .. | 13:58 |
| *** ametts has joined #openstack-barbican | 13:59 | |
| *** paul_glass has joined #openstack-barbican | 14:03 | |
| *** zz_dimtruck is now known as dimtruck | 14:04 | |
| alee | dave-mccowan, when you call validate_refs_in_order, you are passing in project.id -- which is the internal project id. | 14:10 |
| alee | dave-mccowan, but your search within that function is using the external_project_id | 14:11 |
| alee | dave-mccowan, hence the reason the search is not finding your containers | 14:12 |
| dave-mccowan | alee thanks. which one should i be using in both places. external? | 14:14 |
| alee | most likely yes -- thats what the query needs | 14:15 |
| dave-mccowan | alee thanks! that's what i needed. | 14:16 |
| alee | dave-mccowan, so looking at your changes .. | 14:20 |
| alee | dave-mccowan, I understand that this is a little tricky in that we're waiting for the acl changes to merge | 14:21 |
| alee | dave-mccowan, I was going to say that when the acl changes merge , we'd be able to confirm the existence of the container without reference to the project_id | 14:22 |
| alee | but then I also realized that we'd likely need the project_id to determine access permissions | 14:23 |
| alee | dave-mccowan, so I think there needs to be only one validation function called. | 14:23 |
| alee | right now your patch has two validation functions. | 14:24 |
| dave-mccowan | alee yea. the first one validates the format of container ref (all it can do), the second one validates the container contents, once it is retrieved. i could remove the first one, but it is most consistent with all the other orders. | 14:27 |
| alee | dave-mccowan, I'm responding on gerrit -- I think we need only one validation function | 14:27 |
| alee | dave-mccowan, remember that the validation of the container_ref should only take place for stored key requests | 14:28 |
| *** xaeth_afk is now known as xaeth | 14:29 | |
| alee | dave-mccowan, commented | 14:35 |
| dave-mccowan | alee ok. i had in the back of my mind to future-proof the code, in case other order types needed containers someday. but, it would be cleaner to fix that to make it specific to stored key certificate requests. i'll make those changes. thanks! | 14:38 |
| alee | dave-mccowan, yeah - I was thinking about that but its not clear you can do that simply because of the "custom" cert request type. A custom cert request could use a "container_ref" parameter that looks nothing like what we need in the stored key case. | 14:40 |
| woodster_ | rm_work, are you there? | 14:47 |
| *** dave-mccowan has quit IRC | 14:54 | |
| alee | woodster_, ping | 14:58 |
| woodster_ | alee, hey there | 14:59 |
| alee | woodster_, hey -- I need to solve a problem with the cas defined , and need your help to figure out how to do it. | 14:59 |
| alee | woodster_, basically , there is a problem with updating the ca table. because of the uniqueness constraint that is there - the update function I wrote is not working. | 15:00 |
| alee | woodster_, let me get the right test case .. | 15:00 |
| alee | woodster_, try this test in test_repositories_certificate_repositories.py | 15:02 |
| alee | test_should_update (at the end) | 15:03 |
| alee | woodster_, comment out the skip | 15:03 |
| *** joesavak has joined #openstack-barbican | 15:03 | |
| *** dave-mccowan has joined #openstack-barbican | 15:06 | |
| rm_work | woodster_: i am now | 15:13 |
| rm_work | whats up | 15:13 |
| alee | woodster_, any thoughts? | 15:14 |
| openstackgerrit | Merged openstack/barbican: Creating initial commit for containers quickstart guide https://review.openstack.org/169078 | 15:14 |
| rm_work | woodster_: containers being wonky? | 15:15 |
| *** jsavak has joined #openstack-barbican | 15:18 | |
| *** joesavak has quit IRC | 15:21 | |
| alee | woodster_, is the right way to do this by constructing an update() transaction and then calling session.execute() ? | 15:26 |
| *** kebray has joined #openstack-barbican | 15:31 | |
| *** atiwari has joined #openstack-barbican | 15:35 | |
| woodster_ | sorry, planning meetings today.... | 15:37 |
| woodster_ | alee, is this a test already in the code base then? | 15:37 |
| alee | woodster_, yeah -- its been skipped coz it was not working | 15:38 |
| alee | woodster_, looking at sqlalchemy docs -- let me try a couple of things | 15:38 |
| alee | woodster_, so the code in question is .. | 15:43 |
| alee | def update_entity() in CertificateAuthorityRepo() in repositories.py | 15:45 |
| openstackgerrit | Merged openstack/barbican: Write task retry info to database from server.py https://review.openstack.org/166497 | 15:45 |
| alee | yay | 15:45 |
| alee | woodster_, if you comment out the skip and run the test I mentioned you will see that it fails because of a constraint exceptionm | 15:47 |
| alee | woodster_, looks like its trying to do an insert instead of an update | 15:48 |
| alee | woodster_, ok - I see code in there (for example in ContainerConsumerRepo to handle the IntegrityError case | 15:55 |
| rm_work | alee: I think that is done in ContainerConsumerRepo due to that feature being idempotent | 15:55 |
| rm_work | not sure if that applies to other situations | 15:55 |
| alee | rm_work, I'm not sure I understand what is happening there .. | 15:57 |
| alee | rm_work, oh ok -- if it exists already, then ignore the update? | 15:57 |
| rm_work | alee: yeah, and consider it "done", not an error | 15:57 |
| rm_work | because all we care is that it exists "once" | 15:57 |
| rm_work | whereas for other operations that aren't idempotent, that would be an actual failure | 15:58 |
| alee | ok - that doesn't apply in my casew | 15:58 |
| rm_work | and masking it the way I did for consumers could hide a real problem | 15:58 |
| rm_work | yesd | 15:58 |
| rm_work | *yeah | 15:58 |
| *** nickrmc83 has quit IRC | 16:21 | |
| *** nickrmc83 has joined #openstack-barbican | 16:23 | |
| *** jkf has joined #openstack-barbican | 16:26 | |
| *** tkelsey has quit IRC | 17:06 | |
| *** xaeth is now known as xaeth_afk | 17:06 | |
| *** dimtruck is now known as zz_dimtruck | 17:09 | |
| *** tkelsey has joined #openstack-barbican | 17:12 | |
| openstackgerrit | Merged openstack/barbican: Introducing container types and examples to quickstart guide https://review.openstack.org/169151 | 17:13 |
| *** xaeth_afk is now known as xaeth | 17:16 | |
| *** tkelsey has quit IRC | 17:17 | |
| *** tkelsey has joined #openstack-barbican | 17:36 | |
| rm_work | chellygel: you there? or is everyone away in planning | 17:38 |
| chellygel | rm_work, i are here | 17:39 |
| rm_work | chellygel: in the CA Plugins | 17:39 |
| rm_work | like, for example, the symantec one you were writing | 17:39 |
| rm_work | get_default_signing_cert | 17:40 |
| rm_work | you have a TODO to retrieve that | 17:40 |
| rm_work | but… are we really returning that?! is this necessary? | 17:40 |
| *** tkelsey has quit IRC | 17:40 | |
| rm_work | I don't really understand the use-case | 17:40 |
| rm_work | and the docstrings in the abstract class don't illuminate much | 17:40 |
| chellygel | honestly, i havent touched that part of barbican in a while rm_work . i'd need to check that out in context. | 17:40 |
| rm_work | T_T k | 17:40 |
| chellygel | i dont remember anything about a default signing cert | 17:41 |
| chellygel | that's my todo?? | 17:41 |
| rm_work | yes | 17:41 |
| rm_work | def get_default_signing_cert(self): | 17:41 |
| rm_work | # TODO(chellygel) Add code to get the signing cert | 17:41 |
| chellygel | what file / line? | 17:41 |
| rm_work | barbican/plugin/symantec.py | 17:42 |
| rm_work | line 65 | 17:42 |
| chellygel | ah rm_work that was alee that added that line | 17:42 |
| chellygel | and assigned it to me :P | 17:42 |
| rm_work | lol | 17:43 |
| rm_work | alee: ^^ | 17:43 |
| chellygel | cause that doesn't make sense in the symantec context | 17:43 |
| rm_work | right? | 17:43 |
| rm_work | I think | 17:43 |
| chellygel | we dont have access to a signing cert. | 17:43 |
| rm_work | correct | 17:43 |
| rm_work | and also, why would we ever return our signing cert... | 17:43 |
| rm_work | like... | 17:43 |
| rm_work | oh actually nm i get why | 17:43 |
| rm_work | specifically for self-signed, we need to know what cert to trust | 17:44 |
| rm_work | (I am taking over the Snakeoil CA plugin CR) | 17:44 |
| chellygel | ah very cool | 17:44 |
| alee | rm_work, chellygel - whats up? | 17:51 |
| rm_work | alee: I think I figured it out | 17:52 |
| alee | rm_work, chellygel - you need to import the signing cert in order to trust the chain | 17:52 |
| rm_work | yes | 17:52 |
| alee | chellygel, you absolutely should have access to the symantec signing cert -- although for you maybe thats published somewhere or already installed in a browser. | 17:53 |
| rm_work | right, that | 17:54 |
| rm_work | it's published, not easily accessable to the plugin | 17:54 |
| alee | rm_work, well if its published -- its definitely accessible to the plugin | 17:55 |
| rm_work | via what though? | 17:55 |
| alee | wget? | 17:55 |
| rm_work | requests -> open some URL? | 17:55 |
| rm_work | that seems <_< | 17:56 |
| alee | yup | 17:56 |
| rm_work | probably don't want to do that there thouhg | 17:56 |
| rm_work | i guess at least cache it? for some period of time? | 17:56 |
| alee | or if it does not change often - put it in the config | 17:56 |
| rm_work | that's a little awkward | 17:56 |
| rm_work | i guess so <_< | 17:56 |
| *** zz_dimtruck is now known as dimtruck | 17:57 | |
| alee | rm_work, the plugin can specify the expiration time of the ca_info | 17:57 |
| alee | for the symantec plugin, that could be essentially forever .. | 17:57 |
| rm_work | heh, guess so | 17:58 |
| rm_work | still seems awkward | 17:58 |
| alee | why? | 17:58 |
| rm_work | was going to say "because why are we the middle-man for getting symantec's public cert", but i guess that's exactly what we are | 17:58 |
| rm_work | T_T | 17:58 |
| alee | rm_work, right | 17:59 |
| rm_work | middleman 4 life | 17:59 |
| *** xaeth is now known as xaeth_afk | 18:03 | |
| rm_work | alright, updated | 18:04 |
| rm_work | would like to get this in, don't know if it qualifies | 18:04 |
| *** jamielennox|away is now known as jamielennox | 18:04 | |
| openstackgerrit | Adam Harwell proposed openstack/barbican: Create snakeoil certificate plugin https://review.openstack.org/140575 | 18:06 |
| openstackgerrit | Merged openstack/barbican: Initial connect up retry task submit and re-enqueue https://review.openstack.org/167110 | 18:06 |
| *** xaeth_afk is now known as xaeth | 18:10 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding ACL db model changes (Part 1) https://review.openstack.org/164334 | 18:47 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding ACL db repository changes (Part 2) https://review.openstack.org/167712 | 18:48 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Secret ACL controller layer changes (Part 3) https://review.openstack.org/164335 | 18:48 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding Container ACL controller layer changes (Part 4) https://review.openstack.org/165205 | 18:48 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding policy layer changes for ACL support (Part 5) https://review.openstack.org/165207 | 18:48 |
| *** jaosorior has quit IRC | 18:52 | |
| rm_work | ah was about to post comments on #2 ;p | 18:53 |
| *** ametts has quit IRC | 18:59 | |
| arunkant | rm_work, just resolved the merged conflict and need to apply in all 5 parts. So changes should be same as earlier patch. You can add them in earlier patch. I will reply and address in next patch if needed. | 19:00 |
| rm_work | yeah it's fine, was only a couple, ported them to the newest patchset and posted | 19:00 |
| *** everjeje has quit IRC | 19:06 | |
| arunkant | rm_work, can you check my reply comment regarding expiration on #2? | 19:10 |
| rm_work | ah weird | 19:14 |
| rm_work | i could have sworn there was, from when I was writing the client code for it | 19:14 |
| rm_work | but now i can't find any trace | 19:14 |
| rm_work | must be going slightly nutty | 19:14 |
| arunkant | I see its applicable for secrets. | 19:14 |
| rm_work | yeah | 19:16 |
| *** jsavak has quit IRC | 19:16 | |
| rm_work | no, it is just my memory messing with me, i think | 19:17 |
| rm_work | you're fine | 19:17 |
| arunkant | okay...thanks for checking | 19:17 |
| openstackgerrit | Ade Lee proposed openstack/barbican: Fix error in setting and updating ca and preferred ca tables https://review.openstack.org/169471 | 19:35 |
| alee | redrobot, woodster_ jvrbanac, hockeynut ^^ a nice small patch to review please | 19:37 |
| *** tkelsey has joined #openstack-barbican | 19:37 | |
| *** tkelsey has quit IRC | 19:41 | |
| hockeynut | alee looks good, just waiting for the functional tests to agree :-) | 19:48 |
| alee | cool | 19:48 |
| alee | woodster_, aargh .. one of your commits totally changed test_certificate_resources.py .. and now I have to try and merge .. | 19:50 |
| *** paul_glass has quit IRC | 19:57 | |
| *** paul_glass has joined #openstack-barbican | 20:02 | |
| woodster_ | alee, sorry about that....I had to add tests to get coverage up to 100% and might have done some refactorings :\ | 20:08 |
| woodster_ | alee, sorry couldn't help with your db issue | 20:08 |
| alee | woodster_, I resolved it -- see https://review.openstack.org/#/c/169471/ | 20:09 |
| alee | woodster_, please review | 20:09 |
| woodster_ | alee, I see that...looking now | 20:10 |
| alee | woodster_, I have done a bunch of refactoring too -- ie. replacing all mocks with real repos. | 20:10 |
| alee | woodster_, so now I have to figure out how to merge your changes in | 20:10 |
| woodster_ | alee, inspired by jvrbanac were you? :) | 20:11 |
| alee | woodster_, sorta -- I realized I needed to fix the code to do some actual repo retrievals and that was hard to model with mocks | 20:12 |
| alee | woodster_, plus the mocks really do hide errors as I found out | 20:12 |
| alee | woodster_, I think I may end up throwing away your changes, applying mine and then re-adding your changes | 20:13 |
| woodster_ | alee, jvrbanac and reaperhulk have been preaching that for a while over here...true unit testing with mocks is painful and error prone it seems | 20:13 |
| woodster_ | alee, well I won't be too bummed if you replace them as long as the coverage is there | 20:14 |
| alee | woodster_, yeah -- I've been converting a bunch of tests and have uncovered quite a few errors | 20:14 |
| woodster_ | alee, I think some of those test classes were repository/database related ones already though | 20:19 |
| openstackgerrit | Thomas Herve proposed openstack/python-barbicanclient: Fix order listing on the command line. https://review.openstack.org/169481 | 20:22 |
| *** jkf has quit IRC | 20:35 | |
| *** david-lyle has quit IRC | 20:40 | |
| openstackgerrit | Merged openstack/barbican: Imported Translations from Transifex https://review.openstack.org/169181 | 20:56 |
| *** nkinder has quit IRC | 20:57 | |
| *** nkinder has joined #openstack-barbican | 20:57 | |
| *** dimtruck is now known as zz_dimtruck | 20:57 | |
| *** zz_dimtruck is now known as dimtruck | 20:58 | |
| *** chadlung has joined #openstack-barbican | 21:05 | |
| *** chadlung has quit IRC | 21:08 | |
| *** chadlung has joined #openstack-barbican | 21:08 | |
| *** xaeth is now known as xaeth_afk | 21:10 | |
| *** atiwari has quit IRC | 21:22 | |
| *** atiwari has joined #openstack-barbican | 21:24 | |
| openstackgerrit | Merged openstack/barbican: Adding reference doc page for containers https://review.openstack.org/168992 | 21:29 |
| *** atiwari has quit IRC | 21:30 | |
| *** atiwari has joined #openstack-barbican | 21:31 | |
| *** xaeth_afk is now known as xaeth | 21:34 | |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Adding GET and DELETE for containers quickstart guide https://review.openstack.org/169518 | 21:40 |
| *** nkinder has quit IRC | 21:42 | |
| *** chadlung has quit IRC | 21:51 | |
| *** paul_glass has quit IRC | 21:56 | |
| *** xaeth is now known as xaeth_afk | 22:06 | |
| openstackgerrit | Merged openstack/barbican: Fix error in setting and updating ca and preferred ca tables https://review.openstack.org/169471 | 22:12 |
| *** alee has quit IRC | 22:21 | |
| *** nkinder has joined #openstack-barbican | 22:38 | |
| *** dimtruck is now known as zz_dimtruck | 22:47 | |
| *** dave-mccowan has quit IRC | 23:04 | |
| *** atiwari1 has joined #openstack-barbican | 23:16 | |
| *** atiwari has quit IRC | 23:18 | |
| *** tkelsey has joined #openstack-barbican | 23:38 | |
| *** tkelsey has quit IRC | 23:42 | |
| *** dave-mccowan has joined #openstack-barbican | 23:50 | |
| *** kebray has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!