| *** paul_glass has quit IRC | 00:06 | |
| *** jamielennox|away is now known as jamielennox | 00:28 | |
| *** SheenaG has joined #openstack-barbican | 00:55 | |
| *** xaeth_afk is now known as xaeth | 02:31 | |
| *** SheenaG has quit IRC | 02:50 | |
| *** SheenaG has joined #openstack-barbican | 02:52 | |
| *** woodster_ has quit IRC | 03:00 | |
| *** zz_dimtruck is now known as dimtruck | 03:01 | |
| *** gyee has quit IRC | 03:19 | |
| *** elmiko has quit IRC | 03:41 | |
| *** elmiko has joined #openstack-barbican | 03:42 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Refactor Stored Key Certificate Order Validator Code https://review.openstack.org/171023 | 03:45 |
|---|---|---|
| *** xaeth is now known as xaeth_afk | 03:49 | |
| *** dimtruck is now known as zz_dimtruck | 03:49 | |
| *** alee has quit IRC | 03:59 | |
| *** alee has joined #openstack-barbican | 04:12 | |
| *** kebray has joined #openstack-barbican | 04:16 | |
| *** kebray has quit IRC | 04:16 | |
| *** SheenaG has quit IRC | 04:20 | |
| *** kebray has joined #openstack-barbican | 04:21 | |
| *** kebray has quit IRC | 04:21 | |
| *** kebray has joined #openstack-barbican | 04:22 | |
| *** alee has quit IRC | 04:26 | |
| *** crc32 has joined #openstack-barbican | 04:27 | |
| *** alee has joined #openstack-barbican | 04:39 | |
| *** kebray has quit IRC | 04:51 | |
| *** woodster_ has joined #openstack-barbican | 04:57 | |
| *** alee has quit IRC | 05:08 | |
| *** alee has joined #openstack-barbican | 05:21 | |
| *** crc32 has quit IRC | 05:33 | |
| *** alee has quit IRC | 05:42 | |
| *** alee has joined #openstack-barbican | 05:55 | |
| *** dave-mccowan has quit IRC | 06:00 | |
| *** alee has quit IRC | 06:04 | |
| *** alee has joined #openstack-barbican | 06:17 | |
| *** alee has quit IRC | 06:21 | |
| *** alee has joined #openstack-barbican | 06:34 | |
| *** alee has quit IRC | 06:52 | |
| *** woodster_ has quit IRC | 07:00 | |
| *** gitorres has quit IRC | 07:04 | |
| *** alee has joined #openstack-barbican | 07:05 | |
| *** gitorres has joined #openstack-barbican | 07:07 | |
| *** gitorres has quit IRC | 07:12 | |
| *** jamielennox is now known as jamielennox|away | 07:20 | |
| *** gitorres has joined #openstack-barbican | 07:22 | |
| *** gitorres has joined #openstack-barbican | 07:22 | |
| *** alee has quit IRC | 07:24 | |
| *** everjeje has joined #openstack-barbican | 07:30 | |
| *** alee has joined #openstack-barbican | 07:37 | |
| *** alee has quit IRC | 07:41 | |
| *** alee has joined #openstack-barbican | 07:53 | |
| *** alee has quit IRC | 07:58 | |
| *** alee has joined #openstack-barbican | 08:10 | |
| *** alee has quit IRC | 08:14 | |
| *** jaosorior has joined #openstack-barbican | 09:03 | |
| openstackgerrit | Thomas Herve proposed openstack/python-barbicanclient: Fix order listing on the command line. https://review.openstack.org/169481 | 09:47 |
| *** alee has joined #openstack-barbican | 10:39 | |
| *** alee has quit IRC | 10:43 | |
| *** alee has joined #openstack-barbican | 10:43 | |
| *** alee has quit IRC | 10:48 | |
| *** dave-mccowan has joined #openstack-barbican | 10:53 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Readability-related changes to secret store functions https://review.openstack.org/172378 | 11:16 |
| *** rm_you| has joined #openstack-barbican | 12:23 | |
| *** zz_dimtruck is now known as dimtruck | 12:23 | |
| *** rm_you has quit IRC | 12:25 | |
| *** woodster_ has joined #openstack-barbican | 12:37 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add new smoke tests for RSA type containers and secrets https://review.openstack.org/172401 | 12:40 |
| dave-mccowan | jaosorior, ping | 12:42 |
| jaosorior | dave-mccowan: pong | 12:55 |
| dave-mccowan | jaosorior hi oz. are you working on 1441866? | 12:56 |
| dave-mccowan | jaosorior oh, i see you dropped in launchpad. just fyi, my new CR above adds functional tests that will start working when that bug is fixed. | 12:58 |
| jaosorior | dave-mccowan: yeah, I dropped from it since there seemed to be some confusion related to content types. So when that's figured out, I I'll get into it again | 13:00 |
| dave-mccowan | jaosorior, if you get a chance, take a look at my CR to see if it adds to the confusion or helps clear it. :-) https://review.openstack.org/172401 | 13:02 |
| jaosorior | dave-mccowan: sure | 13:03 |
| *** rellerreller has joined #openstack-barbican | 13:05 | |
| rellerreller | redrobot fyi that I am only available until 2:00 CT today. We had said yesterday that we should discuss everyone's favorite topic of content types. | 13:06 |
| *** alee has joined #openstack-barbican | 13:12 | |
| *** alee has quit IRC | 13:18 | |
| *** alee has joined #openstack-barbican | 13:21 | |
| *** gitorres1 has joined #openstack-barbican | 13:30 | |
| *** gitorres has quit IRC | 13:30 | |
| jaosorior | rellerreller: so, at what time will you discuss that? Might be able to join | 13:31 |
| *** gitorres1 has quit IRC | 13:36 | |
| *** gitorres has joined #openstack-barbican | 13:36 | |
| *** gitorres has quit IRC | 13:39 | |
| *** gitorres has joined #openstack-barbican | 13:39 | |
| alee | rellerreller, redrobot do we have a google hangout time for today? | 13:41 |
| *** gitorres has quit IRC | 13:46 | |
| *** gitorres has joined #openstack-barbican | 13:47 | |
| rellerreller | alee jaosorior I have not heard anything yet. | 13:57 |
| rellerreller | I sent a message this morning. I assume the time and details will be posted here. | 13:57 |
| alee | rellerreller, eh? sent a message to redrobot ? | 13:59 |
| rellerreller | alee Yes to redrobot via this irc | 14:00 |
| rellerreller | alee According to the log you joined at 9:12. I sent it at 9:06. You just missed it. | 14:00 |
| alee | rellerreller, ok sorry - I thought you were going to schedule the google hangout | 14:01 |
| rellerreller | alee I thought redrobot said he was going to schedule. | 14:01 |
| alee | rellerreller, either way - I guess we need to wait for redrobot .. | 14:02 |
| rellerreller | correct | 14:03 |
| *** paul_glass has joined #openstack-barbican | 14:14 | |
| *** alee has quit IRC | 14:15 | |
| *** alee_ has joined #openstack-barbican | 14:18 | |
| *** jorge_munoz has joined #openstack-barbican | 14:29 | |
| *** igueths has joined #openstack-barbican | 14:29 | |
| *** mdarby has joined #openstack-barbican | 14:44 | |
| *** xaeth_afk is now known as xaeth | 14:45 | |
| *** kebray has joined #openstack-barbican | 15:03 | |
| *** mdarby has quit IRC | 15:04 | |
| *** mdarby has joined #openstack-barbican | 15:04 | |
| redrobot | alee_ rellerreller here | 15:08 |
| redrobot | jaosorior still around? | 15:08 |
| alee_ | redrobot, morning - when do you want to do that google hangout? | 15:09 |
| jaosorior | redrobot: yeah, but I thought 2pm CT was earlier. Still don't get used to the new time difference. It's beer o' clock now :/ | 15:09 |
| redrobot | alee_ rellerreller jaosorior I can do it now if y'all are avaiable | 15:10 |
| alee_ | dave-mccowan, ^^ | 15:11 |
| rellerreller | redrobot alee_ I'm available too. | 15:11 |
| alee_ | redrobot, me too -- dave-mccowan wrote some functional tests based on your examples -- we should get him on this too,. | 15:11 |
| dave-mccowan | alee i'm in | 15:11 |
| alee_ | cool --- redrobot -- fire it up, please | 15:12 |
| redrobot | on it | 15:12 |
| redrobot | give me 2 seconds | 15:12 |
| jaosorior | I could join briefly | 15:12 |
| jaosorior | But I'm commuting :/ | 15:12 |
| redrobot | https://plus.google.com/hangouts/_/gwtfnttnzlnqlbp6467rptiyeia | 15:14 |
| redrobot | alee_ rellerreller dave-mccowan jaosorior ^^ | 15:15 |
| *** SheenaG has joined #openstack-barbican | 15:17 | |
| hockeynut | would love some love for https://review.openstack.org/#/c/167018/ | 15:39 |
| -openstackstatus- NOTICE: gerrit has been restarted to address a hung event stream. change events between 15:00 and 15:43 utc which were lost will need to be rechecked or have approval workflow votes reapplied for zuul to act on them | 15:44 | |
| *** gyee has joined #openstack-barbican | 15:48 | |
| *** mdarby has quit IRC | 16:09 | |
| *** darrenmoffat has joined #openstack-barbican | 16:11 | |
| *** mdarby has joined #openstack-barbican | 16:27 | |
| *** jkf has joined #openstack-barbican | 16:43 | |
| *** mdarby has quit IRC | 16:50 | |
| *** xaeth is now known as xaeth_afk | 17:15 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add new smoke tests for RSA type containers and secrets https://review.openstack.org/172401 | 17:26 |
| *** jaosorior has quit IRC | 17:42 | |
| *** igueths has quit IRC | 18:17 | |
| *** dave-mccowan has quit IRC | 18:18 | |
| *** igueths has joined #openstack-barbican | 18:19 | |
| *** dimtruck is now known as zz_dimtruck | 18:24 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Improving the code coverage for ACL related changes https://review.openstack.org/172533 | 18:29 |
| *** crc32 has joined #openstack-barbican | 18:33 | |
| *** dave-mccowan has joined #openstack-barbican | 18:42 | |
| *** mdarby has joined #openstack-barbican | 18:50 | |
| *** kebray has quit IRC | 18:53 | |
| dave-mccowan | redrobot, alee_, woodster_ this CR (with content-type func tests) may have gone up while you were out. just in case you missed it: https://review.openstack.org/172401 | 18:54 |
| *** kebray has joined #openstack-barbican | 18:54 | |
| redrobot | dave-mccowan currently reviewing | 19:03 |
| redrobot | dave-mccowan what do you think about having the PEM literals in there instead of generating new keys every time. I think it would make it easier to read the test if you just see the PEM content instead of having to figure out what the openssl library is doing | 19:04 |
| redrobot | dave-mccowan http://paste.openstack.org/show/202190/ for example | 19:05 |
| dave-mccowan | redrobot, i can do that. my intent was to ensure that it worked with 'real' PEMs. since the literals in tests/utils.py were not formatted right, i may have overcompensated. | 19:07 |
| redrobot | dave-mccowan I think this would be a good function to use for the Private Key (pkcs8) use case: http://paste.openstack.org/show/202198/ | 19:13 |
| *** crc32 has quit IRC | 19:13 | |
| redrobot | dave-mccowan don't copy paste that one though, b/c I'm not sure it's the right contents :D | 19:13 |
| dave-mccowan | redrobot i like that a lot. consider it done. | 19:15 |
| redrobot | dave-mccowan ok, last paste, I promise. This one is functionally correct (just generated it on my machine) http://paste.openstack.org/show/202201/ | 19:15 |
| alee_ | redrobot, dave-mccowan if we are going to use explicit literals, then please include a comment as to how that literal was created. | 19:16 |
| dave-mccowan | redrobot. that's cool. i'll make my own, so i can have a matching public key for a container, and second set for the with-passphrase case. | 19:16 |
| dave-mccowan | alee_ +1 | 19:17 |
| redrobot | alee_ agreed, that's what i put in the docstring of the last paste | 19:17 |
| *** zz_dimtruck is now known as dimtruck | 19:17 | |
| *** xaeth_afk is now known as xaeth | 19:19 | |
| *** crc32 has joined #openstack-barbican | 19:20 | |
| alee_ | dave-mccowan, what does "base64" on line 255 do? | 19:21 |
| alee_ | sorry 225? | 19:21 |
| alee_ | same thing for line 260? | 19:22 |
| dave-mccowan | it sets the value of 'payload_content_encoding' to 'base64'. i know that's not right. what is the correct value? | 19:23 |
| dave-mccowan | redrobot ^^ | 19:23 |
| alee_ | dave-mccowan, redrobot I would think that in the put case, we would prefer not to set to base64, right? | 19:27 |
| alee_ | because the data is in fact not base64 encoded. | 19:27 |
| alee_ | dave-mccowan, there are still some tests missing for aym key + passphrase. | 19:28 |
| dave-mccowan | alee_ +1 base64 is wrong (i gave myself a -1 in gerrit with this question). but, i don't know the right value. | 19:28 |
| alee_ | ie. asymm key with private key encrypted with passphrase. | 19:29 |
| alee_ | right now, the test you do that includes a passphrase doesn't actually use it , right? | 19:29 |
| alee_ | ie. the keys that are uploaded are not actually encrypted with a passphrase | 19:30 |
| dave-mccowan | alee_ +1 TODO(dave) asym + passphrase container test cases | 19:30 |
| dave-mccowan | alee_ yes, the only passphrase test case is standalone | 19:30 |
| alee_ | also add generated asym container with passphrase | 19:30 |
| alee_ | alee_, also cert container from stored key with passphrase | 19:31 |
| alee_ | dave-mccowan, on cert order, you should at a minimum confirm that the csr is present | 19:31 |
| alee_ | dave-mccowan, and you might be able to validate it by trying to load it -- | 19:32 |
| alee_ | load_request() ? | 19:32 |
| rm_you| | testing passphrase stuff is a little odd, since the openssl lib by default reverts to stdin input if you don't supply a passphrase | 19:32 |
| rm_you| | have to give it a dummy callback | 19:32 |
| alee_ | rm_work, so what you are saying is that folks are more likely than not to use a passphrase? | 19:33 |
| reaperhulk | ugh, pyopenssl is not handling that for you? cryptography does, heh | 19:34 |
| redrobot | alee_ dave-mccowan got a meeting right now, should be done in about an hour. | 19:34 |
| alee_ | dave-mccowan, other than those things , it looks fine to me. | 19:35 |
| alee_ | reaperhulk, we're assuming cryptography will be the answer to all out problems when we convert to use it in liberty | 19:36 |
| redrobot | for passphrase, you actually have 2 things to submit to barbican | 19:40 |
| redrobot | 1) the cert that is pasphrase protected | 19:40 |
| redrobot | 2) the passphrase itself | 19:40 |
| redrobot | I think 1) could be a literal | 19:40 |
| alee_ | redrobot, you mean the key that is passphrase protected | 19:41 |
| redrobot | alee_ yeah | 19:41 |
| alee_ | and yes, they can all be literal | 19:41 |
| alee_ | (with sufficient documentation) | 19:41 |
| rm_you| | alee_: no, they're likely not to -- but if they DO, and the passphrase they pass in is wrong (or they don't supply one at all), then OpenSSL will *wait for stdin input* and lock up your processing thread | 19:42 |
| rm_you| | alee_: which is super bad | 19:42 |
| reaperhulk | alee_ that's what it should be ;) | 19:43 |
| reaperhulk | hopefully I'll have time to implement all the features you need by then | 19:43 |
| rm_you| | so you have to be careful when loading up PKs | 19:43 |
| reaperhulk | I'll be working on it all during pycon sprints, but there is obviously still a mountain to work on | 19:43 |
| rm_you| | reaperhulk: are you familiar with the default behavior i'm talking about? | 19:43 |
| reaperhulk | rm_you|: I'm familiar with how the C layer does it | 19:44 |
| reaperhulk | I assumed pyopenssl would intercept that | 19:44 |
| reaperhulk | but apparently not | 19:44 |
| reaperhulk | cryptography definitely does :) | 19:44 |
| rm_you| | nope | 19:44 |
| rm_you| | they do not | 19:44 |
| rm_you| | reaperhulk: well, that's good :P | 19:44 |
| rm_you| | so when do we switch to that? :) | 19:44 |
| *** rm_you| is now known as rm_you | 19:44 | |
| reaperhulk | liberty hopefully | 19:44 |
| reaperhulk | This is how we load a key in cryptography: https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/backends/openssl/backend.py#L847 | 19:45 |
| reaperhulk | (not that you really need to look) | 19:45 |
| reaperhulk | but it shows how we do password callbacks and hide the complexity of the password checking | 19:45 |
| *** crc32 has quit IRC | 19:47 | |
| dave-mccowan | reaperhulk what's the difference between .pem (traditional pem format) and .pk8 (pkcs#8 format)? is .pk8 format the right one to use in the barbican api? | 19:52 |
| rm_you | reaperhulk: yeah looks better | 19:59 |
| rm_you | basically is what we did | 19:59 |
| rm_you | but nice to have it hidden -- it was not very well documented in pyopenssl and was really painful <_< | 20:00 |
| reaperhulk | Suffixes aren't really relevant here, but they're two different underlying formats. The agreed upon format for Barbican is pkcs8 with PEM encoding | 20:01 |
| reaperhulk | The other is PEM encoded as well but is traditional OpenSSL format (sometimes called pkcs1) | 20:02 |
| *** kebray has quit IRC | 20:25 | |
| *** elmiko has quit IRC | 20:25 | |
| *** elmiko has joined #openstack-barbican | 20:26 | |
| *** mdarby has quit IRC | 20:36 | |
| *** SheenaG has quit IRC | 20:38 | |
| *** dimtruck is now known as zz_dimtruck | 20:39 | |
| *** rellerreller has quit IRC | 20:41 | |
| *** zz_dimtruck is now known as dimtruck | 20:43 | |
| *** igueths1 has joined #openstack-barbican | 21:01 | |
| *** igueths has quit IRC | 21:03 | |
| *** dimtruck is now known as zz_dimtruck | 21:45 | |
| *** everjeje has quit IRC | 21:46 | |
| *** SheenaG has joined #openstack-barbican | 22:03 | |
| *** paul_glass has quit IRC | 22:07 | |
| *** xaeth is now known as xaeth_afk | 22:09 | |
| *** SheenaG has quit IRC | 22:19 | |
| *** kebray has joined #openstack-barbican | 22:29 | |
| openstackgerrit | Igor Gueths proposed openstack/barbican: Potential resource exhaustion when registering consumers to containers https://review.openstack.org/170693 | 22:30 |
| *** zz_dimtruck is now known as dimtruck | 22:31 | |
| *** jkf has quit IRC | 22:31 | |
| *** igueths1 has quit IRC | 22:33 | |
| *** kebray has quit IRC | 22:34 | |
| hockeynut | anybody done any debugging in pycharm with cliff.app? | 22:34 |
| *** dimtruck is now known as zz_dimtruck | 22:48 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add new smoke tests for RSA type containers and secrets https://review.openstack.org/172401 | 22:51 |
| *** zz_dimtruck is now known as dimtruck | 23:01 | |
| woodster_ | rm_you, btw, those two devstack processes don't 'see' the same database it seems. I figure I'll mess this with this again once your infra change goes in | 23:09 |
| rm_you | hmm | 23:09 |
| rm_you | well, i got a little stuck on that and actually had to spend some time on my REAL task, which is Blueflood metrics integration :P | 23:10 |
| rm_you | hopefully can revisit next week... | 23:10 |
| *** dimtruck is now known as zz_dimtruck | 23:12 | |
| dave-mccowan | alee_, how do I get a copy of the CSR? http://ur1.ca/k5df3 | 23:17 |
| *** zz_dimtruck is now known as dimtruck | 23:25 | |
| *** gyee has quit IRC | 23:26 | |
| openstackgerrit | John Wood proposed openstack/barbican: Expose root cause plugin exceptions https://review.openstack.org/171868 | 23:37 |
| woodster_ | rm_you, arunkant, alee_ It looks like a private secret requires no roles to decrypt a secret. So there is no way for a identity admin to disable a user from decrypting secrets then, short of disabling their access to any tokens? | 23:44 |
| rm_work | hmm | 23:45 |
| rm_work | i remember this discussion | 23:46 |
| rm_work | I thought we discussed adding a role "read_other" or something | 23:46 |
| rm_work | and having that be given by default | 23:46 |
| woodster_ | rm_work, yeah I recall that as well | 23:48 |
| woodster_ | rm_work...but forget it when I reviewed the CRs last week | 23:48 |
| rm_work | i was very opposed to requiring the typical read role | 23:48 |
| rm_work | but a read_other was the compromise i remember | 23:48 |
| rm_work | that's purely policy though, right? | 23:48 |
| *** dimtruck is now known as zz_dimtruck | 23:48 | |
| woodster_ | rm_work, well, how does no roles to decrypt suit ya then? | 23:49 |
| rm_work | so could be done with no code changes, just adding to the policy file | 23:49 |
| rm_work | heh | 23:49 |
| woodster_ | rm_work I'm just trying to see if that's a security concern...it seems that a user should be able to access their private secrets unless they are locked out of the system altogether | 23:51 |
| rm_work | i suppose so | 23:51 |
| woodster_ | rm_work I see one scenario of that is missed though...an admin wants to make a secret private for another user. Probably would just add user to white list instead though | 23:53 |
| rm_work | err | 23:54 |
| rm_work | yeah that's ACL whitelist right | 23:54 |
| openstackgerrit | Steve Heyman proposed openstack/python-barbicanclient: Initial setup for command line tests https://review.openstack.org/172604 | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!