| *** kebray has joined #openstack-barbican | 00:48 | |
| *** kebray has quit IRC | 00:49 | |
| *** jamielennox|away is now known as jamielennox | 01:07 | |
| *** pglass has quit IRC | 01:19 | |
| *** zz_dimtruck is now known as dimtruck | 01:20 | |
| *** dave-mccowan has quit IRC | 01:24 | |
| *** stanzi has joined #openstack-barbican | 01:32 | |
| *** stanzi has quit IRC | 01:43 | |
| *** stanzi has joined #openstack-barbican | 01:43 | |
| *** dave-mccowan has joined #openstack-barbican | 01:46 | |
| *** stanzi has quit IRC | 01:48 | |
| *** kebray has joined #openstack-barbican | 02:24 | |
| *** dimtruck is now known as zz_dimtruck | 02:29 | |
| *** stanzi has joined #openstack-barbican | 02:30 | |
| *** kebray has quit IRC | 03:14 | |
| *** kebray has joined #openstack-barbican | 03:15 | |
| *** dave-mcc_ has joined #openstack-barbican | 03:55 | |
| *** stanzi has quit IRC | 03:56 | |
| *** dave-mccowan has quit IRC | 03:57 | |
| *** dave-mcc_ has quit IRC | 03:59 | |
| *** pglass has joined #openstack-barbican | 04:01 | |
| *** pglass has quit IRC | 04:27 | |
| *** kebray has quit IRC | 04:56 | |
| *** stanzi has joined #openstack-barbican | 05:07 | |
| *** stanzi has quit IRC | 05:11 | |
| *** mordred has quit IRC | 06:46 | |
| *** nickrmc83 has joined #openstack-barbican | 07:05 | |
| *** jaosorior has joined #openstack-barbican | 07:15 | |
| *** openstackgerrit has quit IRC | 10:09 | |
| *** openstackgerrit has joined #openstack-barbican | 10:09 | |
| *** darrenmoffat has quit IRC | 11:55 | |
| *** darrenmoffat has joined #openstack-barbican | 11:55 | |
| *** zz_dimtruck is now known as dimtruck | 12:06 | |
| *** kfarr_ has joined #openstack-barbican | 12:29 | |
| *** woodster_ has quit IRC | 12:32 | |
| *** dimtruck is now known as zz_dimtruck | 12:33 | |
| *** kfarr_ has quit IRC | 12:43 | |
| *** kfarr has joined #openstack-barbican | 12:43 | |
| *** dave-mccowan has joined #openstack-barbican | 12:53 | |
| *** rellerreller has joined #openstack-barbican | 13:23 | |
| *** alee has joined #openstack-barbican | 13:24 | |
| alee | jaosorior, morning | 13:31 |
|---|---|---|
| jaosorior | alee: hey man | 13:31 |
| jaosorior | how's it going? | 13:31 |
| alee | jaosorior, good -- working from the New York office for the next couple of weeks | 13:31 |
| alee | jaosorior, its pretty nice, albeit a little noiser than home | 13:31 |
| jaosorior | not bad! I've never been there | 13:32 |
| alee | jaosorior, Its a great city - although this will be the first time I'm there with the kids | 13:32 |
| alee | (part of our annual "vacation") | 13:33 |
| alee | jaosorior, I was looking at the dogtag gate job | 13:33 |
| jaosorior | Did you look at the section of the log I pointed out last week? | 13:34 |
| alee | it looks like for some reason the nss db is created for the alias-ca directory but not for the alias directory | 13:34 |
| jaosorior | yup, even though we do the mkdir for the alias directory | 13:35 |
| *** woodster_ has joined #openstack-barbican | 13:35 | |
| alee | do we do a mkdir for the alias-ca directory? | 13:35 |
| jaosorior | No, it just works | 13:35 |
| alee | weird -- looking at the plugin code .. | 13:36 |
| jaosorior | Now, I did try to specify them both to be in the same alias directory... but that caused some other error in the installation that I couldn't identify from the logs | 13:36 |
| alee | jaosorior, I wonder if we can just create the initial nssdb in the alias directory | 13:37 |
| jaosorior | I guess that could be possible. But we would still not know what the issue actually is. Which would be nice to either get fixed or at least documented | 13:39 |
| alee | jaosorior, ok - so creating the alias db is probably the wrong thing to do in this case because of this code .. | 13:39 |
| alee | if not os.path.exists(nss_db_path): | 13:40 |
| alee | create_nss_db = True | 13:40 |
| alee | cryptoutil.NSSCryptoProvider.setup_database( | 13:40 |
| alee | nss_db_path, nss_password, over_write=True) | 13:40 |
| alee | so --- if we do create the alias directory, we must also create the nssdb | 13:40 |
| jaosorior | Alright | 13:40 |
| jaosorior | I'll remove the mkdir for the alias directory to try and figure out why it's not setting up the database | 13:41 |
| alee | and then you also have to import the transport key | 13:41 |
| alee | so yeah -- lets remove the mkdir | 13:41 |
| alee | and leave the debugging stuff in there to see whats going on | 13:42 |
| jaosorior | uhm.... would it be that the barbican process doesn't have permissions to create a directory in that path? | 13:42 |
| alee | well it created the alias_ca directory, right? | 13:43 |
| jaosorior | true | 13:43 |
| jaosorior | is there anything different in the creation of that one? | 13:43 |
| alee | no | 13:43 |
| jaosorior | damn | 13:43 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag https://review.openstack.org/185181 | 13:44 |
| alee | now - it is true that for the alias dir , we also import the transport cert | 13:44 |
| alee | so maybe something is failing there | 13:44 |
| alee | I guess this run will tell us | 13:44 |
| jaosorior | where in the code is the import of the transport cert | 13:46 |
| jaosorior | ? | 13:46 |
| alee | plugin/dogtag.py | 13:46 |
| alee | line 158 | 13:46 |
| alee | dont forget to check experimental | 13:46 |
| *** zz_dimtruck is now known as dimtruck | 13:48 | |
| alee | jaosorior, if this doesn't work, we can print out the kra logs -- thats where the transport cert comes from | 13:49 |
| alee | and also modify things in make the import more explicit | 13:50 |
| alee | lets seee what the log says | 13:50 |
| alee | jaosorior, interesting .. | 13:51 |
| jaosorior | alee: what? | 13:51 |
| alee | jaosorior, so looking at the output you had | 13:51 |
| alee | the owner of the certdb files is stack | 13:52 |
| alee | would barbican be running as "stack" or as barbican? | 13:53 |
| jaosorior | uhm... I think it will be stack. Why? | 13:53 |
| alee | just as long as whoever creates the certdb is the user that runs barbican | 13:54 |
| alee | as long as both is stack | 13:54 |
| *** insequent has joined #openstack-barbican | 14:05 | |
| *** pglass has joined #openstack-barbican | 14:12 | |
| alee | jaosorior, looks like the certdb is created and the transport cert is imported | 14:12 |
| alee | jaosorior, looking at logs | 14:12 |
| jaosorior | alee: http://logs.openstack.org/81/185181/18/experimental/gate-barbican-dogtag-devstack-dsvm-f21/56fbc96/console.html#_2015-06-08_14_08_40_812 | 14:17 |
| alee | jaosorior, right -- if you notice - the KRA transport cert has been imported. | 14:18 |
| alee | the code looks like this .. | 14:19 |
| alee | if create_nss_db: | 14:21 |
| alee | self.import_transport_cert(crypto) | 14:21 |
| alee | crypto.initialize() | 14:21 |
| alee | self.keyclient.set_transport_cert( | 14:21 |
| alee | DogtagKRAPlugin.TRANSPORT_NICK) | 14:21 |
| alee | so it imports the transport cert correctly | 14:21 |
| alee | and then tries to get the cert it just imported | 14:21 |
| alee | and puts it in the crypto object | 14:22 |
| alee | that call set_transport_cert() is failing .. | 14:22 |
| alee | why? why? !!! | 14:22 |
| *** Kevin_Bishop has joined #openstack-barbican | 14:25 | |
| jaosorior | yeah... it's that weird issue (SEC_ERROR_BAD_DATABASE) security library: bad database. | 14:26 |
| jaosorior | where's the code for that pki package? | 14:26 |
| alee | jaosorior, well - thats in dogtag code, let me get a link .. | 14:27 |
| alee | jaosorior, https://git.fedorahosted.org/cgit/pki.git/tree/base/common/python/pki/key.py?h=DOGTAG_10_2_1_BRANCH#n441 | 14:33 |
| alee | jaosorior, which calls https://git.fedorahosted.org/cgit/pki.git/tree/base/common/python/pki/crypto.py?h=DOGTAG_10_2_1_BRANCH#n281 | 14:35 |
| alee | which calls nss.find_cert_from_nickname(cert_nick) | 14:35 |
| alee | which is in python-nss | 14:35 |
| *** stanzi has joined #openstack-barbican | 14:37 | |
| jaosorior | ok | 14:38 |
| jaosorior | so, it tries to fetch that cert... where should that cert be set up in the first place? | 14:38 |
| *** jamielennox is now known as jamielennox|away | 14:38 | |
| alee | in the certdb which we just created | 14:38 |
| alee | and which we see actually contains the cert | 14:39 |
| jaosorior | I see | 14:41 |
| *** stanzi has quit IRC | 14:41 | |
| jaosorior | well, crap | 14:41 |
| alee | jaosorior, talking with someone else on this -- maybe join #dogtag-pki | 14:42 |
| jaosorior | Well, I need to go for a couple of hours | 14:42 |
| jaosorior | but I'll check out if there was any news when I'm back | 14:42 |
| *** xaeth_afk is now known as xaeth | 14:55 | |
| openstackgerrit | John Wood proposed openstack/barbican-specs: Add a No Prior Key Certificate Order Type https://review.openstack.org/155891 | 14:56 |
| *** nkinder has joined #openstack-barbican | 15:02 | |
| openstackgerrit | John Wood proposed openstack/barbican-specs: Add a No Prior Key Certificate Order Type https://review.openstack.org/155891 | 15:04 |
| *** xaeth is now known as xaeth_afk | 15:05 | |
| rellerreller | So do the normal unit tests run with `tox` require devstack to be running now? | 15:08 |
| rellerreller | What is the deal with cfg now? chellygel I saw your comment on that, but I did not know what that meant or what to do. | 15:09 |
| *** xaeth_afk is now known as xaeth | 15:13 | |
| therve | rellerreller, Why do you say that? | 15:16 |
| rellerreller | therve say which part? | 15:17 |
| rellerreller | The part about the unit tests or CFG? | 15:17 |
| therve | reaperhulk, unit tests | 15:17 |
| therve | Uh rellerreller sorry | 15:18 |
| rellerreller | therve because my unit tests were failing, lots of them, and they were complaining about not gettting the right response from http://localhost/secrets or something similar. | 15:18 |
| rellerreller | So I invoked devstack to run and now my unit tests are passing, except for the CFG issue now. | 15:19 |
| therve | rellerreller, I don't think that's expected | 15:19 |
| therve | At least that works for me on master | 15:20 |
| rellerreller | therve That's not good. I wonder if I did something wrong, but that was the first time that I have been able to run them. | 15:20 |
| rellerreller | therve You mean you can run without devstack on master? | 15:21 |
| therve | rellerreller, Yes | 15:21 |
| rellerreller | therve What is happening to me then :( | 15:21 |
| *** kebray has joined #openstack-barbican | 15:21 | |
| rellerreller | I'll try to rebase again and see what happens. | 15:22 |
| chellygel | hey rellerreller ! i was referring to the change that Kevin_Bishop made to centralize our configs | 15:22 |
| chellygel | one sec i'll pull it up | 15:22 |
| therve | rellerreller, What's your patch? Did you try master? | 15:22 |
| rellerreller | therve My patch is the pkcs1_config option. I rebased on Friday from the latest from master. That was the last rebase. I have not tried a straight run of master yet. The tests take a long time for me now, many minutes. | 15:23 |
| rellerreller | therve I'm going to rebase and try again. | 15:24 |
| kfarr | chellygel rellerreller https://review.openstack.org/#/c/187297/ | 15:25 |
| kfarr | ^^ Kevin_Bishop 's change | 15:26 |
| elmiko | rellerreller: hey, can i bug you about the ManagedObject stuff for castellan? | 15:27 |
| rellerreller | elmiko sure that's not a problem | 15:27 |
| Kevin_Bishop | rellerreller, yeah so we now create our own global CONF object in config.py instead of using the one found in the cfg module | 15:27 |
| Kevin_Bishop | rellerreller I had to change some of the base barbican unit tests in that patch, so maybe seeing those changes will help? | 15:28 |
| elmiko | rellerreller: so, i appreciate the help on the sahara spec. i'm gonna update to talk about the passpharse key and remove our key. but i'm curious how is a user supposed to extend the key mechanism, i thought the Key abs was supposed to be the contract for those objects? | 15:28 |
| chellygel | rellerreller, i didn't intend for you to have to add it to that change, just as a separate one | 15:28 |
| rellerreller | Kevin_Bishop Thanks. I'll take a look at the changes. | 15:28 |
| Kevin_Bishop | rellerreller Yeah no problem | 15:29 |
| chellygel | in the future | 15:29 |
| chellygel | eventually | 15:29 |
| chellygel | lol | 15:29 |
| *** SheenaG has joined #openstack-barbican | 15:29 | |
| rellerreller | elmiko I'm not sure that I understand the question. Which aspect are you trying to extend the Key or KeyManager hierarchy? | 15:32 |
| *** jsavak has joined #openstack-barbican | 15:33 | |
| elmiko | rellerreller: well, i'm just talking about how i implemented the SaharaKey, but it sounded like from your last comment that it won't be sufficient to pass into another KeyManager. | 15:33 |
| elmiko | for example, | 15:33 |
| elmiko | BarbicanKeyManager wouldn't accept a SaharaKey | 15:34 |
| elmiko | i thought the Key abc was the contract for those objects? | 15:34 |
| *** kfarr-mobile has joined #openstack-barbican | 15:34 | |
| rellerreller | elmiko That is true. We could always extend ManagedObject to support another type of managed. We would just need to make sure that all possible implementations would support that managed object type. | 15:34 |
| rellerreller | elmiko What do you mean by contract? | 15:35 |
| rellerreller | elmiko The ManagedObject hierarchy simply provides an interface for the KeyManager implemenations to pull out the necessary information to store the object. | 15:35 |
| elmiko | rellerreller: i thought those abc's defined the interface for creating objects, so as long as my object implements those methods it would be accepted. that's all i meant by contract | 15:36 |
| therve | rellerreller, The tests work fine on your patch for me. Except that tests failure because of the cfg import | 15:36 |
| elmiko | rellerreller: i guess i'll need to see the ManagedObject stuff to understand it better. | 15:36 |
| *** gyee_ has joined #openstack-barbican | 15:36 | |
| rellerreller | elmiko For example, the KMIP implementation will need to map a SymmetricKey to a KMIPSymmetricKey object. This means getting the algorithm, bit length, and key value from the object. | 15:37 |
| therve | rellerreller, It's possible something weirds happen if you have a /etc/barbican directory in your machine? | 15:37 |
| elmiko | rellerreller: makes sense | 15:37 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Documentation for PKCS11 Key Generation script https://review.openstack.org/187367 | 15:37 |
| redrobot | elmiko why are you extending the Key? I thought the goal of Castellan was to be able to use objects as is. | 15:38 |
| rellerreller | elmiko I guess if your object extended one of the ManagedObjects then it would be ok. I'm not sure of the benefit at that point because none of the implementations would know how to parse SaharaKey. | 15:38 |
| *** kfarr-mobile has quit IRC | 15:39 | |
| rellerreller | elmiko The implementations would only use the information found in the parent class, which is passphrase or symmetric key I do not remember which. | 15:39 |
| elmiko | redrobot: i had started to create a local version of Key for out project since none existed yet | 15:39 |
| redrobot | I think it would be hard to make Castellan return a SaharaKey back to you. | 15:39 |
| rellerreller | elmiko was that message for me? | 15:39 |
| elmiko | rellerreller: this discussion is a little academic because i agree with your assessment about using the Passphrase, but i'm trying to better understand the system | 15:40 |
| elmiko | redrobot: agreed, and it doesn't need to | 15:40 |
| elmiko | we will still be accessing the payload through the get_encoded method, i'm assuming that will stay consistent through all the Key impls | 15:41 |
| rellerreller | elmiko Yes, all of the managed objects will have a means to get the payload or raw bytes. | 15:42 |
| elmiko | rellerreller: i guess, i'm trying to understand if the interface defined by the Key abc will be valid for all keys returned from castellan | 15:42 |
| elmiko | ok | 15:42 |
| rellerreller | elmiko Did I help you understand the system better or worse? What parts are still not clear? | 15:43 |
| elmiko | rellerreller: i think better, i'd like to take a look at the ManagedObject stuff when it's ready. that would cement things for me. | 15:43 |
| rellerreller | elmiko OK. kfarr is working on that. She has some ascii art out there on an etherpad page. | 15:43 |
| kfarr | elmiko, I can be sure to add you to the MR when it's up! | 15:44 |
| elmiko | kfarr: thanks! | 15:44 |
| redrobot | elmiko rellerreller https://etherpad.openstack.org/p/Castellan-fishbowl-L-summit | 15:44 |
| elmiko | redrobot: ok yea, i remember that pad. thanks for the link =) | 15:44 |
| rellerreller | @redrobot Thanks! I was just looking for that. | 15:44 |
| rellerreller | elmiko All of them will have a 'bytes' property. That will return what most people call the payload. The term payload scares me a little because that makes me think of an attacker's payload :) | 15:46 |
| elmiko | hehe | 15:46 |
| rellerreller | elmiko The encoded property defines how the key is encoded. This is like our content type problem. This will be something like PKCS#8, PKCS#1, etc. | 15:47 |
| elmiko | rellerreller: ok, sounds like i'm just moving a little too quickly on our implementation. i was hoping that any Key descended object could be used with any KeyManager descended object | 15:47 |
| elmiko | rellerreller: right, and in our case we don't really use the algorithm stuff, so our key is most like the Passphrase, just a clear text pw or something | 15:47 |
| rellerreller | elmiko It's more like the KeyManagers are really only interested in the ManagedObject types that we define on the graph. A subclass is fine, but the extra information will not be gauranteed to be used by all KeyManager implementations. | 15:48 |
| rellerreller | elmiko right | 15:48 |
| rellerreller | therve My tests just passed for master branch without devstack. I blame my troubles on a 5 month old that is interested in sticking her fingers in my eyes. | 15:49 |
| elmiko | rellerreller: yea, and we wouldn't be adding extra information to the class. which is why i think we could consume whatever object was returned from a KeyManager, be it SaharaKeyManager, BarbicanKeyManager, or something else, so long as we could access those common methods from the Key (ManagedObject?) returned from a retrieval operation. | 15:50 |
| therve | rellerreller, You didn't let here finish the fix! :) | 15:50 |
| rellerreller | elmiko I agree. | 15:52 |
| elmiko | rellerreller: great, then i can count on your +1 ;) j/k | 15:53 |
| rellerreller | elmiko I will have kfarr include you on the review for the change to update the ManagedObject hierarchy. Then you can verify that the classes have all of the information you want. | 15:53 |
| elmiko | rellerreller: cool, i don't think it will be an issue in our use case. i'm just moving too fast with our stuff. | 15:53 |
| rellerreller | elmiko Do you have an update? | 15:53 |
| elmiko | rellerreller: not yet, i needed to ask a few questions first =) | 15:54 |
| rellerreller | elmiko gotcha | 15:54 |
| elmiko | rellerreller: i'm gonna cycle our plans out a little further in to Liberty to ensure better coordination with castellan progress | 15:54 |
| elmiko | rellerreller: i also have a proposal for castellan configs that kfarr and i talked about at summit, i'll focus on some of that stuff in the meantime. | 15:55 |
| rellerreller | elmiko Sounds good. I'll have kfarr give an update on our timeline. Hopefully that will still work for you. | 15:55 |
| *** nickrmc83 has quit IRC | 16:02 | |
| woodster_ | alee: chellygel I added comments to the reissue bp CR here: https://review.openstack.org/#/c/155931 Please let me know if my comments make sense though | 16:08 |
| chellygel | will take a look :) | 16:10 |
| openstackgerrit | Nathan Reller proposed openstack/barbican: Added pkcs1_only Configuration to KMIP https://review.openstack.org/182461 | 16:16 |
| *** stanzi has joined #openstack-barbican | 16:23 | |
| *** stanzi has quit IRC | 16:23 | |
| *** stanzi has joined #openstack-barbican | 16:24 | |
| alee | woodster_, will take a look -- feel free to review https://review.openstack.org/186771 or https://review.openstack.org/187236 or https://review.openstack.org/127823 or https://review.openstack.org/187308 ") | 16:30 |
| woodster_ | alee: will do | 16:31 |
| elmiko | rellerreller: ok, now that i've looked at the diagrams again the ManagedObject makes more sense. looks like *if* we needed our own key type we would just implement a ManagedObject for it. i'm still guessing we will just wait for the Passphrase though. | 16:35 |
| *** kebray has quit IRC | 16:42 | |
| *** HoloIRCUser2 has joined #openstack-barbican | 16:54 | |
| *** HoloIRCUser3 has joined #openstack-barbican | 16:54 | |
| *** stanzi has quit IRC | 16:55 | |
| *** HoloIRCUser2 has quit IRC | 16:58 | |
| *** pglass has quit IRC | 17:00 | |
| *** HoloIRCUser3 has quit IRC | 17:00 | |
| *** pglass has joined #openstack-barbican | 17:04 | |
| alee | redrobot, I'm trying to run latest master and see this: | 17:04 |
| alee | ValueError: Unknown remainder ['g2fbc7f6'] in '2015.2.dev91.g2fbc7f6' | 17:04 |
| alee | anyone know whats going on? | 17:04 |
| alee | woodster_, elmiko you seeing this when you run tox on master ? ^^ | 17:06 |
| elmiko | alee: i was seeing that yesterday | 17:06 |
| elmiko | haven't tried again today | 17:06 |
| alee | elmiko, ah - I was hhoping you'd say you fixed it | 17:06 |
| elmiko | LOL | 17:06 |
| alee | redrobot, jvrbanac woodster_ ^^? | 17:07 |
| elmiko | alee: i kept seeing it when trying to run database upgrades, but then it went away when i started with a fresh db | 17:07 |
| alee | elmiko, hmm .. let me try remove my db | 17:08 |
| alee | elmiko, no - same problem | 17:09 |
| elmiko | dang | 17:09 |
| alee | at least running tox | 17:09 |
| elmiko | i'm running tox now, just to confirm | 17:09 |
| alee | redrobot, special tox cleanup command needed? | 17:10 |
| alee | elmiko, oh wait ,,, | 17:10 |
| alee | elmiko, nm - I think I'm an idiot -- confirming .. | 17:11 |
| elmiko | alee: ok, i'm getting green on tox | 17:13 |
| rellerreller | chellygel woodster_ jvrbanac I updated my pkcs1_only patch to avoid the merge conflicts, https://review.openstack.org/182461 | 17:16 |
| *** erw has left #openstack-barbican | 17:16 | |
| alee | elmiko, I forgot to set my pyenv environment. so not surprising it did not work -- its taking a lot longer now to recreate the envrionment | 17:21 |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Fix http 500 when no accept header passed to secret GET /payload https://review.openstack.org/189048 | 17:21 |
| elmiko | alee: doh! | 17:22 |
| alee | elmiko, yeah .. me be an idjit .. | 17:22 |
| elmiko | lol | 17:23 |
| *** stanzi has joined #openstack-barbican | 17:26 | |
| jaosorior | alee | 17:33 |
| jaosorior | ping | 17:33 |
| alee | jaosorior, yo | 17:33 |
| alee | jaosorior, I think I need to change the way we handle certdb in the dogtag plugin | 17:34 |
| jaosorior | alee: I kinda read what the dude said in the dogtag-pki chat | 17:34 |
| jaosorior | So what are you gonna do? a singleton class for the db? | 17:34 |
| alee | jaosorior, yeah - I have a patch and am trying to test it out , but my machine is a lillte borked right now | 17:34 |
| *** stanzi has quit IRC | 17:34 | |
| alee | jaosorior, let me send /post what I was thinking about for a patch ... | 17:35 |
| jaosorior | sure | 17:35 |
| alee | jaosorior, I guess I'll just pop a quick review to gerrit | 17:36 |
| jaosorior | alright | 17:37 |
| jaosorior | I'll go fetch some dinner and will check it out in a bit | 17:38 |
| openstackgerrit | Ade Lee proposed openstack/barbican: Changes to fix dogtag nss db handling - TESTING DO NOT MERGE https://review.openstack.org/189379 | 17:39 |
| alee | jaosorior, there it is . | 17:39 |
| *** rellerreller_ has joined #openstack-barbican | 17:49 | |
| *** alee is now known as alee_lunch | 17:51 | |
| *** rellerreller has quit IRC | 17:52 | |
| *** gyee_ has quit IRC | 17:57 | |
| *** rellerreller_ has quit IRC | 18:01 | |
| *** stanzi has joined #openstack-barbican | 18:01 | |
| *** rellerreller has joined #openstack-barbican | 18:02 | |
| *** stanzi has quit IRC | 18:08 | |
| *** stanzi has joined #openstack-barbican | 18:08 | |
| *** openstackgerrit has quit IRC | 18:09 | |
| *** openstackgerrit has joined #openstack-barbican | 18:09 | |
| *** rellerreller has quit IRC | 18:23 | |
| *** rellerreller has joined #openstack-barbican | 18:28 | |
| *** SheenaG has quit IRC | 18:28 | |
| *** pglass has quit IRC | 18:29 | |
| *** SheenaG has joined #openstack-barbican | 18:30 | |
| *** pglass has joined #openstack-barbican | 18:30 | |
| *** stanzi has quit IRC | 18:32 | |
| *** xaeth is now known as xaeth_afk | 18:37 | |
| *** alee_lunch is now known as alee | 18:39 | |
| *** stanzi has joined #openstack-barbican | 18:41 | |
| *** insequent has quit IRC | 18:45 | |
| *** xaeth_afk is now known as xaeth | 18:47 | |
| *** jsavak has quit IRC | 18:48 | |
| *** insequent has joined #openstack-barbican | 19:00 | |
| *** xaeth is now known as xaeth_afk | 19:02 | |
| *** xaeth_afk is now known as xaeth | 19:10 | |
| jaosorior | alee: any updates? | 19:24 |
| alee | jaosorior, did you see my CR? | 19:25 |
| jaosorior | I did | 19:25 |
| alee | for some reason, on my machine right now - my tox tests are failing | 19:26 |
| alee | even without my change | 19:26 |
| jaosorior | whaa | 19:26 |
| jaosorior | ok, let me check that out | 19:26 |
| alee | getting SecretStorePluginNotConfigured | 19:26 |
| jaosorior | is that from the functional tests? | 19:27 |
| alee | jaosorior, no just normal unit tests | 19:27 |
| alee | just running tox | 19:27 |
| jaosorior | running | 19:27 |
| alee | jaosorior, jvrbanac what does the tox run point to for barbican-api.conf? | 19:28 |
| jvrbanac | alee, rebuild your tox environment | 19:28 |
| alee | jvrbanac, I did -- I did tox -r | 19:28 |
| jaosorior | tox -r | 19:28 |
| alee | same error | 19:28 |
| jaosorior | uhm, I'm rebuilding it too | 19:28 |
| jvrbanac | alee, is this on trunk | 19:28 |
| jvrbanac | ? | 19:28 |
| alee | jvrbanac, yes | 19:29 |
| alee | jaosorior, did you get this too> | 19:29 |
| alee | ? | 19:29 |
| jvrbanac | alee, I saw something like that over the weekend, so I just rebuild everything (including the db) | 19:29 |
| *** stanzi has quit IRC | 19:30 | |
| alee | jaosorior, jvrbanac well I blew away my db | 19:30 |
| alee | trying tox -r again | 19:31 |
| jaosorior | running still | 19:31 |
| alee | jaosorior, anyways -- maybe you can take the changes I put in my patch and try that against the dogtag gate | 19:32 |
| *** rellerreller has quit IRC | 19:32 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add RBAC tests for orders https://review.openstack.org/189411 | 19:32 |
| jaosorior | well, I could grab your commit and squash it with mine | 19:33 |
| *** stanzi has joined #openstack-barbican | 19:33 | |
| alee | jaosorior, sure | 19:34 |
| *** rellerreller has joined #openstack-barbican | 19:34 | |
| alee | jaosorior, its in different files in any case | 19:35 |
| jaosorior | tox passes in my machine | 19:35 |
| alee | jaosorior, or we can get your commit checked in --- its clearly trying at least to execute the dogtag code | 19:36 |
| alee | jaosorior, and then attempt my commit against the dogtag gate | 19:36 |
| alee | jaosorior, your choice -- I'm hoping this latest tox -r will fix things for me so I can test locally | 19:37 |
| rellerreller | alee I keep getting this error "webtest.app.AppError: Bad response: 500 Internal Server Error (not 200 OK or 3xx redirect for http://localhost/secrets/)" while testing. Is that similar to your error? | 19:38 |
| alee | rellerreller, yup | 19:38 |
| rellerreller | alee I have been getting that error since Friday. | 19:39 |
| alee | if you look at stack trace you see SecretStorePluginNotConfigred I think | 19:39 |
| rellerreller | alee This morning I tried running tests and they worked. Now once again they are failing. I'm not sure what is happening. | 19:39 |
| alee | rellerreller, ok good to know I'm not totally crazy | 19:40 |
| rellerreller | alee me too. therve probably thought I was crazy because I brought it up to him, and he said everything was fine. So I reran and it worked. | 19:41 |
| *** stanzi has quit IRC | 19:41 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag https://review.openstack.org/185181 | 19:41 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Changes to fix dogtag nss db handling - TESTING DO NOT MERGE https://review.openstack.org/189379 | 19:41 |
| jaosorior | aleeL I made your commit dependant on mine | 19:41 |
| alee | jaosorior, ok | 19:41 |
| alee | jaosorior, dont forget to check experimental | 19:42 |
| alee | rellerreller, yeah - I still see the error | 19:42 |
| jaosorior | well, I did a check experimental on your commit instead of mine. Since I guess that's what we want to see | 19:43 |
| alee | jvrbanac, do you see it | 19:43 |
| alee | jaosorior, yes | 19:43 |
| alee | jaosorior, I'm assuming it will apply your changes? | 19:43 |
| alee | seeing as they are dependent? | 19:43 |
| jaosorior | yup | 19:43 |
| jvrbanac | alee, I don't see the problem on just plain trunk | 19:44 |
| jaosorior | well... I haven't updated my system in a while | 19:45 |
| jaosorior | maybe that makes a difference | 19:45 |
| rellerreller | alee I think I may have something for you to fix your tests. | 19:46 |
| rellerreller | alee I did this and it worked for me but not sure why. Kill your tests. Start a devstack instance and then rerun `tox` after devstack is created. | 19:46 |
| rellerreller | alee I did that this morning and this fixed my issue. I just tried it again and it works as well. | 19:47 |
| alee | rellerreller, thats a little screwy | 19:48 |
| rellerreller | alee Tell me about it, but my tests are not blowing up now :) | 19:48 |
| *** igueths has joined #openstack-barbican | 19:48 | |
| alee | rellerreller, I try not to run a devstack instance on my main dev box ... tends to mess things up .. | 19:49 |
| rellerreller | alee After the first run you do not need devstack to be running. The best theory I have now is that devstack blows away db and then recreates it. | 19:49 |
| alee | rellerreller, the db is /var/lib/barbican/barbican.sqlite right? | 19:50 |
| rellerreller | alee I do not know. | 19:50 |
| *** stanzi has joined #openstack-barbican | 19:50 | |
| rellerreller | alee I have not messed with the db stuff much at all. | 19:50 |
| rellerreller | alee I actually thought the unit tests were supposed to have an in-memory db. That would kill my theory, but I do not know what else devstack would do to change my environment and get my tests running. | 19:53 |
| alee | rellerreller, maybe some environment variable change? | 19:54 |
| *** kfarr has left #openstack-barbican | 19:54 | |
| redrobot | Weekly meeting starts in 5 minutes on #openstack-meeting-alt | 19:54 |
| *** stanzi has quit IRC | 19:59 | |
| *** dave-mcc_ has joined #openstack-barbican | 19:59 | |
| jaosorior | alee, rellerreller: after updating I now get an error while running tox | 20:00 |
| alee | jaosorior, when I run on an old tree, I have no issues | 20:01 |
| alee | jaosorior, so some recent checkin .. | 20:02 |
| jaosorior | I had no issues until I updated a LOT of packages from my system | 20:02 |
| *** kfarr has joined #openstack-barbican | 20:02 | |
| jaosorior | so I'm running the same hash from master. But something is messing things up | 20:02 |
| *** dave-mccowan has quit IRC | 20:02 | |
| *** kebray has joined #openstack-barbican | 20:03 | |
| jaosorior | yeah, mostly related to the database | 20:03 |
| *** kfarr_ has joined #openstack-barbican | 20:04 | |
| *** kfarr has quit IRC | 20:07 | |
| *** xaeth is now known as xaeth_afk | 20:32 | |
| jaosorior | well... removing /var/lib/barbican/barbican.sqlite didn't work for me :/ | 20:34 |
| *** rellerreller has quit IRC | 20:35 | |
| jaosorior | by the way, alee: http://logs.openstack.org/79/189379/2/experimental/gate-barbican-dogtag-devstack-dsvm-f21/22f244a/logs/screen-barbican.txt.gz#_2015-06-08_20_10_47_071 | 20:35 |
| alee | jaosorior, phooey | 20:36 |
| openstackgerrit | Amy Marrich proposed openstack/barbican: Changes the naming convention for Barbican config files to be more consistent with other OpenStack projects. https://review.openstack.org/189434 | 20:37 |
| openstackgerrit | Amy Marrich proposed openstack/barbican: Changes the naming convention for Barbican config files to be more consistent with other OpenStack projects. https://review.openstack.org/189434 | 20:37 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Changes to fix dogtag nss db handling - TESTING DO NOT MERGE https://review.openstack.org/189379 | 20:38 |
| alee | jaosorior, you fixed the error reporting? | 20:38 |
| openstackgerrit | Amy Marrich proposed openstack/barbican: Changes naming convention for Barbican config files to be more consistent https://review.openstack.org/189434 | 20:38 |
| jaosorior | alee: yeah. Casted the exception into string | 20:38 |
| alee | jaosorior, check experimental | 20:38 |
| jaosorior | I did | 20:38 |
| jaosorior | buy anyway, after updating my system now I can't run tox :/ | 20:39 |
| jaosorior | so some python library was updated that now breaks the tox tests | 20:39 |
| alee | yeah | 20:39 |
| jaosorior | probably even tox | 20:39 |
| jaosorior | maybe people using Ubuntu will not see this in a bit, since they get updates...well...slower than the rest | 20:40 |
| alee | jaosorior, I did find that when I run tox on an older tree , it passes | 20:41 |
| openstackgerrit | Amy Marrich proposed openstack/barbican: Changes naming convention for Barbican config files for consistency https://review.openstack.org/189434 | 20:41 |
| jaosorior | alee: which is weird, since with the newest tree it used to pass for me, until I updated my box | 20:41 |
| *** xaeth_afk is now known as xaeth | 20:42 | |
| alee | jaosorior, whats the error you are seeing? | 20:42 |
| openstackgerrit | Amy Marrich proposed openstack/barbican: Change naming convention for Barbican config files https://review.openstack.org/189434 | 20:44 |
| *** kfarr_ has quit IRC | 20:45 | |
| *** stanzi has joined #openstack-barbican | 20:47 | |
| *** stanzi has joined #openstack-barbican | 20:47 | |
| alee | jaosorior, still there? | 20:48 |
| jaosorior | alee: yup, redirecting error to a file so I can post the exact errors...since there are many | 20:48 |
| *** alee has quit IRC | 20:48 | |
| *** alee has joined #openstack-barbican | 20:49 | |
| *** dave-mccowan has joined #openstack-barbican | 20:50 | |
| *** dave-mcc_ has quit IRC | 20:50 | |
| jaosorior | soooo, errors are here: http://pastebin.com/GERZNtNb | 20:53 |
| redrobot | jaosorior alee I'm going to blow away my env and see if I can recreate | 20:56 |
| *** xaeth is now known as xaeth_afk | 20:56 | |
| elmiko | did you guys try completely cleaning the barbican dir? | 20:56 |
| alee | elmiko, you mean brand new checkout? | 20:57 |
| alee | elmiko, no -- let me try that | 20:57 |
| elmiko | alee: i suppose you could go that far, but `git clean -fXd` i think would do the trick | 20:57 |
| elmiko | then `tox -r` | 20:57 |
| alee | let me try that | 20:58 |
| elmiko | i'm getting success off master, only a few pyflakes complaints from some old build dir stuff | 20:58 |
| elmiko | alee: actually, `git clean -fxd` sorry | 20:58 |
| alee | elmiko, trying- - the tox -r takes awhile | 20:59 |
| woodster_ | make sure you pip install -U -r requirements.txt and pip install -U -r test-requirements.txt too | 21:01 |
| *** xaeth_afk is now known as xaeth | 21:04 | |
| *** nkinder_ has joined #openstack-barbican | 21:05 | |
| *** dave-mcc_ has joined #openstack-barbican | 21:06 | |
| alee | waiting for this to complete is like watching paint dry .. | 21:09 |
| *** nkinder has quit IRC | 21:09 | |
| *** dave-mccowan has quit IRC | 21:10 | |
| woodster_ | same error for me :\ | 21:10 |
| *** nkinder_ has quit IRC | 21:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/189454 | 21:12 |
| *** nkinder_ has joined #openstack-barbican | 21:13 | |
| woodster_ | alee, might need to do 'pip install -e .' again...that fixed someone else over here...thanks for the reminder redrobot | 21:13 |
| alee | woodster_, seeing if that makes a difference | 21:15 |
| alee | trying tox -r again -- I ran into No module named functools32 for some reason | 21:16 |
| alee | but its there .. | 21:16 |
| jaosorior | alee: ??? | 21:17 |
| alee | back in a sec .. | 21:18 |
| woodster_ | alee, jaosorior can one of you workflow this?: https://review.openstack.org/#/c/188208/ | 21:21 |
| jaosorior | woodster_: Does it work in postgres? | 21:22 |
| *** gyee_ has joined #openstack-barbican | 21:22 | |
| *** kebray has quit IRC | 21:24 | |
| *** nkinder_ has quit IRC | 21:26 | |
| alee | ok - so after clearing all out and doing tox -r , I'm getting "ImportError: No module named functools32" | 21:27 |
| *** nkinder_ has joined #openstack-barbican | 21:27 | |
| elmiko | oh man... | 21:27 |
| alee | why do I feel like I'm going backwards | 21:27 |
| alee | ? | 21:27 |
| *** stanzi has quit IRC | 21:37 | |
| *** stanzi has joined #openstack-barbican | 21:42 | |
| *** stanzi has quit IRC | 21:46 | |
| woodster_ | jaosorior: igueths was able to verify it worked in postgres | 21:50 |
| *** SheenaG has quit IRC | 21:51 | |
| *** SheenaG has joined #openstack-barbican | 21:53 | |
| *** nkinder__ has joined #openstack-barbican | 21:58 | |
| *** SheenaG has quit IRC | 22:01 | |
| *** Kevin_Bishop has quit IRC | 22:02 | |
| *** nkinder_ has quit IRC | 22:02 | |
| *** nkinder__ has quit IRC | 22:03 | |
| *** nkinder__ has joined #openstack-barbican | 22:04 | |
| woodster_ | chellygel: were you looking for reaperhulk to workflow your CR?: https://review.openstack.org/#/c/187367 | 22:12 |
| *** pglass has quit IRC | 22:14 | |
| reaperhulk | will read those docs as soon as I get back | 22:15 |
| chellygel | woodster_, no -- the actual script i wished for him to review; however it was merged | 22:15 |
| *** dave-mccowan has joined #openstack-barbican | 22:15 | |
| chellygel | the docs are just providing feedback for the script thats already there | 22:15 |
| chellygel | reaperhulk, if you coculd review the script, i'd be happy to make changes and upload | 22:16 |
| woodster_ | chellygel: cool | 22:16 |
| *** dave-mcc_ has quit IRC | 22:18 | |
| *** xaeth is now known as xaeth_afk | 22:27 | |
| *** igueths has quit IRC | 22:33 | |
| *** xaeth_afk is now known as xaeth | 22:36 | |
| reaperhulk | chellygel: I think the script looked good? I remember only one little comment and you and I talked about that already | 22:37 |
| chellygel | yep, that is what i assumed :) | 22:39 |
| openstackgerrit | Merged openstack/barbican: Documentation for PKCS11 Key Generation script https://review.openstack.org/187367 | 22:45 |
| *** SheenaG has joined #openstack-barbican | 22:52 | |
| *** dimtruck is now known as zz_dimtruck | 23:17 | |
| *** alee has quit IRC | 23:18 | |
| *** nkinder__ has quit IRC | 23:18 | |
| *** alee has joined #openstack-barbican | 23:21 | |
| *** dave-mcc_ has joined #openstack-barbican | 23:23 | |
| *** alee has quit IRC | 23:24 | |
| *** dave-mccowan has quit IRC | 23:26 | |
| *** xaeth is now known as xaeth_afk | 23:27 | |
| *** jaosorior has quit IRC | 23:31 | |
| *** chlong has joined #openstack-barbican | 23:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/189454 | 23:38 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!