| ade_lee | redrobot, and of course, zuul appears to be down now .. | 00:00 |
|---|---|---|
| *** whoami-rajat has joined #openstack-barbican | 01:20 | |
| *** dave-mccowan has quit IRC | 04:11 | |
| openstackgerrit | Merged openstack/barbican master: Workaround for failing gates https://review.openstack.org/628667 | 05:57 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Fix Safenet HSM regression in PKCS#11 https://review.openstack.org/629294 | 06:16 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Add barbican-status upgrade check command framework https://review.openstack.org/611574 | 06:16 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Remove tripleo newton and ocata jobs https://review.openstack.org/619812 | 06:17 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: PY3: Ensure normalize_before_encryption encodes b64payload https://review.openstack.org/613324 | 06:17 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: functionaltests: Add response headers to logging info https://review.openstack.org/621262 | 06:17 |
| *** velizarx has joined #openstack-barbican | 07:57 | |
| *** graeb has joined #openstack-barbican | 08:48 | |
| *** graeb has quit IRC | 09:00 | |
| *** xek has joined #openstack-barbican | 09:00 | |
| *** graeb has joined #openstack-barbican | 09:00 | |
| *** graeb has quit IRC | 09:06 | |
| *** graeb has joined #openstack-barbican | 09:06 | |
| *** pcaruana has joined #openstack-barbican | 09:30 | |
| *** jaosorior has joined #openstack-barbican | 10:09 | |
| *** salmankhan has joined #openstack-barbican | 10:33 | |
| *** salmankhan has quit IRC | 10:42 | |
| *** salmankhan has joined #openstack-barbican | 10:42 | |
| *** salmankhan has quit IRC | 10:46 | |
| *** salmankhan has joined #openstack-barbican | 10:53 | |
| *** openstackgerrit has quit IRC | 11:22 | |
| *** marios has joined #openstack-barbican | 11:32 | |
| marios | o/ folks review request please if you have time https://review.openstack.org/#/c/628244/ replace the multinode scenario job with the new standalone. More info at http://lists.openstack.org/pipermail/openstack-discuss/2019-January/001377.html thanks! | 11:33 |
| *** ign0tus has joined #openstack-barbican | 11:53 | |
| jaosorior | marios: done | 11:59 |
| marios | thanks jaosorior | 12:02 |
| *** raildo has joined #openstack-barbican | 12:34 | |
| *** Luzi has joined #openstack-barbican | 12:41 | |
| *** gyee has joined #openstack-barbican | 12:53 | |
| redrobot | #startmeeting barbican | 13:01 |
| openstack | Meeting started Tue Jan 15 13:01:41 2019 UTC and is due to finish in 60 minutes. The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot. | 13:01 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 13:01 |
| *** openstack changes topic to " (Meeting topic: barbican)" | 13:01 | |
| openstack | The meeting name has been set to 'barbican' | 13:01 |
| Luzi | o/ | 13:02 |
| graeb | o/ | 13:02 |
| moguimar | o/ | 13:02 |
| moguimar | back from lunch just in time =D | 13:02 |
| redrobot | #topic Roll Call | 13:03 |
| *** openstack changes topic to "Roll Call (Meeting topic: barbican)" | 13:03 | |
| redrobot | Courtesy ping for ade_lee hrybacki jamespage Luzi lxkong moguimar raildo rm_work xek | 13:03 |
| redrobot | moguimar, nice | 13:03 |
| raildo | o/ | 13:04 |
| redrobot | Sweet, let's get started | 13:04 |
| jaosorior | o/ | 13:04 |
| redrobot | #topic Review action items from last week | 13:04 |
| *** openstack changes topic to "Review action items from last week (Meeting topic: barbican)" | 13:04 | |
| graeb | I successfully tested patch for SafeNet HSM (see https://review.openstack.org/#/c/629294/). Thank you very much for the work! | 13:05 |
| redrobot | graeb, awesome! Glad we were able to unbreak you guys | 13:05 |
| graeb | Nevertheless I would like to stress one more time, that I am thinking, that generation of PKEKs with attribute CKA_SENSITIVE set to false may decreases security. As redrobot in the last meeting already mentioned, PKEKs get wrapped immediately after generation. But if my code analysis are correct, PKEKs stay in HSM memory after generation with attribute CKA_SENSITIVE set to false and will be used that way until they gets cleared out of the HSMs | 13:05 |
| graeb | memory and need to be unwrapped again. Therefore setting the default for the new configuration parameter always_set_cka_sensitive to true was a good decision. Thanks again! | 13:05 |
| redrobot | first action item: | 13:05 |
| redrobot | redrobot to update the Barbican Wiki page | 13:06 |
| redrobot | I did not do that | 13:06 |
| redrobot | so let's punt | 13:06 |
| redrobot | #action redrobot to update the Barbican Wiki page | 13:06 |
| redrobot | Next: redrobot to ask alee about submitting the Barbican workshop to the next Summit | 13:06 |
| redrobot | I did remind ade_lee that we've got the Summit CFP deadline coming up, but didn't ask about the workshop specifically | 13:06 |
| redrobot | so punt! | 13:06 |
| redrobot | #action redrobot to ask alee about submitting the Barbican workshop to the next Summit | 13:07 |
| redrobot | graeb, I'll add an item to the agenda to talk about that | 13:07 |
| graeb | redrobot, thx | 13:07 |
| redrobot | ok, moving on | 13:09 |
| redrobot | thanks Luzi and graeb for using the agenda etherpad | 13:09 |
| redrobot | #topic Successfully tested regression fix patch for SafeNet HSM | 13:09 |
| *** openstack changes topic to "Successfully tested regression fix patch for SafeNet HSM (Meeting topic: barbican)" | 13:09 | |
| redrobot | #link https://review.openstack.org/#/c/629294/ | 13:10 |
| *** openstackgerrit has joined #openstack-barbican | 13:10 | |
| openstackgerrit | Merged openstack/barbican master: Replace tripleo-scenario002-multinode with scenario002-standalone https://review.openstack.org/628244 | 13:10 |
| graeb | I was to fast, sorry, First point already mentioned. Second is, we found a new bug: "ERROR: _get_master_key() takes exactly 3 arguments (2 given)" when executing `barbican-manage hsm rewrap_pkek` | 13:10 |
| redrobot | RE: graeb's concern above | 13:11 |
| redrobot | Some HSMs actually require that CKA_SENSITIVE=False when CKA_EXTRACTABLE=True | 13:11 |
| redrobot | The spec is not very clear on the relationship between the two | 13:12 |
| graeb | Jep. Nothing we can do | 13:12 |
| redrobot | hence the disagreement between what the Safenet HSM does and what these other HSMs are doing. | 13:12 |
| redrobot | ok, moving on | 13:12 |
| redrobot | #topic Bug "ERROR: _get_master_key() takes exactly 3 arguments (2 given)" when executing `barbican-manage hsm rewrap_pkek` (Luzi, graeb) | 13:12 |
| *** openstack changes topic to "Bug "ERROR: _get_master_key() takes exactly 3 arguments (2 given)" when executing `barbican-manage hsm rewrap_pkek` (Luzi, graeb) (Meeting topic: barbican)" | 13:12 | |
| graeb | I think nothing more to say here? | 13:13 |
| graeb | It's clearly a bug. Tested also with two different HSMs. | 13:13 |
| Luzi | Safenet and Utimaco Soft HSM are the ones we test with | 13:14 |
| redrobot | Yeah, sounds like we forgot to update wrap_pkek when we changed things to use configurable mechanisms | 13:15 |
| redrobot | should be a striaghtforward fix | 13:15 |
| redrobot | graeb, Luzi did y'all add a Story yet? | 13:15 |
| graeb | No | 13:16 |
| Luzi | will do it, after the meeting | 13:16 |
| graeb | luzi, thx | 13:16 |
| *** mhen has joined #openstack-barbican | 13:16 | |
| redrobot | Cool | 13:17 |
| redrobot | Luzi, thanks, please post the link in the IRC channel after you open it. I'll see about getting that fixed | 13:17 |
| Luzi | redrobot, okay :) | 13:17 |
| redrobot | #action Luzi to add a new story to the Barbican Storyboard for the _get_master_key() error | 13:18 |
| redrobot | #topic Why do we SHA256 HMAC over a wrapped PKEK? | 13:19 |
| *** openstack changes topic to "Why do we SHA256 HMAC over a wrapped PKEK? (Meeting topic: barbican)" | 13:19 | |
| graeb | We have problems with a HSM (emulator) from Utimaco. If a new PKEK gets generated, Barbican computes a HMAC of the wrapped PKEK (and its initialization vector) using CKM_SHA256_HMAC. Barbican throws a traceback with error CKR_MECHANISM_INVALID. We already in touch with Utimaco. One of their system engineers suggested to replace CKM_SHA256_HMAC by CKM_AES_MAC, which works. The problem now is, that the HMAC, that will be generated is just 64 bits | 13:19 |
| graeb | long instead of 256 bits. So i was just wondering, whether Barbican becomes less secure because of that and that the reason for computing a HMAC of wrapped PKEKs actually is? | 13:19 |
| redrobot | So, we calculate an HMAC to guarantee integrity of the data | 13:22 |
| redrobot | e.g. an hmac would fail if the ciphertext for the PKEK becomes corrupted | 13:23 |
| graeb | Ok, but why secure it with an Key? | 13:23 |
| graeb | For integrity reasons makes sense to me. But don't know why encrypting the signature. | 13:24 |
| redrobot | So, HMAC does use a key | 13:24 |
| redrobot | and the signature is not sensitive material | 13:25 |
| redrobot | so there's no need to encrypt that | 13:25 |
| mhen | so, the difference between 256 and 64 bit HMAC is only how frequent collisions are? | 13:27 |
| mhen | (sorry for barging in suddenly) | 13:27 |
| redrobot | I'm not 100% on how AES HMAC works | 13:28 |
| redrobot | no worries mhen | 13:28 |
| redrobot | we always appreciate input from smart folks | 13:28 |
| redrobot | :D | 13:28 |
| *** dave-mccowan has joined #openstack-barbican | 13:28 | |
| graeb | So its just a compatibility issue with Utimaco HSMs. What to do about it? | 13:29 |
| redrobot | graeb, yeah, we'll need to make that HMAC wrap a configurable mechanism as weel | 13:30 |
| redrobot | *well | 13:30 |
| graeb | Sounds good. :-D Shall I add a story? | 13:31 |
| redrobot | graeb, yes, please | 13:32 |
| redrobot | #action graeb to add story for making HMAC Key Wrap mechanism configurable | 13:32 |
| graeb | redrobot, thanks I will do after the meeting. | 13:32 |
| redrobot | #topic Failing Gates | 13:32 |
| *** openstack changes topic to "Failing Gates (Meeting topic: barbican)" | 13:32 | |
| redrobot | I'm sure you noticed the gates were failing all last week. | 13:32 |
| redrobot | We ended up merging a workaround yesterday | 13:33 |
| redrobot | #link https://review.openstack.org/#/c/628667/ | 13:33 |
| redrobot | To undo the workaround we're going to need to rewrite the paging/quota tests so that there are no race conditions when run in parallel | 13:33 |
| *** gyee has quit IRC | 13:34 | |
| redrobot | We'll also need to figure out why grenade is failing | 13:34 |
| redrobot | Maybe I should add some stories for those | 13:35 |
| redrobot | #action redrobot to add stories for permanent fixes to the gate workarounds | 13:36 |
| redrobot | We should be back in business now, so I'll be rebasing patches to get the patch backlog down | 13:36 |
| redrobot | any questions about the workaround? | 13:37 |
| redrobot | Ok, that's all the topics I had for today | 13:38 |
| redrobot | any last minute topics y'all want to talk about? | 13:38 |
| redrobot | I'm gonna take that as a no | 13:40 |
| redrobot | thanks for coming everyone! | 13:40 |
| redrobot | #endmeeting | 13:40 |
| *** openstack changes topic to "OpenStack PTG Denver - https://etherpad.openstack.org/p/barbican-stein-ptg" | 13:40 | |
| openstack | Meeting ended Tue Jan 15 13:40:49 2019 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 13:40 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/barbican/2019/barbican.2019-01-15-13.01.html | 13:40 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/barbican/2019/barbican.2019-01-15-13.01.txt | 13:40 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/barbican/2019/barbican.2019-01-15-13.01.log.html | 13:40 |
| *** ade_lee has quit IRC | 13:46 | |
| *** ignaziocassano1 has joined #openstack-barbican | 13:47 | |
| ignaziocassano1 | Please, anyone could post a heat stack example with octavia and barbican for creating a TLS-terminated HTTPS load balancer? | 13:47 |
| *** velizarx has quit IRC | 13:50 | |
| *** raildo has quit IRC | 13:56 | |
| *** velizarx has joined #openstack-barbican | 13:59 | |
| *** raildo has joined #openstack-barbican | 14:03 | |
| *** mmethot has joined #openstack-barbican | 14:12 | |
| *** ignaziocassano1 has quit IRC | 14:16 | |
| *** moguimar has quit IRC | 14:36 | |
| *** moguimar has joined #openstack-barbican | 14:36 | |
| Luzi | I wrote the first story: https://storyboard.openstack.org/#!/story/2004779 | 14:44 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: Remove tripleo newton and ocata jobs https://review.openstack.org/619812 | 15:26 |
| *** abishop is now known as abishop|afk | 15:37 | |
| *** Luzi has quit IRC | 15:44 | |
| *** salmankhan has quit IRC | 15:45 | |
| *** velizarx has quit IRC | 15:48 | |
| *** moguimar has quit IRC | 15:57 | |
| *** moguimar has joined #openstack-barbican | 15:59 | |
| *** moguimar is now known as moguimar_afk | 15:59 | |
| *** salmankhan has joined #openstack-barbican | 16:04 | |
| *** ign0tus has quit IRC | 16:21 | |
| *** graeb has quit IRC | 16:27 | |
| *** prometheanfire has joined #openstack-barbican | 16:40 | |
| prometheanfire | can we get a release of python-barbicanclient for rocky and queens so they can get the UUID fixes (master also needs a release for the second UUID fix) | 16:41 |
| *** ade_lee has joined #openstack-barbican | 16:41 | |
| redrobot | hi prometheanfire. I'm pretty sure ade_lee is working on it. | 16:44 |
| prometheanfire | cool | 16:45 |
| prometheanfire | ok, didn't see anything in the releases queue for it | 16:45 |
| ade_lee | redrobot, what am I working on? | 16:46 |
| redrobot | ade_lee, python-barbicanclient for rocky and queens | 16:47 |
| prometheanfire | voluntold :D | 16:47 |
| ade_lee | prometheanfire, yeah - I' | 16:48 |
| ade_lee | I'll definitely get that out this week. | 16:48 |
| ade_lee | now that the gates are flowing again .. | 16:49 |
| openstackgerrit | Merged openstack/barbican master: Add barbican-status upgrade check command framework https://review.openstack.org/611574 | 16:49 |
| openstackgerrit | Merged openstack/barbican master: PY3: Ensure normalize_before_encryption encodes b64payload https://review.openstack.org/613324 | 16:49 |
| *** salmankhan has quit IRC | 16:50 | |
| *** salmankhan has joined #openstack-barbican | 16:50 | |
| prometheanfire | cool | 16:54 |
| ade_lee | dave-mccowan, redrobot if we can get a review on https://review.openstack.org/582705 please. Its been sitting for awhile | 17:06 |
| jaosorior | ade_lee: commented. | 17:09 |
| ade_lee | jaosorior, hey! | 17:09 |
| *** abishop|afk is now known as abishop | 17:19 | |
| openstackgerrit | Merged openstack/barbican master: Imported Translations from Zanata https://review.openstack.org/630488 | 17:53 |
| *** pcaruana has quit IRC | 18:01 | |
| *** salmankhan1 has joined #openstack-barbican | 18:04 | |
| *** salmankhan has quit IRC | 18:07 | |
| *** salmankhan1 has quit IRC | 18:08 | |
| openstackgerrit | Merged openstack/barbican master: Remove -u root as mysql is executed with root user https://review.openstack.org/593403 | 18:35 |
| openstackgerrit | Merged openstack/barbican master: Remove tripleo newton and ocata jobs https://review.openstack.org/619812 | 18:35 |
| openstackgerrit | Merged openstack/barbican master: functionaltests: Add response headers to logging info https://review.openstack.org/621262 | 18:49 |
| ade_lee | redrobot, yay --- stuff merging .. | 19:43 |
| ade_lee | redrobot, we gotta backport the dogtag/paging fix to rocky | 19:44 |
| redrobot | ade_lee, 🎉🎉🎉 | 19:44 |
| ade_lee | redrobot, doing that now .. | 19:44 |
| *** whoami-rajat has quit IRC | 20:00 | |
| ade_lee | redrobot, dave-mccowan --> https://review.openstack.org/#/c/631062 and https://review.openstack.org/#/c/631063/ please | 20:03 |
| ade_lee | to unblock gates on queens and rocky | 20:03 |
| ade_lee | dave-mccowan, we need your magic on the above reviews .. | 20:12 |
| ade_lee | to unblock queens/rocky | 20:12 |
| dave-mccowan | i subscribed. i'll watch for the gate jobs to complete. if i don't +2 right away, please ping me again when zuul finishes. | 20:13 |
| ade_lee | dave-mccowan, might as well +2/W -- if the gate jobs fail, it wont go through anyways -- and if they do, well - then we wont have to ping you. | 20:21 |
| ade_lee | up to you though | 20:22 |
| ade_lee | redrobot, whatever happened to https://review.openstack.org/#/c/388267/ ? | 20:25 |
| redrobot | ade_lee, I was working on that right before I left the Rack. Didn't get a chance to get it merged before I started the next gig. | 20:27 |
| redrobot | ade_lee, I still think it would be a good idea... not sure how to make it backwards compatible though? | 20:28 |
| redrobot | maybe deprecate the old names now? and wait a couple of cycles. Add a warning like PIP did when they changed the column format? 🤔 | 20:29 |
| ade_lee | redrobot, ok - I just happened to see its still around. | 20:29 |
| ade_lee | redrobot, and wondered whether it needed to be abandoned .. | 20:30 |
| ade_lee | but yeah, if we want it, we need to deprecate etc. | 20:31 |
| redrobot | I changed it to WIP ... I still think it would make using the cli easier to use | 20:32 |
| ade_lee | redrobot, ok | 20:54 |
| openstackgerrit | Merged openstack/barbican master: Update Octavia co-gate for python3 first https://review.openstack.org/625072 | 21:02 |
| ade_lee | redrobot, dave-mccowan any idea whats going on here -- https://review.openstack.org/#/c/622710/ ? | 21:03 |
| redrobot | ade_lee, looking | 21:09 |
| dave-mccowan | !!! UNABLE to load uWSGI plugin: ./python_plugin.so: cannot open shared object file: No such file ade_lee redrobot in barbican-svc | 21:16 |
| openstack | dave-mccowan: Error: "!!" is not a valid command. | 21:16 |
| dave-mccowan | UNABLE to load uWSGI plugin: ./python_plugin.so: cannot open shared object file: No such file ade_lee redrobot in barbican-svc | 21:16 |
| redrobot | dave-mccowan, where are you seeing that? | 21:17 |
| redrobot | I see this duplicate entry error http://logs.openstack.org/10/622710/1/check/castellan-functional-devstack/b221ee2/controller/logs/screen-barbican-svc.txt.gz#_Jan_15_17_48_42_546352 | 21:17 |
| dave-mccowan | http://logs.openstack.org/10/622710/1/check/castellan-functional-devstack/b221ee2/controller/logs/screen-barbican-svc.txt.gz | 21:18 |
| *** whoami-rajat has joined #openstack-barbican | 21:18 | |
| dave-mccowan | maybe red herring? | 21:18 |
| dave-mccowan | oh yea... we've seen the multiple rows thing before. | 21:19 |
| ade_lee | dave-mccowan, maybe seems to say it cant load it - and goes ahead and does it .. | 21:19 |
| ade_lee | we have? | 21:19 |
| ade_lee | multiple threads trying to do db-init? | 21:20 |
| ade_lee | db-sync .. | 21:20 |
| *** salmankhan has joined #openstack-barbican | 21:23 | |
| *** xek has quit IRC | 21:24 | |
| dave-mccowan | https://bugs.launchpad.net/barbican/+bug/1726378 | 21:26 |
| openstack | Launchpad bug 1726378 in Barbican "MultipleResultsFound error in _find_or_create_kek_objects()" [High,Triaged] | 21:26 |
| dave-mccowan | but, no fix | 21:26 |
| ade_lee | dave-mccowan, thats right - I remember this now -- we end up just kicking it over and over till it worked ... | 21:28 |
| ade_lee | dave-mccowan, not ideal - we should try to fix this .. | 21:30 |
| ade_lee | dave-mccowan, redrobot seems to be rather a consistent problem in those tests to be some kind of timing thing .. | 21:43 |
| ade_lee | at least in those tests .. | 21:43 |
| ade_lee | dave-mccowan, incidentally , if you check zuul, the tests will pass - just waiting on the last non-voting gates | 21:44 |
| ade_lee | for the two rocky/queens reviews | 21:44 |
| ade_lee | ah I see -- the duplicate entry is on the project -- seems like we created two project entries through potentially a timing thing. | 21:48 |
| ade_lee | that would aaffect all the secrets stored or generated for that project | 21:49 |
| ade_lee | so the place we'd potentially need a lock is where we create the project entry | 21:51 |
| *** raildo has quit IRC | 21:58 | |
| ade_lee | well - I suppose the same happens when you have a per-project resource like a PKEK | 22:01 |
| *** mhen has quit IRC | 22:21 | |
| *** trident has joined #openstack-barbican | 22:51 | |
| ade_lee | dave-mccowan, gates up .. | 23:16 |
| ade_lee | dave-mccowan, that is the gates CI jobs passed .. | 23:17 |
| *** ade_lee has quit IRC | 23:22 | |
| *** whoami-rajat has quit IRC | 23:47 | |
| *** salmankhan has quit IRC | 23:56 | |
| *** ade_lee has joined #openstack-barbican | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!