| *** dimtruck is now known as zz_dimtruck | 00:01 | |
| *** zz_dimtruck is now known as dimtruck | 00:02 | |
| *** SheenaG1 has joined #openstack-barbican | 00:02 | |
| *** atiwari has joined #openstack-barbican | 00:04 | |
| *** atiwari has quit IRC | 00:06 | |
| *** dimtruck is now known as zz_dimtruck | 00:12 | |
| *** jkf has quit IRC | 00:44 | |
| openstackgerrit | Merged openstack/python-barbicanclient: Update documentation https://review.openstack.org/154327 | 00:48 |
|---|---|---|
| *** atiwari has joined #openstack-barbican | 00:56 | |
| *** SheenaG1 has quit IRC | 00:56 | |
| *** bdpayne has quit IRC | 01:14 | |
| *** atiwari has quit IRC | 01:31 | |
| *** zz_dimtruck is now known as dimtruck | 01:37 | |
| *** atiwari has joined #openstack-barbican | 01:43 | |
| *** atiwari has quit IRC | 02:26 | |
| *** atiwari has joined #openstack-barbican | 02:26 | |
| *** atiwari has quit IRC | 02:27 | |
| *** woodster_ has quit IRC | 02:30 | |
| *** gyee has quit IRC | 02:52 | |
| *** gyee has joined #openstack-barbican | 02:57 | |
| *** david-lyle is now known as david-lyle_afk | 02:59 | |
| *** woodster_ has joined #openstack-barbican | 02:59 | |
| *** xaeth_afk is now known as xaeth | 03:27 | |
| *** xaeth is now known as xaeth_afk | 03:39 | |
| *** xaeth_afk is now known as xaeth | 03:46 | |
| *** gyee has quit IRC | 04:00 | |
| *** xaeth is now known as xaeth_afk | 04:52 | |
| *** woodster_ has quit IRC | 05:10 | |
| *** dimtruck is now known as zz_dimtruck | 05:22 | |
| *** xaeth_afk is now known as xaeth | 05:42 | |
| *** crc32 has joined #openstack-barbican | 06:15 | |
| *** xaeth is now known as xaeth_afk | 07:04 | |
| *** xaeth_afk is now known as xaeth | 07:14 | |
| *** rm_you| has quit IRC | 07:34 | |
| *** jaosorior has joined #openstack-barbican | 07:47 | |
| *** jaosorior has quit IRC | 07:49 | |
| *** jaosorior has joined #openstack-barbican | 07:49 | |
| *** rm_you has joined #openstack-barbican | 08:05 | |
| *** rm_you has joined #openstack-barbican | 08:05 | |
| *** openstackgerrit has quit IRC | 08:21 | |
| *** openstackgerrit has joined #openstack-barbican | 08:21 | |
| *** xaeth is now known as xaeth_afk | 08:34 | |
| *** chlong has quit IRC | 08:42 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Fix symmetric/asymmetric key order meta validation https://review.openstack.org/150396 | 09:10 |
| *** woodster_ has joined #openstack-barbican | 13:00 | |
| *** alee_afk has quit IRC | 13:49 | |
| *** zz_dimtruck is now known as dimtruck | 13:52 | |
| *** rellerreller has joined #openstack-barbican | 13:58 | |
| *** dimtruck is now known as zz_dimtruck | 14:03 | |
| *** miqui_ has joined #openstack-barbican | 14:13 | |
| *** david-lyle_afk is now known as david-lyle | 14:25 | |
| *** ametts has joined #openstack-barbican | 14:42 | |
| *** alee has joined #openstack-barbican | 14:43 | |
| *** SheenaG1 has joined #openstack-barbican | 14:58 | |
| *** darrenmoffat has quit IRC | 15:03 | |
| *** paul_glass has joined #openstack-barbican | 15:04 | |
| *** darrenmoffat has joined #openstack-barbican | 15:04 | |
| *** xaeth_afk is now known as xaeth | 15:09 | |
| *** zz_dimtruck is now known as dimtruck | 15:24 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Fix "invalid credentials" error running functional tests https://review.openstack.org/155355 | 15:29 |
| *** crc32 has quit IRC | 15:45 | |
| *** xaeth is now known as xaeth_afk | 15:45 | |
| *** SheenaG1 has quit IRC | 15:55 | |
| openstackgerrit | Merged openstack/barbican-specs: Adding spec for Barbican MKEK Model. https://review.openstack.org/148948 | 15:55 |
| *** nkinder has joined #openstack-barbican | 15:57 | |
| *** SheenaG1 has joined #openstack-barbican | 15:58 | |
| *** jaosorior has quit IRC | 16:01 | |
| *** dimtruck is now known as zz_dimtruck | 16:28 | |
| *** zz_dimtruck is now known as dimtruck | 16:32 | |
| *** gyee has joined #openstack-barbican | 16:54 | |
| *** bdpayne has joined #openstack-barbican | 16:57 | |
| *** tkelsey has joined #openstack-barbican | 17:08 | |
| *** atiwari has joined #openstack-barbican | 17:28 | |
| *** jkf has joined #openstack-barbican | 17:44 | |
| *** nkinder is now known as nkinder_sick | 17:46 | |
| rellerreller | ping woodster_ redrobot | 17:47 |
| SheenaG1 | rellerreller: woodster_ is stuck in a meeting with me until 1, I'll let him know you're looking for him though | 17:47 |
| SheenaG1 | rellerreller: redrobot might be around | 17:48 |
| rellerreller | SheenaG1 thanks | 17:48 |
| rellerreller | It's nothing urgent. Just wondering if the payload_content_type parameter can be removed from order POST call. | 17:49 |
| *** dimtruck is now known as zz_dimtruck | 17:54 | |
| SheenaG1 | rellerreller: ah, okay - will make sure woodster_ catches up with you when we release him! | 17:56 |
| *** zz_dimtruck is now known as dimtruck | 18:00 | |
| redrobot | hi rellerreller | 18:01 |
| rellerreller | hey redrobot | 18:01 |
| rellerreller | I have a question about the Orders API | 18:01 |
| rellerreller | When you POST an Order to create a key there is a payload_content_type parameter that is passed as a part of the request. | 18:02 |
| rellerreller | I feel like that parameter will no longer be needed with the content types spec code. | 18:02 |
| rellerreller | I think we can remove that parameter because we are saying now that all keys will be returned in a specific format/encoding. | 18:03 |
| redrobot | rellerreller I think you're right... payload_content_type was intended to differentiate the type of key material, I think maybe it should have been removed when we changed the format of the orders to have type+meta | 18:03 |
| rellerreller | OK, I think we are on the same page then. | 18:04 |
| rellerreller | I'll go ahead and remove it in my code that I will post for content types. If anyone sees a reason to keep it then we can discuss. | 18:05 |
| rellerreller | Is that ok? | 18:05 |
| redrobot | rellerreller yep, I think so. There should be enough information in the meta section to figure out what the content type should be. | 18:05 |
| rellerreller | redrobot Excellent! I'll push forward with that. | 18:06 |
| rellerreller | redrobot Thanks! | 18:06 |
| *** tkelsey has quit IRC | 18:12 | |
| *** jkf has quit IRC | 18:24 | |
| *** paul_glass has quit IRC | 18:26 | |
| *** rellerreller has quit IRC | 18:27 | |
| *** dimtruck is now known as zz_dimtruck | 18:30 | |
| *** zz_dimtruck is now known as dimtruck | 18:35 | |
| *** paul_glass has joined #openstack-barbican | 18:55 | |
| openstackgerrit | Merged openstack/barbican: Fix "invalid credentials" error running functional tests https://review.openstack.org/155355 | 18:58 |
| *** elmiko has joined #openstack-barbican | 19:17 | |
| *** paul_glass has quit IRC | 19:21 | |
| *** atiwari has quit IRC | 19:36 | |
| *** rellerreller has joined #openstack-barbican | 19:37 | |
| *** atiwari has joined #openstack-barbican | 19:39 | |
| *** alee is now known as alee_afk | 19:45 | |
| *** paul_glass has joined #openstack-barbican | 19:51 | |
| elmiko | hey folks, i'm working on putting together a spec for sahara/barbican integration and i'm curious if there are any examples about using keystone with barbican? | 20:00 |
| elmiko | basically i wasn't seeing anything about X-Auth-Token, or the like | 20:00 |
| redrobot | elmiko from a client point of view? http://docs.openstack.org/developer/python-barbicanclient/authentication.html | 20:04 |
| elmiko | yea | 20:04 |
| elmiko | redrobot: awesome, thanks! | 20:05 |
| redrobot | elmiko those are super simple examples... in a real implementation you'd probably want to read the Keystone username/pw from a config file using oslo config or something like that. | 20:06 |
| *** briancurtin has quit IRC | 20:07 | |
| elmiko | redrobot: yeah, we already have a method for gaining a keystone client. then we can just create the session and pass to barbican | 20:08 |
| *** jraim has quit IRC | 20:09 | |
| *** jraim has joined #openstack-barbican | 20:15 | |
| *** dabukalam has joined #openstack-barbican | 20:16 | |
| *** briancurtin has joined #openstack-barbican | 20:17 | |
| *** jkf has joined #openstack-barbican | 20:17 | |
| *** gyee has quit IRC | 20:20 | |
| *** rellerreller has quit IRC | 20:37 | |
| rm_work | elmiko: for Barbican integration you might be interested in Castellan | 20:37 |
| rm_work | elmiko: it'll also take care of the keystone stuff pretty automagically | 20:37 |
| rm_work | elmiko: that's how Neutron / Octavia / Nova / Cinder are planning to integrate with Barbican | 20:38 |
| *** tkelsey has joined #openstack-barbican | 20:39 | |
| *** atiwari has quit IRC | 20:40 | |
| elmiko | rm_work: thanks, i'll do some reading up on Castellan | 20:40 |
| *** atiwari has joined #openstack-barbican | 20:41 | |
| *** atiwari has quit IRC | 20:41 | |
| *** tkelsey has quit IRC | 20:43 | |
| *** alee_afk is now known as alee | 20:47 | |
| rm_work | elmiko: it's still pretty bare, but we hope to have it fleshed out significantly better after next week | 20:52 |
| *** bdpayne has quit IRC | 20:53 | |
| elmiko | rm_work: ok, i doubt my spec will land before feature freeze. but if castellan is the path forward for secret storage then we'll get in line =) | 20:53 |
| elmiko | it may, i'm hopefuly, but who knows | 20:53 |
| woodster_ | elmiki, well, hopefully using castellan will accelerate the review acceptance? | 21:24 |
| woodster_ | redrobot, hockeynut, on the quota bp, please take a look at the latest comments and tsv's summary of API calls. I think we are close... | 21:26 |
| *** atiwari has joined #openstack-barbican | 21:27 | |
| elmiko | woodster_: i dunno, from the sahara team perspective i think barbican and castellan are both relative unknowns | 21:33 |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: All of the containers behaviors and container smoke tests https://review.openstack.org/151787 | 21:38 |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Adds positive secret functional tests https://review.openstack.org/155502 | 22:04 |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Adds positive container functional tests https://review.openstack.org/155502 | 22:06 |
| reaperhulk | inbound bug fix for pkcs11 coming | 22:09 |
| reaperhulk | use after free bug wooooo | 22:09 |
| * reaperhulk kills self | 22:09 | |
| chellygel | reaperhulk for you: http://i.imgur.com/0SlSz9q.gif | 22:10 |
| reaperhulk | I didn't even find it | 22:10 |
| * reaperhulk got emailed about it | 22:11 | |
| chellygel | there are 4 lights? | 22:11 |
| reaperhulk | who is the cardassian torturer in this metaphor | 22:11 |
| openstackgerrit | Paul Kehrer proposed openstack/barbican: fix a use after free bug https://review.openstack.org/155503 | 22:12 |
| chellygel | i think that is only something that you can answer! | 22:12 |
| reaperhulk | Imagine that the "gcm" variable in this patch is an object that holds a reference to something else. When you call _build_gcm_mech it makes that object, assigns its value to "mech" and then returns "mech" | 22:13 |
| reaperhulk | The problem with that is that the way cffi does memory ownership means that when the function returns "gcm" is now no longer in scope and can be garbage collected | 22:13 |
| reaperhulk | so the mech.parameter (line 436) is now pointing at memory that contains the correct data but is no longer owned by the application. | 22:14 |
| woodster_ | hmmm....I'm getting a deja vu sort of feeling right about now... | 22:14 |
| reaperhulk | So it's using the memory after freeing it. This works in most cases, but if something else allocates and overwrites that memory it now reads garbage | 22:14 |
| woodster_ | rm_work, did you see this README by chance when you setup your local devstack env?: https://github.com/openstack-infra/devstack-gate | 22:15 |
| reaperhulk | While this is an obvious bug I'd like to have Rohit confirm it resolves the issue for him (he's able to reproduce this race condition easily in his environment) before we merge | 22:15 |
| woodster_ | reaperhulk, that's the issue that bit you and jvrbanac a week or two back, correct? | 22:15 |
| reaperhulk | yep but in a diff spot :) | 22:15 |
| rm_work | woodster_: hmmm | 22:16 |
| reaperhulk | this one was clearly the exact same bug but we didn't notice because we weren't triggering it | 22:16 |
| reaperhulk | I'm surprised we haven't triggered this in our internal load testing actually, but *shrug* slab allocation | 22:16 |
| reaperhulk | pypy would probably trigger it. It's far more aggressive about nursery gc | 22:16 |
| *** bdpayne has joined #openstack-barbican | 22:16 | |
| woodster_ | hockeynut, I think you were also trying to reproduce devstack gate results locally? | 22:16 |
| rm_work | woodster_: interesting -- i did not, but i have basically replicated all of this from scratch :P | 22:17 |
| woodster_ | reaperhulk, well other than by-inspection or stress testing, there's no cool linting tools to help out with these things? | 22:17 |
| reaperhulk | woodster_: nope | 22:17 |
| reaperhulk | memory leaks are a bit easier. You can hypothetically build python with support for valgrind (effectively disabling its slab allocation) and then run your tests inside valgrind at that point | 22:18 |
| * reaperhulk has not tried to do that | 22:19 | |
| *** atiwari1 has joined #openstack-barbican | 22:19 | |
| reaperhulk | memory leaks are less insidious than use after free though | 22:19 |
| rm_work | woodster_: i might try to do a new script based on this] | 22:19 |
| reaperhulk | valgrind can find use after free, but it wouldn't catch it if it's marked for collection in Python but Python hasn't done a gc pass yet | 22:19 |
| reaperhulk | I suppose you could import gc and call gc.collect() as part of test infra? | 22:20 |
| * reaperhulk is just spitballing | 22:20 | |
| reaperhulk | ultimately this code will get hoisted up into cryptography and become our problem (and we do intend to eventually run it under valgrind) | 22:21 |
| *** atiwari has quit IRC | 22:21 | |
| woodster_ | rm_work, well given that wikis/.rsts go stale quickly you might take it with a few grains of salt, but might be helpful | 22:21 |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Adds positive container functional tests https://review.openstack.org/155507 | 22:21 |
| rm_work | woodster_: it looks very promising actually, but i hear ya | 22:21 |
| woodster_ | reaperhulk, well is gc.collect() merely suggestive or is it a deterministic process? | 22:22 |
| reaperhulk | I have no idea :) | 22:22 |
| woodster_ | hockeynut, had you mentioned Rally before?: https://wiki.openstack.org/wiki/Rally This looks interesting for ci/cd testing | 22:22 |
| reaperhulk | according to the docs it looks like it immediately runs a blocking collection and it returns the number of unreachable objects | 22:22 |
| * jvrbanac snickers | 22:22 | |
| reaperhulk | jvrbanac we totally let a nasty bug slip through | 22:23 |
| jvrbanac | yeaaahhh | 22:23 |
| woodster_ | exterminators are bringing bugs with them too? job security... | 22:24 |
| jvrbanac | reaperhulk, oops | 22:26 |
| jvrbanac | reaperhulk, I like how it didn't seem to come up as an issue in the limited testing we did | 22:26 |
| woodster_ | alembic migrations on sqlite?: http://alembic.readthedocs.org/en/latest/batch.html | 22:27 |
| *** alee has quit IRC | 22:28 | |
| reaperhulk | jvrbanac: especially since the exact same bug with the attribute structs did | 22:28 |
| jvrbanac | reaperhulk, yeah | 22:28 |
| *** xaeth_afk is now known as xaeth | 22:32 | |
| hockeynut | woodster_ yes looking at devstack gate locally. also some teams use Rally, we haven't (yet) | 22:59 |
| *** dimtruck is now known as zz_dimtruck | 22:59 | |
| woodster_ | hockeynut, do you recall who setup up our devstack gate job? Was it Chad? | 23:00 |
| hockeynut | woodster_ I believe it was | 23:00 |
| hockeynut | there are some instructions out there for setting up a "persistent" devstack machine the same as the one used in the gate. I started down that road but then got sidetracked by other more pressing issues | 23:00 |
| *** SheenaG1 has quit IRC | 23:03 | |
| redrobot | I need to get into some of that devstack action | 23:06 |
| openstackgerrit | Merged openstack/python-barbicanclient: All of the containers behaviors and container smoke tests https://review.openstack.org/151787 | 23:12 |
| *** chlong has joined #openstack-barbican | 23:17 | |
| *** gyee has joined #openstack-barbican | 23:29 | |
| *** xaeth is now known as xaeth_afk | 23:33 | |
| *** gyee has quit IRC | 23:33 | |
| *** gyee has joined #openstack-barbican | 23:35 | |
| *** gyee has quit IRC | 23:35 | |
| *** gyee has joined #openstack-barbican | 23:36 | |
| *** gyee has quit IRC | 23:38 | |
| *** gyee has joined #openstack-barbican | 23:38 | |
| *** openstack has joined #openstack-barbican | 23:40 | |
| *** xaeth_afk is now known as xaeth | 23:42 | |
| *** xaeth is now known as xaeth_afk | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
