0.2.2

Change the barbican-tempest-plugin tests to
voting, and run them for both the check and
the gate.

Change-Id: Iedc38ccd61d8361c63ed8c19106522ea268241ea

Add the barbican-tempest tests that use
cursive from git.  These tests are defined
in the barbican repo, and thus can be
reused here.

Needed-By: https://review.openstack.org/#/c/550996/
Change-Id: Id2aa88c12f42dd0d5ce8e0120a760be59338771e

The use of signer and verifier in cryptography has been
deprecated, and causes the following warning:

cursive/cursive/signature_utils.py:139: DeprecationWarning: signer
and verifier have been deprecated. Please use sign and verify
instead.

This patch adds a wrapper around the use of verifier, so
that sign and verify are used with cryptography, but the
client use of the library doesn't have to change.

Change-Id: Ib4aaa4fc9eb893b74f08bc8ff732a4dae152f685

0.2.1

Replace the usage of oslosphinx with openstackdocstheme and follow the
porting guide[1].
Also bump the used Sphinx version to the one from
global-requirements. Otherwise the docs build fails.

[1]
https://specs.openstack.org/openstack/docs-specs/specs/pike/os-manuals-migration.html

Change-Id: I9cb15f670e312faa49d95e14c84b7f4ec72bf8e0

six, lxml and netifaces are not used in the cursive codebase. Remove
them.

Change-Id: I0ea29850376f0d3334d92e6e9669bc228eb49f27

Although mock is used in the unit tests at
https://github.com/openstack/cursive/blob/d5e395cc351911ca1f2ffd0446986912309f87a0/cursive/tests/unit/test_signature_utils.py#L23
it is not in test-requirements.txt.

This commit adds mock to test-requirements.txt.

Change-Id: I07aa5c65195ffe9453d2a5508e447b0bb8d834c0

ManagedObjectNotFoundError which is raised from a several places of
castellan library
(for example castellan/key_manager/barbican_key_manager.py) is not
caught in signature_utils.py.

Caught ManagedObjectNotFoundError and raised SignatureVerificationError
to avoid 500 error response.

Change-Id: Ia8310f8cc9604d11cc4a25617b55a1b61436cd71
Closes-Bug: #1736679

0.1.2

This change adds support for certificate validation, including
certificate inspection utilities. Validating a certificate
requires the certificate UUID of the certificate to validate,
a set of UUIDs corresponding to the set of trusted certificates
needed to validate the certificate, and a user context for
authentication to the key manager. A new certificate verification
context is included that is used to store the set of trusted
certificates once they are loaded from the key manager. This
context is used to validate the signing certificate, verifying
that the certificate belongs to a valid certificate chain rooted
in the set of trusted certificates.

All new certificate utility code is added in a new module named
certificate_utils.

For more information on this work, see the spec:
https://review.openstack.org/#/c/488541/

SecurityImpact
DocImpact

Change-Id: I8d7f43fb4c0573ac3681147eac213b369bbbcb3b
Implements: blueprint nova-validate-certificates

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>