Merge of previous project work into this project

2013-04-01 18:26:03 -05:00 · 2013-04-01 18:26:03 -05:00 · 8f783f473b
commit 8f783f473b
parent 81d7598ca4
84 changed files with 1866 additions and 10258 deletions
--- a/.gitignore
+++ b/.gitignore
@ -40,3 +40,6 @@ nosetests.xml
 # Sqlite databases
 *.sqlite3
 *.db
+
+# Misc. generated files
+versiononly.txt
--- a/2
+++ b/2
@ -0,0 +1,2 @@
+John Wood <john.wood@rackspace.com>
+
--- a/HACKING.rst
+++ b/HACKING.rst
@ -0,0 +1,190 @@
+Barbican Style Commandments
+=======================
+
+
+TBD: Translate the content below to the Barbican project.
+...Adding cosmetic change to trigger build process...
+
+- Step 1: Read http://www.python.org/dev/peps/pep-0008/
+- Step 2: Read http://www.python.org/dev/peps/pep-0008/ again
+- Step 3: Read on
+
+
+General
+-------
+- Put two newlines between top-level code (funcs, classes, etc)
+- Put one newline between methods in classes and anywhere else
+- Do not write "except:", use "except Exception:" at the very least
+- Include your name with TODOs as in "#TODO(termie)"
+- Do not name anything the same name as a built-in or reserved word
+
+
+Imports
+-------
+- Do not make relative imports
+- Order your imports by the full module path
+- Organize your imports according to the following template
+
+Example::
+
+  # vim: tabstop=4 shiftwidth=4 softtabstop=4
+  {{stdlib imports in human alphabetical order}}
+  \n
+  {{third-party lib imports in human alphabetical order}}
+  \n
+  {{glance imports in human alphabetical order}}
+  \n
+  \n
+  {{begin your code}}
+
+
+Human Alphabetical Order Examples
+---------------------------------
+Example::
+
+  import httplib
+  import logging
+  import random
+  import StringIO
+  import time
+  import unittest
+
+  import eventlet
+  import webob.exc
+
+  import glance.api.middleware
+  from glance.api import images
+  from glance.auth import users
+  import glance.common
+  from glance.endpoint import cloud
+  from glance import test
+
+
+Docstrings
+----------
+
+Docstrings are required for all functions and methods.
+
+Docstrings should ONLY use triple-double-quotes (``"""``)
+
+Single-line docstrings should NEVER have extraneous whitespace
+between enclosing triple-double-quotes.
+
+**INCORRECT** ::
+
+  """ There is some whitespace between the enclosing quotes :( """
+
+**CORRECT** ::
+
+  """There is no whitespace between the enclosing quotes :)"""
+
+Docstrings that span more than one line should look like this:
+
+Example::
+
+  """
+  Start the docstring on the line following the opening triple-double-quote
+
+  If you are going to describe parameters and return values, use Sphinx, the
+  appropriate syntax is as follows.
+
+  :param foo: the foo parameter
+  :param bar: the bar parameter
+  :returns: return_type -- description of the return value
+  :returns: description of the return value
+  :raises: AttributeError, KeyError
+  """
+
+**DO NOT** leave an extra newline before the closing triple-double-quote.
+
+
+Dictionaries/Lists
+------------------
+If a dictionary (dict) or list object is longer than 80 characters, its items
+should be split with newlines. Embedded iterables should have their items
+indented. Additionally, the last item in the dictionary should have a trailing
+comma. This increases readability and simplifies future diffs.
+
+Example::
+
+  my_dictionary = {
+      "image": {
+          "name": "Just a Snapshot",
+          "size": 2749573,
+          "properties": {
+               "user_id": 12,
+               "arch": "x86_64",
+          },
+          "things": [
+              "thing_one",
+              "thing_two",
+          ],
+          "status": "ACTIVE",
+      },
+  }
+
+
+Calling Methods
+---------------
+Calls to methods 80 characters or longer should format each argument with
+newlines. This is not a requirement, but a guideline::
+
+    unnecessarily_long_function_name('string one',
+                                     'string two',
+                                     kwarg1=constants.ACTIVE,
+                                     kwarg2=['a', 'b', 'c'])
+
+
+Rather than constructing parameters inline, it is better to break things up::
+
+    list_of_strings = [
+        'what_a_long_string',
+        'not as long',
+    ]
+
+    dict_of_numbers = {
+        'one': 1,
+        'two': 2,
+        'twenty four': 24,
+    }
+
+    object_one.call_a_method('string three',
+                             'string four',
+                             kwarg1=list_of_strings,
+                             kwarg2=dict_of_numbers)
+
+
+Internationalization (i18n) Strings
+-----------------------------------
+In order to support multiple languages, we have a mechanism to support
+automatic translations of exception and log strings.
+
+Example::
+
+    msg = _("An error occurred")
+    raise HTTPBadRequest(explanation=msg)
+
+If you have a variable to place within the string, first internationalize the
+template string then do the replacement.
+
+Example::
+
+    msg = _("Missing parameter: %s") % ("flavor",)
+    LOG.error(msg)
+
+If you have multiple variables to place in the string, use keyword parameters.
+This helps our translators reorder parameters when needed.
+
+Example::
+
+    msg = _("The server with id %(s_id)s has no key %(m_key)s")
+    LOG.error(msg % {"s_id": "1234", "m_key": "imageId"})
+
+
+Creating Unit Tests
+-------------------
+For every new feature, unit tests should be created that both test and
+(implicitly) document the usage of said feature. If submitting a patch for a
+bug that had no unit test, a new passing unit test should be added. If a
+submitted bug fix does have a unit test, be sure to add a new one that fails
+without the patch and passes with the patch.
--- a/3
+++ b/3
@ -1,4 +1,3 @@
-
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
@ -187,7 +186,7 @@
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2013, Rackspace (http://www.rackspace.com)

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
--- a/MANIFEST.in
+++ b/MANIFEST.in
@ -0,0 +1,11 @@
+include ChangeLog
+include README.rst
+include MANIFEST.in pylintrc
+include Authors
+include HACKING.rst
+include LICENSE
+include setup.cfg
+include babel.cfg tox.ini
+include barbican/tests/api/resources_test.py
+graft tools
+graft etc
--- a/README.md
+++ b/README.md
@ -1,4 +1,41 @@
-barbican
-========
+# Barbican
+Barbican is a ReST API designed for the secure storage, provisioning and management of secrets. It is aimed at being useful for all environments, including large ephemeral Clouds. The project is supported by [Rackspace Hosting](http://www.rackspace.com).
+
+Barbican is part of a set of applications that make up the CloudKeep ecosystem. The other systems are:
+
+* [Postern](https://github.com/cloudkeep/postern) - Go based agent that provides access to secrets from the Barbican API.
+* [Palisade](https://github.com/cloudkeep/palisade) - AngularJS based web ui for the Barbican API.
+* [Keep](https://github.com/cloudkeep/keep) - A python-based command line client for the Barbican API.
+
+Additional documentation can be found on the [Github Wiki](https://github.com/cloudkeep/barbican/wiki). For questions, comments or concerns, hop on the [mailing list](https://groups.google.com/forum/#!forum/cloudkeep) and let us know what you think.
+
+## Getting Started
+
+* Installation
+* Contributing
+* API Documentation
+* Technology
+* FAQ
+
+## Why Should You Use Barbican?
+The current state of key management is atrocious. While Windows does have some decent options through the use of the Data Protection API (DPAPI) and Active Directory, Linux lacks a cohesive story around how to manage keys for applicaiton use. 
+
+Barbican was designed to solve this problem. The system was motivated by internal Rackspace needs, requirements from [OpenStack](http://www.openstack.org/) and a realization that the current state of the art could use some help.
+
+Barbican will handle many types of secrets, including:
+
+* **Symmetric Keys** - Used to perform reversible encryption of data at rest, typically using the AES algorithm set. This type of key is required to enable features like [encrypted Swift containers and Cinder volumes](http://www.openstack.org/software/openstack-storage/), [encrypted Cloud Backups](http://www.rackspace.com/cloud/backup/), etc.
+* **Asymmetric Keys** - Asymmetric key pairs (sometimes referred to as [public / private keys](http://en.wikipedia.org/wiki/Public-key_cryptography)) are used in many scenarios where communication between untrusted parties is desired. The most common case is with SSL/TLS certificates, but also is used in solutions like SSH keys, S/MIME (mail) encryption and digital signatures.
+* **Raw Secrets** - Barbican stores secrets as a base64 encoded block of data (encrypted, naturally). Clients can use the API to store any secrets in any format they desire. The [Postern](https://github.com/cloudkeep/postern) agent is capable of presenting these secrets in various formats to ease integration.
+
+For the symmetric and asymmetric key types, Barbican supports full lifecycle management including provisioning, expiration, reporting, etc. A plugin system allows for multiple certificate authority support (including public and private CAs).
+
+## Design Goals
+
+1. Provide a central secret-store capable of distributing secret / keying material to all types of deployments including ephemeral Cloud instances.
+2. Support reasonable compliance regimes through reporting and auditability.
+3. Application adoption costs should be minimal or non-existent.
+4. Build a community and ecosystem by being open-source and extensible.
+5. Improve security through sane defaults and centralized management of [policies for all secrets](https://github.com/cloudkeep/barbican/wiki/Policies).
+6. Out of band communication mechanism to notify and protect sensitive assets.

-A server providing secure, audited access to encryption materials.
--- a/README.rst
+++ b/README.rst
@ -0,0 +1,48 @@
+====
+Barbican
+====
+
+TBD: Make this Barbican specific....
+
+Glance is a project that defines services for discovering, registering,
+retrieving and storing virtual machine images. The discovery and registration
+responsibilities are handled by the `glance-registry` component while the
+retrieval and storage responsiblities are handled by the `glance-api`
+component.
+
+
+Quick Start
+-----------
+
+If you'd like to run trunk, you can clone the git repo:
+
+    git clone git@github.com:openstack/glance.git
+
+
+Install Glance by running::
+
+    python setup.py build
+    sudo python setup.py install
+
+
+By default, `glance-registry` will use a SQLite database. If you'd like to use
+MySQL, or make other adjustments, you can modify the glance.cnf file (see
+documentation for more details).
+
+
+Now that Glance is installed, you can start the service.  The easiest way to
+do that is by using the `glance-control` utility which runs both the
+`glance-api` and `glance-registry` services::
+
+    glance-control all start
+
+
+Once both services are running, you can now use the `glance` tool to
+register new images in Glance.
+
+    glance add name="My Image" < /path/to/my/image
+
+
+With an image registered, you can now configure your IAAS provider to use
+Glance as its image service and begin spinning up instances from your
+newly registered images.
--- a/babel.cfg
+++ b/babel.cfg
@ -0,0 +1 @@
+[python: **.py]
--- a/barbican.py
+++ b/barbican.py
@ -1,90 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Barbican
-    ~~~~~~~~
-
-    A proof of concept implementation of a key management server for
-    use with the postern agent (https://github.com/cloudkeep/postern).
-
-    DO NOT USE THIS IN PRODUCTION. IT IS NOT SECURE IN ANY WAY.
-    YOU HAVE BEEN WARNED.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for details
-"""
-import os
-from flask import Flask, render_template, redirect, flash, request
-from flask.ext.admin import Admin
-from flask.ext.admin.contrib.sqlamodel import ModelView
-from flask.ext import login, wtf
-from flask.ext.login import login_user
-from barbican_api import api
-from database import db_session, init_db
-from models import User, Tenant, Key, Policy, Event
-
-
-app = Flask(__name__)
-app.secret_key = '79f9823f1f0---DEVELOPMENT---c46cebdd1c8f3d0742e02'
-app.register_blueprint(api)
-
-admin = Admin(app, name="Barbican Admin")
-admin.add_view(ModelView(User, db_session))
-admin.add_view(ModelView(Tenant, db_session))
-admin.add_view(ModelView(Key, db_session))
-admin.add_view(ModelView(Policy, db_session))
-admin.add_view(ModelView(Event, db_session))
-
-login_manager = login.LoginManager()
-login_manager.init_app(app)
-login_manager.login_view = 'login'
-
-
-@app.route("/")
-@login.login_required
-def hello():
-    return render_template("index.html")
-
-
-#
-#   Login forms
-#
-class LoginForm(wtf.Form):
-    login = wtf.TextField(validators=[wtf.required()])
-    password = wtf.PasswordField(validators=[wtf.required()])
-
-    def validate_login(self, field):
-        user = self.get_user()
-        if user is None or user.password != self.password.data:
-            raise wtf.ValidationError('Invalid username or credentials.')
-
-    def get_user(self):
-        return User.query.filter_by(name=self.login.data).first()
-
-
-@app.route("/login", methods=["GET", "POST"])
-def login():
-    form = LoginForm(request.form)
-    if form.validate_on_submit():
-        user = form.get_user()
-        login_user(user)
-        flash('Logged in successfully.')
-        return redirect('/admin/')
-
-    return render_template("login.html", form=form)
-
-
-@login_manager.user_loader
-def load_user(user_id):
-    return User.query.get(user_id)
-
-
-@app.teardown_request
-def shutdown_session(exception=None):
-    db_session.remove()
-
-
-if __name__ == '__main__':
-    if not os.path.exists('/tmp/barbican.db'):
-        app.logger.info('No database detected at /tmp/barbican.db. Creating one and the admin user.')
-        init_db()
-    app.run(debug=True)
--- a/barbican/init.py
+++ b/barbican/init.py
@ -0,0 +1,18 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Cloudkeep's Barbican module root
+"""
--- a/barbican/api/init.py
+++ b/barbican/api/init.py
@ -0,0 +1,56 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+API handler for Cloudkeep's Barbican
+"""
+
+
+import json
+import falcon
+
+
+class ApiResource(object):
+    """
+    Base class for API resources
+    """
+    pass
+
+
+def abort(status=falcon.HTTP_500, message=None):
+    """
+    Helper function for aborting an API request process. Useful for error
+    reporting and expcetion handling.
+    """
+    raise falcon.HTTPError(status, message)
+
+
+def load_body(req, required=[]):
+    """
+    Helper function for loading an HTTP request body from JSON into a
+    Python dictionary
+    """
+    try:
+        raw_json = req.stream.read()
+
+    except Exception:
+        abort(falcon.HTTP_500, 'Read Error')
+
+    try:
+        parsed_body = json.loads(raw_json, 'utf-8')
+    except ValueError as ve:
+        abort(falcon.HTTP_400, 'Malformed JSON')
+
+    return parsed_body
--- a/barbican/api/app.py
+++ b/barbican/api/app.py
@ -0,0 +1,63 @@
+import falcon
+
+from barbican.api.resources import *
+
+from config import config
+from sqlalchemy import create_engine, MetaData
+from sqlalchemy.orm import scoped_session, sessionmaker
+from barbican.model.tenant import Base
+
+"""
+Locally scoped db session
+"""
+_Session = scoped_session(sessionmaker())
+_engine = None
+
+
+def db_session():
+    return _Session
+
+
+def _engine_from_config(configuration):
+    configuration = dict(configuration)
+    url = configuration.pop('url')
+
+    return create_engine(url, **configuration)
+
+
+def init_tenant_model():
+    _engine = _engine_from_config(config['sqlalchemy'])
+    from barbican.model.tenant import Tenant, Secret
+    Base.metadata.create_all(_engine)
+    _Session.bind = _engine
+
+
+# Initialize the data model
+init_tenant_model()
+
+# test the database out
+#from barbican.model.tenant import Tenant, Secret
+#jw_user = Tenant("jwoody")
+#_Session.add(jw_user)
+
+# select all and print out all the results sorted by id
+#for instance in _Session.query(Tenant).order_by(Tenant.id):
+#    print instance.username
+
+# Resources
+versions = VersionResource()
+tenants = TenantsResource(db_session())
+tenant = TenantResource(db_session())
+secrets = SecretsResource(db_session())
+secret = SecretResource(db_session())
+
+# Routing
+application = api = falcon.API()
+
+api.add_route('/', versions)
+api.add_route('/v1', tenants)
+api.add_route('/v1/{tenant_id}', tenant)
+api.add_route('/v1/{tenant_id}/secrets', secrets)
+api.add_route('/v1/{tenant_id}/secrets/{secret_id}', secret)
+
+
--- a/barbican/api/resources.py
+++ b/barbican/api/resources.py
@ -0,0 +1,184 @@
+import json
+import falcon
+import logging
+
+from barbican.version import __version__
+from barbican.api import ApiResource, load_body, abort
+from barbican.model.util import find_tenant
+from barbican.model.util import find_secret
+from barbican.model.tenant import Tenant, Secret
+# from barbican.model.secret import Secret
+
+
+def _tenant_not_found():
+    abort(falcon.HTTP_404, 'Unable to locate tenant.')
+
+def _tenant_already_exists():
+    abort(falcon.HTTP_400, 'Tenant already exists.')
+
+def _secret_not_found():
+    abort(falcon.HTTP_400, 'Unable to locate secret profile.')
+
+def format_tenant(tenant):
+    if not isinstance(tenant, dict):
+        tenant = tenant.__dict__
+
+    return {'id': tenant['id'],
+            'tenant_id': tenant['tenant_id']}
+
+
+class VersionResource(ApiResource):
+
+    def on_get(self, req, resp):
+        resp.status = falcon.HTTP_200
+        resp.body = json.dumps({'v1': 'current',
+                                'build': __version__})
+
+
+class TenantsResource(ApiResource):
+
+    def __init__(self, db_session):
+        self.db = db_session
+
+    def on_post(self, req, resp):
+        body = load_body(req)
+        username = body['username']
+        logging.debug('Username is {0}'.format(username))
+
+        tenant = find_tenant(self.db, username=username)
+
+        if tenant:
+            abort(falcon.HTTP_400, 'Tenant with username {0} '
+                                   'already exists'.format(username))
+
+        new_tenant = Tenant(username)
+        self.db.add(new_tenant)
+        self.db.commit()
+
+        resp.status = falcon.HTTP_201
+        resp.set_header('Location', '/v1/{0}'.format(new_tenant.id))
+
+
+class TenantResource(ApiResource):
+
+    def __init__(self, db_session):
+        self.db = db_session
+
+    def on_get(self, req, resp, tenant_id):
+        tenant = find_tenant(self.db, id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        resp.status = falcon.HTTP_200
+        resp.body = json.dumps(tenant.format())
+
+    def on_delete(self, req, resp, tenant_id):
+        tenant = find_tenant(self.db, id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        self.db.delete(tenant)
+        self.db.commit()
+
+        resp.status = falcon.HTTP_200
+
+
+class SecretsResource(ApiResource):
+
+    def __init__(self, db_session):
+        self.db = db_session
+
+    def on_get(self, req, resp, tenant_id):
+        tenant = find_tenant(self.db, id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        resp.status = falcon.HTTP_200
+
+        #jsonify a list of formatted secrets
+        resp.body = json.dumps([s.format() for s in tenant.secrets])
+
+    def on_post(self, req, resp, tenant_id):
+        tenant = find_tenant(self.db, id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        body = load_body(req)
+        secret_name = body['name']
+
+        # Check if the tenant already has a secret with this name
+        for secret in tenant.secrets:
+            if secret.name == secret_name:
+                abort(falcon.HTTP_400, 'Secret with name {0} already exists.'
+                .format(secret.name, secret.id))
+
+        # Create the new secret
+        new_secret = Secret(tenant.id, secret_name)
+        tenant.secrets.append(new_secret)
+
+        self.db.add(new_secret)
+        self.db.commit()
+
+        resp.status = falcon.HTTP_201
+        resp.set_header('Location',
+                        '/v1/{0}/secrets/{1}'
+                        .format(tenant_id, new_secret.id))
+
+
+class SecretResource(ApiResource):
+
+    def __init__(self, db_session):
+        self.db = db_session
+
+    def on_get(self, req, resp, tenant_id, secret_id):
+        #verify the tenant exists
+        tenant = find_tenant(self.db, tenant_id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        #verify the secret exists
+        secret = find_secret(self.db, id=secret_id,
+                                    when_not_found=_secret_not_found)
+
+        #verify the secret belongs to the tenant
+        if not secret in tenant.secrets:
+            _secret_not_found()
+
+        resp.status = falcon.HTTP_200
+        resp.body = json.dumps(secret.format())
+
+    def on_put(self, req, resp, tenant_id, secret_id):
+        #verify the tenant exists
+        tenant = find_tenant(self.db, tenant_id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        #verify the secret exists
+        secret = find_secret(self.db, id=secret_id,
+                             when_not_found=_secret_not_found)
+
+        #verify the secret belongs to the tenant
+        if not secret in tenant.secrets:
+            _secret_not_found()
+
+        #load the message
+        body = load_body(req)
+
+        #if attributes are present in message, update the secret
+        if 'name' in body.keys():
+            secret.name = body['name']
+
+        self.db.commit()
+        resp.status = falcon.HTTP_200
+
+    def on_delete(self, req, resp, tenant_id, secret_id):
+        #verify the tenant exists
+        tenant = find_tenant(self.db, tenant_id=tenant_id,
+                             when_not_found=_tenant_not_found)
+
+        #verify the secret exists
+        secret = find_secret(self.db, id=secret_id,
+                             when_not_found=_secret_not_found)
+
+        #verify the secret belongs to the tenant
+        if not secret in tenant.secrets:
+            _secret_not_found()
+
+        self.db.delete(secret)
+        self.db.commit()
+
+        resp.status = falcon.HTTP_200
--- a/barbican/data/init.py
+++ b/barbican/data/init.py
@ -0,0 +1,18 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Data operations for Cloudkeep's Barbican
+"""
--- a/barbican/data/adapters/init.py
+++ b/barbican/data/adapters/init.py
@ -0,0 +1,18 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Database-specific implementations
+"""
--- a/barbican/data/adapters/handler.py
+++ b/barbican/data/adapters/handler.py
@ -0,0 +1,77 @@
+#from oslo.config import cfg
+#from barbican.config import get_config
+
+# Handler configuration options
+#datasource_group = cfg.OptGroup(name='datasource', title='Datasource Configuration Options')
+#get_config().register_group(datasource_group)
+
+#HANDLER_OPTIONS = [
+#    cfg.StrOpt('handler_name',
+#               default='memory',
+#               help="""Sets the name of the handler to load for
+#                       datasource interactions. e.g. mongodb
+#                    """
+#    ),
+#    cfg.BoolOpt('verbose',
+#                default=False,
+#                help="""Sets whether or not the datasource handlers
+#                       should be verbose in their logging output.
+#                    """
+#    )
+#]
+
+#get_config().register_opts(HANDLER_OPTIONS, group=datasource_group)
+
+
+# Handler registration
+#_DATASOURCE_HANDLERS = DatasourceHandlerManager()
+
+STATUS_NEW = 'NEW'
+STATUS_CONNECTED = 'CONNTECTED'
+STATUS_CLOSED = 'CLOSED'
+
+
+def datasource_handler(conf):
+    handler_def = _DATASOURCE_HANDLERS[conf.handler_name]
+    return handler_def(conf)
+
+
+def register_handler(handler_name, handler_def):
+    _DATASOURCE_HANDLERS.register(handler_name, handler_def)
+
+
+class DatasourceHandlerManager():
+
+    def __init__(self):
+        self.registered_handlers = dict()
+
+    def register(self, handler_name, handler_def):
+        self.registered_handlers[handler_name] = handler_def
+
+    def get(self, handler_name):
+        return self.registered_handlers[handler_name]
+
+_DATASOURCE_HANDLERS = DatasourceHandlerManager()
+
+class DatasourceHandler():
+
+    status = STATUS_NEW
+
+    def status(self):
+        return self.status
+
+    def connect(self):
+        raise NotImplementedError
+
+    def close(self):
+        raise NotImplementedError
+
+    def get(self, object_name, object_id):
+        raise NotImplementedError
+
+    def put(self, object_name, update_object):
+        raise NotImplementedError
+
+    def delete(self, object_name, object_id):
+        raise NotImplementedError
+
--- a/barbican/data/tenant.py
+++ b/barbican/data/tenant.py
@ -0,0 +1,15 @@
+from barbican.data.adapters.handler import datasource_handler
+
+handler = datasource_handler
+
+def get_tenant(tenant_id):
+    pass
+
+def save_tenant(tenant_object):
+    pass
+
+def create_tenant(tenant_id):
+    pass
+
+def delete_tenant(tenant_id):
+    pass
--- a/barbican/samples/init.py
+++ b/barbican/samples/init.py
--- a/barbican/locale/keep.pot
+++ b/barbican/locale/keep.pot
@ -0,0 +1,18 @@
+# Translations template for barbican. 
+# Copyright (C) 2013 ORGANIZATION
+# This file is distributed under the same license as 
+# the barbican project. FIRST AUTHOR <EMAIL@ADDRESS>, 2012.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: barbican 2013.1\n"
+"Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
+"POT-Creation-Date: 2013-03-20 17:19-0800\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" 
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n" 
+"Content-Transfer-Encoding: 8bit\n"
+"Generated-By: Babel 0.9.6\n"
--- a/barbican/model/init.py
+++ b/barbican/model/init.py
@ -0,0 +1,18 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Model objects for Cloudkeep's Barbican
+"""
--- a/barbican/model/base.py
+++ b/barbican/model/base.py
@ -0,0 +1,35 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Base class for all model objects."""
+
+from sqlalchemy import Column
+from sqlalchemy import Integer, ForeignKey
+from sqlalchemy.ext.declarative import declarative_base, declared_attr
+
+
+class Persisted(object):
+
+    id = Column(Integer, primary_key=True)
+
+    @declared_attr
+    def __tablename__(self):
+        return self.__name__.lower()
+
+Base = declarative_base(cls=Persisted)
--- a/barbican/model/secret.py
+++ b/barbican/model/secret.py
@ -0,0 +1,43 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Represents a secret to store in Cloudkeep's Barbican."""
+
+#import barbican.model.Tenant
+from base import Base
+from sqlalchemy import Table, Column, String
+from sqlalchemy import Integer, ForeignKey, Boolean
+from sqlalchemy.orm import relationship, backref
+from sqlalchemy.ext.declarative import declarative_base, declared_attr
+
+#
+# class Secret(Base):
+#     """
+#     A secret is any information that needs to be stored and protected within 
+#     Cloudkeep's Barbican.
+#     """
+#
+#     secret_id = Column(String)
+#     name = Column(String)
+#     tenant_id = Column(Integer, ForeignKey('tenant.id'))
+#     tenant = relationship(Tenant, primaryjoin=tenant_id == Tenant.id)
+#
+#     def __init__(self, secret_id):
+#         self.secret_id = secret_id
+
--- a/barbican/model/tenant.py
+++ b/barbican/model/tenant.py
@ -0,0 +1,86 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Generic Node base class for all workers that run on hosts."""
+
+import logging
+from base import Base
+from sqlalchemy import Table, Column, String
+from sqlalchemy import Integer, ForeignKey, Boolean
+from sqlalchemy.orm import relationship, relation, backref
+from sqlalchemy.ext.declarative import declarative_base, declared_attr
+
+
+class Tenant(Base):
+    """
+    Tenants are users that wish to store secret information within Cloudkeep's Barbican.
+    """
+
+    logging.debug('In Tenant table setup')
+
+    __tablename__ = "tenants"
+
+    id = Column(Integer, primary_key=True)
+    username = Column(String)
+    # secrets = relationship('Secret', backref='tenant', lazy='dynamic')
+    # secrets = relationship('Secret', secondary=_secrets)
+    # secrets = relationship("Secret",
+    #                     order_by="desc(Secret.name)",
+    #                     primaryjoin="Secret.tenant_id==Tenant.id")
+
+
+    def __init__(self, username):
+        self.username = username
+
+    def __init__(self, username, secrets=[]):
+        self.username = username
+        self.secrets = secrets
+
+    def format(self):
+        return {'id': self.id,
+            'username': self.username}
+
+
+class Secret(Base):
+    """
+    A secret is any information that needs to be stored and protected within Cloudkeep's Barbican.
+    """
+
+    __tablename__ = "secrets"
+
+    id = Column(Integer, primary_key=True)
+    name = Column(String)
+    tenant_id = Column(Integer, ForeignKey('tenants.id'))
+    tenant = relationship("Tenant", backref=backref('secrets', order_by=id))
+    # tenant = relationship(Tenant, primaryjoin=tenant_id == Tenant.id)
+
+    # creates a bidirectional relationship
+    # from Secret to Tenant it's Many-to-One
+    # from Tenant to Secret it's One-to-Many
+    # tenant = relation(Tenant, backref=backref('secret', order_by=id))
+
+    def __init__(self, tenant_id, name):
+        self.tenant_id = tenant_id
+        self.name = name
+
+    def format(self):
+        return {'id': self.id,
+                'name': self.username,
+                'tenant_id': self.tenant_id}
+
--- a/barbican/model/util.py
+++ b/barbican/model/util.py
@ -0,0 +1,33 @@
+from sqlalchemy.orm.exc import NoResultFound, MultipleResultsFound
+
+from barbican.model.tenant import Tenant, Secret
+
+
+def _empty_condition():
+    pass
+
+
+def find_tenant(db_session, id=None, username=None,
+                when_not_found=_empty_condition,
+                when_multiple_found=_empty_condition):
+    try:
+        if id:
+            return db_session.query(Tenant).filter_by(id=id).one()
+        elif username:
+            return db_session.query(Tenant).filter_by(username=username).one()
+    except NoResultFound:
+        when_not_found()
+    except MultipleResultsFound:
+        when_multiple_found()
+
+    return None
+
+
+def find_secret(db_session, id, when_not_found=_empty_condition,
+              when_multiple_found=_empty_condition):
+    try:
+        return db_session.query(Secret).filter_by(id=id).one()
+    except NoResultFound:
+        when_not_found()
+    except MultipleResultsFound:
+        when_multiple_found()
--- a/barbican/samples/sample.py
+++ b/barbican/samples/sample.py
@ -1,23 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Sample Python file, here to test out code coverage in Jenkins.
-    ~~~~~~~~~~~~
-
-    DO NOT USE THIS IN PRODUCTION. IT IS NOT SECURE IN ANY WAY.
-    YOU HAVE BEEN WARNED.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for details
-"""
-def a_sample_method_here():
-    foo = "bar"
-    i = 1
-    if ("bar" == foo):
-        print "saw bar"
-        i += 2
-    else:
-        print "not bar"
-        i += 4
-    print "total",i
-
-a_sample_method_here()  # Do something coverage can chew on.
--- a/barbican/tests/init.py
+++ b/barbican/tests/init.py
@ -0,0 +1 @@
+__author__ = 'john.wood'
--- a/barbican/tests/api/init.py
+++ b/barbican/tests/api/init.py
@ -0,0 +1 @@
+__author__ = 'john.wood'
--- a/barbican/tests/api/resources_test.py
+++ b/barbican/tests/api/resources_test.py
@ -0,0 +1,67 @@
+from datetime import datetime
+from barbican.api.resources import *
+from barbican.model.tenant import Tenant
+
+from mock import MagicMock
+
+import falcon
+import unittest
+
+
+def suite():
+    suite = unittest.TestSuite()
+    suite.addTest(WhenTestingVersionResource())
+
+    return suite
+
+
+class WhenTestingVersionResource(unittest.TestCase):
+
+    def setUp(self):
+        self.req = MagicMock()
+        self.resp = MagicMock()
+        self.resource = VersionResource()
+
+    def test_should_return_200_on_get(self):
+        self.resource.on_get(self.req, self.resp)
+        self.assertEqual(falcon.HTTP_200, self.resp.status)
+
+    def test_should_return_version_json(self):
+        self.resource.on_get(self.req, self.resp)
+
+        parsed_body = json.loads(self.resp.body)
+
+        self.assertTrue('v1' in parsed_body)
+        self.assertEqual('current', parsed_body['v1'])
+
+
+class WhenCreatingTenantsUsingTenantsResource(unittest.TestCase):
+
+    def setUp(self):
+        db_filter = MagicMock()
+        db_filter.one.return_value = Tenant('tenant_id')
+
+        db_query = MagicMock()
+        db_query.filter_by.return_value = db_filter
+
+        self.db_session = MagicMock()
+        self.db_session.query.return_value = db_query
+
+        self.stream = MagicMock()
+        self.stream.read.return_value = u'{ "username" : "1234" }'
+
+        self.req = MagicMock()
+        self.req.stream = self.stream
+
+        self.resp = MagicMock()
+        self.resource = TenantsResource(self.db_session)
+
+    def test_should_throw_exception_for_tenants_that_exist(self):
+        with self.assertRaises(falcon.HTTPError):
+            self.resource.on_post(self.req, self.resp)
+
+        self.db_session.query.assert_called_once_with(Tenant)
+
+
+if __name__ == '__main__':
+    unittest.main()
--- a/barbican/tests/api/tenant/init.py
+++ b/barbican/tests/api/tenant/init.py
@ -0,0 +1 @@
+__author__ = 'john.wood'
--- a/barbican/tests/config_test.py
+++ b/barbican/tests/config_test.py
@ -1,38 +0,0 @@
-#import os
-import unittest
-
-#from oslo.config import cfg
-#from meniscus.config import init_config, get_config
-
-
-# Configuration test configuration options
-#test_group = cfg.OptGroup(name='test', title='Configuration Test')
-
-#CFG_TEST_OPTIONS = [
-#    cfg.BoolOpt('should_pass',
-#                default=False,
-#                help="""Example option to make sure configuration
-#                        loading passes test.
-#                     """
-#                )
-#]
-
-
-def suite():
-    suite = unittest.TestSuite()
-    suite.addTest(WhenConfiguring())
-
-    return suite
-
-
-class WhenConfiguring(unittest.TestCase):
-
-    def test_loading(self):
-        self.assertTrue(True) 
-#       init_config(['--config-file', '../etc/meniscus/meniscus.conf'])
-
-#       conf = get_config()
-#       conf.register_group(test_group)
-#       conf.register_opts(CFG_TEST_OPTIONS, group=test_group)
-
-#       self.assertTrue(conf.test.should_pass)
--- a/barbican/version.py
+++ b/barbican/version.py
@ -0,0 +1,21 @@
+# Copyright 2010-2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Cloudkeep's Barbican version
+"""
+
+__version__ = '0.1.74dev'
+__version_info__ = tuple(__version__.split('.'))
--- a/barbican_api.py
+++ b/barbican_api.py
@ -1,106 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Barbican API
-    ~~~~~~~~~~~~
-
-    The API for Barbican.
-
-    DO NOT USE THIS IN PRODUCTION. IT IS NOT SECURE IN ANY WAY.
-    YOU HAVE BEEN WARNED.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for details
-"""
-import uuid
-import datetime
-from dateutil.parser import parse
-from flask import Blueprint, request, jsonify, Response, json
-from models import Event, Tenant, Key, Agent, Policy
-from database import db_session
-
-api = Blueprint('api', __name__, url_prefix="/api")
-
-
-@api.route('/')
-def root():
-    return jsonify(hello='World')
-
-
-@api.route('/<int:tenant_id>/policies/', methods=['GET', 'POST'])
-def policies(tenant_id):
-    if request.method == 'POST':
-        for policy in request.json['policies']:
-            keys = []
-            for k in policy['keys']:
-                key = Key(uuid=k['uuid'], filename=k['filename'], mime_type=k['mime_type'],
-                          expiration=parse(k['expiration']), secret=k['secret'], owner=k['owner'],
-                          group=k['group'], cacheable=k['cacheable'])
-                keys.append(key)
-
-            policy = Policy(uuid=policy['uuid'], name=policy['name'], tenant_id=tenant_id,
-                            directory_name=policy['directory_name'],
-                            max_key_accesses=policy['max_key_accesses'],
-                            time_available_after_reboot=policy['time_available_after_reboot'])
-            policy.keys.extend(keys)
-            db_session.add(policy)
-        db_session.commit()
-
-        return Response(status=200)
-    else:
-        policy = Policy.query.filter_by(tenant_id=tenant_id).first()
-
-        if policy is None:
-            return Response('No policies defined for tenant', status=404)
-
-        return jsonify(policy.as_dict())
-
-
-@api.route('/<int:tenant_id>/agents/', methods=['GET', 'POST'])
-def agents(tenant_id):
-    if request.method == 'POST':
-        tenant = Tenant.query.get(tenant_id)
-        agent = Agent(tenant=tenant, uuid=request.json['uuid'])
-        db_session.add(agent)
-        db_session.commit()
-        return jsonify(agent.as_dict())
-    else:
-        agents = Agent.query.filter_by(tenant_id=tenant_id)
-        agents_dicts = map(Agent.as_dict, agents.all())
-        return Response(json.dumps(agents_dicts, cls=DateTimeJsonEncoder), mimetype='application/json')
-
-
-
-@api.route('/<int:tenant_id>/logs/', methods=['GET', 'POST'])
-def logs(tenant_id):
-    if request.method == 'POST':
-        agent_id = uuid.UUID(request.json['agent_id'])
-        received_on = parse(request.json['received_on'])
-        key_id = uuid.UUID(request.json['key_id'])
-
-        if request.json['severity'] in ['DEBUG', 'INFO', 'WARN', 'FATAL']:
-            severity = request.json['severity']
-        else:
-            severity = 'UNKNOWN'
-
-        # Load the key and tenant
-        tenant = Tenant.query.get(tenant_id)
-        key = Key.query.filter_by(uuid=str(key_id)).first()
-
-        ev = Event(tenant_id=tenant_id, agent_id=str(agent_id), received_on=received_on,
-                   severity=severity, message=request.json['message'], tenant=tenant, key=key)
-        db_session.add(ev)
-        db_session.commit()
-
-        return Response(json.dumps(ev.as_dict(), cls=DateTimeJsonEncoder), mimetype='application/json')
-    else:
-        events = Event.query.filter_by(tenant_id=tenant_id).order_by(Event.received_on)
-        events_dicts = map(Event.as_dict, events.all())
-        return Response(json.dumps(events_dicts, cls=DateTimeJsonEncoder), mimetype='application/json')
-
-
-class DateTimeJsonEncoder(json.JSONEncoder):
-    def default(self, obj):
-        if isinstance(obj, datetime.datetime):
-            return obj.isoformat()
-        else:
-            return super(DateTimeJsonEncoder, self).default(obj)
--- a/barbican_tests.py
+++ b/barbican_tests.py
@ -1,12 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Barbican Tests
-    ~~~~~~~~~~~~~~
-
-    Tests the Barbican application.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for more details.
-"""
-
-
--- a/database.py
+++ b/database.py
@ -1,34 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Barbican Models
-    ~~~~~~~~~~~~~~~
-
-    The models for the Barbican application.
-
-    DO NOT USE THIS IN PRODUCTION. IT IS NOT SECURE IN ANY WAY.
-    YOU HAVE BEEN WARNED.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for details
-"""
-from sqlalchemy import create_engine
-from sqlalchemy.orm import scoped_session, sessionmaker
-from sqlalchemy.ext.declarative import declarative_base
-
-engine = create_engine('sqlite:////tmp/barbican.db', convert_unicode=True)
-db_session = scoped_session(sessionmaker(autocommit=False,
-                                         autoflush=False,
-                                         bind=engine))
-Base = declarative_base()
-Base.query = db_session.query_property()
-
-
-def init_db():
-    # import all modules here that might define models so that
-    # they will be registered properly on the metadata.  Otherwise
-    # you will have to import them first before calling init_db()
-    import models
-    Base.metadata.create_all(bind=engine)
-    db_session.add(models.User('admin', 'admin@localhost', 'Passw0rd'))
-    db_session.add(models.Tenant(id=123))
-    db_session.commit()
--- a/debian/barbican-api.dirs
+++ b/debian/barbican-api.dirs
@ -0,0 +1 @@
+/var/lib/barbican/temp
--- a/debian/barbican-api.init
+++ b/debian/barbican-api.init
@ -0,0 +1,94 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          barbican-api
+# Required-Start:    $network $local_fs $remote_fs $syslog
+# Required-Stop:     $remote_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Barbican API server
+# Description:       Frontend Barbican API server
+### END INIT INFO
+
+# Author: John Wood <john.wood@rackspace.com>
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="Key Management Service API"
+NAME=barbican-api
+DAEMON=/usr/bin/barbican-api
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x $DAEMON ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+. /lib/lsb/init-functions
+
+do_start()
+{
+	start-stop-daemon --start --background --quiet --chuid barbican:barbican --make-pidfile --pidfile $PIDFILE --startas $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --background --quiet --chuid barbican:barbican --make-pidfile --pidfile $PIDFILE --startas $DAEMON \
+		|| return 2
+}
+
+do_stop()
+{
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE
+	RETVAL="$?"
+	rm -f $PIDFILE
+
+        # TBD: HACK ALERT! Need to figure out why uwsgi spawns a separate process!
+        killall -s SIGKILL uwsgi
+
+	return "$RETVAL"
+}
+
+case "$1" in
+  start)
+    log_daemon_msg "Starting $DESC" "$NAME"
+    do_start
+    case "$?" in
+		0|1) log_end_msg 0 ;;
+		2) log_end_msg 1 ;;
+	esac
+  ;;
+  stop)
+	log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) log_end_msg 0 ;;
+		2) log_end_msg 1 ;;
+	esac
+	;;
+  status)
+       status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+       ;;
+  restart|force-reload)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
--- a/debian/barbican-api.install
+++ b/debian/barbican-api.install
@ -0,0 +1,3 @@
+etc/barbican/barbican-api.ini etc/barbican
+etc/barbican/config.py etc/barbican
+usr/bin/barbican-api
--- a/debian/barbican-api.logrotate
+++ b/debian/barbican-api.logrotate
@ -0,0 +1,7 @@
+/var/log/barbican/barbican-api.log {
+    daily
+    missingok
+    compress
+    delaycompress
+    notifempty
+}
--- a/debian/barbican-api.postinst
+++ b/debian/barbican-api.postinst
@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "configure" ]
+then
+
+    # TBD: If we need to ask the user for config info such as 'use lightweight/standalone mode?', 
+    #   then look at Glance's glance-api.postinst
+    # . /usr/share/debconf/confmodule
+
+    chown barbican:barbican /var/lib/barbican -R
+fi
+
+#DEBHELPER#
--- a/debian/barbican-api.prerm
+++ b/debian/barbican-api.prerm
@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -e
+
+case $1 in
+    remove|purge)
+        if [ -x /etc/init.d/barbican-api ]; then
+            invoke-rc.d barbican-api stop || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#
+
--- a/debian/barbican-common.dirs
+++ b/debian/barbican-common.dirs
@ -0,0 +1,4 @@
+/etc/barbican/
+/var/lib/barbican/
+/var/lib/barbican/temp/
+/var/log/barbican/
--- a/debian/barbican-common.postinst
+++ b/debian/barbican-common.postinst
@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "configure" ]
+then
+    . /usr/share/debconf/confmodule
+    if ! getent group barbican > /dev/null 2>&1
+    then
+	addgroup --quiet --system barbican >/dev/null
+    fi
+    if ! getent passwd barbican > /dev/null 2>&1
+    then
+	adduser --quiet --system --home /var/lib/barbican --ingroup barbican --no-create-home --shell /bin/false barbican
+    fi
+
+    chown -R barbican:adm /var/log/barbican/
+    chmod 0750 /var/log/barbican/
+    chown barbican:barbican -R /var/lib/barbican/ /etc/barbican/
+    chmod 0700 /etc/barbican/
+
+    # TBD: Replace these pip requirements with a true Debian package equivalent (via stdeb perhaps).
+    pip install uwsgi
+    pip install falcon
+fi
+
+#DEBHELPER#
--- a/debian/barbican-common.postrm
+++ b/debian/barbican-common.postrm
@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -e
+
+case $1 in
+    purge)
+	echo "Purging barbican. Backup of /var/lib/barbican can be found at /var/lib/barbican.tar.bz2" >&2
+	if ( getent passwd barbican) > /dev/null 2>&1; then
+	    userdel barbican || true
+	fi
+
+	if ( getent group barbican) > /dev/null 2>&1; then
+	    groupdel barbican || true
+	fi
+
+	[ -e /var/lib/barbican ] && rm -rf /var/lib/barbican
+	[ -e /var/log/barbican ] && rm -rf /var/log/barbican
+	;;
+esac
+
+#DEBHELPER#
--- a/debian/changelog
+++ b/debian/changelog
@ -0,0 +1,5 @@
+barbican (0.1.1dev-1) stable; urgency=high
+
+  * Updated version.
+
+ -- John Wood <john.wood@rackspace.com>  Mon, 01 Apr 2013 16:27:50 -0500
--- a/debian/changelog-orig
+++ b/debian/changelog-orig
@ -0,0 +1,5 @@
+barbican (0.1.42-1) stable; urgency=high
+
+  * Initial upload.
+
+ -- John Wood <john.wood@rackspace.com>  Wed, 20 Mar 2013 12:01:32 +0100
--- a/debian/compat
+++ b/debian/compat
@ -0,0 +1 @@
+7
--- a/debian/control
+++ b/debian/control
@ -0,0 +1,96 @@
+Source: barbican
+Section: net
+Priority: extra
+Maintainer: PKG OpenStack <openstack-devel@lists.alioth.debian.org>
+Uploaders: John Wood <john.wood@rackspace.com>
+Build-Depends: debhelper (>= 7.0.50),
+ po-debconf,
+ python-all (>= 2.6.6-3~),
+ sqlite3,
+ curl,
+ pep8,
+ python-boto,
+ python-crypto,
+ python-eventlet,
+ python-httplib2 (>= 0.6.0),
+ python-iso8601,
+ python-kombu,
+ python-novaclient,
+ python-migrate,
+ python-mox,
+ python-nose,
+ python-paste,
+ python-pastedeploy,
+ python-routes,
+ python-setuptools,
+ python-sphinx,
+ python-sqlalchemy (>= 0.7.4),
+ python-pysqlite2,
+ python-swift,
+ python-webob,
+ python-xattr,
+ procps
+Standards-Version: 3.9.3
+X-Python-Version: >= 2.6
+Homepage: http://launchpad.net/barbican
+Vcs-Browser: https://github.com/jfwood/barbican
+Vcs-Git: git://github.com/jfwood/barbican.git
+
+Package: python-barbican
+Architecture: amd64
+Section: python
+Depends: ${python:Depends}, ${misc:Depends},
+ python-boto,
+ python-crypto,
+ python-eventlet,
+ python-httplib2 (>= 0.6.0),
+ python-iso8601,
+ python-kombu,
+ python-migrate,
+ python-pastedeploy,
+ python-routes,
+ python-sqlalchemy (>= 0.7.4),
+ python-pysqlite2,
+ python-swift,
+ python-webob,
+ python-xattr
+Description: OpenStack Key Management Service - Python client library
+ The Barbican project provides services for storing and retrieving sensitive 
+ client information such as encryption keys.
+ .
+ This package contains the Python client libraries.
+
+Package: barbican-common
+Architecture: amd64
+Section: python
+Depends: ${python:Depends}, ${misc:Depends},
+ python-barbican (= ${binary:Version}),
+ adduser,
+ debconf,
+Description: OpenStack Key Management Service - common files
+ The Barbican project provides services for storing and retrieving sensitive 
+ client information such as encryption keys.
+ .
+ This package contains common files for Barbican.
+
+Package: barbican-api
+Architecture: amd64
+Section: python
+Depends: ${python:Depends}, ${misc:Depends},
+ barbican-common (= ${binary:Version})
+Description: OpenStack Key Management Service - API Server
+ The Barbican project provides services for storing and retrieving sensitive 
+ client information such as encryption keys.
+ .
+ This package contains the Barbican API Server.
+
+Package: barbican
+Architecture: amd64
+Section: python
+Depends: barbican-api (= ${binary:Version}),
+ ${misc:Depends}
+Description: OpenStack Key Management Service - metapackage
+ The Barbican project provides services for storing and retrieving sensitive 
+ client information such as encryption keys.
+ .
+ This is a dependency package to install all of the Cloudkeep suite.
--- a/debian/copyright
+++ b/debian/copyright
@ -0,0 +1,23 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: barbican
+Source: https://code.launchpad.net/barbican
+
+Files: *
+Copyright: 2010 United States Government as represented by the Administrator of the National Aeronautics and Space Administration.
+  2010-2011 OpenStack LLC
+  Others (See individual files for more details)
+License: Apache-2
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ .
+    http://www.apache.org/licenses/LICENSE-2.0
+ .
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ .
+ On Debian-based systems the full text of the Apache version 2.0 license
+ can be found in `/usr/share/common-licenses/Apache-2.0'.
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@ -0,0 +1,8 @@
+[DEFAULT]
+upstream-branch = master
+debian-branch = master
+upstream-tag = %(version)
+compression = xz 
+
+[git-buildpackage]
+export-dir = ../build-area/
--- a/debian/python-barbican.install
+++ b/debian/python-barbican.install
@ -0,0 +1 @@
+usr/lib/python*/dist-packages/*
--- a/debian/rules
+++ b/debian/rules
@ -0,0 +1,43 @@
+#!/usr/bin/make -f
+
+# Verbose mode
+#export DH_VERBOSE=1
+
+%:
+	dh $@ --with python2
+
+#ifeq (,$(findstring nocheck, $(DEB_BUILD_OPTIONS)))
+#override_dh_auto_test:
+#	bash run_tests.sh -N || true
+#endif
+
+# TBD: Use this when we are ready for sphinx docs
+#override_dh_auto_build:
+#	dh_auto_build
+#ifeq (,$(findstring nodocs, $(DEB_BUILD_OPTIONS)))
+#	mkdir -p doc/build
+#	python setup.py build_sphinx
+#else
+#	mkdir -p doc/build/html
+#endif
+
+override_dh_auto_clean:
+	dh_auto_clean
+# TDB: OpenStack:	debconf-updatepo
+# TBD: OpenStack:	rm -rf doc/build
+	rm -rf build barbican.egg-info 
+# TBD: OpenStack:	po/barbican.pot barbican/vcsversion.py
+	rm -rf barbican.sqlite
+
+# TBD: Revisit this for OpenStack usage...probably can't do the 'dev' for snapshots approach anymore!
+#get-vcs-source:
+#	git remote add upstream git://github.com/jfwood/barbican.git || true
+#	git fetch upstream
+##        cd barbican
+##        VER=$(python -c 'import barbican.version; print barbican.version.__version__')
+#	if ! [ -f ../glance_2012.1.orig.tar.xz ] ; then git archive --prefix=glance-2012.1/ 2012.1 | xz >../glance_2012.1.orig.tar.xz ; fi
+#	if ! git checkout master ; then \
+#		echo "No upstream branch: checking out" ; \
+#		git checkout -b master upstream/master ; \
+#	fi
+#	git checkout debian/unstable
--- a/debian/source/format
+++ b/debian/source/format
@ -0,0 +1 @@
+3.0 (quilt)
--- a/debian/watch_tbd
+++ b/debian/watch_tbd
@ -0,0 +1 @@
+TBD: Eventually, we might need a true 'watch' file to barbican track of launchpad tarballs?  See glance project for example.
--- a/etc/barbican/barbican-api.ini
+++ b/etc/barbican/barbican-api.ini
@ -0,0 +1,11 @@
+[uwsgi] 
+socket = :8080
+protocol = http
+processes = 1
+master = true
+vaccum = true
+no-default-app = true 
+memory-report = true
+
+pythonpath = /etc/barbican
+module = barbican.api.app:application
--- a/etc/barbican/barbican.conf
+++ b/etc/barbican/barbican.conf
@ -0,0 +1 @@
+# Default Cloudkeep Barbican Config File
--- a/etc/barbican/config.py
+++ b/etc/barbican/config.py
@ -0,0 +1,9 @@
+config = {
+    'sqlalchemy' : {
+        'url'           : 'sqlite:////tmp/barbican.db',
+        'echo'          : True,
+        'echo_pool'     : False,
+        'pool_recycle'  : 3600,
+        'encoding'      : 'utf-8'
+    }
+}
--- a/examples/agent-pair.json
+++ b/examples/agent-pair.json
@ -1,3 +0,0 @@
-{
-    "uuid": "3e77a5e3-8778-44aa-b19e-36e2b688b815"
-}
--- a/examples/log-event.json
+++ b/examples/log-event.json
@ -1,7 +0,0 @@
-{
-    "agent_id": "869b81e0-6181-4afc-bf5b-3f785f2d503f",
-    "received_on": "2013-02-26T19:53:14+18:00",
-    "severity": "INFO",
-    "key_id": "331d341c-b171-47f9-9a7b-7a15e8d85893",
-    "message": "Key accessed by user 'apache'."
-}
--- a/examples/policy.json
+++ b/examples/policy.json
@ -1,23 +0,0 @@
-{
-    "policies": [
-        {
-            "uuid": "01fb57ff-058c-4d68-85e9-d81844dd0089",
-            "name": "Available after reboot",
-            "directory_name": "my-app-key",
-            "max_key_accesses": 1,
-            "time_available_after_reboot": 10,
-            "keys": [
-                {
-                    "uuid": "e2b633c7-fda5-4be8-b42c-9a2c9280284d",
-                    "filename": "configuration_key",
-                    "mime_type": "application/aes-256-cbc",
-                    "expiration": "2014-02-28T19:14:44.180394",
-                    "secret": "b7990b786ee9659b43e6b1cd6136de07d9c5aa06513afe5d091c04bde981b280",
-                    "owner": "myapp",
-                    "group": "myapp",
-                    "cacheable": false
-                }
-            ]
-        }
-    ]
-}
--- a/models.py
+++ b/models.py
@ -1,216 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    Barbican Models
-    ~~~~~~~~~~~~~~~
-
-    The models for Barbican.
-
-    :copyright: (c) 2013 by Jarret Raim
-    :license: Apache 2.0, see LICENSE for details
-"""
-from uuid import uuid4
-from sqlalchemy import Column, Integer, String, DateTime, Text, Boolean
-from sqlalchemy.orm import relationship, backref
-from sqlalchemy.schema import ForeignKey
-from database import Base
-
-
-class User(Base):
-    __tablename__ = 'users'
-    id = Column(Integer, primary_key=True)
-    name = Column(String(50), unique=True)
-    email = Column(String(120), unique=True)
-    password = Column(String(50))
-
-    def is_authenticated(self):
-        return True
-
-    def is_active(self):
-        return True
-
-    def is_anonymous(self):
-        return False
-
-    def get_id(self):
-        return self.id
-
-    def __init__(self, name=None, email=None, password=None):
-        self.name = name
-        self.email = email
-        self.password = password
-
-    def __repr__(self):
-        return '<User %r>' % self.name
-
-
-class Tenant(Base):
-    __tablename__ = 'tenants'
-    id = Column(Integer, primary_key=True)
-    uuid = Column(String(36), unique=True)
-
-    def __init__(self, uuid=None, id=None):
-        self.id = id
-        if uuid is None:
-            self.uuid = str(uuid4())
-        else:
-            self.uuid = uuid
-
-    def __repr__(self):
-        return '<Tenant %s>' % self.uuid
-
-
-class Key(Base):
-    __tablename__ = 'keys'
-    id = Column(Integer, primary_key=True)
-    uuid = Column(String(36), unique=True)
-    filename = Column(String(128))
-    mime_type = Column(String(128))
-    expiration = Column(DateTime)
-    secret = Column(Text)
-    owner = Column(String(33))
-    group = Column(String(33))
-    cacheable = Column(Boolean)
-
-    policy_id = Column(Integer, ForeignKey('policies.id'))
-    policy = relationship("Policy", backref=backref('keys'))
-
-    def __init__(self, uuid=None, filename=None, mime_type=None, expiration=None, secret=None,
-                 owner=None, group=None, cacheable=None, policy_id=None):
-        if uuid is None:
-            self.uuid = str(uuid4())
-        else:
-            self.uuid = uuid
-
-        self.filename = filename
-        self.mime_type = mime_type
-        self.expiration = expiration
-        self.secret = secret
-        self.owner = owner
-        self.group = group
-        self.cacheable = cacheable
-        self.policy_id = policy_id
-
-    def __repr__(self):
-        return '<Key %s>' % self.uuid
-
-    def as_dict(self):
-        json = {
-            'uuid': self.uuid,
-            'filename': self.filename,
-            'mime_type': self.mime_type,
-            'expiration': self.expiration.isoformat(),
-            'secret': self.secret,
-            'owner': self.owner,
-            'group': self.group,
-            'cachecable': self.cacheable
-        }
-        return json
-
-
-class Agent(Base):
-    __tablename__ = 'agents'
-    id = Column(Integer, primary_key=True)
-    uuid = Column(String(36), unique=True)
-
-    tenant_id = Column(Integer, ForeignKey('tenants.id'))
-    tenant = relationship("Tenant", backref=backref('agents', order_by=id))
-
-    def __init__(self, tenant=None, uuid=None):
-        self.tenant = tenant
-        if uuid is None:
-            self.uuid = str(uuid4())
-        else:
-            self.uuid = uuid
-
-    def __repr__(self):
-        return '<Agent %s>' % self.uuid
-
-    def as_dict(self):
-        agent = {
-            'tenant_id': self.tenant_id,
-            'uuid': self.uuid
-        }
-        return agent
-
-
-class Policy(Base):
-    __tablename__ = 'policies'
-    id = Column(Integer, primary_key=True)
-    uuid = Column(String(36), unique=True)
-    name = Column(String(100))
-    directory_name = Column(String(254))
-    max_key_accesses = Column(Integer)
-    time_available_after_reboot = Column(Integer)
-
-    tenant_id = Column(Integer, ForeignKey('tenants.id'))
-    tenant = relationship("Tenant", backref=backref('policies', order_by=id))
-
-    def __init__(self, uuid=None, name=None, directory_name=None, max_key_accesses=None,
-                 time_available_after_reboot=None, tenant_id=None):
-        if uuid is None:
-            self.uuid = str(uuid4())
-        else:
-            self.uuid = uuid
-
-        self.name = name
-        self.directory_name = directory_name
-        self.max_key_accesses = max_key_accesses
-        self.time_available_after_reboot = time_available_after_reboot
-        self.tenant_id = tenant_id
-
-    def __repr__(self):
-        return '<Policy %s >' % self.uuid
-
-    def as_dict(self):
-        keys = map(Key.as_dict, self.keys)
-
-        json = {
-            'uuid': self.uuid,
-            'name': self.name,
-            'directory_name': self.directory_name,
-            'max_key_accesses': self.max_key_accesses,
-            'time_available_after_reboot': self.time_available_after_reboot,
-            'tenant_id': self.tenant_id,
-            'keys': keys
-        }
-        return json
-
-
-class Event(Base):
-    __tablename__ = 'events'
-    id = Column(Integer, primary_key=True)
-    agent_id = Column(String(36))
-    received_on = Column(DateTime())
-    severity = Column(String(10))
-    message = Column(Text())
-
-    tenant_id = Column(Integer, ForeignKey('tenants.id'))
-    tenant = relationship("Tenant", backref=backref('events', order_by=id))
-
-    key_id = Column(Integer, ForeignKey('keys.id'))
-    key = relationship("Key", backref=backref('events', order_by=id))
-
-    def __init__(self, tenant_id=None, agent_id=None, received_on=None, severity=None,
-                 message=None, tenant=None, key=None):
-        self.tenant_id = tenant_id
-        self.agent_id = agent_id
-        self.received_on = received_on
-        self.severity = severity
-        self.message = message
-        self.key = key
-        self.tenant = tenant
-
-    def __repr__(self):
-        return '<Event %s [%s] - %s >' % (self.received_on, self.severity, self.message[:25])
-
-    def as_dict(self):
-        json = {
-            'id': self.id,
-            'agent_id': self.agent_id,
-            'received_on': self.received_on.isoformat(),
-            'severity': self.severity,
-            'tenant_id': self.tenant_id,
-            'key_id': self.key_id,
-            'message': self.message
-        }
-        return json
--- a/27
+++ b/27
@ -0,0 +1,27 @@
+[Messages Control]
+# W0511: TODOs in code comments are fine.
+# W0142: *args and **kwargs are fine.
+# W0622: Redefining id is fine.
+disable-msg=W0511,W0142,W0622
+
+[Basic]
+# Variable names can be 1 to 31 characters long, with lowercase and underscores
+variable-rgx=[a-z_][a-z0-9_]{0,30}$
+
+# Argument names can be 2 to 31 characters long, with lowercase and underscores
+argument-rgx=[a-z_][a-z0-9_]{1,30}$
+
+# Method names should be at least 3 characters long
+# and be lowecased with underscores
+method-rgx=[a-z_][a-z0-9_]{2,50}$
+
+# Module names matching nova-* are ok (files in bin/)
+module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+)|(nova-[a-z0-9_-]+))$
+
+# Don't require docstrings on tests.
+no-docstring-rgx=((__.*__)|([tT]est.*)|setUp|tearDown)$
+
+[Design]
+max-public-methods=100
+min-public-methods=0
+max-args=6
--- a/requirements.txt
+++ b/requirements.txt
@ -1,14 +0,0 @@
-Flask==0.9
-Flask-Admin==1.0.4
-Flask-Login==0.1.3
-Flask-SQLAlchemy==0.16
-Flask-WTF==0.8.2
-Jinja2==2.6
-SQLAlchemy==0.8.0b2
-WTForms==1.0.3
-Werkzeug==0.8.3
-argparse==1.2.1
-ipython==0.13.1
-python-dateutil==2.1
-six==1.2.0
-wsgiref==0.1.2
--- a/run_tests.sh
+++ b/run_tests.sh
@ -0,0 +1,96 @@
+#!/bin/bash
+
+function usage {
+  echo "Usage: $0 [OPTION]..."
+  echo "Run Glance's test suite(s)"
+  echo ""
+  echo "  -V, --virtual-env        Always use virtualenv.  Install automatically if not present"
+  echo "  -N, --no-virtual-env     Don't use virtualenv.  Run tests in local environment"
+  echo "  -f, --force              Force a clean re-build of the virtual environment. Useful when dependencies have been added."
+  echo "  --unittests-only         Run unit tests only, exclude functional tests."
+  echo "  -p, --pep8               Just run pep8"
+  echo "  -h, --help               Print this usage message"
+  echo ""
+  echo "Note: with no options specified, the script will try to run the tests in a virtual environment,"
+  echo "      If no virtualenv is found, the script will ask if you would like to create one.  If you "
+  echo "      prefer to run tests NOT in a virtual environment, simply pass the -N option."
+  exit
+}
+
+function process_option {
+  case "$1" in
+    -h|--help) usage;;
+    -V|--virtual-env) let always_venv=1; let never_venv=0;;
+    -N|--no-virtual-env) let always_venv=0; let never_venv=1;;
+    -p|--pep8) let just_pep8=1;;
+    -f|--force) let force=1;;
+    --unittests-only) noseargs="$noseargs --exclude-dir=glance/tests/functional";;
+    *) noseargs="$noseargs $1"
+  esac
+}
+
+venv=.venv
+with_venv=tools/with_venv.sh
+always_venv=0
+never_venv=0
+force=0
+noseargs=
+wrapper=""
+just_pep8=0
+
+for arg in "$@"; do
+  process_option $arg
+done
+
+function run_tests {
+  # Just run the test suites in current environment
+  ${wrapper} rm -f tests.sqlite
+  ${wrapper} $NOSETESTS 2> run_tests.err.log
+}
+
+function run_pep8 {
+  echo "Running pep8 ..."
+  PEP8_OPTIONS="--exclude=$PEP8_EXCLUDE --repeat"
+  PEP8_INCLUDE="bin/* glance tools setup.py run_tests.py"
+  ${wrapper} pep8 $PEP8_OPTIONS $PEP8_INCLUDE
+}
+
+
+NOSETESTS="python run_tests.py $noseargs"
+
+if [ $never_venv -eq 0 ]
+then
+  # Remove the virtual environment if --force used
+  if [ $force -eq 1 ]; then
+    echo "Cleaning virtualenv..."
+    rm -rf ${venv}
+  fi
+  if [ -e ${venv} ]; then
+    wrapper="${with_venv}"
+  else
+    if [ $always_venv -eq 1 ]; then
+      # Automatically install the virtualenv
+      python tools/install_venv.py
+      wrapper="${with_venv}"
+    else
+      echo -e "No virtual environment found...create one? (Y/n) \c"
+      read use_ve
+      if [ "x$use_ve" = "xY" -o "x$use_ve" = "x" -o "x$use_ve" = "xy" ]; then
+        # Install the virtualenv and run the test suite in it
+        python tools/install_venv.py
+		    wrapper=${with_venv}
+      fi
+    fi
+  fi
+fi
+
+if [ $just_pep8 -eq 1 ]; then
+    run_pep8
+    exit
+fi
+
+run_tests || exit
+
+if [ -z "$noseargs" ]; then
+  run_pep8
+fi
--- a/setup.cfg
+++ b/setup.cfg
@ -1,3 +1,28 @@
+[build_sphinx]
+all_files = 1 
+build-dir = doc/build
+source-dir = doc/source
+
+[egg_info]
+tag_build =
+tag_date = 0
+tag_svn_revision = 0
+
+# TBD: Use this for OpenStack
+#[compile_catalog]
+#directory = barbican/locale
+#domain = barbican
+#
+#[update_catalog]
+#domain = barbican
+#output_dir = barbican/locale
+#input_file = barbican/locale/barbican.pot
+#
+#[extract_messages]
+#keywords = _ gettext ngettext l_ lazy_gettext
+#mapping_file = babel.cfg
+#output_file = barbican/locale/barbican.pot
+
 [nosetests]
 where=barbican
 nocapture=1
@ -8,3 +33,19 @@ traverse-namespace=1
 #with-coverage=1
 cover-package=barbican
 cover-inclusive=1
+
+# TBD: OpenStack stuff...
+# NOTE(jkoelker) To run the test suite under nose install the following
+#                coverage http://pypi.python.org/pypi/coverage 
+#                tissue http://pypi.python.org/pypi/tissue (pep8 checker)
+#                openstack-nose https://github.com/jkoelker/openstack-nose
+#verbosity=2
+#detailed-errors=1
+#with-openstack=1
+#openstack-red=0.05
+#openstack-yellow=0.025
+#openstack-show-elapsed=1
+#openstack-color=1
+
+#[install]
+#install-lib=/usr/local/bin/vbarbican/lib/python2.7/site-packages/
--- a/setup.py
+++ b/setup.py
@ -1,26 +1,73 @@
-# -*- coding: utf-8 -*-
+#!/usr/bin/python
+# Copyright (c) 2010 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
 try:
    from setuptools import setup, find_packages
+    from setuptools.command.sdist import sdist
 except ImportError:
    from ez_setup import use_setuptools
    use_setuptools()
    from setuptools import setup, find_packages
+    from setuptools.command.sdist import sdist
+
+# Determine version of this application.
+# TBD: Revisit version flows and processing once integrating with OpenStack, see glance setup.py
+PKG = "barbican"
+VERSIONFILE = os.path.join(PKG, "version.py") 
+version = "unknown"
+try: 
+    version_file = open(VERSIONFILE, "r")
+    for line in version_file:
+        if '__version__' in line:
+            version = line.split("'")[1]
+            break
+except EnvironmentError:
+    pass # Okay, there is no version file.
+
+class local_sdist(sdist):
+    """Customized sdist hook - builds the ChangeLog file from VC first"""
+
+    def run(self):
+        sdist.run(self)
+
+cmdclass = {'sdist': local_sdist}
+
+# TDB: Revisit sphinx documentation needs once move to OpenStack...see glance setup.py

 setup(
    name = 'barbican',
-    version = '0.1',
-    description = '',
-    author = 'Project Barbican',
-    author_email = '',
-    install_requires = [
-        "falcon",
-        "mock",
-        "wsgiref",
-        "uWSGI",
-        "pymongo",
+    version = version,
+    description = 'The Barbican project provides a service for storing '
+                  'sensitive client information such as encryption keys',
+    license='Apache License (2.0)',
+    author = 'OpenStack',
+    author_email = 'john.wood@rackspace.com',
+    url='http://barbican.openstack.org/',
+    packages = find_packages(exclude=['bin']),
+    test_suite = 'nose.collector',
+    cmdclass=cmdclass,
+    include_package_data=True,
+    classifiers=[
+        'Development Status :: 4 - Beta',
+        'License :: OSI Approved :: Apache Software License',
+        'Operating System :: POSIX :: Linux',
+        'Programming Language :: Python :: 2.7',
+        'Environment :: No Input/Output (Daemon)',
    ],
-    test_suite = 'barbican.tests',
-    zip_safe = False,
-    include_package_data = True,
-    packages = find_packages(exclude=['ez_setup'])
+    scripts=['bin/barbican-api'],
+    py_modules=[]
 )
--- a/source/format
+++ b/source/format
@ -0,0 +1 @@
+3.0 (quilt)
--- a/static/css/bootstrap.css
+++ b/static/css/bootstrap.css
--- a/static/css/bootstrap.min.css
+++ b/static/css/bootstrap.min.css
--- a/static/css/style.css
+++ b/static/css/style.css
@ -1,24 +0,0 @@
-/* Tweak navbar brand link to be super sleek
-------------------------------------------------- */
-
-body > .navbar {
-    font-size: 13px;
-}
-
-/* Change the docs' brand */
-body > .navbar .brand {
-    padding-right: 0;
-    padding-left: 0;
-    margin-left: 20px;
-    float: right;
-    font-weight: bold;
-    color: #000;
-    text-shadow: 0 1px 0 rgba(255,255,255,.1), 0 0 30px rgba(255,255,255,.125);
-    -webkit-transition: all .2s linear;
-    -moz-transition: all .2s linear;
-    transition: all .2s linear;
-}
-body > .navbar .brand:hover {
-    text-decoration: none;
-    text-shadow: 0 1px 0 rgba(255,255,255,.1), 0 0 30px rgba(255,255,255,.4);
-}
--- a/static/ico/favicon.ico
+++ b/static/ico/favicon.ico
--- a/static/img/glyphicons-halflings-white.png
+++ b/static/img/glyphicons-halflings-white.png
--- a/static/img/glyphicons-halflings.png
+++ b/static/img/glyphicons-halflings.png
--- a/static/js/bootstrap.js
+++ b/static/js/bootstrap.js
--- a/static/js/bootstrap.min.js
+++ b/static/js/bootstrap.min.js
--- a/static/js/html5shiv.js
+++ b/static/js/html5shiv.js
@ -1,8 +0,0 @@
-/*
- HTML5 Shiv v3.6.2pre | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Licensed
-*/
-(function(l,f){function m(){var a=e.elements;return"string"==typeof a?a.split(" "):a}function i(a){var b=n[a[o]];b||(b={},h++,a[o]=h,n[h]=b);return b}function p(a,b,c){b||(b=f);if(g)return b.createElement(a);c||(c=i(b));b=c.cache[a]?c.cache[a].cloneNode():r.test(a)?(c.cache[a]=c.createElem(a)).cloneNode():c.createElem(a);return b.canHaveChildren&&!s.test(a)?c.frag.appendChild(b):b}function t(a,b){if(!b.cache)b.cache={},b.createElem=a.createElement,b.createFrag=a.createDocumentFragment,b.frag=b.createFrag();
-a.createElement=function(c){return!e.shivMethods?b.createElem(c):p(c,a,b)};a.createDocumentFragment=Function("h,f","return function(){var n=f.cloneNode(),c=n.createElement;h.shivMethods&&("+m().join().replace(/\w+/g,function(a){b.createElem(a);b.frag.createElement(a);return'c("'+a+'")'})+");return n}")(e,b.frag)}function q(a){a||(a=f);var b=i(a);if(e.shivCSS&&!j&&!b.hasCSS){var c,d=a;c=d.createElement("p");d=d.getElementsByTagName("head")[0]||d.documentElement;c.innerHTML="x<style>article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}mark{background:#FF0;color:#000}</style>";
-c=d.insertBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var k=l.html5||{},s=/^<|^(?:button|map|select|textarea|object|iframe|option|optgroup)$/i,r=/^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|label|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i,j,o="_html5shiv",h=0,n={},g;(function(){try{var a=f.createElement("a");a.innerHTML="<xyz></xyz>";j="hidden"in a;var b;if(!(b=1==a.childNodes.length)){f.createElement("a");var c=f.createDocumentFragment();b="undefined"==typeof c.cloneNode||
-"undefined"==typeof c.createDocumentFragment||"undefined"==typeof c.createElement}g=b}catch(d){g=j=!0}})();var e={elements:k.elements||"abbr article aside audio bdi canvas data datalist details figcaption figure footer header hgroup main mark meter nav output progress section summary time video",version:"3.6.2pre",shivCSS:!1!==k.shivCSS,supportsUnknownElements:g,shivMethods:!1!==k.shivMethods,type:"default",shivDocument:q,createElement:p,createDocumentFragment:function(a,b){a||(a=f);if(g)return a.createDocumentFragment();
-for(var b=b||i(a),c=b.frag.cloneNode(),d=0,e=m(),h=e.length;d<h;d++)c.createElement(e[d]);return c}};l.html5=e;q(f)})(this,document);
--- a/static/js/jquery-1.9.1.min.js
+++ b/static/js/jquery-1.9.1.min.js
--- a/templates/index.html
+++ b/templates/index.html
@ -1,4 +0,0 @@
-{% extends 'layout.html' %}
-
-{% block body %}
-{% endblock %}
--- a/templates/layout.html
+++ b/templates/layout.html
@ -1,66 +0,0 @@
-
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8">
-    <title>{% block title %}Welcome{% endblock %} | Barbican</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="description" content="">
-    <meta name="author" content="Jarret Raim">
-
-    <!-- Le styles -->
-    <link href="/static/css/bootstrap.css" rel="stylesheet">
-    <link href="/static/css/style.css" rel="stylesheet">
-    <style>
-        body {
-            padding-top: 60px; /* 60px to make the container go all the way to the bottom of the topbar */
-        }
-    </style>
-
-    <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
-    <!--[if lt IE 9]>
-    <script src="/static/js/html5shiv.js"></script>
-    <![endif]-->
-
-    <!-- Fav and touch icons -->
-    <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/static/ico/apple-touch-icon-144-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" sizes="114x114" href="/static/ico/apple-touch-icon-114-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" sizes="72x72" href="/static/ico/apple-touch-icon-72-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" href="/static/ico/apple-touch-icon-57-precomposed.png">
-    <link rel="shortcut icon" href="/static/ico/favicon.ico">
-</head>
-
-<body>
-
-<div class="navbar navbar-inverse navbar-fixed-top">
-    <div class="navbar-inner">
-        <div class="container">
-            <button type="button" class="btn btn-navbar" data-toggle="collapse" data-target=".nav-collapse">
-                <span class="icon-bar"></span>
-                <span class="icon-bar"></span>
-                <span class="icon-bar"></span>
-            </button>
-            <a class="brand" href="#">Barbican</a>
-            <div class="nav-collapse collapse">
-                <ul class="nav">
-                    <li><a href="/">Home</a></li>
-                    <li><a href="/users">Users</a></li>
-                    <li><a href="/tenants">Tenants</a></li>
-                </ul>
-            </div><!--/.nav-collapse -->
-        </div>
-    </div>
-</div>
-
-<div class="container">
-
-    {% block body %}{% endblock %}
-
-</div> <!-- /container -->
-
-<!-- Le javascript
-================================================== -->
-<!-- Placed at the end of the document so the pages load faster -->
-<script src="/static/js/jquery-1.9.1.min.js"></script>
-</body>
-</html>
--- a/templates/login.html
+++ b/templates/login.html
@ -1,96 +0,0 @@
-
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8">
-    <title>Sign in &middot; Twitter Bootstrap</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="description" content="">
-    <meta name="author" content="">
-
-    <!-- Le styles -->
-    <link href="/static/css/bootstrap.css" rel="stylesheet">
-    <style type="text/css">
-        body {
-            padding-top: 40px;
-            padding-bottom: 40px;
-            background-color: #f5f5f5;
-        }
-
-        .form-signin {
-            max-width: 300px;
-            padding: 19px 29px 29px;
-            margin: 0 auto 20px;
-            background-color: #fff;
-            border: 1px solid #e5e5e5;
-            -webkit-border-radius: 5px;
-            -moz-border-radius: 5px;
-            border-radius: 5px;
-            -webkit-box-shadow: 0 1px 2px rgba(0,0,0,.05);
-            -moz-box-shadow: 0 1px 2px rgba(0,0,0,.05);
-            box-shadow: 0 1px 2px rgba(0,0,0,.05);
-        }
-        .form-signin .form-signin-heading,
-        .form-signin .checkbox {
-            margin-bottom: 10px;
-        }
-        .form-signin input[type="text"],
-        .form-signin input[type="password"] {
-            font-size: 16px;
-            height: auto;
-            margin-bottom: 15px;
-            padding: 7px 9px;
-        }
-
-    </style>
-    <link href="/static/css/bootstrap-responsive.css" rel="stylesheet">
-
-    <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
-    <!--[if lt IE 9]>
-    <script src="/static/js/html5shiv.js"></script>
-    <![endif]-->
-
-    <!-- Fav and touch icons -->
-    <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/static/ico/apple-touch-icon-144-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" sizes="114x114" href="/static/ico/apple-touch-icon-114-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" sizes="72x72" href="/static/ico/apple-touch-icon-72-precomposed.png">
-    <link rel="apple-touch-icon-precomposed" href="/static/ico/apple-touch-icon-57-precomposed.png">
-    <link rel="shortcut icon" href="/static/ico/favicon.png">
-</head>
-
-<body>
-
-<div class="container">
-
-    <form method="post" class="form-signin">
-        {{ form.hidden_tag() }}
-        <h2 class="form-signin-heading">Please sign in</h2>
-        {% if form.errors %}
-            <div class="alert alert-error alert-block">
-                <h4>Errors</h4>
-                <ul>
-                    {% for field_name, field_errors in form.errors|dictsort if field_errors %}
-                        {% for error in field_errors %}
-                        <li>{{ form[field_name].name }}: {{ error }}</li>
-                        {% endfor %}
-                    {% endfor %}
-                </ul>
-            </div>
-        {% endif %}
-
-        {% for f in form if f.type != 'CSRFTokenField' %}
-        {{ f.label }}{{ f }}
-
-        {% endfor %}
-
-        <button class="btn btn-large btn-primary" type="submit">Sign in</button>
-    </form>
-
-</div> <!-- /container -->
-
-<!-- Le javascript
-================================================== -->
-<!-- Placed at the end of the document so the pages load faster -->
-<script src="/static/js/jquery-1.9.1.min.js"></script>
-</body>
-</html>
--- a/tools/install_venv.py
+++ b/tools/install_venv.py
@ -0,0 +1,153 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+# Copyright 2010 OpenStack LLC.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Installation script for Barbican's development virtualenv
+"""
+
+import os
+import subprocess
+import sys
+
+
+ROOT = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
+VENV = os.path.join(ROOT, '.venv')
+PIP_REQUIRES = os.path.join(ROOT, 'tools', 'pip-requires')
+TEST_REQUIRES = os.path.join(ROOT, 'tools', 'test-requires')
+
+
+def die(message, *args):
+    print >> sys.stderr, message % args
+    sys.exit(1)
+
+
+def run_command(cmd, redirect_output=True, check_exit_code=True):
+    """
+    Runs a command in an out-of-process shell, returning the
+    output of that command.  Working directory is ROOT.
+    """
+    if redirect_output:
+        stdout = subprocess.PIPE
+    else:
+        stdout = None
+
+    proc = subprocess.Popen(cmd, cwd=ROOT, stdout=stdout)
+    output = proc.communicate()[0]
+    if check_exit_code and proc.returncode != 0:
+        die('Command "%s" failed.\n%s', ' '.join(cmd), output)
+    return output
+
+
+HAS_EASY_INSTALL = bool(run_command(['which', 'easy_install'],
+                                    check_exit_code=False).strip())
+HAS_VIRTUALENV = bool(run_command(['which', 'virtualenv'],
+                                    check_exit_code=False).strip())
+
+
+def check_dependencies():
+    """Make sure virtualenv is in the path."""
+
+    if not HAS_VIRTUALENV:
+        print 'not found.'
+        # Try installing it via easy_install...
+        if HAS_EASY_INSTALL:
+            print 'Installing virtualenv via easy_install...',
+            if not run_command(['which', 'easy_install']):
+                die('ERROR: virtualenv not found.\n\n'
+                    'Barbican development requires virtualenv, please install'
+                    ' it using your favorite package management tool')
+            print 'done.'
+    print 'done.'
+
+
+def create_virtualenv(venv=VENV):
+    """
+    Creates the virtual environment and installs PIP only into the
+    virtual environment
+    """
+    print 'Creating venv...',
+    run_command(['virtualenv', '-q', '--no-site-packages', VENV])
+    print 'done.'
+    print 'Installing pip in virtualenv...',
+    if not run_command(['tools/with_venv.sh', 'easy_install',
+                        'pip>1.0']).strip():
+        die("Failed to install pip.")
+    print 'done.'
+
+
+def pip_install(*args):
+    run_command(['tools/with_venv.sh',
+                 'pip', 'install', '--upgrade'] + list(args),
+                redirect_output=False)
+
+
+def install_dependencies(venv=VENV):
+    print 'Installing dependencies with pip (this can take a while)...'
+
+    pip_install('pip')
+
+    pip_install('-r', PIP_REQUIRES)
+    pip_install('-r', TEST_REQUIRES)
+
+    # Tell the virtual env how to "import barbican"
+    py_ver = _detect_python_version(venv)
+    pthfile = os.path.join(venv, "lib", py_ver, "site-packages", "barbican.pth")
+    f = open(pthfile, 'w')
+    f.write("%s\n" % ROOT)
+
+
+def _detect_python_version(venv):
+    lib_dir = os.path.join(venv, "lib")
+    for pathname in os.listdir(lib_dir):
+        if pathname.startswith('python'):
+            return pathname
+    raise Exception('Unable to detect Python version')
+
+
+def print_help():
+    help = """
+ Barbican development environment setup is complete.
+
+ Barbican development uses virtualenv to track and manage Python dependencies
+ while in development and testing.
+
+ To activate the Barbican virtualenv for the extent of your current shell session
+ you can run:
+
+ $ source .venv/bin/activate
+
+ Or, if you prefer, you can run commands in the virtualenv on a case by case
+ basis by running:
+
+ $ tools/with_venv.sh <your command>
+
+ Also, make test will automatically use the virtualenv.
+    """
+    print help
+
+
+def main(argv):
+    check_dependencies()
+    create_virtualenv()
+    install_dependencies()
+    print_help()
+
+if __name__ == '__main__':
+    main(sys.argv)
--- a/tools/pip-requires
+++ b/tools/pip-requires
@ -1,7 +1,8 @@
-falcon
+falcon>=0.1.1
 uWSGI>=1.4.5
 wsgiref>=0.1.2
-pymongo>=2.4.2
+pysqlite>=2.6.3
+

 # Right now this is the location for oslo-config (its not in PyPi yet)
 http://tarballs.openstack.org/oslo-config/oslo-config-2013.1b3.tar.gz#egg=oslo-config
--- a/tools/with_venv.sh
+++ b/tools/with_venv.sh
@ -0,0 +1,4 @@
+#!/bin/bash
+TOOLS=`dirname $0`
+VENV=$TOOLS/../.venv
+source $VENV/bin/activate && $@
--- a/tox.ini
+++ b/tox.ini
@ -2,6 +2,7 @@
 envlist = py27

 [testenv]
+setenv = VIRTUAL_ENV={envdir}
 deps = -r{toxinidir}/tools/pip-requires
       -r{toxinidir}/tools/test-requires

--- a/uwsgi.ini
+++ b/uwsgi.ini
@ -0,0 +1,17 @@
+[uwsgi]
+
+socket = 172.16.83.131:8080
+protocol = http
+
+processes = 1
+
+master = true
+vaccum = true
+
+no-default-app = true
+memory-report = true
+
+env = CONFIG_FILE=/etc/barbican/barbican.cfg
+
+pythonpath = ./
+module = barbican.api.app:application
				`@ -0,0 +1 @@`
				`TBD: Eventually, we might need a true 'watch' file to barbican track of launchpad tarballs? See glance project for example.`