diff --git a/keystone/cli.py b/keystone/cli.py
index d8fc8ce6c..78ec5cdc2 100644
--- a/keystone/cli.py
+++ b/keystone/cli.py
@@ -219,9 +219,9 @@ class MappingPurge(BaseApp):
 
             if (CONF.command.all is True and
                 (CONF.command.domain_name is not None or
-                CONF.command.public_id is not None or
-                CONF.command.local_id is not None or
-                    CONF.command.type is not None)):
+                 CONF.command.public_id is not None or
+                 CONF.command.local_id is not None or
+                 CONF.command.type is not None)):
                 raise ValueError(_('--all option cannot be mixed with '
                                    'other options'))
 
diff --git a/keystone/common/environment/__init__.py b/keystone/common/environment/__init__.py
index 77eecee3a..29d8f7595 100644
--- a/keystone/common/environment/__init__.py
+++ b/keystone/common/environment/__init__.py
@@ -66,6 +66,7 @@ def use_eventlet(monkeypatch_thread=None):
     import eventlet
     from eventlet.green import httplib as _httplib
     from eventlet.green import subprocess as _subprocess
+
     from keystone.common.environment import eventlet_server
 
     if monkeypatch_thread is None:
diff --git a/keystone/common/ldap/core.py b/keystone/common/ldap/core.py
index 4a64042a0..ff726c038 100644
--- a/keystone/common/ldap/core.py
+++ b/keystone/common/ldap/core.py
@@ -13,17 +13,17 @@
 # under the License.
 
 import abc
-import os.path
-import re
-
 import codecs
 import functools
+import os.path
+import re
+import sys
+import weakref
+
 import ldap
 import ldap.filter
 import ldappool
 import six
-import sys
-import weakref
 
 from keystone import exception
 from keystone.i18n import _
diff --git a/keystone/common/validation/validators.py b/keystone/common/validation/validators.py
index 401bb5377..a45741766 100644
--- a/keystone/common/validation/validators.py
+++ b/keystone/common/validation/validators.py
@@ -52,10 +52,8 @@ class SchemaValidator(object):
                 # we don't expose sensitive user information in the event it
                 # fails validation.
                 detail = _("Invalid input for field '%(path)s'. The value is "
-                           "'%(value)s'.") % {
-                               'path': ex.path.pop(),
-                               'value': ex.instance
-                           }
+                           "'%(value)s'.") % {'path': ex.path.pop(),
+                                              'value': ex.instance}
             else:
                 detail = ex.message
             raise exception.SchemaValidationError(detail=detail)
diff --git a/keystone/contrib/ec2/controllers.py b/keystone/contrib/ec2/controllers.py
index d7267c55e..0cc42fc24 100644
--- a/keystone/contrib/ec2/controllers.py
+++ b/keystone/contrib/ec2/controllers.py
@@ -36,9 +36,8 @@ import abc
 import sys
 import uuid
 
-import six
-
 from keystoneclient.contrib.ec2 import utils as ec2_utils
+import six
 
 from keystone.common import controller
 from keystone.common import dependency
diff --git a/keystone/contrib/oauth1/core.py b/keystone/contrib/oauth1/core.py
index 6ba007f3a..8d54242f1 100644
--- a/keystone/contrib/oauth1/core.py
+++ b/keystone/contrib/oauth1/core.py
@@ -18,11 +18,11 @@ from __future__ import absolute_import
 
 import abc
 import string
+import uuid
 
 import oauthlib.common
 from oauthlib import oauth1
 import six
-import uuid
 
 from keystone.common import dependency
 from keystone.common import extension
diff --git a/keystone/models/token_model.py b/keystone/models/token_model.py
index 133842809..0581f0158 100644
--- a/keystone/models/token_model.py
+++ b/keystone/models/token_model.py
@@ -105,7 +105,7 @@ class KeystoneToken(dict):
             elif 'user' in self:
                 return CONF.identity.default_domain_id
         except KeyError:
-        # Do not raise KeyError, raise UnexpectedError
+            # Do not raise KeyError, raise UnexpectedError
             pass
         raise exception.UnexpectedError()
 
diff --git a/keystone/service.py b/keystone/service.py
index 48f8872bf..3837d8d0c 100644
--- a/keystone/service.py
+++ b/keystone/service.py
@@ -12,9 +12,9 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import functools
 import sys
 
-import functools
 import routes
 
 from keystone import assignment
diff --git a/keystone/tests/core.py b/keystone/tests/core.py
index 020f53e41..a51735dc4 100644
--- a/keystone/tests/core.py
+++ b/keystone/tests/core.py
@@ -16,6 +16,7 @@ from __future__ import absolute_import
 import atexit
 import copy
 import functools
+import logging
 import os
 import re
 import shutil
@@ -25,7 +26,6 @@ import time
 import warnings
 
 import fixtures
-import logging
 from oslo.config import fixture as config_fixture
 import oslotest.base as oslotest
 from oslotest import mockpatch
@@ -37,7 +37,7 @@ import webob
 # NOTE(ayoung)
 # environment.use_eventlet must run before any of the code that will
 # call the eventlet monkeypatching.
-from keystone.common import environment
+from keystone.common import environment  # noqa
 environment.use_eventlet()
 
 from keystone import auth
@@ -61,7 +61,6 @@ from keystone.openstack.common import policy as common_policy  # noqa
 
 config.configure()
 
-
 LOG = log.getLogger(__name__)
 PID = six.text_type(os.getpid())
 TESTSDIR = os.path.dirname(os.path.abspath(__file__))
diff --git a/keystone/tests/test_backend.py b/keystone/tests/test_backend.py
index 106f4742e..7ab192a9f 100644
--- a/keystone/tests/test_backend.py
+++ b/keystone/tests/test_backend.py
@@ -15,10 +15,10 @@
 import copy
 import datetime
 import hashlib
-import mock
 import uuid
 
 from keystoneclient.common import cms
+import mock
 from oslo.utils import timeutils
 import six
 from testtools import matchers
diff --git a/keystone/tests/test_contrib_stats_core.py b/keystone/tests/test_contrib_stats_core.py
index 9060f1fd3..7abfb1cc5 100644
--- a/keystone/tests/test_contrib_stats_core.py
+++ b/keystone/tests/test_contrib_stats_core.py
@@ -12,9 +12,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from keystone.contrib import stats
-
 from keystone import config
+from keystone.contrib import stats
 from keystone import tests
 
 
diff --git a/keystone/tests/test_driver_hints.py b/keystone/tests/test_driver_hints.py
index 8df853a70..d06c01220 100644
--- a/keystone/tests/test_driver_hints.py
+++ b/keystone/tests/test_driver_hints.py
@@ -12,10 +12,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-
-from keystone.tests import core as test
-
 from keystone.common import driver_hints
+from keystone.tests import core as test
 
 
 class ListHintsTests(test.TestCase):
diff --git a/keystone/tests/test_keystoneclient.py b/keystone/tests/test_keystoneclient.py
index aa39d6d0e..8c3ed53e0 100644
--- a/keystone/tests/test_keystoneclient.py
+++ b/keystone/tests/test_keystoneclient.py
@@ -15,10 +15,10 @@
 import datetime
 import os
 import uuid
-import webob
 
 import mock
 from oslo.utils import timeutils
+import webob
 
 from keystone import config
 from keystone.openstack.common import jsonutils
diff --git a/keystone/tests/test_keystoneclient_sql.py b/keystone/tests/test_keystoneclient_sql.py
index a05ad5932..fdbd167cf 100644
--- a/keystone/tests/test_keystoneclient_sql.py
+++ b/keystone/tests/test_keystoneclient_sql.py
@@ -291,13 +291,14 @@ class KcMasterSqlTestCase(test_keystoneclient.KcMasterTestCase):
                           id=uuid.uuid4().hex)
 
     def test_policy_crud(self):
+        from keystoneclient import exceptions as client_exceptions
+
         # FIXME(dolph): this test was written prior to the v3 implementation of
         #               the client and essentially refers to a non-existent
         #               policy manager in the v2 client. this test needs to be
         #               moved to a test suite running against the v3 api
         self.skipTest('Written prior to v3 client; needs refactor')
 
-        from keystoneclient import exceptions as client_exceptions
         client = self.get_client(admin=True)
 
         policy_blob = uuid.uuid4().hex
diff --git a/keystone/tests/test_ldap_livetest.py b/keystone/tests/test_ldap_livetest.py
index 1cb0e090a..8c9f1ed0b 100644
--- a/keystone/tests/test_ldap_livetest.py
+++ b/keystone/tests/test_ldap_livetest.py
@@ -12,11 +12,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import ldap
-import ldap.modlist
 import subprocess
 import uuid
 
+import ldap
+import ldap.modlist
+
 from keystone import config
 from keystone import exception
 from keystone.identity.backends import ldap as identity_ldap
diff --git a/keystone/tests/test_ldap_pool_livetest.py b/keystone/tests/test_ldap_pool_livetest.py
index 726041f9a..534fdf4a5 100644
--- a/keystone/tests/test_ldap_pool_livetest.py
+++ b/keystone/tests/test_ldap_pool_livetest.py
@@ -12,9 +12,10 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import ldappool
 import uuid
 
+import ldappool
+
 from keystone.common.ldap import core as ldap_core
 from keystone import config
 from keystone.identity.backends import ldap
diff --git a/keystone/tests/test_no_admin_token_auth.py b/keystone/tests/test_no_admin_token_auth.py
index 9b0bdf48a..72b350caf 100644
--- a/keystone/tests/test_no_admin_token_auth.py
+++ b/keystone/tests/test_no_admin_token_auth.py
@@ -13,6 +13,7 @@
 #    under the License.
 
 import os
+
 import webtest
 
 from keystone import tests
diff --git a/keystone/tests/test_pemutils.py b/keystone/tests/test_pemutils.py
index 0f614a492..515c9e683 100644
--- a/keystone/tests/test_pemutils.py
+++ b/keystone/tests/test_pemutils.py
@@ -13,9 +13,11 @@
 #    under the License.
 
 import base64
+
+from six import moves
+
 from keystone.common import pemutils
 from keystone import tests
-from six import moves
 
 
 # List of 2-tuples, (pem_type, pem_header)
diff --git a/keystone/tests/test_v3_auth.py b/keystone/tests/test_v3_auth.py
index 153e4e1a7..12d54a8c3 100644
--- a/keystone/tests/test_v3_auth.py
+++ b/keystone/tests/test_v3_auth.py
@@ -15,11 +15,11 @@
 import copy
 import datetime
 import operator
-from testtools import testcase
 import uuid
 
 from keystoneclient.common import cms
 from oslo.utils import timeutils
+from testtools import testcase
 
 from keystone import auth
 from keystone.common import dependency
diff --git a/keystone/token/providers/common.py b/keystone/token/providers/common.py
index 00e871e85..adae58b2f 100644
--- a/keystone/token/providers/common.py
+++ b/keystone/token/providers/common.py
@@ -22,13 +22,11 @@ from keystone.contrib import federation
 from keystone import exception
 from keystone.i18n import _
 from keystone.openstack.common import jsonutils
+from keystone.openstack.common import log
 from keystone import token
 from keystone.token import provider
 
 
-from keystone.openstack.common import log
-
-
 LOG = log.getLogger(__name__)
 CONF = config.CONF
 
diff --git a/test-requirements-py3.txt b/test-requirements-py3.txt
index 8bbaaf0af..bf9767a79 100644
--- a/test-requirements-py3.txt
+++ b/test-requirements-py3.txt
@@ -1,4 +1,4 @@
-hacking>=0.8.0,<0.9
+hacking>=0.9.2,<0.10
 bashate >= 0.2
 
 # pysqlite does not install on py3
diff --git a/test-requirements.txt b/test-requirements.txt
index c477f81a2..128264792 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,4 +1,4 @@
-hacking>=0.8.0,<0.9
+hacking>=0.9.2,<0.10
 bashate >= 0.2
 
 # Optional backend: SQL
diff --git a/tox.ini b/tox.ini
index c4a8fa5e4..2d5a63194 100644
--- a/tox.ini
+++ b/tox.ini
@@ -74,8 +74,11 @@ commands =
 filename= *.py,keystone-*
 show-source = true
 
+# H104  File contains nothing but comments
+# H405  multi line docstring summary not separated with an empty line
 # H803  Commit message should not end with a period (do not remove per list discussion)
-ignore = H803
+# H904  Wrap long lines in parentheses instead of a backslash
+ignore = H104,H405,H803,H904
 
 builtins = _
 exclude=.venv,.git,.tox,build,dist,doc,*openstack/common*,*lib/python*,*egg,tools,vendor,.update-venv,*.ini,*.po,*.pot