)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"d9572a2a9b47331a08e51ef484ed969604ca86ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"bb500330_a64d3179","updated":"2026-09-15 15:55:24.000000000","message":"I think `sysmeta-\u003cowner\u003e-sensitive-\u003cname\u003e` is going to be very restrictive.\n\nI thought `sysmeta-\u003cowner\u003e-\u003cname\u003e-senstive` was going to help - but I think it\u0027s all subject to the same problem.\n\nWe should look at maybe a `crypto.register_sensitive_sysmeta(names_or_prefixes)`","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"f4d136d9_71eafd58","updated":"2026-09-15 09:32:52.000000000","message":"It\u0027s nice that this preserves the single top level namespace for all sysmeta.\n\nHowever, I\u0027m concerned about the restrictions that this places on how middlewares (including crypto) can use their namespace in the future.\n\nHypothetical scenario: an \"annotate\" middleware that supports client setting immutable object \"user\" metadata with a PUT by translating it to/from sysmeta:\n\nfor any client header x-object-annotate-\u003ckey\u003e \u003d \u003cval\u003e:\n    set x-object-sysmeta-annotate-\u003ckey\u003e \u003d \u003cval\u003e\n\nIIUC this could not be implemented (with the proposed change) without constraining the client supplied key to not contain `sensitive-`, or doing some kind of escaping of the \u0027sensitive\u0027 string.","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"d9572a2a9b47331a08e51ef484ed969604ca86ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"34f52e48_ea8d5c96","in_reply_to":"f4d136d9_71eafd58","updated":"2026-09-15 15:55:24.000000000","message":"I agree, this mw seems pretty reasonable:\n\n```\ndef keep_important_user_detail(req):\n    keepers \u003d \u0027x-annotate-user-keeper-\u0027\n    for k, v in req.headers.items():\n        k \u003d k.lower()\n        if not k.startswith(keepers):\n            continue\n        user_name \u003d k[len(keepers):]\n        sysk \u003d \u0027x-object-sysmeta-annotate-user-stuff-%s\u0027 % user_name\n        req.headers[sysk] \u003d do_awesome_stuff(req, v)\n```\n\n... we\u0027ve never previously had a reason to \"escape\" the `user_name` \n\nI think an explicit configured/coded \"registry based\" approach to \"pls, encrypt these headers/prefixes\" would avoid most of the problems with \"reclaiming\" a namespace out of sysmeta:\n\nhttps://github.com/openstack/swift/blob/911191aab0662e00a7c386e5a40f72caa87521aa/swift/common/middleware/tempurl.py#L860-L866","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}],"doc/source/development_middleware.rst":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":393,"context_line":"``X-Object-Sysmeta-S3api-Sensitive-Checksum-Value``, which stores a checksum of"},{"line_number":394,"context_line":"the plaintext object body."},{"line_number":395,"context_line":""},{"line_number":396,"context_line":"The first ``-sensitive-`` segment after ``X-Object-Sysmeta-`` declares"},{"line_number":397,"context_line":"sensitivity. The owner and name must both be non-empty. Matching is not case"},{"line_number":398,"context_line":"sensitive. The owner can contain hyphens. The ``X-Object-Sysmeta-Crypto-``"},{"line_number":399,"context_line":"namespace is reserved for encryption and does not declare sensitive plaintext."},{"line_number":400,"context_line":"No registration is required. The header name alone declares sensitivity, even"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b2adfc79_2f5a9a2f","line":397,"range":{"start_line":396,"start_character":0,"end_line":397,"end_character":11},"updated":"2026-09-15 09:32:52.000000000","message":"does it, or is it the first after \u0027owner\u0027?","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":395,"context_line":""},{"line_number":396,"context_line":"The first ``-sensitive-`` segment after ``X-Object-Sysmeta-`` declares"},{"line_number":397,"context_line":"sensitivity. The owner and name must both be non-empty. Matching is not case"},{"line_number":398,"context_line":"sensitive. The owner can contain hyphens. The ``X-Object-Sysmeta-Crypto-``"},{"line_number":399,"context_line":"namespace is reserved for encryption and does not declare sensitive plaintext."},{"line_number":400,"context_line":"No registration is required. The header name alone declares sensitivity, even"},{"line_number":401,"context_line":"when the middleware that owns the field is not in the pipeline."}],"source_content_type":"text/x-rst","patch_set":2,"id":"735e6868_e194b756","line":398,"range":{"start_line":398,"start_character":11,"end_line":398,"end_character":40},"updated":"2026-09-15 09:32:52.000000000","message":"Is this necessary?\n\nIt makes it harder to pin down what is allowed and not allowed\n\n```\nx-object-sysmeta-mw-sensitive-foo -\u003e sensitive, owner\u003dmw\nx-object-sysmeta-mw-sensitive-sensitive-foo -\u003e ?, owner \u003d mw or mw-sensitive?\nx-object-sysmeta-mw-not-sensitive-foo -\u003e ?, owner \u003d mw or mw-not?\n```","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}],"swift/common/middleware/crypto/crypto_utils.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"CRYPTO_KEY_CALLBACK \u003d \u0027swift.callback.fetch_crypto_keys\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The encrypter stores encrypted sensitive sysmeta here. The name is inside"},{"line_number":33,"context_line":"# x-object-sysmeta-crypto-, which the decrypter removes from responses."},{"line_number":34,"context_line":"ENCRYPTED_SYSMETA_PREFIX \u003d get_sys_meta_prefix(\u0027object\u0027) + \u0027crypto-\u0027"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"bd745604_2c696160","line":32,"range":{"start_line":32,"start_character":23,"end_line":32,"end_character":55},"updated":"2026-09-15 09:32:52.000000000","message":"this is true, but fails to mention that other sysmeta is also stored under x-object-sysmeta-crypto e.g.:\n\n```\nX-Object-Sysmeta-Crypto-Etag\nX-Object-Sysmeta-Crypto-Body-Meta\nX-Object-Sysmeta-Crypto-Etag-Mac\n```\n\nsee next comment: either refactor to always use the constant or (less code churn in this patch...) just use the helper inline for sensitive sysmeta as per the existing pattern.","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# The encrypter stores encrypted sensitive sysmeta here. The name is inside"},{"line_number":33,"context_line":"# x-object-sysmeta-crypto-, which the decrypter removes from responses."},{"line_number":34,"context_line":"ENCRYPTED_SYSMETA_PREFIX \u003d get_sys_meta_prefix(\u0027object\u0027) + \u0027crypto-\u0027"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"class Crypto(object):"}],"source_content_type":"text/x-python","patch_set":2,"id":"927578cc_e72a5fdb","line":34,"updated":"2026-09-15 09:32:52.000000000","message":"I\u0027m usually quite keen on defining constant for commonly used strings but this is anomalous w.r.t. the rest of encryption middlewares, where we already have `crypto-` passed to the generic sysmeta helper functions. For me, consistency within the middleware wins: either define all the prefixes as constants, or always have the literal strings inline.","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}],"swift/common/middleware/crypto/encrypter.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":108,"context_line":"                crypto_sysmeta[name] \u003d val"},{"line_number":109,"context_line":"                continue"},{"line_number":110,"context_line":"            new_name \u003d ENCRYPTED_SYSMETA_PREFIX + \\"},{"line_number":111,"context_line":"                strip_sys_meta_prefix(\u0027object\u0027, name)"},{"line_number":112,"context_line":"            enc_val, crypto_meta \u003d encrypt_header_val("},{"line_number":113,"context_line":"                self.crypto, val, self.keys[\u0027object\u0027])"},{"line_number":114,"context_line":"            crypto_sysmeta[new_name] \u003d append_crypto_meta("}],"source_content_type":"text/x-python","patch_set":2,"id":"a64edad5_4eee4b27","line":111,"updated":"2026-09-15 09:32:52.000000000","message":"```\nX-Object-Sysmeta-A-B-C-Sensitive-Digest is translated to X-Object-Sysmeta-Crypto-A-B-C-Sensitive-Digest\n```\n\nI think this means that in general, crypto middleware must never be extended to use, for its own purposes, a sysmeta with ``-Sensitive-`` anywhere in the name e.g. (hypothetical)\n\n```\nX-Object-Sysmeta-Crypto-Alternate-Sensitive-Value\n```\n\nbecause it might clash with the translation of an \u0027alternate\u0027 owner mw sending:\n\n```\nX-Object-Sysmeta-Alternate-Sensitive-Value\n```\n\nFor this reason, crypto should translate all other mw sensitive headers into a *sub-namespace* e.g. x-object-sysmeta-crypto-sysmeta-","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}],"swift/common/request_helpers.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":323,"context_line":"    if not is_sys_meta(\u0027object\u0027, key):"},{"line_number":324,"context_line":"        return False"},{"line_number":325,"context_line":"    name \u003d strip_sys_meta_prefix(\u0027object\u0027, key).lower()"},{"line_number":326,"context_line":"    if name.startswith(\u0027crypto-\u0027):"},{"line_number":327,"context_line":"        return False"},{"line_number":328,"context_line":"    owner, _sep, field \u003d name.partition(\u0027-sensitive-\u0027)"},{"line_number":329,"context_line":"    return bool(owner and field)"}],"source_content_type":"text/x-python","patch_set":2,"id":"89f948b5_b6fbcbc5","line":326,"updated":"2026-09-15 09:32:52.000000000","message":"I don\u0027t like how the crypto middleware namespace has bled into request_helpers. It might be better for this function to parse the key and return owner and field IFF it is sensitive, then the caller (e.g. encrypter) can filter out based on owner\u003d\u003dcrypto","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c8c44baf18e98af8565eafc5de9d9648b4287537","unresolved":true,"context_lines":[{"line_number":325,"context_line":"    name \u003d strip_sys_meta_prefix(\u0027object\u0027, key).lower()"},{"line_number":326,"context_line":"    if name.startswith(\u0027crypto-\u0027):"},{"line_number":327,"context_line":"        return False"},{"line_number":328,"context_line":"    owner, _sep, field \u003d name.partition(\u0027-sensitive-\u0027)"},{"line_number":329,"context_line":"    return bool(owner and field)"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"246a11a1_894e4849","line":328,"updated":"2026-09-15 09:32:52.000000000","message":"```\n\u0027a-this-is-not-sensitive-x\u0027.partition(\u0027-sensitive-\u0027)\n(\u0027a-this-is-not\u0027, \u0027-sensitive-\u0027, \u0027x\u0027)\n```\n\nSo, the `-sensitive-` string is not allowed anywhere in a sysmeta key that is *not* sensitive?? IMHO that is way too restrictive","commit_id":"6ec8f291b9c68c52ba3f7b934d7d8bb454c510d4"}]}