)]}'
{"test/unit/common/middleware/test_encrypter_decrypter.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2e063d9feb68288b0aa48850c6b0ae716800631","unresolved":false,"context_lines":[{"line_number":25,"context_line":"class TestEncrypterDecrypter(unittest.TestCase):"},{"line_number":26,"context_line":"    \"\"\""},{"line_number":27,"context_line":"    Unit tests to verify round-trip encryption followed by decryption."},{"line_number":28,"context_line":"    These tests serve to compliment the separate unit tests for encrypter and"},{"line_number":29,"context_line":"    decrypter, which are also tested in isolation."},{"line_number":30,"context_line":"    However, the real Crypto implementation is used."},{"line_number":31,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_9a79da84","line":28,"updated":"2015-12-02 17:53:06.000000000","message":"nit s/compliment/complement/","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"0302a09c112ba08c1a82ba5c0e0b46cc1c61d6bd","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        # Encrypted headers captured from FakeSwift."},{"line_number":49,"context_line":"        encrypt_req_hdrs \u003d encrypt_app.headers[0]"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"        # Obtain the encrypted response body."},{"line_number":52,"context_line":"        encrypt_get_req \u003d Request.blank(\u0027/v1/a/c/o\u0027,"},{"line_number":53,"context_line":"                                        environ\u003d{\u0027REQUEST_METHOD\u0027: \u0027GET\u0027})"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_e420dbb2","line":50,"updated":"2015-12-01 15:41:44.000000000","message":"Maybe I should verify that the body and request headers were indeed encrypted after the PUT? Otherwise, it might be possible that it was never encrypted.","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2e063d9feb68288b0aa48850c6b0ae716800631","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        # Encrypted headers captured from FakeSwift."},{"line_number":49,"context_line":"        encrypt_req_hdrs \u003d encrypt_app.headers[0]"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"        # Obtain the encrypted response body."},{"line_number":52,"context_line":"        encrypt_get_req \u003d Request.blank(\u0027/v1/a/c/o\u0027,"},{"line_number":53,"context_line":"                                        environ\u003d{\u0027REQUEST_METHOD\u0027: \u0027GET\u0027})"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_da89a227","line":50,"in_reply_to":"9a8ffd7b_e420dbb2","updated":"2015-12-02 17:53:06.000000000","message":"nice idea, you get the object directly from the fake swift app below so go ahead and verify it is encrypted.","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2e063d9feb68288b0aa48850c6b0ae716800631","unresolved":false,"context_lines":[{"line_number":57,"context_line":"        # - Body is from a GET request to the FakeSwift following the PUT"},{"line_number":58,"context_line":"        #   using encryption."},{"line_number":59,"context_line":"        # - Headers are from the output/transformed request headers of the"},{"line_number":60,"context_line":"        #   PUT, by inspecting FakeSwift.headers[0] following the PUT."},{"line_number":61,"context_line":"        decrypt_env \u003d {\u0027REQUEST_METHOD\u0027: \u0027GET\u0027,"},{"line_number":62,"context_line":"                       \u0027swift.crypto.fetch_crypto_keys\u0027: fetch_crypto_keys}"},{"line_number":63,"context_line":"        decrypt_req \u003d Request.blank(\u0027/v1/a/c/o\u0027, environ\u003ddecrypt_env)"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_f33db18f","line":60,"updated":"2015-12-02 17:53:06.000000000","message":"you ought to be able to just GET the object back from FakeSwift, which makes it unnecessary to register the GET request. Except there seems to be a bug in FakeSwift. See:\n\nhttps://gist.github.com/alistairncoles/f5637b7dee872e6ca1d1","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"0302a09c112ba08c1a82ba5c0e0b46cc1c61d6bd","unresolved":false,"context_lines":[{"line_number":75,"context_line":"        self.assertEqual(\u0027encrypt me\u0027,"},{"line_number":76,"context_line":"                         decrypt_resp.headers[\u0027x-object-meta-test\u0027])"},{"line_number":77,"context_line":"        self.assertEqual(\u0027do not encrypt me\u0027,"},{"line_number":78,"context_line":"                         decrypt_resp.headers[\u0027x-object-sysmeta-test\u0027])"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"if __name__ \u003d\u003d \u0027__main__\u0027:"},{"line_number":81,"context_line":"    unittest.main()"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_2447c378","line":78,"updated":"2015-12-01 15:41:44.000000000","message":"This assert may not add much value since one could not tell whether it was encrypted/decrypted.","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2e063d9feb68288b0aa48850c6b0ae716800631","unresolved":false,"context_lines":[{"line_number":75,"context_line":"        self.assertEqual(\u0027encrypt me\u0027,"},{"line_number":76,"context_line":"                         decrypt_resp.headers[\u0027x-object-meta-test\u0027])"},{"line_number":77,"context_line":"        self.assertEqual(\u0027do not encrypt me\u0027,"},{"line_number":78,"context_line":"                         decrypt_resp.headers[\u0027x-object-sysmeta-test\u0027])"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"if __name__ \u003d\u003d \u0027__main__\u0027:"},{"line_number":81,"context_line":"    unittest.main()"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a8ffd7b_5397dd47","line":78,"in_reply_to":"9a8ffd7b_2447c378","updated":"2015-12-02 17:53:06.000000000","message":"true, but same is true of all of these asserts - you are not proving that anything was encrypted, you are verifying that nothing got broken from PUT to GET","commit_id":"81e706eee70dcc8ed2f834f519d525f46c0fe089"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"2300dfa4503e1bf99246cb372efc43f96c13a2b5","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        # Otherwise, checking that input matches output after decryption is"},{"line_number":59,"context_line":"        # not sufficient, if encryption and decryption were both just the"},{"line_number":60,"context_line":"        # identity function! (i.e. if they did nothing)"},{"line_number":61,"context_line":"        self.assertNotEqual(body, encrypt_get_resp.body)"},{"line_number":62,"context_line":"        self.assertNotEqual(\u0027text/plain\u0027, encrypt_req_hdrs[\u0027Content-Type\u0027])"},{"line_number":63,"context_line":"        self.assertFalse(\u0027Etag\u0027 in encrypt_req_hdrs)"},{"line_number":64,"context_line":"        self.assertNotEqual(\u0027encrypt me\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a8ffd7b_555258df","line":61,"updated":"2015-12-02 21:14:42.000000000","message":"This is a little kludgey way of determining whether the request was indeed encrypted; does anyone have any better suggestions?","commit_id":"64c45b829781a14f17965d68d21848903398ec80"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"2300dfa4503e1bf99246cb372efc43f96c13a2b5","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        # Call the decrypter using the output from the encrypter:"},{"line_number":72,"context_line":"        # - Body is from a GET request to the FakeSwift following the PUT"},{"line_number":73,"context_line":"        #   using encryption."},{"line_number":74,"context_line":"        # - Headers are from the output/transformed request headers of the"},{"line_number":75,"context_line":"        #   PUT, by inspecting FakeSwift.headers[0] following the PUT."},{"line_number":76,"context_line":"        decrypt_env \u003d {\u0027REQUEST_METHOD\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a8ffd7b_f5deec3c","line":73,"updated":"2015-12-02 21:14:42.000000000","message":"Will change this just to use the captured/encrypted body from FakeSwift rather than doing another GET, once FakeSwift is fixed.","commit_id":"64c45b829781a14f17965d68d21848903398ec80"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"dbade5e38023d48e1afb34d00c969814b1191c8a","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        # Call the decrypter using the output from the encrypter:"},{"line_number":72,"context_line":"        # - Body is from a GET request to the FakeSwift following the PUT"},{"line_number":73,"context_line":"        #   using encryption."},{"line_number":74,"context_line":"        # - Headers are from the output/transformed request headers of the"},{"line_number":75,"context_line":"        #   PUT, by inspecting FakeSwift.headers[0] following the PUT."},{"line_number":76,"context_line":"        decrypt_env \u003d {\u0027REQUEST_METHOD\u0027: \u0027GET\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a8ffd7b_f5a02c44","line":73,"in_reply_to":"9a8ffd7b_f5deec3c","updated":"2015-12-02 21:23:13.000000000","message":"Correction: I meant, will remove the register() call and just do the GET once this works in FakeSwift.","commit_id":"64c45b829781a14f17965d68d21848903398ec80"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"490263219fcd36f7ec4bdff6374dac4f6b632194","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        encrypt_req_hdrs \u003d app.headers[0]"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        # TODO: Is there a way to get back the encrypted body without doing"},{"line_number":58,"context_line":"        # another GET request?"},{"line_number":59,"context_line":"        encrypt_get_req \u003d Request.blank(\u0027/v1/a/c/o\u0027,"},{"line_number":60,"context_line":"                                        environ\u003d{\u0027REQUEST_METHOD\u0027: \u0027GET\u0027})"},{"line_number":61,"context_line":"        encrypt_get_resp \u003d encrypt_get_req.get_response(app)"}],"source_content_type":"text/x-python","patch_set":6,"id":"7a740942_b69cf75d","line":58,"updated":"2015-12-07 19:09:30.000000000","message":"you could dig inside FakeSwift for the body of the request its received, but IMHO doing the GET direct on FakeSwift is fine.\n\nso...remove the TODO :)","commit_id":"ce8412a5acb3a6f22ac9908d3676b6484115cb79"},{"author":{"_account_id":18820,"name":"Peter Chng","email":"pchng@ca.ibm.com","username":"pchng"},"change_message_id":"eaad2690a340f4f6b81bcf976493f0fe79be740c","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        # another GET request?"},{"line_number":59,"context_line":"        encrypt_get_req \u003d Request.blank(\u0027/v1/a/c/o\u0027,"},{"line_number":60,"context_line":"                                        environ\u003d{\u0027REQUEST_METHOD\u0027: \u0027GET\u0027})"},{"line_number":61,"context_line":"        encrypt_get_resp \u003d encrypt_get_req.get_response(app)"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        self.assertNotEqual(body, encrypt_get_resp.body)"},{"line_number":64,"context_line":"        self.assertNotEqual(\u0027text/plain\u0027, encrypt_req_hdrs[\u0027Content-Type\u0027])"}],"source_content_type":"text/x-python","patch_set":6,"id":"7a740942_cc0ceb96","line":61,"updated":"2015-12-04 15:47:05.000000000","message":"This is only being done to assert that the body was indeed changed. However, I wasn\u0027t able to find a way to get back the encrypted body without doing another GET request. (The existing tests in test_encrypter.py do the same)","commit_id":"ce8412a5acb3a6f22ac9908d3676b6484115cb79"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"490263219fcd36f7ec4bdff6374dac4f6b632194","unresolved":false,"context_lines":[{"line_number":60,"context_line":"                                        environ\u003d{\u0027REQUEST_METHOD\u0027: \u0027GET\u0027})"},{"line_number":61,"context_line":"        encrypt_get_resp \u003d encrypt_get_req.get_response(app)"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"        self.assertNotEqual(body, encrypt_get_resp.body)"},{"line_number":64,"context_line":"        self.assertNotEqual(\u0027text/plain\u0027, encrypt_req_hdrs[\u0027Content-Type\u0027])"},{"line_number":65,"context_line":"        self.assertNotEqual(md5hex(body), encrypt_req_hdrs[\u0027Etag\u0027])"},{"line_number":66,"context_line":"        self.assertNotEqual(\u0027encrypt me\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"7a740942_d6b8a3ca","line":63,"updated":"2015-12-07 19:09:30.000000000","message":"you can calculate the expected ciphertext and the assert equality:\n\nhttp://paste.openstack.org/show/481069/","commit_id":"ce8412a5acb3a6f22ac9908d3676b6484115cb79"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"490263219fcd36f7ec4bdff6374dac4f6b632194","unresolved":false,"context_lines":[{"line_number":64,"context_line":"        self.assertNotEqual(\u0027text/plain\u0027, encrypt_req_hdrs[\u0027Content-Type\u0027])"},{"line_number":65,"context_line":"        self.assertNotEqual(md5hex(body), encrypt_req_hdrs[\u0027Etag\u0027])"},{"line_number":66,"context_line":"        self.assertNotEqual(\u0027encrypt me\u0027,"},{"line_number":67,"context_line":"                            encrypt_req_hdrs[\u0027x-object-meta-test\u0027])"},{"line_number":68,"context_line":"        # TODO: This may not be necessary, it\u0027s duplicating checks in"},{"line_number":69,"context_line":"        # test_encrypter.py"},{"line_number":70,"context_line":"        self.assertEqual(\u0027do not encrypt me\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"7a740942_d61423a1","line":67,"updated":"2015-12-07 19:09:30.000000000","message":"The above assertNotEquals and assertEqual below do duplicate tests in test_encrypter, so I think we could remove them here - just keep the assertion on object body being ciphertext as a sanity check that we are encrypting.","commit_id":"ce8412a5acb3a6f22ac9908d3676b6484115cb79"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"490263219fcd36f7ec4bdff6374dac4f6b632194","unresolved":false,"context_lines":[{"line_number":82,"context_line":"        self.assertEqual(md5hex(body), decrypt_resp.headers[\u0027Etag\u0027])"},{"line_number":83,"context_line":"        self.assertEqual(\u0027encrypt me\u0027,"},{"line_number":84,"context_line":"                         decrypt_resp.headers[\u0027x-object-meta-test\u0027])"},{"line_number":85,"context_line":"        # TODO: This may not be worthwhile."},{"line_number":86,"context_line":"        self.assertEqual(\u0027do not encrypt me\u0027,"},{"line_number":87,"context_line":"                         decrypt_resp.headers[\u0027x-object-sysmeta-test\u0027])"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"7a740942_5670330b","line":85,"updated":"2015-12-07 19:09:30.000000000","message":"I think it is :) It verifies that the sysmeta did not get lost in the round trip.\n\nremove TODO","commit_id":"ce8412a5acb3a6f22ac9908d3676b6484115cb79"},{"author":{"_account_id":16964,"name":"Jonathan Hinson","email":"jlhinson@us.ibm.com","username":"jlhinson"},"change_message_id":"35c3e71ff01cc0527d8e3d2b2dc62dcc368fc8b8","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        self.assertEqual(md5hex(body), decrypt_resp.headers[\u0027Etag\u0027])"},{"line_number":71,"context_line":"        self.assertEqual(\u0027encrypt me\u0027,"},{"line_number":72,"context_line":"                         decrypt_resp.headers[\u0027x-object-meta-test\u0027])"},{"line_number":73,"context_line":"        self.assertEqual(\u0027do not encrypt me\u0027,"},{"line_number":74,"context_line":"                         decrypt_resp.headers[\u0027x-object-sysmeta-test\u0027])"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    def encrypt_value(self, value, key, crypto_meta_json):"}],"source_content_type":"text/x-python","patch_set":8,"id":"3a7e1126_a4859d07","line":73,"updated":"2015-12-18 22:54:19.000000000","message":"NIT: I think using \u0027do not encrypt me\u0027 as the header value is misleading. It implies that we are asserting that the value isn\u0027t being encrypted, even though we never assert that.","commit_id":"3d6b05cbbe5857f6d82b1b339a14363ceba6d91d"}]}