)]}'
{"swift/common/middleware/encrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"2881c93bb54904928b8a68084579701744d94b9d","unresolved":false,"context_lines":[{"line_number":115,"context_line":"            val, _ \u003d encrypt_header_val("},{"line_number":116,"context_line":"                self.crypto, self.plaintext_md5.hexdigest(),"},{"line_number":117,"context_line":"                self.keys[\u0027container\u0027], append_crypto_meta\u003dTrue)"},{"line_number":118,"context_line":"            footers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d val"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"            if inner_callback:"},{"line_number":121,"context_line":"                # pass on footers dict to any other callback that was"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_717acaf2","line":118,"updated":"2016-04-19 04:13:36.000000000","message":"For this update value, the same key is used for all etags in a container:\n\nIt is worth considering the security implications for this case.  The etag is a special case for us - using the same iv if the path is the same. Previously, the container key encrypted version was not persisted when an overwrite happens (it was only in the DB).  But the \u0027old\u0027 sysmeta for an old object version *might* be on disk at the same time as the new sysmeta.  Right?\n\nBut I suppose this is equal to the threat case already posed by the current design:  the container key is the same for all the etags in a container, but the iv is still only the same if the path is the same.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"676936393f3d251d327eed84aa7418082122839b","unresolved":false,"context_lines":[{"line_number":115,"context_line":"            val, _ \u003d encrypt_header_val("},{"line_number":116,"context_line":"                self.crypto, self.plaintext_md5.hexdigest(),"},{"line_number":117,"context_line":"                self.keys[\u0027container\u0027], append_crypto_meta\u003dTrue)"},{"line_number":118,"context_line":"            footers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d val"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"            if inner_callback:"},{"line_number":121,"context_line":"                # pass on footers dict to any other callback that was"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_c6d95e85","line":118,"in_reply_to":"1a122d0e_717acaf2","updated":"2016-04-19 08:38:49.000000000","message":"We have for each object cont_etag \u003d (etag encrypted using container key and a random nonce). We never re-use the same IV with the container key.\n\nYes, different versions of cont_etag could be on disk in different places - in obj sysmeta and in container db, and also different versions in different replicas of the container db, and also it could be written into the async pending files (which was also the case with previous non-sysmeta update override).\n\nBut different versions use different IVs unlike the object sysmeta encrypted etag which uses the path as an IV base.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"c081f90596ccd855f897357edbc6c3c2b415c0a7","unresolved":false,"context_lines":[{"line_number":115,"context_line":"            val, _ \u003d encrypt_header_val("},{"line_number":116,"context_line":"                self.crypto, self.plaintext_md5.hexdigest(),"},{"line_number":117,"context_line":"                self.keys[\u0027container\u0027], append_crypto_meta\u003dTrue)"},{"line_number":118,"context_line":"            footers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d val"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"            if inner_callback:"},{"line_number":121,"context_line":"                # pass on footers dict to any other callback that was"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_a0423366","line":118,"in_reply_to":"1a122d0e_c6d95e85","updated":"2016-04-19 14:46:43.000000000","message":"Ah, right, thanks.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"}],"test/probe/test_object_async_update.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"2881c93bb54904928b8a68084579701744d94b9d","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            \u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027: \u0027override-etag\u0027,"},{"line_number":111,"context_line":"            \u0027X-Object-Sysmeta-Container-Update-Override-Content-Type\u0027:"},{"line_number":112,"context_line":"                \u0027override-type\u0027"},{"line_number":113,"context_line":"        }"},{"line_number":114,"context_line":"        client.put_container(self.url, self.token, \u0027c1\u0027,"},{"line_number":115,"context_line":"                             headers\u003d{\u0027X-Storage-Policy\u0027:"},{"line_number":116,"context_line":"                                      self.policy.name})"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_1fe2d903","line":113,"updated":"2016-04-19 04:13:36.000000000","message":"seems like the rest of this tests is identical to \"test_for_backwards_compatibility\".  you could do the same type of \"do_test\" that was done in the other test updates and just set the different headers before calling a \"do_test\" function.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"676936393f3d251d327eed84aa7418082122839b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            \u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027: \u0027override-etag\u0027,"},{"line_number":111,"context_line":"            \u0027X-Object-Sysmeta-Container-Update-Override-Content-Type\u0027:"},{"line_number":112,"context_line":"                \u0027override-type\u0027"},{"line_number":113,"context_line":"        }"},{"line_number":114,"context_line":"        client.put_container(self.url, self.token, \u0027c1\u0027,"},{"line_number":115,"context_line":"                             headers\u003d{\u0027X-Storage-Policy\u0027:"},{"line_number":116,"context_line":"                                      self.policy.name})"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_da3beecf","line":113,"in_reply_to":"1a122d0e_1fe2d903","updated":"2016-04-19 08:38:49.000000000","message":"yes! good spot.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"}],"test/unit/obj/test_server.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"2881c93bb54904928b8a68084579701744d94b9d","unresolved":false,"context_lines":[{"line_number":793,"context_line":"        do_test(headers)"},{"line_number":794,"context_line":""},{"line_number":795,"context_line":"        # PUT - X-Object-Sysmeta-Container-Update-Override-Etag trumps"},{"line_number":796,"context_line":"        # \u0027X-Object-Sysmeta-Ec-Etag\u0027 for container update"},{"line_number":797,"context_line":"        headers \u003d dict(base_headers)"},{"line_number":798,"context_line":"        headers[\u0027X-Object-Sysmeta-Ec-Etag\u0027] \u003d \u0027ec etag\u0027"},{"line_number":799,"context_line":"        headers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d \u0027expected\u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a122d0e_3f41950c","line":796,"updated":"2016-04-19 04:13:36.000000000","message":"nice!  great test.","commit_id":"e80c1d63c364f6e537f59f5ddc6c0e1c21545d51"}]}