)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"903eb9c3f07fd890eb37c7c55b41c3e53c183a9a","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This changes also allows some simplification of the keymaster,"},{"line_number":22,"context_line":"and now the keymaster only calculates keys when they are asked"},{"line_number":23,"context_line":"for by a call to fetch_keys."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Change-Id: Icb368305a15e1bbe32483f2e2bbb98a1441a4dad"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9abb7d3a_4f4b2db1","line":23,"updated":"2016-05-27 04:35:57.000000000","message":"in addition, the keymaster will never set the \u0027swift.crypto.override\u0027 flag anymore.  There are still encrypter and decrypter unit tests to handle the case where somebody uses such a keymaster, but this one will not make use of that flag.","commit_id":"f4e9a1859510af5737a2587bd9438f5e3bd9830a"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"f6a9ce76c48f938a82d453bb865a8ab1aa04a88b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"no longer use the X-Object-Sysmeta-Crypto-Id header. That way,"},{"line_number":23,"context_line":"if ever a different key_id were used by keymaster for a POST"},{"line_number":24,"context_line":"vs a PUT then we\u0027d have the right value stored with the metadata"},{"line_number":25,"context_line":"vs the data."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"This changes also allows some simplification of the keymaster,"},{"line_number":28,"context_line":"and now the keymaster only calculates keys when they are asked"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9abb7d3a_b87a3486","line":25,"updated":"2016-05-31 20:59:01.000000000","message":"If you are making a change anyway, could also mention that the key id will also be stored in the dict returned by fetch_keys callback","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"b91fa4ce93ebf972c0faa278eb5b9ac222c7de54","unresolved":false,"context_lines":[{"line_number":22,"context_line":"no longer use the X-Object-Sysmeta-Crypto-Id header. That way,"},{"line_number":23,"context_line":"if ever a different key_id were used by keymaster for a POST"},{"line_number":24,"context_line":"vs a PUT then we\u0027d have the right value stored with the metadata"},{"line_number":25,"context_line":"vs the data."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"This changes also allows some simplification of the keymaster,"},{"line_number":28,"context_line":"and now the keymaster only calculates keys when they are asked"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"9abb7d3a_7169f0f8","line":25,"in_reply_to":"9abb7d3a_b87a3486","updated":"2016-06-01 11:04:30.000000000","message":"Done","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"}],"swift/common/middleware/encrypter.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"f6a9ce76c48f938a82d453bb865a8ab1aa04a88b","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        self.body_crypto_ctxt \u003d None"},{"line_number":59,"context_line":"        self.keys \u003d keys"},{"line_number":60,"context_line":"        # remove any Etag from headers, it won\u0027t be valid for ciphertext and"},{"line_number":61,"context_line":"        # we\u0027ll send the ciphertext Etag later in footer metadata"},{"line_number":62,"context_line":"        self.plaintext_md5 \u003d None"},{"line_number":63,"context_line":"        self.ciphertext_md5 \u003d None"},{"line_number":64,"context_line":"        self.logger \u003d logger"}],"source_content_type":"text/x-python","patch_set":6,"id":"9abb7d3a_da0e108b","line":61,"updated":"2016-05-31 20:59:01.000000000","message":"Sorry, I didn\u0027t review a couple of the previous patches.  This comment needs to move to the location of the pop \u0027etag\u0027 in the install_footers_callback method.","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"b91fa4ce93ebf972c0faa278eb5b9ac222c7de54","unresolved":false,"context_lines":[{"line_number":58,"context_line":"        self.body_crypto_ctxt \u003d None"},{"line_number":59,"context_line":"        self.keys \u003d keys"},{"line_number":60,"context_line":"        # remove any Etag from headers, it won\u0027t be valid for ciphertext and"},{"line_number":61,"context_line":"        # we\u0027ll send the ciphertext Etag later in footer metadata"},{"line_number":62,"context_line":"        self.plaintext_md5 \u003d None"},{"line_number":63,"context_line":"        self.ciphertext_md5 \u003d None"},{"line_number":64,"context_line":"        self.logger \u003d logger"}],"source_content_type":"text/x-python","patch_set":6,"id":"9abb7d3a_114344b3","line":61,"in_reply_to":"9abb7d3a_da0e108b","updated":"2016-06-01 11:04:30.000000000","message":"Done","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"f6a9ce76c48f938a82d453bb865a8ab1aa04a88b","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                # crypto parameters appended."},{"line_number":145,"context_line":"                val, crypto_meta \u003d encrypt_header_val("},{"line_number":146,"context_line":"                    self.crypto, container_listing_etag,"},{"line_number":147,"context_line":"                    self.keys[\u0027container\u0027], iv_base\u003dself.path)"},{"line_number":148,"context_line":"                crypto_meta[\u0027key_id\u0027] \u003d self.keys[\u0027id\u0027]"},{"line_number":149,"context_line":"                val \u003d append_crypto_meta(val, crypto_meta)"},{"line_number":150,"context_line":"                footers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"9abb7d3a_5d5dfa13","line":147,"updated":"2016-05-31 20:59:01.000000000","message":"Sorry, I didn\u0027t review a couple of the previous patches, so I am going to ask about those changes here.  Why is the listing etag re-determined now that the same key and iv are used for both the listing version and the regular \u0027X-Object-Sysmeta-Crypto-Etag\u0027?  Isn\u0027t this the same value every time now?","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"b91fa4ce93ebf972c0faa278eb5b9ac222c7de54","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                # crypto parameters appended."},{"line_number":145,"context_line":"                val, crypto_meta \u003d encrypt_header_val("},{"line_number":146,"context_line":"                    self.crypto, container_listing_etag,"},{"line_number":147,"context_line":"                    self.keys[\u0027container\u0027], iv_base\u003dself.path)"},{"line_number":148,"context_line":"                crypto_meta[\u0027key_id\u0027] \u003d self.keys[\u0027id\u0027]"},{"line_number":149,"context_line":"                val \u003d append_crypto_meta(val, crypto_meta)"},{"line_number":150,"context_line":"                footers[\u0027X-Object-Sysmeta-Container-Update-Override-Etag\u0027] \u003d \\"}],"source_content_type":"text/x-python","patch_set":6,"id":"9abb7d3a_912e14f9","line":147,"in_reply_to":"9abb7d3a_5d5dfa13","updated":"2016-06-01 11:04:30.000000000","message":"Yes it\u0027s same value, that is fixed over here https://review.openstack.org/#/c/321638/3/swift/common/middleware/encrypter.py","commit_id":"6cf3659ef507ac4e1b022ae5b42f69eedacbaad8"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"4fd9fcebebb301452343222aee9d3c73b5d4fe57","unresolved":false,"context_lines":[{"line_number":197,"context_line":"        for name, val in req.headers.items():"},{"line_number":198,"context_line":"            if is_user_meta(self.server_type, name) and val:"},{"line_number":199,"context_line":"                req.headers[name], meta \u003d encrypt_header_val("},{"line_number":200,"context_line":"                    self.crypto, val, keys[self.server_type])"},{"line_number":201,"context_line":"                # short_name is extracted in order to use it for naming the"},{"line_number":202,"context_line":"                # corresponding x-object-transient-sysmeta-crypto- header"},{"line_number":203,"context_line":"                short_name \u003d strip_user_meta_prefix(self.server_type, name)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9abb7d3a_d495ce88","line":200,"updated":"2016-06-02 17:14:31.000000000","message":"so, we decided not to put the key_id into the crypto-meta of the headers?  I also see that the id is no longer in the callback.  I will have to get my head around the patches merged versus in-work for all the \u0027id\u0027 handling.  I am afraid I have lost track as to where we landed with where to store the id, and what that would mean for this patch in particular (since something may not have been merged that is related).  Will do this in the next 10 hours and give a score.","commit_id":"507bfbfacfd836be81e639fbb7e2b041e167988f"},{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"0fe31ab77ab4fb18cc872b9638f11742692b669a","unresolved":false,"context_lines":[{"line_number":197,"context_line":"        for name, val in req.headers.items():"},{"line_number":198,"context_line":"            if is_user_meta(self.server_type, name) and val:"},{"line_number":199,"context_line":"                req.headers[name], meta \u003d encrypt_header_val("},{"line_number":200,"context_line":"                    self.crypto, val, keys[self.server_type])"},{"line_number":201,"context_line":"                # short_name is extracted in order to use it for naming the"},{"line_number":202,"context_line":"                # corresponding x-object-transient-sysmeta-crypto- header"},{"line_number":203,"context_line":"                short_name \u003d strip_user_meta_prefix(self.server_type, name)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9abb7d3a_a540d608","line":200,"in_reply_to":"9abb7d3a_7a804947","updated":"2016-06-02 17:54:33.000000000","message":"oh right, ok - that helped me to get back on track.  context switching is hard :-)\n\nas for what i said about fetch keys, i meant that in patchset 6, you had the id being in the dict returned from fetch keys.   now its no longer there.  i thought it was an interesting addition.  seemed to be nice to have. but w/e.","commit_id":"507bfbfacfd836be81e639fbb7e2b041e167988f"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"b05149ecb492b35731a4b1d5f77bd50f9d1361a2","unresolved":false,"context_lines":[{"line_number":197,"context_line":"        for name, val in req.headers.items():"},{"line_number":198,"context_line":"            if is_user_meta(self.server_type, name) and val:"},{"line_number":199,"context_line":"                req.headers[name], meta \u003d encrypt_header_val("},{"line_number":200,"context_line":"                    self.crypto, val, keys[self.server_type])"},{"line_number":201,"context_line":"                # short_name is extracted in order to use it for naming the"},{"line_number":202,"context_line":"                # corresponding x-object-transient-sysmeta-crypto- header"},{"line_number":203,"context_line":"                short_name \u003d strip_user_meta_prefix(self.server_type, name)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9abb7d3a_7a804947","line":200,"in_reply_to":"9abb7d3a_d495ce88","updated":"2016-06-02 17:31:04.000000000","message":"Correct. Right now there is only one id ever generated for an object, so it\u0027s only needed to be stored in one place. That is same as when the keymaster put it in it sysmeta-crypto-id header.\n\nThe difference is that IF we ever need to handle different key id\u0027s between PUT and POSTs then we can start to stash a (potentially different) id in the crypto meta for headers. The previous approach did not support that future possibility.\n\nBUT we do not need that now and so I have implemented the very minimum necessary to allow for that future.\n\nI do think that the key_id should be passed in the fetch_keys callback eventually* but it does not need to be yet - it is not used by the keymaster. Ideally I would change the callback interface soon (pre-merge to master) but that is not essential. The change here IS essential because it determines what gets written with objects that we need to be compatible with.\n\nSo, for the sake of getting to master, I am focussed first on what must be correct on disk, but I do have in mind the callback change.\n\n(*I don\u0027t think the key_id ever has been passed in the callback?? fetch_crypto_keys has always been a zero-arg callable.)","commit_id":"507bfbfacfd836be81e639fbb7e2b041e167988f"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"f8de984417d4e14b91644a67fa739f4d3d8f8ebb","unresolved":false,"context_lines":[{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    def __call__(self, env, start_response):"},{"line_number":297,"context_line":"        # If override is set in env, then just pass along"},{"line_number":298,"context_line":"        if config_true_value(env.get(\u0027swift.crypto.override\u0027)):"},{"line_number":299,"context_line":"            return self.app(env, start_response)"},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"        req \u003d Request(env)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9abb7d3a_025a452a","line":298,"updated":"2016-06-03 13:23:29.000000000","message":"since we are no longer setting the swift.crypto.override flag, this could be removed I think?","commit_id":"e6898c2a8df9cc3175efdce70d7b804375e8eda2"}],"swift/common/middleware/keymaster.py":[{"author":{"_account_id":12279,"name":"Janie Richling","email":"jrichli@us.ibm.com","username":"jrichli"},"change_message_id":"305e8fe5321ddafc3b355d0cca603bad46c44a1f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"            # that particular data or metadata had its keys generated."},{"line_number":85,"context_line":"            # Currently we have no need to do that, so we are simply persisting"},{"line_number":86,"context_line":"            # this information for future use."},{"line_number":87,"context_line":"            self._keys[\u0027id\u0027] \u003d {\u0027v\u0027: \u00271\u0027, \u0027path\u0027: base64.b64encode(path)}"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        return self._keys"},{"line_number":90,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"7aa08908_26607535","line":87,"updated":"2016-06-06 03:55:40.000000000","message":"Thanks for the addition of the keymaster version number.  great idea","commit_id":"e6898c2a8df9cc3175efdce70d7b804375e8eda2"}]}