)]}'
{"doc/source/overview_encryption.rst":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"12bd01d5326f3dc97fcd0d1acfcb4b853e83e7f4","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Deployment and operation"},{"line_number":60,"context_line":"------------------------"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Encryption at rest is deployed by two middleware filters to the proxy"},{"line_number":63,"context_line":"server WSGI pipeline and including their respective filter configuration"},{"line_number":64,"context_line":"sections in the `proxy-server.conf` file. :ref:`Additional steps"},{"line_number":65,"context_line":"\u003ccontainer_sync_client_config\u003e` are required if the container sync feature is"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3aaa91ec_ebda384a","line":62,"range":{"start_line":62,"start_character":22,"end_line":62,"end_character":30},"updated":"2016-06-29 19:45:38.000000000","message":"I think we either want \"is deployed by adding\" or \"is enabled by\" or \"is accomplished using\". The middlewares don\u0027t do the deploying.","commit_id":"bf05e66bcfc95c657e5178c07846f1d0456c999c"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"12bd01d5326f3dc97fcd0d1acfcb4b853e83e7f4","unresolved":false,"context_lines":[{"line_number":137,"context_line":"Disabling Encryption"},{"line_number":138,"context_line":"--------------------"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Once deployed, the keymasters and encryption middlewares should not be removed"},{"line_number":141,"context_line":"from the pipeline. To do so will cause encrypted object data and/or metadata to"},{"line_number":142,"context_line":"be returned in response to GET or HEAD requests for objects that were"},{"line_number":143,"context_line":"previously encrypted."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3aaa91ec_aba2f0ab","line":140,"range":{"start_line":140,"start_character":19,"end_line":140,"end_character":29},"updated":"2016-06-29 19:45:38.000000000","message":"s/keymasters/keymaster/","commit_id":"bf05e66bcfc95c657e5178c07846f1d0456c999c"},{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"d81a70d61c8f6539b4ac7b6660e1106cc526eae8","unresolved":false,"context_lines":[{"line_number":68,"context_line":"The `keymaster` and `encryption` middleware filters must be to the right of all"},{"line_number":69,"context_line":"other middleware in the pipeline apart from the final proxy-logging middleware,"},{"line_number":70,"context_line":"and in the order shown in this example::"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  \u003cother middleware\u003e keymaster encryption proxy-logging proxy-server"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  [filter:keymaster]"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_a9d15859","line":71,"updated":"2016-06-29 20:15:05.000000000","message":"Maybe my understanding of the wsgi pipeline is not up to scratch, but does merging the encrypter and decrypter into a single encryption filter, and having this filter to the right of the keymaster in the wsgi pipeline, affect future keymasters that may rely on information stored in e.g., object metadata for providing the encryption keys?\n\nMy understanding was that for the original \u0027decrypter keymaster encrypter\u0027 setup, for e.g., PUTs and POSTs, the decrypter is a NOP, keymaster provides the keys for encryption, and encrypter encrypts the data. On the way out, e.g., for GETs, the filters are called in reverse order, i.e., first the encrypter which now is a NOP, then the keymaster provides the keys while having access to metadata (e.g., wrapped keys), and the decrypter then uses the keys.\n\nFor this keymaster that derives keys based on the path, I don\u0027t see an issue with merging the encrypter and decrypter, since the keymaster has enough information to generate the keys for both encryption and decryption already \u0027on the way in\u0027, but I\u0027m wondering if this change would potentially force future keymasters to again separate the encrypter and decrypter into two filters?","commit_id":"bb3f25fc1298e6e9074ea150b5ca71c289b6d907"}],"swift/common/middleware/crypto_utils.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7d00dc1afdf225bd5770622eb4600e5ef103e4cf","unresolved":false,"context_lines":[{"line_number":298,"context_line":""},{"line_number":299,"context_line":"def filter_factory(global_conf, **local_conf):"},{"line_number":300,"context_line":"    \"\"\"Provides a factory function for loading encryption middleware.\"\"\""},{"line_number":301,"context_line":"    # imports here to avoid circular import dependency"},{"line_number":302,"context_line":"    from swift.common.middleware.decrypter import Decrypter"},{"line_number":303,"context_line":"    from swift.common.middleware.encrypter import Encrypter"},{"line_number":304,"context_line":"    conf \u003d global_conf.copy()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3aaa91ec_0b122457","line":301,"updated":"2016-06-29 19:27:39.000000000","message":"someone smarter may know a better way to deal with this","commit_id":"bf05e66bcfc95c657e5178c07846f1d0456c999c"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"35e8c4e54c565184a2ed48a0779d0b9b4a617770","unresolved":false,"context_lines":[{"line_number":300,"context_line":"    \"\"\"Provides a factory function for loading encryption middleware.\"\"\""},{"line_number":301,"context_line":"    # imports here to avoid circular import dependency"},{"line_number":302,"context_line":"    from swift.common.middleware.decrypter import Decrypter"},{"line_number":303,"context_line":"    from swift.common.middleware.encrypter import Encrypter"},{"line_number":304,"context_line":"    conf \u003d global_conf.copy()"},{"line_number":305,"context_line":"    conf.update(local_conf)"},{"line_number":306,"context_line":"    register_swift_info(\u0027encryption\u0027, admin\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3aaa91ec_a37e90ac","line":303,"updated":"2016-06-29 22:48:16.000000000","message":"I think it\u0027s fine, pretty obvious why it\u0027s like this","commit_id":"bb3f25fc1298e6e9074ea150b5ca71c289b6d907"},{"author":{"_account_id":2622,"name":"Samuel Merritt","email":"spam+launchpad@andcheese.org","username":"torgomatic"},"change_message_id":"dcb8d7212e53a5db02b215f88bcd0bcb63d8f7d7","unresolved":false,"context_lines":[{"line_number":303,"context_line":"    from swift.common.middleware.encrypter import Encrypter"},{"line_number":304,"context_line":"    conf \u003d global_conf.copy()"},{"line_number":305,"context_line":"    conf.update(local_conf)"},{"line_number":306,"context_line":"    register_swift_info(\u0027encryption\u0027, admin\u003dTrue)"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    def encryption_filter(app):"},{"line_number":309,"context_line":"        return Decrypter(Encrypter(app, conf), conf)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3aaa91ec_a464dd21","line":306,"updated":"2016-06-29 20:54:41.000000000","message":"I think Tim was saying something about needing a config value here for swift3... maybe \"disable_encryption\"?","commit_id":"bb3f25fc1298e6e9074ea150b5ca71c289b6d907"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"882ac00909dae6a2cb3cbb76025499bf0206df61","unresolved":false,"context_lines":[{"line_number":303,"context_line":"    from swift.common.middleware.encrypter import Encrypter"},{"line_number":304,"context_line":"    conf \u003d global_conf.copy()"},{"line_number":305,"context_line":"    conf.update(local_conf)"},{"line_number":306,"context_line":"    register_swift_info(\u0027encryption\u0027, admin\u003dTrue)"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    def encryption_filter(app):"},{"line_number":309,"context_line":"        return Decrypter(Encrypter(app, conf), conf)"}],"source_content_type":"text/x-python","patch_set":2,"id":"3aaa91ec_9823efbc","line":306,"in_reply_to":"3aaa91ec_a464dd21","updated":"2016-06-30 09:04:36.000000000","message":"yeah and maybe we could also consider auto inserting crypto middleware into pipeline?","commit_id":"bb3f25fc1298e6e9074ea150b5ca71c289b6d907"},{"author":{"_account_id":2622,"name":"Samuel Merritt","email":"spam+launchpad@andcheese.org","username":"torgomatic"},"change_message_id":"dcb8d7212e53a5db02b215f88bcd0bcb63d8f7d7","unresolved":false,"context_lines":[{"line_number":306,"context_line":"    register_swift_info(\u0027encryption\u0027, admin\u003dTrue)"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    def encryption_filter(app):"},{"line_number":309,"context_line":"        return Decrypter(Encrypter(app, conf), conf)"},{"line_number":310,"context_line":"    return encryption_filter"}],"source_content_type":"text/x-python","patch_set":2,"id":"3aaa91ec_e4e545a4","line":309,"updated":"2016-06-29 20:54:41.000000000","message":"Yep, this is good, solid Python.\n\nSometimes I wish we had Clojure\u0027s macros available, though.\n\n    (-\u003e app\n        (Encrypter conf)\n        (Decrypter conf))","commit_id":"bb3f25fc1298e6e9074ea150b5ca71c289b6d907"}],"test/unit/common/middleware/test_encrypter_decrypter.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7d00dc1afdf225bd5770622eb4600e5ef103e4cf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"3aaa91ec_5801a005","updated":"2016-06-29 19:27:39.000000000","message":"Ideally I would rename this test_encryption.py, but that will make review harder.","commit_id":"bf05e66bcfc95c657e5178c07846f1d0456c999c"}]}