)]}'
{"etc/proxy-server.conf-sample":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":785,"context_line":""},{"line_number":786,"context_line":"# Sets the path from which the root secret should be read. The content of the"},{"line_number":787,"context_line":"# file is subject to all of the same expectations as above. This option (if"},{"line_number":788,"context_line":"# present) takes precedence over encryption_root_secret."},{"line_number":789,"context_line":"# encryption_root_secret_path \u003d"},{"line_number":790,"context_line":""},{"line_number":791,"context_line":"[filter:encryption]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1aa78d24_b5ec7290","line":788,"range":{"start_line":788,"start_character":2,"end_line":788,"end_character":9},"updated":"2016-07-08 17:37:50.000000000","message":"\"set\" might be better than \"present\". we could have\n\n  encryption_root_secret_path \u003d\n\nwith no effect.\n\nCould we add the converse statement at end of line 783:\n\n  The encryption_root_secret_path option (if set) takes precedence over this option.","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":785,"context_line":""},{"line_number":786,"context_line":"# Sets the path from which the root secret should be read. The content of the"},{"line_number":787,"context_line":"# file is subject to all of the same expectations as above. This option (if"},{"line_number":788,"context_line":"# present) takes precedence over encryption_root_secret."},{"line_number":789,"context_line":"# encryption_root_secret_path \u003d"},{"line_number":790,"context_line":""},{"line_number":791,"context_line":"[filter:encryption]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1aa78d24_d66dc4cd","line":788,"range":{"start_line":788,"start_character":2,"end_line":788,"end_character":9},"in_reply_to":"1aa78d24_b5ec7290","updated":"2016-07-08 19:01:28.000000000","message":"Done","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"}],"swift/common/middleware/crypto/keymaster.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":114,"context_line":"        self.app \u003d app"},{"line_number":115,"context_line":"        root_secret_path \u003d conf.get(\u0027encryption_root_secret_path\u0027)"},{"line_number":116,"context_line":"        if root_secret_path:"},{"line_number":117,"context_line":"            with open(root_secret_path, \u0027rb\u0027) as fd:"},{"line_number":118,"context_line":"                self.root_secret \u003d fd.read()"},{"line_number":119,"context_line":"        else:"},{"line_number":120,"context_line":"            self.root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_1572a67c","line":117,"updated":"2016-07-08 17:37:50.000000000","message":"\u003cparanoia\u003e\nIt would be stupid to put this file in some directory on the proxy that might be served up by some web service. If you put it in /var/cache/swift then I am pretty sure recon middleware wouldn\u0027t serve it, but I have been involved in conversation about making recon extensible by allowing it to serve arbitrary \"recon files\".\n\nSwift pretty much requires conf files to be in /etc/swift. Should we require the same of this secret file? It could of course always be symlinked to some other place but it might save an unfortunate mistake.\n\u003c/paranoia\u003e","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":117,"context_line":"            with open(root_secret_path, \u0027rb\u0027) as fd:"},{"line_number":118,"context_line":"                self.root_secret \u003d fd.read()"},{"line_number":119,"context_line":"        else:"},{"line_number":120,"context_line":"            self.root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"        try:"},{"line_number":123,"context_line":"            # b64decode will silently discard bad characters, but we should"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_d5349e4b","line":120,"updated":"2016-07-08 17:37:50.000000000","message":"I wonder if we should raise an error if both are specified? Saves someone inadvertently changing their root secret by adding a file path.\n\nOr, since a valid secret cannot contain a \u0027:\u0027, allow encryption_root_secret to be a url e.g.:\n\n  encryption_root_secret\u003dfile:///etc/swift/my_secret.txt","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":117,"context_line":"            with open(root_secret_path, \u0027rb\u0027) as fd:"},{"line_number":118,"context_line":"                self.root_secret \u003d fd.read()"},{"line_number":119,"context_line":"        else:"},{"line_number":120,"context_line":"            self.root_secret \u003d conf.get(\u0027encryption_root_secret\u0027)"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"        try:"},{"line_number":123,"context_line":"            # b64decode will silently discard bad characters, but we should"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_dbfded6f","line":120,"in_reply_to":"1aa78d24_d5349e4b","updated":"2016-07-08 19:01:28.000000000","message":"I had debated about something like that second option, probably with an option to explicitly say\n\n encryption_root_secret \u003d base64:\u003cb64-encoded secret\u003e\n\n(Inventing a new scheme mainly because a proper data: URI would be much longer and uglier than strictly necessary.)\n\nI shied away from it for two main reasons:\n- It might set expectations that other protocols may be supported in the future, and the idea of having proxies fetching secrets over, say, http on startup makes me nervous.\n- It is unlike any other way that we reference files or paths in configs.\n\nAs to raising an error if both are set, I think I\u0027m more inclined to log a warning and continue. The best precedent I found was memcache_servers / memcache.conf which doesn\u0027t even go that far. Although I suppose the memcache.conf behavior supports your paranoia above...\n\nI suppose we could leave the single option as it is now, and if it\u0027s blank try to read os.path.join(conf.get(\u0027swift_dir\u0027, \u0027/etc/swift\u0027), \u0027encryption_root_secret.b64\u0027) or something (might need to think more about what it should be named), and if we *still* can\u0027t get anything useful, error out. Thoughts?","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":124,"context_line":"            # treat them as an error"},{"line_number":125,"context_line":"            if not isinstance(self.root_secret, six.string_types) or any("},{"line_number":126,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":127,"context_line":"                    for c in self.root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":128,"context_line":"                raise ValueError"},{"line_number":129,"context_line":"            self.root_secret \u003d base64.b64decode(self.root_secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_ea08d92a","line":126,"updated":"2016-07-08 17:37:50.000000000","message":"nice, allow for \\r and \\n","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            # b64decode will silently discard bad characters, but we should"},{"line_number":124,"context_line":"            # treat them as an error"},{"line_number":125,"context_line":"            if not isinstance(self.root_secret, six.string_types) or any("},{"line_number":126,"context_line":"                    c not in string.digits + string.ascii_letters + \u0027/+\\r\\n\u0027"},{"line_number":127,"context_line":"                    for c in self.root_secret.strip(\u0027\\r\\n\u003d\u0027)):"},{"line_number":128,"context_line":"                raise ValueError"},{"line_number":129,"context_line":"            self.root_secret \u003d base64.b64decode(self.root_secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_1b6db532","line":126,"in_reply_to":"1aa78d24_ea08d92a","updated":"2016-07-08 19:01:28.000000000","message":"Seemed like a good idea, especially given how `openssl rand` will automatically wrap at 64 chars.","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                raise ValueError"},{"line_number":132,"context_line":"        except (TypeError, ValueError):"},{"line_number":133,"context_line":"            raise ValueError("},{"line_number":134,"context_line":"                \u0027encryption_root_secret from proxy-server.conf must be \u0027"},{"line_number":135,"context_line":"                \u0027a base64 encoding of at least 32 raw bytes\u0027)"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    def __call__(self, env, start_response):"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_4a4bedb0","line":134,"updated":"2016-07-08 17:37:50.000000000","message":"nit: how about parameterising the message with the source file name: root_secret_path or proxy-server.conf. Might save some config debugging.","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"}],"test/unit/common/middleware/crypto/test_keymaster.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        for secret in (os.urandom(32), os.urandom(33), os.urandom(50)):"},{"line_number":129,"context_line":"            encoded_secret \u003d base64.b64encode(secret)"},{"line_number":130,"context_line":"            for conf_val in (bytes(encoded_secret), unicode(encoded_secret),"},{"line_number":131,"context_line":"                             encoded_secret[:30] + \u0027\\n\u0027 + encoded_secret[30:]):"},{"line_number":132,"context_line":"                try:"},{"line_number":133,"context_line":"                    app \u003d keymaster.KeyMaster("},{"line_number":134,"context_line":"                        self.swift, {\u0027encryption_root_secret\u0027: conf_val})"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_2a8941cb","line":131,"updated":"2016-07-08 17:37:50.000000000","message":"and same for \u0027\\r\u0027 ?","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":128,"context_line":"        for secret in (os.urandom(32), os.urandom(33), os.urandom(50)):"},{"line_number":129,"context_line":"            encoded_secret \u003d base64.b64encode(secret)"},{"line_number":130,"context_line":"            for conf_val in (bytes(encoded_secret), unicode(encoded_secret),"},{"line_number":131,"context_line":"                             encoded_secret[:30] + \u0027\\n\u0027 + encoded_secret[30:]):"},{"line_number":132,"context_line":"                try:"},{"line_number":133,"context_line":"                    app \u003d keymaster.KeyMaster("},{"line_number":134,"context_line":"                        self.swift, {\u0027encryption_root_secret\u0027: conf_val})"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_7b64b948","line":131,"in_reply_to":"1aa78d24_2a8941cb","updated":"2016-07-08 19:01:28.000000000","message":"Done","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                             encoded_secret[:30] + \u0027\\n\u0027 + encoded_secret[30:]):"},{"line_number":132,"context_line":"                try:"},{"line_number":133,"context_line":"                    app \u003d keymaster.KeyMaster("},{"line_number":134,"context_line":"                        self.swift, {\u0027encryption_root_secret\u0027: conf_val})"},{"line_number":135,"context_line":"                    self.assertEqual(secret, app.root_secret)"},{"line_number":136,"context_line":"                except AssertionError as err:"},{"line_number":137,"context_line":"                    self.fail(str(err) + \u0027 for secret %r\u0027 % secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_ea3a99e6","line":134,"updated":"2016-07-08 17:37:50.000000000","message":"add\n\n  \u0027encryption_root_secret_path\u0027: None\n\nto verify that empty path is ignored.","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                             encoded_secret[:30] + \u0027\\n\u0027 + encoded_secret[30:]):"},{"line_number":132,"context_line":"                try:"},{"line_number":133,"context_line":"                    app \u003d keymaster.KeyMaster("},{"line_number":134,"context_line":"                        self.swift, {\u0027encryption_root_secret\u0027: conf_val})"},{"line_number":135,"context_line":"                    self.assertEqual(secret, app.root_secret)"},{"line_number":136,"context_line":"                except AssertionError as err:"},{"line_number":137,"context_line":"                    self.fail(str(err) + \u0027 for secret %r\u0027 % secret)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_5be57da6","line":134,"in_reply_to":"1aa78d24_ea3a99e6","updated":"2016-07-08 19:01:28.000000000","message":"Done","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":148,"context_line":"                    .read.return_value \u003d conf_val"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"                app \u003d keymaster.KeyMaster("},{"line_number":151,"context_line":"                    self.swift, {\u0027encryption_root_secret_path\u0027: \u0027/some/path\u0027})"},{"line_number":152,"context_line":"                try:"},{"line_number":153,"context_line":"                    self.assertEqual(secret, app.root_secret)"},{"line_number":154,"context_line":"                    self.assertEqual(mock_open.mock_calls, ["}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_aa49b190","line":151,"updated":"2016-07-08 17:37:50.000000000","message":"add tests with \u0027encryption_root_secret\u0027: \u0027bogus\u0027 \u0027encryption_root_secret\u0027: \u003cvalid secret\u003e to validate that the file takes precedence regardless of validity of the proxy-server.conf option","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":148,"context_line":"                    .read.return_value \u003d conf_val"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"                app \u003d keymaster.KeyMaster("},{"line_number":151,"context_line":"                    self.swift, {\u0027encryption_root_secret_path\u0027: \u0027/some/path\u0027})"},{"line_number":152,"context_line":"                try:"},{"line_number":153,"context_line":"                    self.assertEqual(secret, app.root_secret)"},{"line_number":154,"context_line":"                    self.assertEqual(mock_open.mock_calls, ["}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_563434dd","line":151,"in_reply_to":"1aa78d24_aa49b190","updated":"2016-07-08 19:01:28.000000000","message":"Done","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":12261,"name":"Mahati","email":"mahati.chamarthy@gmail.com","username":"Mahati"},"change_message_id":"1ca747e6e61f09df11c04af8a748da34bc496fa3","unresolved":false,"context_lines":[{"line_number":165,"context_line":"                       u\u0027a\u0027 * 44 + u\u0027????\u0027, b\u0027a\u0027 * 44 + b\u0027????\u0027,  # not base64"},{"line_number":166,"context_line":"                       u\u0027a\u0027 * 45, b\u0027a\u0027 * 45,  # bad padding"},{"line_number":167,"context_line":"                       99, None):"},{"line_number":168,"context_line":"            conf \u003d {\u0027encryption_root_secret\u0027: secret}"},{"line_number":169,"context_line":"            try:"},{"line_number":170,"context_line":"                with self.assertRaises(ValueError) as err:"},{"line_number":171,"context_line":"                    keymaster.KeyMaster(self.swift, conf)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_d54af554","line":168,"updated":"2016-07-08 10:57:24.000000000","message":"add a conf option for encryption_root_secret_path as well?","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"78e46c1764fc47b9e541cc8fd380d62d0ac28276","unresolved":false,"context_lines":[{"line_number":165,"context_line":"                       u\u0027a\u0027 * 44 + u\u0027????\u0027, b\u0027a\u0027 * 44 + b\u0027????\u0027,  # not base64"},{"line_number":166,"context_line":"                       u\u0027a\u0027 * 45, b\u0027a\u0027 * 45,  # bad padding"},{"line_number":167,"context_line":"                       99, None):"},{"line_number":168,"context_line":"            conf \u003d {\u0027encryption_root_secret\u0027: secret}"},{"line_number":169,"context_line":"            try:"},{"line_number":170,"context_line":"                with self.assertRaises(ValueError) as err:"},{"line_number":171,"context_line":"                    keymaster.KeyMaster(self.swift, conf)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_1b8935cb","line":168,"in_reply_to":"1aa78d24_aabb7174","updated":"2016-07-08 19:01:28.000000000","message":"Done","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c5d0606a70e8a7de19de5a252662081287982d77","unresolved":false,"context_lines":[{"line_number":165,"context_line":"                       u\u0027a\u0027 * 44 + u\u0027????\u0027, b\u0027a\u0027 * 44 + b\u0027????\u0027,  # not base64"},{"line_number":166,"context_line":"                       u\u0027a\u0027 * 45, b\u0027a\u0027 * 45,  # bad padding"},{"line_number":167,"context_line":"                       99, None):"},{"line_number":168,"context_line":"            conf \u003d {\u0027encryption_root_secret\u0027: secret}"},{"line_number":169,"context_line":"            try:"},{"line_number":170,"context_line":"                with self.assertRaises(ValueError) as err:"},{"line_number":171,"context_line":"                    keymaster.KeyMaster(self.swift, conf)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1aa78d24_aabb7174","line":168,"in_reply_to":"1aa78d24_d54af554","updated":"2016-07-08 17:37:50.000000000","message":"+1 add test for invalid secret loaded from the file","commit_id":"4b7df5fc1bc504bb7b2263cd185282ab9d1448da"}]}