)]}'
{"doc/source/overview_encryption.rst":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d8b927a005cbc57066a91dd8c4162e0a69350e43","unresolved":false,"context_lines":[{"line_number":312,"context_line":"    use \u003d egg:swift#kmip_keymaster"},{"line_number":313,"context_line":"    keymaster_config_path \u003d /etc/swift/kmip_keymaster.conf"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"In this case, the ``filter:kmip_keymaster`` section should container no other"},{"line_number":316,"context_line":"options than ``use`` and ``keymaster_config_path``. All other options should be"},{"line_number":317,"context_line":"defined in the separate config file in a section named ``kmip_keymaster``. For"},{"line_number":318,"context_line":"example::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f7c97a3_ef22bd02","line":315,"range":{"start_line":315,"start_character":59,"end_line":315,"end_character":68},"updated":"2018-06-27 17:50:01.000000000","message":"contain","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5b9796822442b98729ec961f50888f063002b095","unresolved":false,"context_lines":[{"line_number":312,"context_line":"    use \u003d egg:swift#kmip_keymaster"},{"line_number":313,"context_line":"    keymaster_config_path \u003d /etc/swift/kmip_keymaster.conf"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"In this case, the ``filter:kmip_keymaster`` section should container no other"},{"line_number":316,"context_line":"options than ``use`` and ``keymaster_config_path``. All other options should be"},{"line_number":317,"context_line":"defined in the separate config file in a section named ``kmip_keymaster``. For"},{"line_number":318,"context_line":"example::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f7c97a3_aff1bb98","line":315,"range":{"start_line":315,"start_character":59,"end_line":315,"end_character":68},"in_reply_to":"5f7c97a3_ef22bd02","updated":"2018-07-03 08:00:00.000000000","message":"Done","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"}],"etc/keymaster.conf-sample":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"35c4f5e7ac7b0e19d97980b4626edc8e2fb203b4","unresolved":false,"context_lines":[{"line_number":76,"context_line":"# domain_name \u003d changeme"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"[kmip_keymaster]"},{"line_number":79,"context_line":"# The kmip_keymaster section is used to configure a keymater that fetches an"},{"line_number":80,"context_line":"# encryption root secret from a KMIP service."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"# The value of the ``key_id`` option should be the unique identifier for a"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_e9acfd37","line":79,"range":{"start_line":79,"start_character":52,"end_line":79,"end_character":60},"updated":"2018-06-27 17:05:48.000000000","message":"keymaster","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5b9796822442b98729ec961f50888f063002b095","unresolved":false,"context_lines":[{"line_number":76,"context_line":"# domain_name \u003d changeme"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"[kmip_keymaster]"},{"line_number":79,"context_line":"# The kmip_keymaster section is used to configure a keymater that fetches an"},{"line_number":80,"context_line":"# encryption root secret from a KMIP service."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"# The value of the ``key_id`` option should be the unique identifier for a"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_4ff02792","line":79,"range":{"start_line":79,"start_character":52,"end_line":79,"end_character":60},"in_reply_to":"5f7c97a3_e9acfd37","updated":"2018-07-03 08:00:00.000000000","message":"Done","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"35c4f5e7ac7b0e19d97980b4626edc8e2fb203b4","unresolved":false,"context_lines":[{"line_number":80,"context_line":"# encryption root secret from a KMIP service."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"# The value of the ``key_id`` option should be the unique identifier for a"},{"line_number":83,"context_line":"# secret that will be retrieved from the KMIP service."},{"line_number":84,"context_line":"# key_id \u003d \u003cunique id of secret to be fetched from the KMIP service\u003e"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"# The remaining options are used to configure a PyKMIP client and are shown"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_096ff9fa","line":83,"range":{"start_line":83,"start_character":2,"end_line":83,"end_character":8},"updated":"2018-06-27 17:05:48.000000000","message":"Maybe worth calling out the expected properties? I.e., that it will be a AES-256 secret key?","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c2059e82f3bfe5951a86b505ef8c83c9ae8077a2","unresolved":false,"context_lines":[{"line_number":80,"context_line":"# encryption root secret from a KMIP service."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"# The value of the ``key_id`` option should be the unique identifier for a"},{"line_number":83,"context_line":"# secret that will be retrieved from the KMIP service."},{"line_number":84,"context_line":"# key_id \u003d \u003cunique id of secret to be fetched from the KMIP service\u003e"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"# The remaining options are used to configure a PyKMIP client and are shown"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_8fa1c9ab","line":83,"range":{"start_line":83,"start_character":2,"end_line":83,"end_character":8},"in_reply_to":"5f7c97a3_096ff9fa","updated":"2018-06-27 17:42:05.000000000","message":"+1","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5b9796822442b98729ec961f50888f063002b095","unresolved":false,"context_lines":[{"line_number":80,"context_line":"# encryption root secret from a KMIP service."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"# The value of the ``key_id`` option should be the unique identifier for a"},{"line_number":83,"context_line":"# secret that will be retrieved from the KMIP service."},{"line_number":84,"context_line":"# key_id \u003d \u003cunique id of secret to be fetched from the KMIP service\u003e"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"# The remaining options are used to configure a PyKMIP client and are shown"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_2f2b6bea","line":83,"range":{"start_line":83,"start_character":2,"end_line":83,"end_character":8},"in_reply_to":"5f7c97a3_096ff9fa","updated":"2018-07-03 08:00:00.000000000","message":"Done","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"}],"etc/proxy-server.conf-sample":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"35c4f5e7ac7b0e19d97980b4626edc8e2fb203b4","unresolved":false,"context_lines":[{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"# Sets the path from which the keymaster config options should be read. This"},{"line_number":1086,"context_line":"# allows multiple processes which need to be encryption-aware (for example,"},{"line_number":1087,"context_line":"# proxy-server and container-sync) to share the same config file, ensuring"},{"line_number":1088,"context_line":"# that the encryption keys used are the same. The format expected is similar"},{"line_number":1089,"context_line":"# to other config files, with a single [kmip_keymaster] section. See the"},{"line_number":1090,"context_line":"# keymaster.conf-sample file for details on the kmip_keymaster configuration"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_09061923","line":1087,"range":{"start_line":1087,"start_character":38,"end_line":1087,"end_character":64},"updated":"2018-06-27 17:05:48.000000000","message":"As an added benefit, the keymaster config can have separate (most likely reduced) permissions from those of proxy-server.conf","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5b9796822442b98729ec961f50888f063002b095","unresolved":false,"context_lines":[{"line_number":1084,"context_line":""},{"line_number":1085,"context_line":"# Sets the path from which the keymaster config options should be read. This"},{"line_number":1086,"context_line":"# allows multiple processes which need to be encryption-aware (for example,"},{"line_number":1087,"context_line":"# proxy-server and container-sync) to share the same config file, ensuring"},{"line_number":1088,"context_line":"# that the encryption keys used are the same. The format expected is similar"},{"line_number":1089,"context_line":"# to other config files, with a single [kmip_keymaster] section. See the"},{"line_number":1090,"context_line":"# keymaster.conf-sample file for details on the kmip_keymaster configuration"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"5f7c97a3_0f5f8f75","line":1087,"range":{"start_line":1087,"start_character":38,"end_line":1087,"end_character":64},"in_reply_to":"5f7c97a3_09061923","updated":"2018-07-03 08:00:00.000000000","message":"Done","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"}],"swift/common/middleware/crypto/kmip_keymaster.py":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d8b927a005cbc57066a91dd8c4162e0a69350e43","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    use \u003d egg:swift#kmip_keymaster"},{"line_number":62,"context_line":"    keymaster_config_path\u003d/etc/swift/kmip_keymaster.conf"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"In this case, the ``filter:kmip_keymaster`` section should container no other"},{"line_number":65,"context_line":"options than ``use`` and ``keymaster_config_path``. All other options should be"},{"line_number":66,"context_line":"defined in the separate config file in a section named ``kmip_keymaster``. For"},{"line_number":67,"context_line":"example::"}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_2f099583","line":64,"range":{"start_line":64,"start_character":59,"end_line":64,"end_character":68},"updated":"2018-06-27 17:50:01.000000000","message":"contain","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"35c4f5e7ac7b0e19d97980b4626edc8e2fb203b4","unresolved":false,"context_lines":[{"line_number":118,"context_line":"            raise ValueError(\u0027Expected an AES-256 key, not %s-%d\u0027 % ("},{"line_number":119,"context_line":"                secret.cryptographic_algorithm.name,"},{"line_number":120,"context_line":"                secret.cryptographic_length))"},{"line_number":121,"context_line":"        self.logger.debug(\u0027Loaded secret id %s\u0027, key_id)"},{"line_number":122,"context_line":"        return secret.value"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_c489e86f","line":121,"range":{"start_line":121,"start_character":8,"end_line":121,"end_character":56},"updated":"2018-06-27 17:05:48.000000000","message":"Do/should we consider the key_id sensitive? Maybe it doesn\u0027t really matter, since this is just at debug anyway...","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"5b9796822442b98729ec961f50888f063002b095","unresolved":false,"context_lines":[{"line_number":118,"context_line":"            raise ValueError(\u0027Expected an AES-256 key, not %s-%d\u0027 % ("},{"line_number":119,"context_line":"                secret.cryptographic_algorithm.name,"},{"line_number":120,"context_line":"                secret.cryptographic_length))"},{"line_number":121,"context_line":"        self.logger.debug(\u0027Loaded secret id %s\u0027, key_id)"},{"line_number":122,"context_line":"        return secret.value"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_8f52bf67","line":121,"range":{"start_line":121,"start_character":8,"end_line":121,"end_character":56},"in_reply_to":"5f7c97a3_4fb651fc","updated":"2018-07-03 08:00:00.000000000","message":"Done","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c2059e82f3bfe5951a86b505ef8c83c9ae8077a2","unresolved":false,"context_lines":[{"line_number":118,"context_line":"            raise ValueError(\u0027Expected an AES-256 key, not %s-%d\u0027 % ("},{"line_number":119,"context_line":"                secret.cryptographic_algorithm.name,"},{"line_number":120,"context_line":"                secret.cryptographic_length))"},{"line_number":121,"context_line":"        self.logger.debug(\u0027Loaded secret id %s\u0027, key_id)"},{"line_number":122,"context_line":"        return secret.value"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_4fb651fc","line":121,"range":{"start_line":121,"start_character":8,"end_line":121,"end_character":56},"in_reply_to":"5f7c97a3_c489e86f","updated":"2018-06-27 17:42:05.000000000","message":"TBH this is hangover from my testing, I\u0027d be happy for it to be removed and having an id gives an attacker a head start.","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"}],"test/unit/common/middleware/crypto/test_kmip_keymaster.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"35c4f5e7ac7b0e19d97980b4626edc8e2fb203b4","unresolved":false,"context_lines":[{"line_number":21,"context_line":"from textwrap import dedent"},{"line_number":22,"context_line":"from shutil import rmtree"},{"line_number":23,"context_line":"import sys"},{"line_number":24,"context_line":"sys.modules[\u0027kmip\u0027] \u003d mock.Mock()"},{"line_number":25,"context_line":"sys.modules[\u0027kmip.pie\u0027] \u003d mock.Mock()"},{"line_number":26,"context_line":"sys.modules[\u0027kmip.pie.client\u0027] \u003d mock.Mock()"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"from swift.common.middleware.crypto.kmip_keymaster import KmipKeyMaster"},{"line_number":29,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_a4eb8cdb","line":26,"range":{"start_line":24,"start_character":0,"end_line":26,"end_character":44},"updated":"2018-06-27 17:05:48.000000000","message":"Well that\u0027s one way to avoid adding new test dependencies...","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c2059e82f3bfe5951a86b505ef8c83c9ae8077a2","unresolved":false,"context_lines":[{"line_number":21,"context_line":"from textwrap import dedent"},{"line_number":22,"context_line":"from shutil import rmtree"},{"line_number":23,"context_line":"import sys"},{"line_number":24,"context_line":"sys.modules[\u0027kmip\u0027] \u003d mock.Mock()"},{"line_number":25,"context_line":"sys.modules[\u0027kmip.pie\u0027] \u003d mock.Mock()"},{"line_number":26,"context_line":"sys.modules[\u0027kmip.pie.client\u0027] \u003d mock.Mock()"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"from swift.common.middleware.crypto.kmip_keymaster import KmipKeyMaster"},{"line_number":29,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_8fd2295b","line":26,"range":{"start_line":24,"start_character":0,"end_line":26,"end_character":44},"in_reply_to":"5f7c97a3_a4eb8cdb","updated":"2018-06-27 17:42:05.000000000","message":"inspired by test_kms_keymaster :/","commit_id":"7574aa01f61e7875dad70d02018fe5bc9ae96799"}]}