)]}'
{"swift/common/middleware/s3api/s3request.py":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"2d618cb4ec9a7aa146b93048182b77d92a77bcc2","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"    def check_signature(self, secret):"},{"line_number":119,"context_line":"        user_signature \u003d self.signature"},{"line_number":120,"context_line":"        derived_secret \u003d (\u0027AWS4\u0027 + secret).encode(\u0027ascii\u0027)"},{"line_number":121,"context_line":"        for scope_piece in self.scope:"},{"line_number":122,"context_line":"            derived_secret \u003d hmac.new("},{"line_number":123,"context_line":"                derived_secret, scope_piece, sha256).digest()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_d6d4d54d","line":120,"updated":"2018-09-27 18:42:15.000000000","message":"Won\u0027t work with tempauth users that have a non-ascii password (which currently works on master):\n\n Sep 27 18:21:43 saio proxy-server: \u0027ascii\u0027 codec can\u0027t decode byte 0xc3 in position 5: ordinal not in range(128):\n Traceback (most recent call last):\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3api.py\", line 227, in __call__\n     resp \u003d self.handle_request(req)\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3api.py\", line 263, in handle_request\n     res \u003d handler(req)\n   File \"/vagrant/swift/swift/common/middleware/s3api/controllers/service.py\", line 34, in GET\n     resp \u003d req.get_response(self.app, query\u003d{\u0027format\u0027: \u0027json\u0027})\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3request.py\", line 1254, in get_response\n     headers, body, query)\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3request.py\", line 1192, in _get_response\n     sw_resp \u003d sw_req.get_response(app)\n   File \"/vagrant/swift/swift/common/swob.py\", line 1080, in get_response\n     status, headers, app_iter \u003d self.call_application(application)\n   File \"/vagrant/swift/swift/common/swob.py\", line 1064, in call_application\n     app_iter \u003d application(self.environ, start_response)\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3api.py\", line 123, in __call__\n     return self.app(env, start_response)\n   File \"/vagrant/swift/swift/common/middleware/tempauth.py\", line 283, in __call__\n     groups \u003d self.get_groups(env, token)\n   File \"/vagrant/swift/swift/common/middleware/tempauth.py\", line 458, in get_groups\n     if not s3_auth_details[\u0027check_signature\u0027](user[\u0027key\u0027]):\n   File \"/vagrant/swift/swift/common/middleware/s3api/s3request.py\", line 120, in check_signature\n     derived_secret \u003d (\u0027AWS4\u0027 + secret).encode(\u0027ascii\u0027)\n UnicodeDecodeError: \u0027ascii\u0027 codec can\u0027t decode byte 0xc3 in position 5: ordinal not in range(128) (txn: tx7439b38579374ae1a4d27-005bad1fb7)\n\nWe\u0027d need a `not isinstance(secret, bytes)` check or something before trying to encode.\n\nMore generally though, I think I\u0027d prefer for check_signature to have a pretty strong contract of expecting bytes, and letting whatever auth system be responsible for deciding how their secrets ought to be encoded. I left a long comment on https://review.openstack.org/#/c/603529/ exploring how keystone deals with non-ascii secrets; apparently they do UTF-8, but what if they restricted possible secrets to the Latin-1 subset and used Latin-1 encoding? I\u0027d rather have s3token (which *must* be tied to Keystone\u0027s implementation) be the one choosing the proper encoding.","commit_id":"9283c419a27272e2414528778766bd54489b110c"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"4f8da9a525e3f0ce2da2c63ee68bb397da0e29cd","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"    def check_signature(self, secret):"},{"line_number":119,"context_line":"        user_signature \u003d self.signature"},{"line_number":120,"context_line":"        derived_secret \u003d (\u0027AWS4\u0027 + secret).encode(\u0027ascii\u0027)"},{"line_number":121,"context_line":"        for scope_piece in self.scope:"},{"line_number":122,"context_line":"            derived_secret \u003d hmac.new("},{"line_number":123,"context_line":"                derived_secret, scope_piece, sha256).digest()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_6a9ce35a","line":120,"in_reply_to":"3f79a3b5_d6d4d54d","updated":"2018-10-10 23:03:11.000000000","message":"I think it may be in response to my comment in the caching patch, where I wanted the opposite of your strong contract: have check_signature() methods accept either-or. This way the callers would not need to adhere, which causes an str() in case of Sam. But I don\u0027t insist, I understand it makes sense to enforce a type at a function boundary. Just as long as it works on py3, anything is okay by me.","commit_id":"9283c419a27272e2414528778766bd54489b110c"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"2d618cb4ec9a7aa146b93048182b77d92a77bcc2","unresolved":false,"context_lines":[{"line_number":457,"context_line":"        # by full URL when absolute path given. See swift.swob for more detail."},{"line_number":458,"context_line":"        self.environ[\u0027swift.leave_relative_location\u0027] \u003d True"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"    def check_signature(self, secret):"},{"line_number":461,"context_line":"        user_signature \u003d self.signature"},{"line_number":462,"context_line":"        valid_signature \u003d base64.b64encode(hmac.new("},{"line_number":463,"context_line":"            secret, self.string_to_sign, sha1).digest()).strip()"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_76b5c131","line":460,"range":{"start_line":460,"start_character":8,"end_line":460,"end_character":37},"updated":"2018-09-27 18:42:15.000000000","message":"There are two check_signatures, one for each algorithm.\n\nIf we do one, we should do both.","commit_id":"9283c419a27272e2414528778766bd54489b110c"}]}