)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"2d678a02951f20470263fbe8fc0d1b907397d9a9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1426818e_56da09e5","updated":"2021-11-18 20:47:36.000000000","message":"I take it this is mostly because of clients (such as tempest and swiftclient) wanting to be able to use the full path from the URL when calculating the signature, like in https://github.com/openstack/tempest/blob/29.2.0/tempest/api/object_storage/test_object_temp_url.py#L71-L77 and https://github.com/openstack/python-swiftclient/blob/3.12.0/swiftclient/shell.py#L1476 ?\n\nThe existing notion of \"path\" is definitely more squishy than I\u0027d like it to be. (Consider, for example, how \"/v1/...\" and \"/v1.0/...\" give different signatures. Is that a bug or a feature?) Now I want to check what happens when the client sends an unquoted URL that really *should* have been quoted...\n\nI wonder if we should have a similar option in [app:proxy-server] for the /info endpoint: https://github.com/openstack/swift/blob/2.28.0/swift/proxy/controllers/info.py#L80-L85","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"a286d8c33a734c1e2d2c67402fcfce8d399f98e8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"edb5ffcb_49f49be4","updated":"2026-10-14 21:50:35.000000000","message":"I\u0027ve restored this 5 years old patch... because I want to fix my Tempest! 😉\n\nPatch set 3: rebased on current master; all remarks addressed.\n\n- Pete: renamed to `url_base` and it now accepts the same syntax as\n  staticweb\u0027s `url_base` (a scheme and/or host and/or path, parsed\n  with urlparse). Only the path component is used here, since tempurl\n  signs over the path. staticweb\u0027s code already anticipates this use\n  of the path part (\"in case we want to incorporate the path prefix\n  later\"), so both middlewares can share one setting describing the\n  public base of the same proxy deployment.\n- Clay: the prefix is now normalized once in `__init__`\n  (`self.url_path_prefix`) and the signature computation is a simple\n  list of accepted paths.\n- Clay: yes, un-prefixed signatures now \"just work\": both the public\n  (prefixed) and the internal (un-prefixed) forms are accepted, like\n  Ceph RGW does (cf. Tim\u0027s rgw_swift_auth.cc reference). Verified\n  against a live deployment: tempest\u0027s new\n  test_get_object_using_temp_url_with_prefix signs the un-prefixed\n  path and passes with this version.\n- Tim: the option is now registered in /info, only when set, so the\n  capabilities response of deployments not using it stays unchanged.\n- Tim: while re-testing against that live deployment we also found\n  that the previous version mangled prefix-mode (temp_url_prefix)\n  signatures: the prefix was concatenated in front of the \"prefix:\"\n  marker (e.g. \"/objectprefix:/v1/...\"). The marker now stays first,\n  and unit tests cover both forms.\n- Tests: 4 new unit tests (both signature forms in plain and prefix\n  mode, bare-path url_base, /info registration); the full\n  test_tempurl module passes (78 tests).\n\nFWIW this option has been carried in Debian since 2021 (there named\npath_prefix) and is in active use behind a rewriting haproxy; if this\nmerges, Debian will drop the carried patch and migrate configs to\nurl_base.\n\nHappy to revisit the name if core prefers something else (e.g.\nClay\u0027s proxy_path_prefix).","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"41dce4fb9c8c49416aa77e25107dd9496850947f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"f708f45d_d9bb701c","updated":"2021-11-18 15:28:40.000000000","message":"This makes sense!  I noted a few minor style nits that might be an imporvement; a test would be a welcome addition!\n\nI\u0027d also curious, and you might be able to help us confirm, if a client can send a signature matching the un-prefixed path and it would \"just work\"?","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"}],"etc/proxy-server.conf-sample":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"41dce4fb9c8c49416aa77e25107dd9496850947f","unresolved":true,"context_lines":[{"line_number":936,"context_line":""},{"line_number":937,"context_line":"# Allow to have swiftproxy endpoint not bound to the root with haproxy"},{"line_number":938,"context_line":"# on-the-fly URL rewriting."},{"line_number":939,"context_line":"# path_prefix \u003d /object"},{"line_number":940,"context_line":""},{"line_number":941,"context_line":"# Note: Put formpost just before your auth filter(s) in the pipeline"},{"line_number":942,"context_line":"[filter:formpost]"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"94d775a2_d68ea0ff","line":939,"updated":"2021-11-18 15:28:40.000000000","message":"maybe even call it: proxy_path_prefix\n\n\t# If you run swift behind a proxy with URL rewriting tempurl needs to know the\n\t# full path for signature calculation, default is no prefix\n\t# proxy_path_prefix \u003d","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"f14b689d5a17d54a824325c199de4bb2c11a5252","unresolved":false,"context_lines":[{"line_number":936,"context_line":""},{"line_number":937,"context_line":"# Allow to have swiftproxy endpoint not bound to the root with haproxy"},{"line_number":938,"context_line":"# on-the-fly URL rewriting."},{"line_number":939,"context_line":"# path_prefix \u003d /object"},{"line_number":940,"context_line":""},{"line_number":941,"context_line":"# Note: Put formpost just before your auth filter(s) in the pipeline"},{"line_number":942,"context_line":"[filter:formpost]"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9803b035_ee92ab53","line":939,"in_reply_to":"94d775a2_d68ea0ff","updated":"2026-10-14 21:51:01.000000000","message":"Done","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"}],"swift/common/middleware/tempurl.py":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"41dce4fb9c8c49416aa77e25107dd9496850947f","unresolved":true,"context_lines":[{"line_number":748,"context_line":"        :returns: a list of (hmac, scope) 2-tuples"},{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"}],"source_content_type":"text/x-python","patch_set":2,"id":"e7bad48c_15357c43","line":751,"updated":"2021-11-18 15:28:40.000000000","message":"I think typically we\u0027d see an update in __init__ that sets a self.path_prefix attribute\n\nif we do default and normalization there (once) it might make this path manipulation cleaner\n\n    path \u003d prefix + path","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"f14b689d5a17d54a824325c199de4bb2c11a5252","unresolved":false,"context_lines":[{"line_number":748,"context_line":"        :returns: a list of (hmac, scope) 2-tuples"},{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"}],"source_content_type":"text/x-python","patch_set":2,"id":"896fc6ab_cd171d85","line":751,"in_reply_to":"e7bad48c_15357c43","updated":"2026-10-14 21:51:01.000000000","message":"Done","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"dbffe5771d58dff0debfe8bcb4beda92557c27f0","unresolved":true,"context_lines":[{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"},{"line_number":755,"context_line":"            request_method \u003d env[\u0027REQUEST_METHOD\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"8149dbc0_6bfcab39","line":752,"updated":"2021-12-20 22:04:19.000000000","message":"Do I understand it correctly that it\u0027s pretty much the same thing as url_baase setting for staticweb?\nCan we call this one url_base and let accept the same syntax here?\nShould we?","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"2d678a02951f20470263fbe8fc0d1b907397d9a9","unresolved":true,"context_lines":[{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"},{"line_number":755,"context_line":"            request_method \u003d env[\u0027REQUEST_METHOD\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"b7fce267_0a42686e","line":752,"updated":"2021-11-18 20:47:36.000000000","message":"Not saying it\u0027s a good thing, but apparently ceph checks *both* prefixed and non-prefixed: https://github.com/ceph/ceph/blob/51eafb38ac2f798e3e27a4ac3c0e8cf271c68303/src/rgw/rgw_swift_auth.cc#L328-L338","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"d5b296f9511bc9801054cfdfce47cde5c158bb50","unresolved":false,"context_lines":[{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"},{"line_number":755,"context_line":"            request_method \u003d env[\u0027REQUEST_METHOD\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"c5815082_39ac1bea","line":752,"in_reply_to":"8149dbc0_6bfcab39","updated":"2026-10-14 21:47:31.000000000","message":"Done","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"d5b296f9511bc9801054cfdfce47cde5c158bb50","unresolved":false,"context_lines":[{"line_number":749,"context_line":"        \"\"\""},{"line_number":750,"context_line":""},{"line_number":751,"context_line":"        if \u0027path_prefix\u0027 in self.conf:"},{"line_number":752,"context_line":"            path \u003d \"/\" + self.conf[\u0027path_prefix\u0027].strip(\"/\") + path"},{"line_number":753,"context_line":""},{"line_number":754,"context_line":"        if not request_method:"},{"line_number":755,"context_line":"            request_method \u003d env[\u0027REQUEST_METHOD\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"7204ad42_06033458","line":752,"in_reply_to":"b7fce267_0a42686e","updated":"2026-10-14 21:47:31.000000000","message":"Done","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"2d678a02951f20470263fbe8fc0d1b907397d9a9","unresolved":true,"context_lines":[{"line_number":874,"context_line":"                         \u0027for tempurls\u0027)"},{"line_number":875,"context_line":"    info_conf[\u0027allowed_digests\u0027] \u003d sorted(allowed_digests)"},{"line_number":876,"context_line":""},{"line_number":877,"context_line":"    register_swift_info(\u0027tempurl\u0027, **info_conf)"},{"line_number":878,"context_line":"    conf.update(info_conf)"},{"line_number":879,"context_line":""},{"line_number":880,"context_line":"    return lambda app: TempURL(app, conf)"}],"source_content_type":"text/x-python","patch_set":2,"id":"8d9197e4_68a2cd9f","line":877,"updated":"2021-11-18 20:47:36.000000000","message":"We almost certainly want this new config getting registered in /info.","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"},{"author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"change_message_id":"d5b296f9511bc9801054cfdfce47cde5c158bb50","unresolved":false,"context_lines":[{"line_number":874,"context_line":"                         \u0027for tempurls\u0027)"},{"line_number":875,"context_line":"    info_conf[\u0027allowed_digests\u0027] \u003d sorted(allowed_digests)"},{"line_number":876,"context_line":""},{"line_number":877,"context_line":"    register_swift_info(\u0027tempurl\u0027, **info_conf)"},{"line_number":878,"context_line":"    conf.update(info_conf)"},{"line_number":879,"context_line":""},{"line_number":880,"context_line":"    return lambda app: TempURL(app, conf)"}],"source_content_type":"text/x-python","patch_set":2,"id":"d0754b3f_908df156","line":877,"in_reply_to":"8d9197e4_68a2cd9f","updated":"2026-10-14 21:47:31.000000000","message":"Done","commit_id":"836e425387f8869b032dd51eb8c93a5bcb0d5f90"}]}