| openstackgerrit | Matthew Oliver proposed openstack/swift master: Expand docs on root secret life cycle https://review.openstack.org/592626 | 00:52 |
|---|---|---|
| openstackgerrit | Matthew Oliver proposed openstack/swift master: Add chaging secret key for external KMS section https://review.openstack.org/592773 | 00:52 |
| *** ianychoi has joined #openstack-swift | 01:47 | |
| *** mahatic has quit IRC | 01:51 | |
| kota_ | good morning | 02:33 |
| *** HW_Peter has quit IRC | 02:36 | |
| mattoliverau | kota_: morning | 03:02 |
| zaitcev | did anyone notice that all pep8 tests in the gate fail with "[main] ERROR Unknown test found in profile: B109"? | 03:04 |
| *** gkadam_ has joined #openstack-swift | 03:24 | |
| *** cbartz has joined #openstack-swift | 04:15 | |
| *** gkadam_ has quit IRC | 04:30 | |
| *** mahatic has joined #openstack-swift | 05:07 | |
| *** ChanServ sets mode: +v mahatic | 05:07 | |
| *** hseipp has joined #openstack-swift | 06:12 | |
| *** links has joined #openstack-swift | 06:37 | |
| *** pcaruana has joined #openstack-swift | 06:54 | |
| *** rcernin has quit IRC | 06:55 | |
| mattoliverau | zaitcev: I did notice that, well now. I wonder if infra know (as in it's a OS wide ci issue). | 06:59 |
| *** mvkr has quit IRC | 08:08 | |
| *** ejat has joined #openstack-swift | 08:12 | |
| *** cbartz has quit IRC | 08:25 | |
| *** zaitcev_ has joined #openstack-swift | 08:32 | |
| *** ChanServ sets mode: +v zaitcev_ | 08:32 | |
| *** zaitcev has quit IRC | 08:35 | |
| *** hseipp has quit IRC | 08:40 | |
| *** mikecmpbll has joined #openstack-swift | 08:45 | |
| *** cbartz has joined #openstack-swift | 08:47 | |
| *** mvkr has joined #openstack-swift | 08:55 | |
| *** notmyname has quit IRC | 11:42 | |
| *** notmyname has joined #openstack-swift | 11:43 | |
| *** ChanServ sets mode: +v notmyname | 11:43 | |
| *** yousef_ has joined #openstack-swift | 11:58 | |
| *** yousef_ has quit IRC | 12:02 | |
| openstackgerrit | Thiago da Silva proposed openstack/swift master: Attempt to fix pep8 https://review.openstack.org/593048 | 13:17 |
| *** zaitcev_ is now known as zaitcev | 13:19 | |
| *** hoonetorg has quit IRC | 14:02 | |
| *** hoonetorg has joined #openstack-swift | 14:03 | |
| * zaitcev pokes tdasilva - so why not bandit.yaml? | 14:03 | |
| *** cbartz has quit IRC | 14:06 | |
| *** hoonetorg has quit IRC | 14:09 | |
| tdasilva | zaitcev: good point, let me fix that | 14:18 |
| openstackgerrit | Thiago da Silva proposed openstack/swift master: Attempt to fix pep8 https://review.openstack.org/593048 | 14:23 |
| *** hoonetorg has joined #openstack-swift | 14:35 | |
| clayg | tdasilva: what's going on with this pep8 stuff!? | 15:14 |
| clayg | ERRORUnknown test found in profile: B109 - I mean what even *is* B109? | 15:18 |
| tdasilva | clayg: not sure specifically about b109, but looks like latest version of bandit removed it. This bandit release hit different projects with pep8 issues: http://lists.openstack.org/pipermail/openstack-dev/2018-August/133418.html | 15:26 |
| clayg | tdasilva: ok, so unpin bandit and pull the check? Or something.... | 15:33 |
| clayg | oh, or we don't need to do anything to the bandit requirements or whatever... just pull out the check... | 15:35 |
| clayg | which had something to do with secrets... | 15:35 |
| clayg | sigh | 15:35 |
| tdasilva | clayg bandit is not currently pinned, so we always get the latest, which caused this issue | 15:41 |
| tdasilva | in that email thread Doug mentioned pinning stable branches, maybe that's a good diea | 15:42 |
| tdasilva | ideia | 15:42 |
| tdasilva | idea | 15:42 |
| zaitcev | It was hours, but still no check from Zuul. | 15:49 |
| tdasilva | zaitcev: according to http://zuul.openstack.org/ 11 more minutes | 15:54 |
| *** silor has joined #openstack-swift | 16:00 | |
| *** mikecmpbll has quit IRC | 16:05 | |
| tdasilva | i put a +A | 16:34 |
| tdasilva | brb | 16:35 |
| zaitcev | Yes, thanks. Saw it just now. | 16:38 |
| *** links has quit IRC | 16:43 | |
| *** gyee has joined #openstack-swift | 16:52 | |
| timburke | tdasilva: bah! i messed up my commit message when i was editing things. https://review.openstack.org/#/c/592230/ was supposed to be a new patchset for https://review.openstack.org/#/c/575860/. will fix | 16:54 |
| patchbot | patch 592230 - swift - s3api: Include '-' in multipart ETags - 1h 44m 25s spent in CI | 16:54 |
| patchbot | patch 575860 - swift - Include '-' in multipart ETags - 11h 52m 26s spent in CI | 16:54 |
| *** mikecmpbll has joined #openstack-swift | 16:58 | |
| timburke | clayg: each individual piece of metadata gets its own iv -- but it should all get encrypted at once with the same derived key. that encryption/key information is what gets stuffed into X-Object-Transient-Sysmeta-Crypto-Meta | 17:01 |
| clayg | yup | 17:02 |
| clayg | i got a little confused with swift-object-info only showing metadata from the data file - but I got there eventually | 17:02 |
| clayg | timburke: you're too good about reading scrollback :P | 17:02 |
| timburke | the encryption is done directly with the derived key rather than using the derived key to encrypt a randomly generated key (like we do for the data) because the metadata will be fairly small -- so if we ever want to re-key, we're willing to just replace it all | 17:02 |
| clayg | but THANK YOU | 17:02 |
| timburke | and if you want to get us to the point where we can encrypt content-type, *great* -- i would love to see that patch | 17:03 |
| clayg | yes, design makes sense - no good reason for me to be confused - i was just ignorant | 17:03 |
| clayg | timburke: oh, i figured there was some good reason we don't do it? | 17:04 |
| timburke | i think there were concerns about whether we could do that and not horribly break things. but i don't remember all of the details now | 17:04 |
| clayg | so in the container listsings - the only thing we encrypt is ... the etag? | 17:04 |
| timburke | we'd definitely need to start storing *that* with its own key_id though | 17:05 |
| timburke | yup | 17:05 |
| timburke | maybe there were concerns about making the content-type header too long? idk | 17:08 |
| openstackgerrit | Tim Burke proposed openstack/swift master: s3api: Include '-' in multipart ETags https://review.openstack.org/575860 | 17:31 |
| openstackgerrit | Tim Burke proposed openstack/swift master: s3api: Include '-' in S3 ETags of normal SLOs https://review.openstack.org/592231 | 17:31 |
| *** nguyenhai_ has quit IRC | 17:39 | |
| *** nguyenhai_ has joined #openstack-swift | 17:40 | |
| tdasilva | timburke: heh, i'm still a bit confused, so I'll let you update https://wiki.openstack.org/wiki/Swift/PriorityReviews | 17:46 |
| timburke | tdasilva: updated. and the patch that needed to be abandoned has been abandoned | 17:52 |
| timburke | just gotta wait another half-hour or so for the bandit patch to land... :-/ | 17:53 |
| openstackgerrit | Tim Burke proposed openstack/swift master: Add support for multiple root encryption secrets https://review.openstack.org/577874 | 17:58 |
| openstackgerrit | Tim Burke proposed openstack/swift master: Multi-key KMIP keymaster https://review.openstack.org/586455 | 17:58 |
| openstackgerrit | Tim Burke proposed openstack/swift master: Multi-key KMS keymaster https://review.openstack.org/591555 | 18:00 |
| openstackgerrit | Tim Burke proposed openstack/swift master: Add debugging info to SignatureDoesNotMatch responses https://review.openstack.org/575808 | 18:04 |
| openstackgerrit | Merged openstack/swift master: Attempt to fix pep8 https://review.openstack.org/593048 | 18:25 |
| openstackgerrit | Merged openstack/swift master: Fix locking in swift-recon-cron https://review.openstack.org/592200 | 18:30 |
| *** gyee has quit IRC | 18:43 | |
| *** silor has quit IRC | 19:50 | |
| clayg | hrm....ValueError: keymaster_config_path is set, but there are other config options specified: key_id, key_id_2018, key_id_2019, active_root_secret_id | 20:09 |
| timburke | clayg: you set those in proxy-server.conf instead of the external file? | 20:10 |
| clayg | so I didn't really notice that i put key_id in my kmip config file... now that i'm doing multiple keys it seems to make more sense that my connection/client details would go one place but the keymaster config would stay near the middleware config... hmm... | 20:10 |
| clayg | ok, I think i see how this works... | 21:13 |
| openstackgerrit | Merged openstack/swift master: Add support for multiple root encryption secrets https://review.openstack.org/577874 | 21:16 |
| clayg | oh, ok... right ValueError: KmipKeyMaster config cannot be read from conf dir %s. Use keymaster_config_path option in the proxy server config to specify a config file. | 21:18 |
| clayg | I see how this happened :D | 21:18 |
| *** mikecmpbll has quit IRC | 23:36 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!