Bug #1847755 “On-disk encryption is borken with Python 3” : Bugs : OpenStack Object Storage (swift)

Revision history for this message

Tim Burke (1-tim-z) wrote on 2019-10-12:

#1

From IRC, this was the Barbican keymaster, which explains why we hadn't caught this earlier.

I finally got an instance up and running and... it just worked. I wonder if maybe it's because I requested a payload-content-type of application/octet-stream when I ran `openstack secret order create`. What were you using? Should be able to find out with `openstack secret get` -- on my machine, that gives me something like

+---------------+----------------------------------------------------------------------+
| Field | Value |
+---------------+----------------------------------------------------------------------+
| Secret href | http://hostname:9311/v1/secrets/de423521-8a7b-491c-be39-74f040e30827 |
| Name | swift_root_secret |
| Created | 2019-10-11T23:27:12.985712+00:00 |
| Status | ACTIVE |
| Content types | {'default': 'application/octet-stream'} |
| Algorithm | aes |
| Bit length | 256 |
| Secret type | symmetric |
| Mode | ctr |
| Expiration | None |
+---------------+----------------------------------------------------------------------+

And for completeness, I've got a handful of follow-up questions:
- Is this on upload, download, container listing? Probably, all three.
- What version of python-barbicanclient is installed? What version of castellan?

Revision history for this message

Thomas Goirand (thomas-goirand) wrote on 2019-10-12:

#2

Hi,

I'm using this:

openstack secret store --name swift-encryption-key \
  --payload-content-type=text/plain --algorithm aes \
  --bit-length 256 --mode ctr --secret-type symmetric \
  --payload $(openssl rand -hex 32)

Can you try the same way?

This happens when doing:

openstack object create

Container creation seems ok, listing probably too as well.

Thomas

Revision history for this message

Tim Burke (1-tim-z) wrote on 2019-10-13:

#3

Download full text (3.8 KiB)

Oh, interesting! Rather than generating the secret locally, I was requesting that barbican generate one with

  openstack secret order create --name swift_root_secret \
   --payload-content-type="application/octet-stream" \
   --algorithm aes --bit-length 256 --mode ctr key

When I tried a --payload-content-type=text/plain, starting the proxy would bomb out with

Key manager error: Not Acceptable: Secret payload retrieval
issue seen - Wrong payload content-type.

Server-side, barbican had some error logging:

  Traceback (most recent call last):
    File ".../barbican/plugin/util/translations.py", line 106, in denormalize_after_decryption
      unencrypted = base64.decode_as_text(unencrypted)
    File ".../oslo_serialization/base64.py", line 92, in decode_as_text
      return decoded.decode(encoding)
  UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd0 in position 3: invalid continuation byte

During handling of the above exception, another exception occurred:

  Traceback (most recent call last):
    File ".../barbican/api/controllers/__init__.py", line 101, in handler
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 87, in enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 207, in payload
      **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 185, in _on_get_secret_payload
      transport_key)
    File ".../barbican/plugin/resources.py", line 147, in get_secret
      requesting_content_type)
    File ".../barbican/plugin/util/translations.py", line 108, in denormalize_after_decryption
      raise s.SecretAcceptNotSupportedException(content_type)
  barbican.plugin.interface.secret_store.SecretAcceptNotSupportedException: Secret Accept of 'text/plain' not supported

Using your method, I can repro just fine. It also gave me some fun ideas, like not using hex but instead declaring the raw bytes to be latin-1. Nope, no dice:

  $ openstack secret store --payload "$(openssl rand 32)" \
    --name 'rand-no-hex' --payload-content-type \
    text/plain;charset=latin-1
  5xx Server error: Internal Server Error: Secret creation
  failure seen - please contact site administrator.
  Internal Server Error: Secret creation failure seen -
  please contact site administrator.

Barbican logs said

  Traceback (most recent call last):
    File ".../barbican/api/controllers/__init__.py", line 101, in handler
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 87, in enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 149, in content_types_enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 424, in on_post
      data = api.load_body(pecan.request, validator=self.validator)
    File ".../barbican/api/__init__.py", line 70, in load_body
      parsed_body = validator.validate(parsed_body)
    File ".../barbican/common/validators.py", line 210, in validate
      payload = self._extract_payload(json_data)
    File ".../barbican/common/validators.py", line 319, in _extract_payload
      i...

Oh, interesting! Rather than generating the secret locally, I was requesting that barbican generate one with

openstack secret order create --name swift_root_secret \
   --payload-content-type="application/octet-stream" \
   --algorithm aes --bit-length 256 --mode ctr key

When I tried a --payload-content-type=text/plain, starting the proxy would bomb out with

Key manager error: Not Acceptable: Secret payload retrieval
  issue seen - Wrong payload content-type.

Server-side, barbican had some error logging:

Traceback (most recent call last):
    File ".../barbican/plugin/util/translations.py", line 106, in denormalize_after_decryption
      unencrypted = base64.decode_as_text(unencrypted)
    File ".../oslo_serialization/base64.py", line 92, in decode_as_text
      return decoded.decode(encoding)
  UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd0 in position 3: invalid continuation byte

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
    File ".../barbican/api/controllers/__init__.py", line 101, in handler
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 87, in enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 207, in payload
      **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 185, in _on_get_secret_payload
      transport_key)
    File ".../barbican/plugin/resources.py", line 147, in get_secret
      requesting_content_type)
    File ".../barbican/plugin/util/translations.py", line 108, in denormalize_after_decryption
      raise s.SecretAcceptNotSupportedException(content_type)
  barbican.plugin.interface.secret_store.SecretAcceptNotSupportedException: Secret Accept of 'text/plain' not supported

Using your method, I can repro just fine. It also gave me some fun ideas, like not using hex but instead declaring the raw bytes to be latin-1. Nope, no dice:

$ openstack secret store --payload "$(openssl rand 32)" \
    --name 'rand-no-hex' --payload-content-type \
    text/plain;charset=latin-1
  5xx Server error: Internal Server Error: Secret creation
  failure seen - please contact site administrator.
  Internal Server Error: Secret creation failure seen -
  please contact site administrator.

Barbican logs said

Traceback (most recent call last):
    File ".../barbican/api/controllers/__init__.py", line 101, in handler
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 87, in enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/__init__.py", line 149, in content_types_enforcer
      return fn(inst, *args, **kwargs)
    File ".../barbican/api/controllers/secrets.py", line 424, in on_post
      data = api.load_body(pecan.request, validator=self.validator)
    File ".../barbican/api/__init__.py", line 70, in load_body
      parsed_body = validator.validate(parsed_body)
    File ".../barbican/common/validators.py", line 210, in validate
      payload = self._extract_payload(json_data)
    File ".../barbican/common/validators.py", line 319, in _extract_payload
      if secret_too_big(payload):
    File ".../barbican/common/validators.py", line 50, in secret_too_big
      return len(data.encode('UTF-8')) > CONF.max_allowed_secret_in_bytes
  UnicodeEncodeError: 'utf-8' codec can't encode character '\udcd7' in position 0: surrogates not allowed

... so I guess barbican is pretty set on it being valid utf-8? I also tried

$ openstack secret store --payload 🌴 --name 'palm-tree' \
    --payload-content-type text/plain --mode ctr --secret-type symmetric

... which barbican happily stores and claims has a bit-length of 256 (!). We almost certainly ought to have more validation on the key material we retrieve...

Changed in swift:
status:	New → Confirmed
importance:	Undecided → High
tags:	added: python3

Revision history for this message

Thomas Goirand (thomas-goirand) wrote on 2019-10-13:

#4

Hi Tim,

Thanks for taking this seriously, and I'm happy that you've been able to reproduce the issue too.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-10-15: Fix merged to swift (master)

#5

Reviewed: https://review.opendev.org/688113
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=85d3658d6297efbe9a588d1b4364a2a68f9e5bb7
Submitter: Zuul
Branch: master

commit 85d3658d6297efbe9a588d1b4364a2a68f9e5bb7
Author: Thomas Goirand <email address hidden>
Date: Fri Oct 11 14:12:01 2019 +0200

Fix kms_keymaster under Python 3

    Depending on how the key was stored in Barbican, it may come out of
    Castellan as a native string, which would not be suitable on Python 3.
    Now, check that the secret is a byte string, and if it isn't, encode as
    UTF-8 (to match Barbican's internal encoding).

Change-Id: I6da047716c05e4f2a9e1e74ca19afb62e812d172
Closes-Bug: #1847755

Changed in swift:
status:	Confirmed → Fix Released

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-10-15: Fix proposed to swift (stable/train)

#6

Fix proposed to branch: stable/train
Review: https://review.opendev.org/688767

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-10-15: Fix merged to swift (stable/train)

#7

Reviewed: https://review.opendev.org/688767
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=dd51658949ca937abd9d87a5184704cd48135682
Submitter: Zuul
Branch: stable/train

commit dd51658949ca937abd9d87a5184704cd48135682
Author: Thomas Goirand <email address hidden>
Date: Fri Oct 11 14:12:01 2019 +0200

Fix kms_keymaster under Python 3

    Depending on how the key was stored in Barbican, it may come out of
    Castellan as a native string, which would not be suitable on Python 3.
    Now, check that the secret is a byte string, and if it isn't, encode as
    UTF-8 (to match Barbican's internal encoding).

    Change-Id: I6da047716c05e4f2a9e1e74ca19afb62e812d172
    Closes-Bug: #1847755
    (cherry picked from commit 85d3658d6297efbe9a588d1b4364a2a68f9e5bb7)

tags:

added: in-stable-train

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-10-22: Fix included in openstack/swift 2.23.1

#8

This issue was fixed in the openstack/swift 2.23.1 release.

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-11-07: Fix proposed to swift (feature/losf)

#9

Fix proposed to branch: feature/losf
Review: https://review.opendev.org/693283

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2019-11-07: Fix merged to swift (feature/losf)

#10

Download full text (9.6 KiB)

Reviewed: https://review.opendev.org/693283
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=dbfb6a6fc90cb3367ed2248572089ee3cbafc15a
Submitter: Zuul
Branch: feature/losf

commit 7cb92810acfd3cd598860aefadff8fba47e3efdd
Author: SeongSoo Cho <email address hidden>
Date: Wed Nov 6 15:32:56 2019 +0800

Fix bug internal client's delete_object logs 499

    Internal Client's doest not read body for 404.
    So, When internal deleing object that not existed, proxy-server logs
    its response code to 499.

In this patch, add a code that drain the reponse body to prevent
unexpected disconnect in proxy-server

Change-Id: I6d170fead798d0d539c69d27a6fa8a2d0123ca99
Closes-Bug: #1835324

commit c512574e110c214396658743e75ae497ba76e2ff
Author: Tim Burke <email address hidden>
Date: Tue Nov 5 01:45:26 2019 +0000

Make our py2 func tests more explicitly py2

...because otherwise, I think they might be running under py3 right now.

Change-Id: I96ad9e5ed87a7e08d06e889233730cec476d3af7

commit a505d02b3762ecbe7ea80b968ddec90ca3446549
Author: Chris Smart <email address hidden>
Date: Sat Nov 2 20:48:47 2019 +1100

Tweak Swift AIO docs, update CentOS and Fedora

The Swift AIO documentation is out of date for CentOS and Fedora.

This patch updates the documentation to ensure that the instructions are
clear and accurate.

    It also cleans up a few other sections along the way and adds some new
    headings to make it easier to read. Some explanatory notes are added,
    such as the need for XFS storage and test directories. XFS tmp loopback
    device is moved out of the user's home directory to /srv to match
    storage.

Change-Id: Ieb0341536b7149c99139a1cf620828eba25f4bc6
Signed-off-by: Chris Smart <email address hidden>

commit 281ffab2a52f348aa3f8ad39e800a43c6047e1cf
Author: Thiago da Silva <email address hidden>
Date: Fri Nov 1 09:57:34 2019 +0200

pin lower-constraints to run against python 2.7

Change-Id: I5c856012a04ef8f910c28b0248ea7bcda47e4816

commit 0c1b485ad671fc0abac15cd0bbec894e517e1dd9
Author: John Dickinson <email address hidden>
Date: Thu Oct 17 09:43:55 2019 -0700

exclude utf8 tests under py3

These are known to not work until https://bugs.python.org/issue37093
is addressed in CPython upstream.

Change-Id: I4a6877907d14b632a9a477c887913488427b62b7

commit dd235b6ac0757e34805b041d331511c957764f3e
Author: Clay Gerrard <email address hidden>
Date: Mon Oct 28 11:27:58 2019 -0500

use request_helpers import namespace for tests

Change-Id: I8e18ff2036312d3049a420f3332a6ea6110447c4

commit b75d5939352c405ab82ab52c3a9a1c3ad030aa26
Author: Clay Gerrard <email address hidden>
Date: Fri Oct 25 14:34:41 2019 -0500

Refactor timestamp iter in db backend tests

Change-Id: I61d044a6d778e158af73a3f4d9fc75d642af0beb

commit 739c3704107bd991493472c18bfe7ac5f933077c
Author: OpenStack Proposal Bot <email address hidden>
Date: Fri Oct 18 07:10:33 2019 +0000

Imported Translations from Zanata

For more information about this automat...

Reviewed:  https://review.opendev.org/693283
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=dbfb6a6fc90cb3367ed2248572089ee3cbafc15a
Submitter: Zuul
Branch:    feature/losf

commit 7cb92810acfd3cd598860aefadff8fba47e3efdd
Author: SeongSoo Cho <ppiyakk2@printf.kr>
Date:   Wed Nov 6 15:32:56 2019 +0800

Fix bug internal client's delete_object logs 499
    
    Internal Client's doest not read body for 404.
    So, When internal deleing object that not existed, proxy-server logs
    its response code to 499.
    
    In this patch, add a code that drain the reponse body to prevent
    unexpected disconnect in proxy-server
    
    Change-Id: I6d170fead798d0d539c69d27a6fa8a2d0123ca99
    Closes-Bug: #1835324

commit c512574e110c214396658743e75ae497ba76e2ff
Author: Tim Burke <tim.burke@gmail.com>
Date:   Tue Nov 5 01:45:26 2019 +0000

Make our py2 func tests more explicitly py2
    
    ...because otherwise, I think they might be running under py3 right now.
    
    Change-Id: I96ad9e5ed87a7e08d06e889233730cec476d3af7

commit a505d02b3762ecbe7ea80b968ddec90ca3446549
Author: Chris Smart <chris.smart@humanservices.gov.au>
Date:   Sat Nov 2 20:48:47 2019 +1100

Tweak Swift AIO docs, update CentOS and Fedora
    
    The Swift AIO documentation is out of date for CentOS and Fedora.
    
    This patch updates the documentation to ensure that the instructions are
    clear and accurate.
    
    It also cleans up a few other sections along the way and adds some new
    headings to make it easier to read. Some explanatory notes are added,
    such as the need for XFS storage and test directories. XFS tmp loopback
    device is moved out of the user's home directory to /srv to match
    storage.
    
    Change-Id: Ieb0341536b7149c99139a1cf620828eba25f4bc6
    Signed-off-by: Chris Smart <chris.smart@humanservices.gov.au>

commit 281ffab2a52f348aa3f8ad39e800a43c6047e1cf
Author: Thiago da Silva <thiagodasilva@gmail.com>
Date:   Fri Nov 1 09:57:34 2019 +0200

pin lower-constraints to run against python 2.7
    
    Change-Id: I5c856012a04ef8f910c28b0248ea7bcda47e4816

commit 0c1b485ad671fc0abac15cd0bbec894e517e1dd9
Author: John Dickinson <me@not.mn>
Date:   Thu Oct 17 09:43:55 2019 -0700

exclude utf8 tests under py3
    
    These are known to not work until https://bugs.python.org/issue37093
    is addressed in CPython upstream.
    
    Change-Id: I4a6877907d14b632a9a477c887913488427b62b7

commit dd235b6ac0757e34805b041d331511c957764f3e
Author: Clay Gerrard <clay.gerrard@gmail.com>
Date:   Mon Oct 28 11:27:58 2019 -0500

use request_helpers import namespace for tests
    
    Change-Id: I8e18ff2036312d3049a420f3332a6ea6110447c4

commit b75d5939352c405ab82ab52c3a9a1c3ad030aa26
Author: Clay Gerrard <clay.gerrard@gmail.com>
Date:   Fri Oct 25 14:34:41 2019 -0500

Refactor timestamp iter in db backend tests
    
    Change-Id: I61d044a6d778e158af73a3f4d9fc75d642af0beb

commit 739c3704107bd991493472c18bfe7ac5f933077c
Author: OpenStack Proposal Bot <openstack-infra@lists.openstack.org>
Date:   Fri Oct 18 07:10:33 2019 +0000

Imported Translations from Zanata
    
    For more information about this automatic import see:
    https://docs.openstack.org/i18n/latest/reviewing-translation-import.html
    
    Change-Id: I7a72be3568c2e8afd7211978cd917810c9af22ad

commit 2ac50079c1a9f2dfe2db4f9671d823086915e9d2
Author: Tim Burke <tim.burke@gmail.com>
Date:   Thu Oct 17 09:52:50 2019 -0700

docs: Fix then/than grammar
    
    Change-Id: I948d65d0d3b58fcb13f8141fe095ccad4b8f1425
    Closes-Bug: #1848485

commit 86952dd3edf4ca45f8df7440cb8b6d31d9e415d7
Author: Tim Burke <tim.burke@gmail.com>
Date:   Tue Oct 15 15:06:35 2019 -0700

tests: Stop invoking python just to get the real source directory
    
    While we're at it, stop checking for a seven-year-old version of nose --
    we already list a newer version in test-requirements.txt anyway.
    
    Change-Id: I97beace3094f11286730b99653dc1e8f699c5aec

commit d270596b6766bf59ea8eaa58a7d48dd2b368cf37
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 14:03:16 2019 -0700

Consistently use io.BytesIO
    
    Change-Id: Ic41b37ac75b5596a8307c4962be86f2a4b0d9731

commit 8efaa3556fdb21f741ff897dac4730c3c3654421
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 17:59:36 2019 -0700

py38: Provide readinto() interface for RingReader
    
    Otherwise pickle complains
    
       TypeError: file must have 'read', 'readinto' and 'readline' attributes
    
    Change-Id: I7ae0d7e47ae44286564f8ab7126e8ff131bc0de6

commit 3bd5653873bbb0ddc154481c3804ce6d801664b3
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 17:40:42 2019 -0700

Use `==` to compare against the empty string, not `is`
    
    py38 will start complaining like
    
       SyntaxWarning: "is" with a literal. Did you mean "=="?
    
    Change-Id: I799e288f66230a7847a13b7f303e4cd8e63eea59

commit 2edcd0b7b9dd02a041fd1452ea17efda5f27f21c
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 11:40:03 2019 -0700

py3: Fix swift-recon
    
    Avoid things like
    
        TypeError: '<' not supported between instances of 'NoneType' and 'int'
    
    Change-Id: I82edbf1ddcc28f86e97405d21db0b96249412eac

commit 4c66596e630ee63cf2cd54d216c8e443203e59fe
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 11:34:31 2019 -0700

py3: fix swift-dispersion-populate
    
    Change-Id: I1f140ae00cbd25b23c9a40ee91dccee8c7c15d81

commit 3e90ddb37d1d13977b69ae01117f50bab3495266
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 11:15:37 2019 -0700

swift-account-audit: clean up some error formatting
    
    "127.0.0.1s:sdas" is confusing at best.
    
    Change-Id: I37f78d5993082ac29b001e9563aa4b24fd009a27

commit 2f4fe56ca484c0efc11736aa323b2e63199e3513
Author: Tim Burke <tim.burke@gmail.com>
Date:   Mon Oct 14 11:15:14 2019 -0700

py3: fix swift-account-audit
    
    Previously, we'd get a KeyError trying to read headers.
    
    Change-Id: I5d9f86784a3e39577ab010d29d8d03b26ffda357

commit 85d3658d6297efbe9a588d1b4364a2a68f9e5bb7
Author: Thomas Goirand <zigo@debian.org>
Date:   Fri Oct 11 14:12:01 2019 +0200

Fix kms_keymaster under Python 3
    
    Depending on how the key was stored in Barbican, it may come out of
    Castellan as a native string, which would not be suitable on Python 3.
    Now, check that the secret is a byte string, and if it isn't, encode as
    UTF-8 (to match Barbican's internal encoding).
    
    Change-Id: I6da047716c05e4f2a9e1e74ca19afb62e812d172
    Closes-Bug: #1847755

commit 405a2b2a55866b74f196ad81eaafedeee4615fa8
Author: Tim Burke <tim.burke@gmail.com>
Date:   Sun Oct 13 21:55:54 2019 -0700

py3: Fix swift-drive-audit
    
    Walking through the kernel logs backwards requires that we open them
    in binary mode. Add a new option to allow users to specify which
    encoding should be used to interpret those logs; default to the same
    encoding that open() uses for its default.
    
    Change-Id: Iae332bb58388b5521445e75beba6ee2e9f06bfa6
    Closes-Bug: #1847955

commit 78a4070c90573fb8cf3f933329a27019d52aeea4
Author: Christian Schwede <cschwede@redhat.com>
Date:   Tue Jul 10 09:15:18 2018 +0000

Fix misleading error msg if swift.conf unreadable
    
    Several tools are returning a misleading error message if swift.conf is
    missing or not readable by the user, stating that the hash pre-/suffixes
    are missing. Let's fix this by catching the real issue down below.
    
    Change-Id: I7a47e6260ed51a3b7d9665b3a4510520429ae158

commit d667affb6f0b0b125901a0c002ddb00322a8e4f4
Author: Thiago da Silva <thiagodasilva@gmail.com>
Date:   Wed Oct 9 16:24:12 2019 +0200

Create segment container w/ same policy as primary
    
    When users upload an MPU object, s3api will automatically
    create a segment container if one doesn't already exist.
    
    Currently, s3api will create the segment bucket using the
    cluster's default storage policy. This patch changes that
    behavior to use the same storage policy as the primary bucket.
    
    Change-Id: Ib64a06868bd3670a1d4a1860ac29122e1ede7c39
    Closes-Bug: 1832390

commit 98f9781096f4f8f989e11f52fee0ec145fb5a173
Author: Christian Schwede <cschwede@redhat.com>
Date:   Sat Mar 12 06:36:46 2016 +0000

Add commands to ring-builder to change region / zone
    
    Currently one has to remove and re-add devices when the region or zone needs to
    be changed. Adding the subcommands set_region and set_zone simplifies this, now
    it is possible to change the region and/or zone easily. Note that there is no
    change to the required rebalancing; it is likely that data still needs to be
    moved within the cluster.
    
    This is mostly copy-n-paste of the existing set_weight subcommand and adopting
    tests accordingly. Some duplicated code in the tests has been aggregated as
    well.
    
    Change-Id: I37dd8e8ac24e2b0bb196758449a1d91a769b2e96

commit bb5fa0ea2e5be9d7537f31091015e816796499ba
Author: Pete Zaitcev <zaitcev@kotori.zaitcev.us>
Date:   Fri May 3 14:51:47 2019 -0500

tests: bust md5 of object not footers
    
    The test test_PUT_ec_fragment_quorum_archive_etag_mismatch
    busts the md5 in server.py, so it ends damaging the md5 of
    footers instead of the fragment archive. It appears that the
    intention of the test was to check the integrity verification
    for fragment archive, so change the test to bust diskfile.py
    instead.
    
    Change-Id: I54a203bb637d5f5814e8df2b4297758b0b72adac

commit 3f7ffbc2ccc899cdf17ff1a338560ce3bc075e07
Author: Thiago da Silva <thiagodasilva@gmail.com>
Date:   Thu Oct 3 17:05:23 2019 +0200

Start building py3 docker images
    
    Change-Id: Id6f1075b2774536bb095de0904a1cdcf2b34b0fd

tags:

added: in-feature-losf

Revision history for this message

OpenStack Infra (hudson-openstack) wrote on 2020-02-03: Fix included in openstack/swift 2.24.0

#11

This issue was fixed in the openstack/swift 2.24.0 release.

OpenStack Object Storage (swift)

On-disk encryption is borken with Python 3

Bug Description

Other bug subscribers

Remote bug watches