Use key/secret to obfuscate values in the local database #7958
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jgsogo
changed the title
jgsogo
changed the title
memsharded
reviewed
Oct 28, 2020
conans/util/encrypt.py
Outdated
| def decode(enc, key): | ||
| assert isinstance(enc, bytes), "Expected 'bytes', got '{}'".format(type(enc)) | ||
| assert isinstance(key, str), "Expected 'str' type, got '{}'".format(type(key)) | ||
| return urlsafe_b64decode(enc)[len(key):].decode('utf-8') |
There was a problem hiding this comment.
This seems a bit weak, as it brings the length of the key only as the thing to "crack". I would say it is worth to at least use something like the Vigenere-Cipher, that would require way more effort to crack, and seems quite straight forward to implement.
danimtb
approved these changes
Oct 28, 2020
czoido
approved these changes
Oct 28, 2020
memsharded
approved these changes
Oct 28, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Changelog: Feature: Add
CONAN_LOGIN_ENCRYPTION_KEYenvironment variable to obfuscate stored auth token.Docs: conan-io/docs#1903
This PR implements a level of obfuscation over the data stored in the local database. It uses any value provided (if provided) in the
CONAN_LOGIN_ENCRYPTION_KEYenvvar to compose the data that will be stored in the database. It cannot be considered an encryption mechanism, this is NOT OK FOR SECURITY, but it can be useful for CI pipelines: the CI job assigns a random-unique value for each build, with this simple implementation the data stored in the Conan cache is no longer usable by other jobs/builds in the same machine.#PYVERS: py27