DO NOT MERGE: Encryption example for review. #111
Conversation
| for uid in keydata['uids']: | ||
| if uid.split(' ')[0] == name: | ||
| self.fingerprint = keydata['fingerprint'] | ||
| break |
There was a problem hiding this comment.
Looping over keydata['uids'] implies you're allowing for multiple iterations, so should this break be indented further?
| self.fingerprint = None | ||
| for keydata in self._encryptor.list_keys(): | ||
| for uid in keydata['uids']: | ||
| if uid.split(' ')[0] == name: |
There was a problem hiding this comment.
Should this be a case-insensitive comparison? Exact match seems overly strict to me.
|
Likely the passphrase would be coming from a configuration file such as the |
|
Hmm, storing secrets in plain text files worries me but I guess that would be okay if file permissions are restrictive enough. I was wondering, maybe as a future feature, if we could delegate key storage to Custodia? It can also use etcd as a backing store but handles the crypto, if I understand correctly. (I don't know how mature that project is though; maybe still too early?) |
|
@mbarnes I like the idea, but I'm not sure if we want to require Custodia to be set up to use Commissaire. |
|
@mbarnes though we could make it part of commissaire proper install as it does seem like a good fit. |
|
The more I think about this the more it seems to make sense install and use Custodia as part of Commissaire standard install. We can then front it's API as well which would continue the idea of providing one api location to look at when one has Commissaire. @tiran Any thoughts around this? |
|
If we do use Custodia it will significantly change the 101 proposal. We could take advantage of Custodia for storage and retrieval of sensitive data. The need to provide our on encryption backend system wouldn't be required any longer. |
|
@ashcrow In general I'm +1 on any new use of Custodia. However I'm not familiar with commissaire yet. Give me a chance to learn more about the project first and understand its role in Atomic. I'll get back to you tomorrow. |
|
Closing this example PR and will update CPD-101 with Custodia wording. |
Encryption code example similar to CPD-101.