feat(backup): Support import decryption #58128
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
Scope: Backend
Codecov Report
@@ Coverage Diff @@
## master #58128 +/- ##
=======================================
Coverage 79.04% 79.05%
=======================================
Files 5135 5135
Lines 223466 223480 +14
Branches 37622 37626 +4
=======================================
+ Hits 176643 176673 +30
+ Misses 41173 41152 -21
- Partials 5650 5655 +5
|
Base automatically changed from
azaslavsky/backup/export_encryption
to
master
October 16, 2023 04:48
azaslavsky
force-pushed
the
azaslavsky/backup/import_decryption
branch
from
e80a8dd
to
016d82c
Compare
hubertdeng123
approved these changes
Oct 16, 2023
tests/sentry/backup/test_imports.py
Outdated
|
|
||
| tmp_tarball_path = Path(tmp_dir).joinpath("input.tar") | ||
| with open(tmp_tarball_path, "wb") as i, open(tmp_pub_key_path, "rb") as p: | ||
| i.write(create_encrypted_export_tarball(data, p).getvalue()) |
There was a problem hiding this comment.
Is it worth it to have a testcase encrypting an export tarbell without this function create_encrypted_export_tarbell? Since technically changing the behavior in this function could lead to all these test cases failing.
There was a problem hiding this comment.
Good idea, I copied out the logic into this testing method.
mdtro
reviewed
Oct 16, 2023
src/sentry/backup/helpers.py
Outdated
| backup_encryptor = Fernet(data_encryption_key) | ||
| encrypted_json_export = backup_encryptor.encrypt(json.dumps(json_export).encode("utf-8")) | ||
|
|
||
| # Encrypt the newly minted DEK using symmetric public key encryption. |
There was a problem hiding this comment.
Suggested change
| # Encrypt the newly minted DEK using symmetric public key encryption. | |
| # Encrypt the newly minted DEK using asymmetric public key encryption. |
The DEK is encrypted with asymmetric encryption. Once encrypted with the public key, it can only be decrypted with the private key.
There was a problem hiding this comment.
Good catch, done!
This is the follow up to #58015, adding the corresponding `--decrypt_with` flag to decrypt tarballs at import time. Closes getsentry/team-ospo#207
azaslavsky
force-pushed
the
azaslavsky/backup/import_decryption
branch
from
016d82c
to
73aa12b
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is the follow up to #58015, adding the corresponding
--decrypt_withflag to decrypt tarballs at import time.Closes getsentry/team-ospo#207