Improve efficiency of source key management #793
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rmol
requested review from
sssoleileraaa,
kushaldas and
redshiftzero
as code owners
Only set db.Source.public_key and db.Source.fingerprint when a source's key is successfully imported to the local key ring. This allows us to use those columns to check the presence of the key and save a call to GPG during sync.
There was a problem hiding this comment.
I confirmed this fixes the issue: i no longer see frequent keyring popups. i verified that now for every sync i see a log like this one for each existing source:
2020-02-11 16:02:43,081 - securedrop_client.storage:145(update_source_key) DEBUG: Source key data is unchanged
2020-02-11 16:02:43,081 - securedrop_client.storage:192(update_sources) DEBUG: Updated source 82cec7df-b54c-4396-b8f1-c1f4dde778d9
and if there is a new source:
2020-02-11 16:05:13,094 - securedrop_client.crypto:152(import_key) DEBUG: Importing key with fingerprint 8A80A746A38F8DCF1295428917C08CCA40466BF6
2020-02-11 16:05:13,107 - securedrop_client.storage:206(update_sources) DEBUG: Added new source c21b9e51-2ec2-425f-ac77-df9de45eebfc
i left a nitpicky comment that you can just ignore. also leaving this open since it's on redshiftzero's todo list
|
but if you don't want to ignore my nitpicky comment that's fine too! |
The session needs to be committed before calling import_key, but that should happen where the changes to the source are being made, in update_sources.
kushaldas
approved these changes
Feb 12, 2020
sssoleileraaa
approved these changes
Feb 12, 2020
|
going to run through this one more time to make sure everything still works with the latest changes from |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Only set
db.Source.public_keyanddb.Source.fingerprintwhen a source's key is successfully imported to the local key ring. This allows us to use those columns to check the presence of the key and save a call to GPG during sync.Fixes #757.
Test Plan
Run the client against a local dev server with
LOGLEVEL=debug. Observe in the logs that the initial sync imports source public keys, and subsequent ones skip the imports. Observe that there is no keyring access popup for syncs where no new keys are imported.Checklist
If these changes modify code paths involving cryptography, the opening of files in VMs or network (via the RPC service) traffic, Qubes testing in the staging environment is required. For fine tuning of the graphical user interface, testing in any environment in Qubes is required. Please check as applicable:
If these changes add or remove files other than client code, packaging logic (e.g., the AppArmor profile) may need to be updated. Please check as applicable: