-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Configurable s3 endpoint for download #1163
Configurable s3 endpoint for download #1163
Conversation
d5fc9f1
to
d9c8803
Compare
d9c8803
to
73baacd
Compare
9f68afa
to
d4e2439
Compare
32a1128
to
058887a
Compare
402b10a
to
8a9b000
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Crypt4gh config already exists, there is not need to add another one since the app will only need one.
Either reuse the existing one or move everything up under the app
sub heading.
sda-download/.github/integration/tests/s3notls/52_check_endpoint.sh
Outdated
Show resolved
Hide resolved
I unresolved the initial the conversations that I set as resolved (these are answered) so that @jbygdell can take a look and resolve. According to how we decided to do things on our last meeting about PRs. |
sda-download/.github/integration/tests/common/90_check_s3_errors.sh
Outdated
Show resolved
Hide resolved
sda-download/.github/integration/tests/common/90_check_s3_errors.sh
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like good and thorough work..!
I left some questions, but otherwise I think it looks good!
for testing (un)encrypted download cases
and do a small refactoring
- add serveDecrypted object variable - repurpose obsolete c4gh secret logic - update README
if they are run more than once
to increase success rate of date comparison
Co-authored-by: Nanjiang Shu <[email protected]>
107a01a
to
a4a5e96
Compare
Related issue(s) and PR(s)
This PR closes #750.
Description
With this PR
download
can either be deployed as serving either unencrypted or encrypted files. TheserveUnencryptedData
boolean is removed as well as the logic fordownload
to always generate an internal c4gh key-pair (that would allow the service to serve unencrypted files in caseserveUnencryptedData=true
).Main changes:
download
can now be configured to only serve unencrypted files if a filepath to a c4gh private key file is provided. Internally, the code checks the validity of the provided key by using the supplied passphrase to retrieve the corresponding c4gh public key. The service will not start if this procedure fails and the service will serve unencrypted data only if the retrieved public key is non-empty. This ensures that there can be no misconfiguration by e.g. providing malfunctioning keys etc. For example, the crypt4gh library and thereforereencrypt
will use any string provided to it and encrypt a file but with this mechanism we avoid such a scary scenario.download
will serve only encrypted files. This is the default behavior.Other changes include:
download
listening at different ports, one serving encrypted and the other serving unencrypted filesHow to test
Integration tests pass.