yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: glance
       Status: Fix Committed => Fix Released

** Changed in: glance
    Milestone: None => havana-2

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1180884

Title:
  scrubber creates queued files containing unencrypted uris

Status in OpenStack Image Registry and Delivery Service (Glance):
  Fix Released

Bug description:
  The scrubber can sometimes create queue files under certain
  conditions. in _delete(), if there is a store.UnsupportedBackend or
  exception.NotFound exception the uri is stored in the queue file in
  unencryped form.

  From glance/store/scrubber.py:

      def _delete(self, id, uri, now):
          file_path = os.path.join(self.datadir, str(id))
          if CONF.metadata_encryption_key is not None:
              uri = crypt.urlsafe_decrypt(CONF.metadata_encryption_key, uri)
          try:
              LOG.debug(_("Deleting %(uri)s") % {'uri': uri})
              # Here we create a request context with credentials to support
              # delayed delete when using multi-tenant backend storage
              ctx = context.RequestContext(auth_tok=self.registry.auth_tok,
                                           user=self.admin_user,
                                           tenant=self.admin_tenant)
              store.delete_from_backend(ctx, uri)
          except store.UnsupportedBackend:
              msg = _("Failed to delete image from store (%(id)s).")
              LOG.error(msg % {'id': id})
              if CONF.metadata_encryption_key is not None:
                  uri = crypt.urlsafe_encrypt(CONF.metadata_encryption_key, uri, 64)
              write_queue_file(file_path, uri, now)
          except exception.NotFound:
              msg = _("Image not found in store (%(id)s).")
              LOG.error(msg % {'id': id})
              if CONF.metadata_encryption_key is not None:
                  uri = crypt.urlsafe_encrypt(CONF.metadata_encryption_key, uri, 64)
              write_queue_file(file_path, uri, now)

          self.registry.update_image(id, {'status': 'deleted'})
          utils.safe_remove(file_path)

  Fix to follow shortly.

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1180884/+subscriptions