Repository navigation
Conversation
Clients advertise an encryption policy (optional or required) in SYFT_version.json. A pair encrypts when one side requires it, so clients of an enclave need no encryption setting. WIP: not ready for review.
- Load the key file without a nested lock in ensure_keys (deadlock). - Keep held messages on disk; save after each send. - Read an earlier peer without a bundle as unknown for one load, then off. - Advertise a switch to required also from a process that never wrote the version file. - Hold sends before the first peer load. - Re-read an unknown peer through PeerManager, before the message is converted. - Skip a bundle that is already published; warn on a Drive error.
- Send queued outbox messages directly; keep only pending ones on disk, with one write per flush and no loss on errors. - Reload the key file policy before direct event writes. - Catch every pending error per recipient when sending changes. - Read earlier peers' bundles in the parallel version load. - Decode held hashes again only when the held file changes. - Document the encryption policy and the earlier-client limit.
…ites - Remember peers seen as required in the key file; ignore an advertised downgrade until the user trusts a new key for the peer. - Encrypt plaintext files at rest before direct event writes too. - Run the at-rest pass under its own lock, with parallel downloads. - Key the held-hash cache on file content. - Read earlier peers without a bundle again only every tenth load. - Download in parallel batches when rejecting plaintext inbox messages.
- Take an earlier peer as required only for a valid bundle; a failed check or a junk file keeps the policy unknown and is checked again. - Record a missing bundle only in a peer load, so add_peer keeps the grace. - Wait on plaintext while the peer policy is unknown; keep the last known policy when the version file disappears. - Hold unsent proposals when a send fails. - Keep a version when only the bundle check fails. - Treat an unreadable own bundle as not published. - Name test SyftBox folders with uuid4, so tests do not share caches.
- Treat a peer without an encryption policy as outdated: skip it with a warning to upgrade, and raise on a send to it. - Remove the use_encryption keyword shim; pass encryption_policy. - Share the hold-or-drop rule through PeerStore.should_hold. - Remove the held-hash cache, the parallel downloads and the holding of sends before the first peer load. - Merge redundant tests and rename tests without filler words.
An off client keeps no record of required peers; say so in the docs.
…ected_ prefix - Refuse plaintext at rest once the files at rest are encrypted - Write only changes to remembered required peers - Use the effective peer policy in add_peer - Find rejected messages with a Drive name query - Read the key file again only after it changes - Share the file lock and atomic write helpers - Record required_since; accept older plaintext outbox history
…ejected lookup - Record when the files at rest were encrypted; accept older plaintext - Read the key file once per batch of files at rest - Take key file data in a process without keys - Escape names in Drive queries; read every page - Check resent names in one query per batch
- Drop plaintext to an encrypting pair with a warning; remove reject-and-resend - Keep pending sends in memory until the next sync; remove held message files - Encrypt only new files at rest; remove the one-time pass and required_since - Remove remembered required peers (moved to a follow-up) - Take the policy from the key file at startup only
- Warn when a message waits in memory for encryption, or is dropped - Warn when messages from a peer wait to be read - Refuse to sync when the key file became required after start
- Split the send loop out of process_file_changes_queue - Remove unused PeerManagerConfig.use_encryption - Rename tests with filler words; fix a docstring and an import - Restore the original place of _with_pin and BUNDLE_FILE_KEY
…nd PeerManagerConfig
|
Check out this pull request on See visual diffs & provide feedback on Jupyter Notebooks. Powered by ReviewNB |
- Integration test: the DS syncs after approval to send the job it held - Apply prettier and nbstripout to files the branch changed
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Each client now advertises an encryption policy (
off,optionalorrequired) in its versionfile, and a pair encrypts when either side requires it. Keys and bundles are set up automatically,
so a client of an enclave that requires encryption needs no setting. The default stays
optional.Changes
login(encryption=...)takesTrue(required),False(optional) or"off". The policy is thenew
encryption_policyfield ofSYFT_version.json.optionalclient makes keys only when a peer requires encryption. The key file records arequiredpolicy, so later logins and syft-bg stayrequired. A key file without the field readsas
required.offand arequiredclient conflict: each side skips the other with a warning. A peer whoseversion file has no policy runs an outdated syft and is skipped with a warning to upgrade.
skips it, both with a warning.
warning. A scientist's send to a non-peer raises; the owner drops an outbox message to a
non-peer with a warning.
required. Files written before a switch stayplaintext and remain readable.
requiredafter this one started.of the last path.
optional. Clientsfollow the enclave's policy, so the demo scripts drop their encryption flag.
Note
Release note: clients skip an enclave image built before this change as outdated. Rebuild and
deploy the enclave image with, or before, this client release.
Testing
tests/unit/test_encryption_policy.py(57 tests, mock Drive) and enclave tests for thenegotiated job flow and boot-time keys.
tests/unit626, migrations 108,syft-enclave298,syft-rds151,syft-job121,syft-datasets51.required, and with both optional; an
off/requiredconflict; and a policy change while aprocess runs. All five passed, with the raw Drive files checked as encrypted or plaintext.
Asana task