You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2022/04/15 14:54:38 UTC
[GitHub] [airflow] nsAstro opened a new pull request, #23043: Add exception to catch single line private keys
nsAstro opened a new pull request, #23043:
URL: https://github.com/apache/airflow/pull/23043
This is to address issue #22576 where paramiko expects that any private keys provided have the BEGIN and END header/footer in separate lines. The exception should technically be thrown downstream, but since paramiko doesn't have a clear exception message or specific exception type, we catch it before using the key and present it back to the user.
[Relevant paramiko snippet](https://github.com/paramiko/paramiko/blob/main/paramiko/pkey.py#L325-L338)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nsAstro commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
nsAstro commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1119485516
@potiuk sorry for the delay on this. Should be fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] uranusjr commented on a diff in pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
uranusjr commented on code in PR #23043:
URL: https://github.com/apache/airflow/pull/23043#discussion_r851669478
##########
airflow/providers/ssh/hooks/ssh.py:
##########
@@ -415,6 +415,9 @@ def _pkey_from_private_key(self, private_key: str, passphrase: Optional[str] = N
:return: ``paramiko.PKey`` appropriate for given key
:raises AirflowException: if key cannot be read
"""
+ if private_key.count("\n") < 2:
Review Comment:
```suggestion
if len(private_key.split("\n", 2)) < 2:
```
Using `count()` here would unnecessarily scan the entire key. It feels wrong to waste time for that since valid values are expected (which usually contains many lines).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] uranusjr commented on a diff in pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
uranusjr commented on code in PR #23043:
URL: https://github.com/apache/airflow/pull/23043#discussion_r851669478
##########
airflow/providers/ssh/hooks/ssh.py:
##########
@@ -415,6 +415,9 @@ def _pkey_from_private_key(self, private_key: str, passphrase: Optional[str] = N
:return: ``paramiko.PKey`` appropriate for given key
:raises AirflowException: if key cannot be read
"""
+ if private_key.count("\n") < 2:
Review Comment:
```suggestion
if private_key.split("\n", 2) < 2:
```
Using `count()` here would unnecessarily scan the entire key. It feels wrong to waste time for that since valid values are expected (which usually contains many lines).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
potiuk commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1108509132
Can you please fix static checks and rebase @nsAstro ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1100156912
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst)
Here are some useful points:
- Pay attention to the quality of your code (flake8, mypy and type annotations). Our [pre-commits]( https://github.com/apache/airflow/blob/main/STATIC_CODE_CHECKS.rst#prerequisites-for-pre-commit-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/docs/apache-airflow/howto/custom-operator.rst) Consider adding an example DAG that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/BREEZE.rst) for testing locally, itโs a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#coding-style-and-best-practices).
Apache Airflow is a community-driven project and together we are making it better ๐.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nsAstro commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
nsAstro commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121317335
I didn't see this failure last time but I think it's flagging the dummy key I've put in as an actual SSH key
```
Detect if private key is added to the repository.........................................Failed
- hook id: detect-private-key
- exit code: 1
```
Splitting the string seems to pass the check for now. Hoping that will suffice.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
potiuk commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121334409
> Splitting the string seems to pass the check for now. Hoping that will suffice.
You can explicitly exclude your file with regexp in .pre-commit.cfg. It is a better solution than splitting the key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121658704
Awesome work, congrats on your first merged pull request!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
potiuk commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121234693
No worries checking :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk merged pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
potiuk merged PR #23043:
URL: https://github.com/apache/airflow/pull/23043
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nsAstro commented on a diff in pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
nsAstro commented on code in PR #23043:
URL: https://github.com/apache/airflow/pull/23043#discussion_r852089412
##########
airflow/providers/ssh/hooks/ssh.py:
##########
@@ -415,6 +415,9 @@ def _pkey_from_private_key(self, private_key: str, passphrase: Optional[str] = N
:return: ``paramiko.PKey`` appropriate for given key
:raises AirflowException: if key cannot be read
"""
+ if private_key.count("\n") < 2:
Review Comment:
Good point, I've amended it accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] nsAstro commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
nsAstro commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121341482
I was thinking about that, but I feel like test_ssh.py is the most likely location for a user to accidentally leave/commit an actual Private Key so adding this to the ignore list might defeat a significant purpose of the check itself. If you're not worried about that, then I can make the required changes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #23043: Add exception to catch single line private keys
Posted by GitBox <gi...@apache.org>.
potiuk commented on PR #23043:
URL: https://github.com/apache/airflow/pull/23043#issuecomment-1121347948
Good point. Let's see if splitting solves the problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org