{"action":"created","issue":{"url":"https://api.github.com/repos/celery/celery/issues/5091","repository_url":"https://api.github.com/repos/celery/celery","labels_url":"https://api.github.com/repos/celery/celery/issues/5091/labels{/name}","comments_url":"https://api.github.com/repos/celery/celery/issues/5091/comments","events_url":"https://api.github.com/repos/celery/celery/issues/5091/events","html_url":"https://github.com/celery/celery/pull/5091","id":367444458,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIwODc4MzI3","number":5091,"title":"WIP: Improve message signing (#5056)","user":{"login":"bpereto","id":1131885,"node_id":"MDQ6VXNlcjExMzE4ODU=","avatar_url":"https://avatars0.githubusercontent.com/u/1131885?v=4","gravatar_id":"","url":"https://api.github.com/users/bpereto","html_url":"https://github.com/bpereto","followers_url":"https://api.github.com/users/bpereto/followers","following_url":"https://api.github.com/users/bpereto/following{/other_user}","gists_url":"https://api.github.com/users/bpereto/gists{/gist_id}","starred_url":"https://api.github.com/users/bpereto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bpereto/subscriptions","organizations_url":"https://api.github.com/users/bpereto/orgs","repos_url":"https://api.github.com/users/bpereto/repos","events_url":"https://api.github.com/users/bpereto/events{/privacy}","received_events_url":"https://api.github.com/users/bpereto/received_events","type":"User","site_admin":false},"labels":[{"id":774806383,"node_id":"MDU6TGFiZWw3NzQ4MDYzODM=","url":"https://api.github.com/repos/celery/celery/labels/PR%20Type:%20Enhancement","name":"PR Type: Enhancement","color":"7ec6dd","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/celery/celery/milestones/20","html_url":"https://github.com/celery/celery/milestone/20","labels_url":"https://api.github.com/repos/celery/celery/milestones/20/labels","id":3359245,"node_id":"MDk6TWlsZXN0b25lMzM1OTI0NQ==","number":20,"title":"v4.3","description":"The last version to support python2","creator":{"login":"thedrow","id":48936,"node_id":"MDQ6VXNlcjQ4OTM2","avatar_url":"https://avatars2.githubusercontent.com/u/48936?v=4","gravatar_id":"","url":"https://api.github.com/users/thedrow","html_url":"https://github.com/thedrow","followers_url":"https://api.github.com/users/thedrow/followers","following_url":"https://api.github.com/users/thedrow/following{/other_user}","gists_url":"https://api.github.com/users/thedrow/gists{/gist_id}","starred_url":"https://api.github.com/users/thedrow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thedrow/subscriptions","organizations_url":"https://api.github.com/users/thedrow/orgs","repos_url":"https://api.github.com/users/thedrow/repos","events_url":"https://api.github.com/users/thedrow/events{/privacy}","received_events_url":"https://api.github.com/users/thedrow/received_events","type":"User","site_admin":false},"open_issues":45,"closed_issues":101,"state":"open","created_at":"2018-05-20T07:51:39Z","updated_at":"2018-12-04T17:51:26Z","due_on":"2018-12-01T08:00:00Z","closed_at":null},"comments":16,"created_at":"2018-10-06T10:25:37Z","updated_at":"2018-12-05T09:03:57Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/celery/celery/pulls/5091","html_url":"https://github.com/celery/celery/pull/5091","diff_url":"https://github.com/celery/celery/pull/5091.diff","patch_url":"https://github.com/celery/celery/pull/5091.patch"},"body":"## Description\r\n\r\nthis improves the message signing described in   \r\nhttp://docs.celeryproject.org/en/latest/userguide/security.html#message-signing\r\n\r\nThis fixes #5056 . see the issue for ongoing discussion\r\n\r\n---\r\n\r\n* [X] better documentation how to configure (`accept_content = ['auth']` and `auth` serializer)\r\n* [X] remove silent fail on `app.setup_security()` if not correctly configured\r\n* [X] Unsigned Messages: `ContentDisallowed` should be dismissed (like a unkown task)\r\n* [ ] Invalid Signatures: `SecurityError` should also be dismissed.\r\n  *  a security error should take attention. some logging/alarming? I don't know what the standard mechanisms in celery are for this case.\r\n* [ ] Handle Pidbox/Event exceptions if serializers don't match (auth - json/json - auth)\r\n  * [ ] Gossip\r\n  * [ ] Mingle\r\n* [X] New Worker should introduce themselves with a signed message\r\n* [ ] ~~Proposal: A configuration setting for verifying the certificates against a CA.~~\r\n* [X] Proposal: Make digest of OpenSSL Sign configurable\r\n  * Change default digest from `sha1` to something modern (sha256) ? Performance impact should be considered. (https://pyopenssl.org/en/stable/api/crypto.html#digest-names)\r\n* [X] Test coverage\r\n* [X] Integration Test\r\n* [X] Replace pyOpenSSL with pyca/crypthography\r\n"},"comment":{"url":"https://api.github.com/repos/celery/celery/issues/comments/444410682","html_url":"https://github.com/celery/celery/pull/5091#issuecomment-444410682","issue_url":"https://api.github.com/repos/celery/celery/issues/5091","id":444410682,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDQxMDY4Mg==","user":{"login":"thedrow","id":48936,"node_id":"MDQ6VXNlcjQ4OTM2","avatar_url":"https://avatars2.githubusercontent.com/u/48936?v=4","gravatar_id":"","url":"https://api.github.com/users/thedrow","html_url":"https://github.com/thedrow","followers_url":"https://api.github.com/users/thedrow/followers","following_url":"https://api.github.com/users/thedrow/following{/other_user}","gists_url":"https://api.github.com/users/thedrow/gists{/gist_id}","starred_url":"https://api.github.com/users/thedrow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thedrow/subscriptions","organizations_url":"https://api.github.com/users/thedrow/orgs","repos_url":"https://api.github.com/users/thedrow/repos","events_url":"https://api.github.com/users/thedrow/events{/privacy}","received_events_url":"https://api.github.com/users/thedrow/received_events","type":"User","site_admin":false},"created_at":"2018-12-05T09:03:57Z","updated_at":"2018-12-05T09:03:57Z","author_association":"CONTRIBUTOR","body":"Is not having certificate validation a problem?"}}
{"actor":{"display_login":"thedrow"}}