This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch db/8611 in repository https://gitbox.apache.org/repos/asf/allura.git
commit 41ce425fc5e7577554df1ae52f7e5a77d56aa41b Author: Dave Brondsema <[email protected]> AuthorDate: Tue Jun 16 11:57:39 2026 -0400 [#8611] put encryption settings into development.ini with a default that triggers a warning --- Allura/allura/lib/utils.py | 17 +++++++++++++++++ Allura/development.ini | 12 ++++++++++++ 2 files changed, 29 insertions(+) diff --git a/Allura/allura/lib/utils.py b/Allura/allura/lib/utils.py index 7dd73f4ed..8a800994d 100644 --- a/Allura/allura/lib/utils.py +++ b/Allura/allura/lib/utils.py @@ -18,6 +18,7 @@ import base64 import importlib +import sys from collections.abc import Iterable, Mapping, MutableMapping from contextlib import contextmanager import time @@ -81,8 +82,24 @@ def clean_ming_config(config): return config +def check_ming_config(config: dict): + if 'pytest' in sys.modules: + return + for ming_group in ['main', 'project', 'task']: + key = config.get(f'ming.{ming_group}.encryption.kms_providers.local.key') + if not key: + raise ValueError('MongoDB encryption needs a key. Set ming.*.encryption.* in your .ini file!') + if key.startswith('REPLACE/ME'): + msg = 'insecure default key used for MongoDB encryption. Update ming.*.key in your .ini file!' + if asbool(config['debug']): + log.warning(msg) + else: + raise ValueError(msg) + + def configure_ming(conf): conf = clean_ming_config(conf) + check_ming_config(conf) ming.configure(**conf) diff --git a/Allura/development.ini b/Allura/development.ini index 62d03b9f1..cb356cc81 100644 --- a/Allura/development.ini +++ b/Allura/development.ini @@ -578,10 +578,22 @@ activitystream.ming.auto_ensure_indexes = false ; be all in the same database if desired ming.main.uri = mongodb://127.0.0.1:27017/allura ming.main.auto_ensure_indexes = False +; the .key values must be a base64-encoded 96-byte key for encrypted fields in mongo +; generate one with: python -c 'import base64, secrets; print(base64.b64encode(secrets.token_bytes(96)).decode())' +; changing it will make existing encrypted data inaccessible until extra steps are taken https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/manage-keys/ +ming.main.encryption.kms_providers.local.key = REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME////// +ming.main.encryption.key_vault_namespace = encryption.dataKeyVault +ming.main.encryption.provider_options.local.key_alt_names = ["datakey1"] ming.project.uri = mongodb://127.0.0.1:27017/project-data ming.project.auto_ensure_indexes = False +ming.project.encryption.kms_providers.local.key = REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME////// +ming.project.encryption.key_vault_namespace = encryption.dataKeyVault +ming.project.encryption.provider_options.local.key_alt_names = ["datakey1"] ming.task.uri = mongodb://127.0.0.1:27017/task ming.task.auto_ensure_indexes = False +ming.task.encryption.kms_providers.local.key = REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME/THIS/IS/INSECURE/REPLACE/ME////// +ming.task.encryption.key_vault_namespace = encryption.dataKeyVault +ming.task.encryption.provider_options.local.key_alt_names = ["datakey1"] ; A float from 0-1 representing a % of requests to measure timing on. ; Sampled requests will have timing logged to stats.log (can change file in [handler_timermiddleware] logging section)
