Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/19616 )
Change subject: KUDU-3448 Add support for encrypting IPKI keys ...................................................................... Patch Set 4: (1 comment) http://gerrit.cloudera.org:8080/#/c/19616/4/src/kudu/master/catalog_manager.cc File src/kudu/master/catalog_manager.cc: http://gerrit.cloudera.org:8080/#/c/19616/4/src/kudu/master/catalog_manager.cc@1360 PS4, Line 1360: [&](){ : string ret; : WARN_NOT_OK(security::GetPasswordFromShellCommand( : FLAGS_ipki_private_key_password_cmd, &ret), : "could not get IPKI private key password from configured command"); : return ret; : } My concern here is that PasswordCallback might return an empty string, just logging the warning message. Since that's just a warning, it might go completely unnoticed. As a result, it provides a false sense of security since the password would be empty. Do you think it's time to change the signature of PasswordCallback? Say, make it std::function<Status(std::string*)> instead of std::function<std::string(void)>, so non-OK status of PasswordCallback would pop up and be returned from PrivateKey::ToEncryptedString()? -- To view, visit http://gerrit.cloudera.org:8080/19616 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I71f2ec856f018d56efbf6901039eed2676fcbe23 Gerrit-Change-Number: 19616 Gerrit-PatchSet: 4 Gerrit-Owner: Attila Bukor <[email protected]> Gerrit-Reviewer: Abhishek Chennaka <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Ashwani Raina <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Mahesh Reddy <[email protected]> Gerrit-Reviewer: Tidy Bot (241) Gerrit-Reviewer: Zoltan Chovan <[email protected]> Gerrit-Reviewer: Ádám Bakai <[email protected]> Gerrit-Comment-Date: Sat, 18 Mar 2023 01:47:56 +0000 Gerrit-HasComments: Yes
