{"action":"created","issue":{"url":"https://api.github.com/repos/BD2KGenomics/toil/issues/412","labels_url":"https://api.github.com/repos/BD2KGenomics/toil/issues/412/labels{/name}","comments_url":"https://api.github.com/repos/BD2KGenomics/toil/issues/412/comments","events_url":"https://api.github.com/repos/BD2KGenomics/toil/issues/412/events","html_url":"https://github.com/BD2KGenomics/toil/issues/412","id":107632304,"number":412,"title":"Best-effort to prevent secret key leakage","user":{"login":"hannes-ucsc","id":5143256,"avatar_url":"https://avatars.githubusercontent.com/u/5143256?v=3","gravatar_id":"","url":"https://api.github.com/users/hannes-ucsc","html_url":"https://github.com/hannes-ucsc","followers_url":"https://api.github.com/users/hannes-ucsc/followers","following_url":"https://api.github.com/users/hannes-ucsc/following{/other_user}","gists_url":"https://api.github.com/users/hannes-ucsc/gists{/gist_id}","starred_url":"https://api.github.com/users/hannes-ucsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hannes-ucsc/subscriptions","organizations_url":"https://api.github.com/users/hannes-ucsc/orgs","repos_url":"https://api.github.com/users/hannes-ucsc/repos","events_url":"https://api.github.com/users/hannes-ucsc/events{/privacy}","received_events_url":"https://api.github.com/users/hannes-ucsc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/BD2KGenomics/toil/labels/discuss","name":"discuss","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-22T02:01:04Z","updated_at":"2015-09-22T22:37:20Z","closed_at":null,"body":"The toil.lib.encryption module reads the encryption key from the file system for every encryption/decryption of a message. This *may* limit its performance. The AWSJobStore opens the key once and stores it in memory. This is inconsistent. \n\nWe should measure the overhead of opening and reading from a short file, once with memory and I/O pressure and once without. The ``stress`` utility may be handy for this.\n\nIf the overhead is significant, eliminate the opening of the file from the encrypt() and decrypt() functions and pass the key instead of a path to the key file.\n\nOptionally, wrap the key string in an instance of a class whose __str__ and __repr__ methods are overridden to return a redacted string, and that has a special method called get_secret() to get the actual key string. That way we reduce the chance of accidentally logging or printing the key."},"comment":{"url":"https://api.github.com/repos/BD2KGenomics/toil/issues/comments/142441067","html_url":"https://github.com/BD2KGenomics/toil/issues/412#issuecomment-142441067","issue_url":"https://api.github.com/repos/BD2KGenomics/toil/issues/412","id":142441067,"user":{"login":"hannes-ucsc","id":5143256,"avatar_url":"https://avatars.githubusercontent.com/u/5143256?v=3","gravatar_id":"","url":"https://api.github.com/users/hannes-ucsc","html_url":"https://github.com/hannes-ucsc","followers_url":"https://api.github.com/users/hannes-ucsc/followers","following_url":"https://api.github.com/users/hannes-ucsc/following{/other_user}","gists_url":"https://api.github.com/users/hannes-ucsc/gists{/gist_id}","starred_url":"https://api.github.com/users/hannes-ucsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hannes-ucsc/subscriptions","organizations_url":"https://api.github.com/users/hannes-ucsc/orgs","repos_url":"https://api.github.com/users/hannes-ucsc/repos","events_url":"https://api.github.com/users/hannes-ucsc/events{/privacy}","received_events_url":"https://api.github.com/users/hannes-ucsc/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T22:37:20Z","updated_at":"2015-09-22T22:37:20Z","body":"Also prevent pickling using copyreg."}}