{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments/38547385","id":38547385,"diff_hunk":"@@ -0,0 +1,144 @@\n+Sign collection to enforce data integrity\n+#########################################\n+\n+:date: 2015-08-26\n+:summary: How to enforce data integrity to Kinto users using collection hash signature.\n+:slug: data-signature\n+:lang: en\n+:url: data-signature\n+\n+.. note::\n+\n+    Translated from the French by `Rémy Hubscher <https://twitter.com/Natim>`_.\n+\n+Within the scope of the `Go Faster <https://wiki.mozilla.org/Firefox/Go_Faster>`_\n+project, we want to distribute minor Firefox updates more often than\n+just with major updates (which happens once every six weeks).\n+\n+There are multiple kind of data that we will need to update on the client.\n+Among others, we would like to `update the SSL OneCRL (Control Revocation List)\n+<https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/>`_.\n+\n+In that specific case, it is obviously very important to make sure\n+that all the fetched data are coming from Mozilla and that no records\n+are missing. So that we can be absolutely confident that nobody added\n+a valide certificate to the CRL or remove a revocated one.\n+\n+A cryptographic signature can give us the guarantee that all the\n+records where fetched but it is still possible to prevent users to\n+completely access the service (*Chinese Great Firewall* for instance.)\n+\n+This mecanism works in our specific use-cases of the OneCRL update\n+project, but it can also be useful to any future project that needs to\n+make sure that all records on a collection have been correctly synced.\n+We will probably need to re-use it to update other part of Firefox or\n+Fennec but you may also want to use it for your use-cases.\n+\n+In order to distribute the data or meta-data associated with the files\n+that needs to be updated, we plan to use `Kinto\n+<https://kinto.readthedocs.org>`_. Kinto is a good fit because it can\n+easily be cached behind a CDN.\n+\n+Also we don't want our user to trust either the CDN or the Kinto\n+server itself without checking. Somebody can attack the CDN or the\n+Kinto server and may add or remove records and update the CRL in a\n+wrong way. If you think about it is a horrible scenario.\n+\n+Consider the following workflow:\n+\n+- The person responsible to update the CRL, *the updater*, has got a\n+  private key (or even better `a HSM\n+  <https://en.wikipedia.org/wiki/Hardware_Security_Module>`_ which\n+  will enable her to sign a hash of the collection records;\n+- The corresponding public key ships with the client (Firefox or Fennec);\n+- *Hashing* and *signature* are done on client side to prevent some\n+  attacks vectors (if somebody can access the Kinto server for\n+  instance.)\n+\n+The signing is a one-way operation called *hashing* that guarantee the","path":"content/2015.08.donnees-et-signatures-en.rst","position":58,"original_position":58,"commit_id":"880f96f8d111ebf3d686038b04c885403bd25538","original_commit_id":"880f96f8d111ebf3d686038b04c885403bd25538","user":{"login":"ametaireau","id":67073,"avatar_url":"https://avatars.githubusercontent.com/u/67073?v=3","gravatar_id":"","url":"https://api.github.com/users/ametaireau","html_url":"https://github.com/ametaireau","followers_url":"https://api.github.com/users/ametaireau/followers","following_url":"https://api.github.com/users/ametaireau/following{/other_user}","gists_url":"https://api.github.com/users/ametaireau/gists{/gist_id}","starred_url":"https://api.github.com/users/ametaireau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ametaireau/subscriptions","organizations_url":"https://api.github.com/users/ametaireau/orgs","repos_url":"https://api.github.com/users/ametaireau/repos","events_url":"https://api.github.com/users/ametaireau/events{/privacy}","received_events_url":"https://api.github.com/users/ametaireau/received_events","type":"User","site_admin":false},"body":"signing and hashing are two different things.","created_at":"2015-09-02T15:38:25Z","updated_at":"2015-09-02T15:38:25Z","html_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/54#discussion_r38547385","pull_request_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54","_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments/38547385"},"html":{"href":"https://github.com/mozilla-services/servicedenuages.fr/pull/54#discussion_r38547385"},"pull_request":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54"}}},"pull_request":{"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54","id":44005206,"html_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/54","diff_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/54.diff","patch_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/54.patch","issue_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/54","number":54,"state":"open","locked":false,"title":"Translate the collection signature article.","user":{"login":"Natim","id":229453,"avatar_url":"https://avatars.githubusercontent.com/u/229453?v=3","gravatar_id":"","url":"https://api.github.com/users/Natim","html_url":"https://github.com/Natim","followers_url":"https://api.github.com/users/Natim/followers","following_url":"https://api.github.com/users/Natim/following{/other_user}","gists_url":"https://api.github.com/users/Natim/gists{/gist_id}","starred_url":"https://api.github.com/users/Natim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Natim/subscriptions","organizations_url":"https://api.github.com/users/Natim/orgs","repos_url":"https://api.github.com/users/Natim/repos","events_url":"https://api.github.com/users/Natim/events{/privacy}","received_events_url":"https://api.github.com/users/Natim/received_events","type":"User","site_admin":false},"body":"r? @tarekziade @n1k0 @ametaireau @magopian ","created_at":"2015-09-02T15:23:21Z","updated_at":"2015-09-02T15:38:25Z","closed_at":null,"merged_at":null,"merge_commit_sha":"21b2e8ae04b5f093818fda512b2980dc10efd4c2","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54/commits","review_comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54/comments","review_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/54/comments","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/880f96f8d111ebf3d686038b04c885403bd25538","head":{"label":"mozilla-services:2015.08.donnees-et-signatures-en","ref":"2015.08.donnees-et-signatures-en","sha":"880f96f8d111ebf3d686038b04c885403bd25538","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":34000996,"name":"servicedenuages.fr","full_name":"mozilla-services/servicedenuages.fr","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/servicedenuages.fr","description":"Da french team blog.","fork":false,"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr","forks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/forks","keys_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/teams","hooks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/events","assignees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/tags","blobs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscription","commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/merges","archive_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/downloads","issues_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/releases{/id}","created_at":"2015-04-15T15:07:57Z","updated_at":"2015-08-27T13:07:27Z","pushed_at":"2015-09-02T15:23:21Z","git_url":"git://github.com/mozilla-services/servicedenuages.fr.git","ssh_url":"git@github.com:mozilla-services/servicedenuages.fr.git","clone_url":"https://github.com/mozilla-services/servicedenuages.fr.git","svn_url":"https://github.com/mozilla-services/servicedenuages.fr","homepage":"http://www.servicedenuages.fr","size":6321,"stargazers_count":3,"watchers_count":3,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3,"mirror_url":null,"open_issues_count":6,"forks":3,"open_issues":6,"watchers":3,"default_branch":"master"}},"base":{"label":"mozilla-services:master","ref":"master","sha":"d2c8036ae2c54a98ca5fa12cbd33a1667fabb627","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":34000996,"name":"servicedenuages.fr","full_name":"mozilla-services/servicedenuages.fr","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/servicedenuages.fr","description":"Da french team blog.","fork":false,"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr","forks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/forks","keys_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/teams","hooks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/events","assignees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/tags","blobs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscription","commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/merges","archive_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/downloads","issues_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/releases{/id}","created_at":"2015-04-15T15:07:57Z","updated_at":"2015-08-27T13:07:27Z","pushed_at":"2015-09-02T15:23:21Z","git_url":"git://github.com/mozilla-services/servicedenuages.fr.git","ssh_url":"git@github.com:mozilla-services/servicedenuages.fr.git","clone_url":"https://github.com/mozilla-services/servicedenuages.fr.git","svn_url":"https://github.com/mozilla-services/servicedenuages.fr","homepage":"http://www.servicedenuages.fr","size":6321,"stargazers_count":3,"watchers_count":3,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3,"mirror_url":null,"open_issues_count":6,"forks":3,"open_issues":6,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54"},"html":{"href":"https://github.com/mozilla-services/servicedenuages.fr/pull/54"},"issue":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/54"},"comments":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/54/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/54/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/880f96f8d111ebf3d686038b04c885403bd25538"}}}}