Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      story #10726 encrypt Gerrit credentials before storing them in the DB
    Actions
    Summary
    Empty
    encrypt Gerrit credentials before storing them in the DB
    Gerrit credentials are still reasonably safe if the database server is compromised but not the Tuleap server.

    As site admin, in the Gerrit section of the Git plugin administration:

    • A warning is displayed on Gerrit servers whose password is stored (or has been stored) in cleartext

    Then, at Gerrit server creation or update only the encrypted password is stored and the cleartext password is nulled if existing.

    When a Gerrit server is used, the password is decrypted before usage

     

    It leverages the existing Tuleap cryptography API.

    Empty
    Empty
    Status
    Empty
    Ready (stalled)
    Development
    • [ ] Does it involves User Interface? 
    • [ ] Are there any mockups?
    • [ ] Are permissions checked?
    • [ ] Does it need Javascript development?
    • [ ] Does it need a forge upgrade bucket?
    • [ ] Does it need to execute things in system events?
    • [ ] Does it impact project creation (templates)?
    • [ ] Is it exploratory?
    Empty
    Details
    #10726
    Thomas Gerbet (tgerbet)
    2017-10-04 13:25
    2017-10-04 13:07
    10962

    References
    Artifact links
    Empty
    References list is empty
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2017-10-04 13:25
    • Acceptance criteria
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Permissions set to
    • Category set to