Timezone aware datetimes + remove hack from #209 #300

mikaelarguedas · 2024-05-07T08:13:40Z

This PR (basically a redo of #210) does:

Set timezone to UTC explicitly in all security artifacts
- this allows to remove the -1 day hack from start valid date a day before to account for timezone mismatch #209
- I don't think it fixes any kind of issue and would assume the issue have been fixed on the connext side in version 6
- But I think it's more explicit and doesnt hurt
Make python datetime object timezone-aware, as this will be mandatory in future versions of python and reduces unexpected behaviors

I dont have a connext setup (license plugins etc right now) and the ROS 2 CI machines seem to be UTC so maybe they wont reflect the issue. If a reviewer that is behind UTC and has the right setup can give it a try that'd be awesome

mikaelarguedas · 2024-05-07T09:49:09Z

@marcoag @clalancette is it possible to launch a round of CI for this PR please 🙏

ahcorde · 2024-05-07T10:01:20Z

Linux
Linux-aarch64
Windows

sros2/sros2/_utilities.py

sros2/test/sros2/commands/security/verbs/test_create_enclave.py

mikaelarguedas · 2024-05-07T11:11:30Z

@ruffsl interested in having your feedback on this.

(all info in the description of the PR)

mikaelarguedas · 2024-05-07T11:29:57Z

CI on WIndows is failing because CI is using a lower version of Python than the one defined in REP-2000.
More details at ros-infrastructure/ros2-cookbooks#69

clalancette · 2024-05-07T12:24:39Z

CI on WIndows is failing because CI is using a lower version of Python than the one defined in REP-2000.
More details at ros-infrastructure/ros2-cookbooks#69

I commented over there, but in short, we are not going to be able to update Python. So we'll have to figure out another solution.

codecov · 2024-05-08T14:01:01Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.38%. Comparing base (0b6ac75) to head (03a1e3e).
Report is 10 commits behind head on rolling.

Additional details and impacted files

@@             Coverage Diff             @@
##           rolling     #300      +/-   ##
===========================================
+ Coverage    77.35%   77.38%   +0.03%     
===========================================
  Files           25       25              
  Lines          627      628       +1     
  Branches        66       66              
===========================================
+ Hits           485      486       +1     
  Misses         121      121              
  Partials        21       21

Flag	Coverage Δ
unittests	`77.38% <100.00%> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

mikaelarguedas · 2024-05-08T14:01:20Z

~~@ahcorde @clalancette is it possible to launch CI on that version to see if Windows is happy with it ?~~

mikaelarguedas · 2024-05-08T15:25:10Z

Linux
Linux-aarch64
Windows
Windows debug

Signed-off-by: Mikael Arguedas <[email protected]>

Python 3.8 compatible because windows Signed-off-by: Mikael Arguedas <[email protected]>

Signed-off-by: Mikael Arguedas <[email protected]>

ruffsl · 2024-05-09T01:54:29Z

sros2/sros2/policy/templates/dds/permissions.xsl

-<xsl:param name="not_valid_before" select="'2020-05-01T00:00:00'"/>
-<xsl:param name="not_valid_after" select="'2030-05-01T00:00:00'"/>
+<xsl:param name="not_valid_before" select="'2020-05-01T00:00:00+00:00'"/>
+<xsl:param name="not_valid_after" select="'2030-05-01T00:00:00+00:00'"/>


Do we want to use +00:00 or Z here?

From the OP ticket:

The time zone may be specified as Z (UTC) or (+|-)hh:mm.

Use current time as default start validity time for certs and permissions #211 (comment)

Not sure if this (formatting choice) was the original point of issue here.

Yeah I initially tried this 2754240 but one of the issues is that Python has pretty limited support for it.

The ability to parse a string in that format appeared in Python 3.11.
And even in Python 3.12, the printing in isoformat is not configurable and outputs the +HH:MM.

I guess we can revisit if the testing of this with connext show the issue still exists with version 6.0.1.

ruffsl · 2024-05-09T01:57:46Z

sros2/sros2/keystore/_permission.py

@@ -75,8 +76,15 @@ def create_permission_file(path: pathlib.Path, domain_id, policy_element) -> Non

    cert_path = path.parent.joinpath('cert.pem')
    cert_content = _utilities.load_cert(cert_path)
-    kwargs['not_valid_before'] = etree.XSLT.strparam(cert_content.not_valid_before.isoformat())
-    kwargs['not_valid_after'] = etree.XSLT.strparam(cert_content.not_valid_after.isoformat())
+    # TODO replace "not_valid_before"/"not_valid_after" functions by


Sad to read about that window holding back and blocking the python REP updates, given the Qt release changes. I hope the latest minor release of cryptography is still secure and up-to-date for all platforms. :<

ruffsl · 2024-05-09T02:00:47Z

sros2/sros2/_utilities.py

-            # when extracting it from the permissions file and thinking it's in the future
-            # https://github.com/ros2/ci/pull/436#issuecomment-624874296
-            utcnow - datetime.timedelta(days=1)
+            utcnow


I'm kind of the opinion if it still broken for a DDS vendor by now, then that's more concerning. I've no longer have an active licence, but I could go ask for a renewal to verify this if you'd like.

yeah so its a bit tricky,

the version shipped with the Jazzy binaries fails to run the launcher:

/opt/rti.com/rti_connext_dds-6.0.1/bin/rtilauncher Gtk-Message: 09:06:35.729: Failed to load module "canberra-gtk-module" No RTI workspace was created. Please contact RTI Support (https://support.rti.com)

The only one I saw available on their website is 7.3.0.

And 7.3.0 is not API compatible with 6.0.1 so I cannot launch nodes

I could try to install the rtipkg from commandline but not sure where to download them if not from the rti website or launcher..

Maybe someone at Open Robotics could give this PR a try ? (as osrf has both license and installer backed up)

@clalancette do you know anyone we could reach out for that could test this ?

So there is a larger issue here, how do people install connext with security plugins for any active ROS 2 distro ?

@ahcorde Hey there 👋

The PR I dont have the ability to test myself we were chatting about offline today

sloretz · 2024-05-16T22:29:08Z

@marcoag mind giving this a try with connect? 🧇

mikaelarguedas marked this pull request as ready for review May 7, 2024 09:48

marcoag requested changes May 7, 2024

View reviewed changes

sros2/sros2/_utilities.py Outdated Show resolved Hide resolved

sros2/test/sros2/commands/security/verbs/test_create_enclave.py Outdated Show resolved Hide resolved

mikaelarguedas mentioned this pull request May 7, 2024

Bump Python to 3.12.3 for rolling ros-infrastructure/ros2-cookbooks#69

Closed

mikaelarguedas force-pushed the timezone-aware-datetimes branch from 5006e37 to 1752d32 Compare May 8, 2024 13:23

mikaelarguedas requested a review from marcoag May 8, 2024 14:29

mikaelarguedas mentioned this pull request May 8, 2024

remove deprecated create_key and list_keys verbs #302

Merged

mikaelarguedas added 3 commits May 8, 2024 23:43

mark timezone explicitly in datetime strings

087edef

Signed-off-by: Mikael Arguedas <[email protected]>

use timezone aware datetime, remove -1 day hack in validity

6c5f800

Python 3.8 compatible because windows Signed-off-by: Mikael Arguedas <[email protected]>

missing import

03a1e3e

Signed-off-by: Mikael Arguedas <[email protected]>

mikaelarguedas force-pushed the timezone-aware-datetimes branch from fefd058 to 03a1e3e Compare May 8, 2024 21:43

ruffsl approved these changes May 9, 2024

View reviewed changes

sloretz assigned marcoag May 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Timezone aware datetimes + remove hack from #209 #300

Timezone aware datetimes + remove hack from #209 #300

mikaelarguedas commented May 7, 2024 •

edited

Loading

mikaelarguedas commented May 7, 2024

ahcorde commented May 7, 2024

mikaelarguedas commented May 7, 2024

mikaelarguedas commented May 7, 2024

clalancette commented May 7, 2024

codecov bot commented May 8, 2024 •

edited

Loading

mikaelarguedas commented May 8, 2024 •

edited

Loading

mikaelarguedas commented May 8, 2024 •

edited

Loading

ruffsl May 9, 2024

mikaelarguedas May 9, 2024

ruffsl May 9, 2024

ruffsl May 9, 2024

mikaelarguedas May 9, 2024

mikaelarguedas Jun 20, 2024

sloretz commented May 16, 2024

Timezone aware datetimes + remove hack from #209 #300

Are you sure you want to change the base?

Timezone aware datetimes + remove hack from #209 #300

Conversation

mikaelarguedas commented May 7, 2024 • edited Loading

mikaelarguedas commented May 7, 2024

ahcorde commented May 7, 2024

mikaelarguedas commented May 7, 2024

mikaelarguedas commented May 7, 2024

clalancette commented May 7, 2024

codecov bot commented May 8, 2024 • edited Loading

Codecov Report

mikaelarguedas commented May 8, 2024 • edited Loading

mikaelarguedas commented May 8, 2024 • edited Loading

ruffsl May 9, 2024

Choose a reason for hiding this comment

mikaelarguedas May 9, 2024

Choose a reason for hiding this comment

ruffsl May 9, 2024

Choose a reason for hiding this comment

ruffsl May 9, 2024

Choose a reason for hiding this comment

mikaelarguedas May 9, 2024

Choose a reason for hiding this comment

mikaelarguedas Jun 20, 2024

Choose a reason for hiding this comment

sloretz commented May 16, 2024

mikaelarguedas commented May 7, 2024 •

edited

Loading

codecov bot commented May 8, 2024 •

edited

Loading

mikaelarguedas commented May 8, 2024 •

edited

Loading

mikaelarguedas commented May 8, 2024 •

edited

Loading