summaryrefslogtreecommitdiff
path: root/config/settings.rb
diff options
context:
space:
mode:
authorStan Hu <stanhu@gmail.com>2018-06-01 13:44:16 -0700
committerStan Hu <stanhu@gmail.com>2018-06-01 13:49:22 -0700
commit78d78ad1991f0a27b8ff79614d09f85909d20ed1 (patch)
treeb6bd17f78f714d9882d3b1dc4c81b5dfc0d0d7a9 /config/settings.rb
parent2de002b3db1bc199755f8be212fa8804fcb80905 (diff)
downloadgitlab-ce-78d78ad1991f0a27b8ff79614d09f85909d20ed1.tar.gz
Add comment about the need for truncating keys in Ruby 2.4sh-add-ruby-2.4-comment
[ci skip]
Diffstat (limited to 'config/settings.rb')
-rw-r--r--config/settings.rb7
1 files changed, 7 insertions, 0 deletions
diff --git a/config/settings.rb b/config/settings.rb
index 4aa903109ea..58f38d103ea 100644
--- a/config/settings.rb
+++ b/config/settings.rb
@@ -85,7 +85,14 @@ class Settings < Settingslogic
File.expand_path(path, Rails.root)
end
+ # Returns a 256-bit key for attr_encrypted
def attr_encrypted_db_key_base
+ # Ruby 2.4+ requires passing in the exact required length for OpenSSL keys
+ # (https://github.com/ruby/ruby/commit/ce635262f53b760284d56bb1027baebaaec175d1).
+ # Previous versions quietly truncated the input.
+ #
+ # The default mode for the attr_encrypted gem is to use a 256-bit key.
+ # We truncate the 128-byte string to 32 bytes.
Gitlab::Application.secrets.db_key_base[0..31]
end