Hi all,
This patch should fix
https://bugzilla.redhat.com/show_bug.cgi?id=760592 (with a
moderately-incorrect title), in which aeolus-image-rubygem generates invalid OAuth
requests when speaking to iwhd. Specifically, the oauth_body_hash is incorrect.
Greg Blomquist fixed a related issue in Audrey, determining that RestClient is not
including the entire body when signing requests and just using the OAuth gem directly to
make requests. (See
https://bugzilla.redhat.com/show_bug.cgi?id=760377 for that one.) This
patch implements a similar approach for aeolus-image-rubygem.
Note that, today, iwhd is not verifying this value;
https://www.aeolusproject.org/redmine/issues/2606 exists to implement that feature. The
bad news is that this means this fix is mostly academic until that patch is implemented.
The good news is that it means we can safely implement this patch now without breaking
reverse compatibility.
I verified that the oauth_body_hash parameter was changed by using Wireshark with a
"tcp.port == 9090" filter, for what it's worth. The POST generated by
fetching an image has a body of "op=parts", which should generate the hashes
seen in Redmine 2606, linked above.
-- Matt