The cryptography package expects an instance of bytes to be sent to its Fernet.encrypt method: https://github.com/pyca/cryptography/blob/master/cryptography/fernet.py#L63

Since json.dumps is being used to serialize the data before encryption, a string is being passed to the cryptography package. In Python 2 strings are also bytes. In Python 3 they are not, so an explicit translation is required.

It appears that doing something like message.encode('utf-8') (if the Python version is 3.x) would make the cryptography package happy.

I've just started recently using this package as part of a Django + Celery setup, and I'm finding having to set KOMBU_FERNET_KEY even when I'm doing something quite unrelated to Kombu (e.g. making Django database migrations) a real pain.

#12 by @diwu1989 looks like it'll solve the issue and looks good to me, but it's been sitting there for over four years with no feedback.

Is there a reason it hasn't been merged in? Can it be?

@iamjem @lambacck @dgouldin could you please push version 0.1.0 to pypi?

(To rephrase @pcraciunoiu from issue #16.)

The current version of kombu-fernet-serializers on pypi is 0.0.5 and has a couple of issues solved by the 0.1.0 release. And most importantly: 0.0.5 does not support Python 3, while 0.1.0 does.

Hi,

I'm getting an error while runnign a flask app in python 3.6.4 with the following config:

    from kombu_fernet.serializers.pickle import MIMETYPE
    CELERY_TASK_SERIALIZER = 'fernet_pickle'
    CELERY_RESULT_SERIALIZER = 'fernet_pickle'
    CELERY_ACCEPT_CONTENT = [MIMETYPE]

Below is the erorr, its looking for unicode which isn't global in python3. Chaning the line to

if isinstance(encoded_message, str):

Solved the issue.

Full error:

11:17:56 web.1   |  [2018-05-25 11:17:56,027: INFO/MainProcess] Received task: car_listing_flask_app.blueprints.general_info.views.wait_and_add_background_task[d8c098d6-3881-4dce-9348-8e898a39464e]  
11:17:56 web.1   |  [2018-05-25 11:17:56,045: ERROR/MainProcess] Pool callback raised exception: DecodeError(NameError("name 'unicode' is not defined",),)
11:17:56 web.1   |  Traceback (most recent call last):
11:17:56 web.1   |    File "/Users/V/Documents/Python/Car_Listing_Project/venv_car_listing_project/lib/python3.6/site-packages/kombu/utils/objects.py", line 42, in __get__
11:17:56 web.1   |      return obj.__dict__[self.__name__]
11:17:56 web.1   |  KeyError: 'chord'
11:17:56 web.1   |  During handling of the above exception, another exception occurred:
11:17:56 web.1   |  Traceback (most recent call last):
11:17:56 web.1   |    File "/Users/V/Documents/Python/Car_Listing_Project/venv_car_listing_project/lib/python3.6/site-packages/kombu/utils/objects.py", line 42, in __get__
11:17:56 web.1   |      return obj.__dict__[self.__name__]
11:17:56 web.1   |  KeyError: '_payload'
11:17:56 web.1   |  During handling of the above exception, another exception occurred:
11:17:56 web.1   |  Traceback (most recent call last):
11:17:56 web.1   |    File "/Users/V/Documents/Python/Car_Listing_Project/venv_car_listing_project/lib/python3.6/site-packages/kombu/serialization.py", line 50, in _reraise_errors
11:17:56 web.1   |      yield
11:17:56 web.1   |    File "/Users/V/Documents/Python/Car_Listing_Project/venv_car_listing_project/lib/python3.6/site-packages/kombu/serialization.py", line 263, in loads
11:17:56 web.1   |      return decode(data)
11:17:56 web.1   |    File "/Users/V/Documents/Python/Car_Listing_Project/venv_car_listing_project/lib/python3.6/site-packages/kombu_fernet/serializers/__init__.py", line 16, in inner
11:17:56 web.1   |      if isinstance(encoded_message, unicode):
11:17:56 web.1   |  NameError: name 'unicode' is not defined

Say that you have a queue which is constantly receiving new jobs. You don't have the opportunity to force a quiescence, yet need to rotate the encryption keys. Rotating the key with jobs in the queue would possibly lead to some tasks being lost.

I am proposing that we make use of an environmental var such as KOMBU_FERNET_KEY_PREVIOUS. In the case that a key needs to be rotated you can then do it like so:

1. Set the value of KOMBU_FERNET_KEY_PREVIOUS to the current value of KOMBU_FERNET_KEY
2. Set the value of KOMBU_FERNET_KEY to the value of the new fernet encryption key.

Within the code, you could try the KOMBU_FERNET_KEY value, and if that raises an exception, try KOMBU_FERNET_KEY_PREVIOUS if it is set.

The name for 'KOMBU_FERNET_KEY_PREVIOUS' can be anything, just named it here to make it obvious. Thoughts?

Hi there,

I'm curious as to why the json serializer doesn't leverage kombu.serialization.json loads and dumps functions and instead uses anyjson.
The pickle serializer leverages kombu.serialization pickle and unpickle as expected.

Thanks