[IPython-dev] "Unsigned Message" error in a forking kernel manager

[Jason Grout]

On 5/29/12 3:36 PM, Fernando Perez wrote:
> Hi Jason,
>
> On Tue, May 29, 2012 at 1:08 PM, Jason Grout
> <jason-sage at creativetrax.com>  wrote:
>> Is there a key or something that I should be
>> doing to "sign" my messages?  If someone could give this a quick
>> look-over and see if there are any obvious problems, that would be great.
>
> Yes, kernels sign their messages, to make it harder for other
> processes in the same machine to send them arbitrary commands
> (remember, our protocol is openly explained, so without this any
> ipython process would basically be a user shell listening on a  port
> for the first clown to say 'rm -rf $HOME').  See the code in
> zmq/session.py around line 423 for the signing, and the key is a
> member of the Session class which you can change/reassign (which will
> trigger a recomputation of the auth field used to sign the messages,
> see line 298).

Thanks.  I remember being a part of the original authentication 
conversation last year (we implemented the same thing for the sage cell 
server).  The question is: how do I get the key the kernel expects 
messages to be signed with?  Should I be initializing the kernel with 
that?  If so, how should I initialize a kernel to use a specific key for 
its sessions?  It seems that the initializing code is in the KernelApp 
class in kernelapp.py.  If I understand traits correctly, the various 
*_port traits can be initialized by passing in keyword arguments into 
the constructor, and that is how the ports are being correctly 
initialized in my gist.  However, the key for the session seems to be 
only initialized if I read a connection file (in load_connection_file). 
  So a more specific question is: can I initialize a session key using 
embed_kernel using just the arguments to embed_kernel?  Or equivalently, 
using just initialization arguments to KernelApp, can I set the kernel's 
session key?

Thanks,

Jason