cloud pull --encrypt leaves the project without its key path and encrypts referenced libraries

オープン
  • 何か問題がありますか？
#688 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 3 日以内に返信

@Amadeus-22 がすでに取り組んでいます。

2026年10月30日 から。

  • #689 @Amadeus-22 による — オープン

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
25/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
python
領域
cli

調査の方向性

Start with PullManager._pull_project and pull_projects, then compare the encryption-key handling with encrypt.py and decrypt.py; the issue also points to push_manager.py for how associated libraries are handled. Check the relevant tests for pull encryption behavior. Done means encrypt and decrypt keep the project config consistent, and pulled libraries are not encrypted; a linked pull request is already open.

索引モデルが issue の本文から書いたものです。

説明

Expected Behavior

lean cloud pull --encrypt --key <key> leaves the local project in the same state as lean encrypt --key <key>: files encrypted, encrypted: true and encryption-key-path in the project config, so a later lean cloud push keeps the cloud project encrypted. --decrypt removes encryption-key-path, like lean decrypt. Referenced libraries are pulled as they are in the cloud, the same way lean cloud push --encrypt already leaves them unencrypted.

Actual Behavior
  1. PullManager._pull_project sets encrypted but never sets or removes encryption-key-path. PushManager._push_project only re-encrypts when that path is present, so a plain push after pull --encrypt uploads the encrypted file contents as source code with encryption_key='':
$ lean cloud pull --project "Python Project" --encrypt --key key.txt   # cloud project was not encrypted
$ lean cloud push --project "Python Project"
# projects/update is called with main.py = 'iFdKTV...==' (ciphertext) and encryption_key = ''

The cloud project ends up unencrypted, with ciphertext as its code. After pull --decrypt, the stale encryption-key-path stays in the config.

  1. PullManager.pull_projects passes the encryption action and key to every pulled project, including the libraries it adds. pull --project P --encrypt therefore encrypts the shared library Library/L on disk and marks it encrypted: true. The push side deliberately skips associated libraries (push_manager.py, "we don't encrypt those"), so the two commands disagree.
Potential Solution

In _pull_project, set encryption-key-path on encrypt and delete it on decrypt, as encrypt.py/decrypt.py do. In pull_projects, apply the encryption action only to the projects that were asked for, not to the libraries added afterwards. I have a PR ready with the fix and tests (fail on master, pass with the fix).

Reproducing the Problem

Run the two commands above on an unencrypted cloud project with a registered key. For the library case, use a project that references a library and check Library/<name>/main.py after the pull.

System Information

lean-cli master at 1873571, Linux.

Checklist
  • I have completely filled out this template
  • I have confirmed that this issue exists on the current master branch
  • I have confirmed that this is not a duplicate issue by searching issues
主要言語
Python
スター
329
フォーク
169
平均マージ
4日 2時間
マージ済み PR（30日）
11

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

QuantConnect/lean-cli のほかの issue

QuantConnect/lean-cli の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。