cloud pull --encrypt leaves the project without its key path and encrypts referenced libraries

未关闭
  • 哪里不对？
#688 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 6 天内回复

@Amadeus-22 已经在做这个了。

开始于 2026年10月30日。

  • #689 来自 @Amadeus-22 —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
停滞
技术栈
python
领域
cli

调研方向

Start with PullManager._pull_project and pull_projects, then compare the encryption-key handling with encrypt.py and decrypt.py; the issue also points to push_manager.py for how associated libraries are handled. Check the relevant tests for pull encryption behavior. Done means encrypt and decrypt keep the project config consistent, and pulled libraries are not encrypted; a linked pull request is already open.

由索引模型根据 Issue 内容生成。

描述

Expected Behavior

lean cloud pull --encrypt --key <key> leaves the local project in the same state as lean encrypt --key <key>: files encrypted, encrypted: true and encryption-key-path in the project config, so a later lean cloud push keeps the cloud project encrypted. --decrypt removes encryption-key-path, like lean decrypt. Referenced libraries are pulled as they are in the cloud, the same way lean cloud push --encrypt already leaves them unencrypted.

Actual Behavior
  1. PullManager._pull_project sets encrypted but never sets or removes encryption-key-path. PushManager._push_project only re-encrypts when that path is present, so a plain push after pull --encrypt uploads the encrypted file contents as source code with encryption_key='':
$ lean cloud pull --project "Python Project" --encrypt --key key.txt   # cloud project was not encrypted
$ lean cloud push --project "Python Project"
# projects/update is called with main.py = 'iFdKTV...==' (ciphertext) and encryption_key = ''

The cloud project ends up unencrypted, with ciphertext as its code. After pull --decrypt, the stale encryption-key-path stays in the config.

  1. PullManager.pull_projects passes the encryption action and key to every pulled project, including the libraries it adds. pull --project P --encrypt therefore encrypts the shared library Library/L on disk and marks it encrypted: true. The push side deliberately skips associated libraries (push_manager.py, "we don't encrypt those"), so the two commands disagree.
Potential Solution

In _pull_project, set encryption-key-path on encrypt and delete it on decrypt, as encrypt.py/decrypt.py do. In pull_projects, apply the encryption action only to the projects that were asked for, not to the libraries added afterwards. I have a PR ready with the fix and tests (fail on master, pass with the fix).

Reproducing the Problem

Run the two commands above on an unencrypted cloud project with a registered key. For the library case, use a project that references a library and check Library/<name>/main.py after the pull.

System Information

lean-cli master at 1873571, Linux.

Checklist
  • I have completely filled out this template
  • I have confirmed that this issue exists on the current master branch
  • I have confirmed that this is not a duplicate issue by searching issues
主要语言
Python
星标
329
派生
169
平均合并
4 天 18 小时
30 天内合并 PR
9

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

QuantConnect/lean-cli 的其他 Issue

查看 QuantConnect/lean-cli 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。