Introduction of core functionality and tests #1

mattsb42-aws · 2018-03-07T01:55:40Z

This is the core functionality required for the client to work, including all necessary configuration structures, serialization/deserialization, and cryptographic components.

The highest level interface currently provided in this codebase is found in dynamodb_encryption_sdk.encrypted.item, which contains found functions that will encrypt DynamoDB items and Python dictionaries.

All operations are performed on DynamoDB JSON items. The Python dictionary functions simply use the transformers provided in boto3.dynamodb.types to convert back and forth.

Notes

The base namespace is up for discussion. I don't love dynamodb_encryption_sdk, but it seemed as good a starting point as any.
The test vectors used in the acceptance tests were extracted from TransformerHolisticTests
I'm working on building more tests to hit the edge cases not touched yet by the current tests (currently at 87% coverage).
I'm also working on the higher level interfaces that will provide drop-in replacements for boto3 DynamoDB client, resources, and Table classes.

Places wanting specific attention

@SalusaSecondus : Please pay special attention to the cryptographic materials providers (material_providers), cryptographic materials (materials), and delegated keys (delegated_keys). I'm pretty sure these are aligned with the intended concepts now, but I'd like your eyes on those.
- @david-koenig : It would be helpful to have someone with little or no background with the existing DDB encryption client look over these as well, to get an outside perspective on them.
@bdonlan : The JCE translation layer (internal.crypto.jce_bridge and delegated_keys.jce) should provide close analogues to the JCE interfaces because we have to work with JCE StandardNames and transformations as the core primitives of configuration in the material description. Having someone who is much more familiar with the JCE structure than I would be very helpful to validate that the way the structures are built makes sense.
- @SalusaSecondus : As our other resident JCE expert, it would be good to have you look at this part as well.
@david-koenig : Other areas of interest are the non-JCE crypto (internal.crypto) and formatting (internal.formatting) components.

…x environment

bdonlan

High level review of API structure around the JCE emulation only.

bdonlan · 2018-03-08T22:46:20Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

+
+@attr.s(hash=False)
+class JceNameLocalDelegatedKey(DelegatedKey):
+    """Delegated key that JCE StandardName algorithm values to determine behavior.


I can't parse this sentence.

That should be "Delegated key that uses JCE StandardName algorithm values to determine behavior."

fixed

bdonlan · 2018-03-08T23:15:25Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

+        :returns: Encrypted ciphertext
+        :rtype: bytes
+        """
+        encryptor = encryption.JavaCipher.from_transformation(algorithm)


should this be cached?

The transformation won't necessarily be consistent for all calls to this method across the life of the delegated key instance, so it should not be retained permanently. As for caching JavaCipher instances based on the transformation, I haven't run performance tests, but from past experience I don't think that the JavaCipher class constructor will affect performance enough to justify the additional complexity that caching would add.

bdonlan · 2018-03-08T23:18:14Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

+
+    @property
+    def allowed_for_raw_materials(self):
+        """Only ``JceNameLocalDelegatedKey`` backed by ``JavaSymmetricEncryptionAlgorithm``


If this is the first class you're looking at, this is a lot of gibberish. Why not just say "Returns true if this key can be used with raw cryptographic materials (i.e. random bytes), rather than a structured key (e.g. an EC or RSA key)." or similar?

I'll add reference links to the mentioned classes, but it's more complex than that . RawCryptographicMaterials is a specific class in this client[1] that encrypts attributes directly with a delegated key. This is a pattern that we want to heavily discourage, but need to support for legacy compatibility, so the default behavior of all delegated keys is to not allow this.

[1] https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-f4f15b02a6ad66eb2f84473ea538d731R1

bdonlan · 2018-03-08T23:28:52Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/authentication.py

+    # TODO: should we support these?
+    # HmacMD5
+    # HmacSHA1
+    HMAC_SHA224 = ('HmacSHA224', hmac.HMAC, hashes.SHA224)


... does this somehow instantiate the containing class?

As discussed offline: https://docs.python.org/3/library/enum.html

bdonlan · 2018-03-08T23:29:11Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/authentication.py

+        self.java_name = algorithm_name
+        self.algorithm_type = algorithm_type
+        self.hash_type = hash_type
+        self.register()


Having globally visible side-effects in a constructor seems a bit surprising and dangerous.

Why not just have a list or dict of supported algorithms in jce_bridge/__init__.py? This is analogous to how JCE does algorithm registration, and means all supported algorithms are in one place for easy inspection.

Enum constructors are run on first module import, so this will only run once, and will run before any of these object can be accessed. The registration adds them to the lookup table of the first class up in the class hierarchy that defines the class attribute __rlookup__. In this case (JavaMac), this is JavaAuthenticator.

This is the same as saying self.__rlookup__[self.java_name] = self, just less to screw up each time it is written and clearer about what it is doing. Having a static list of values would (IMO) just introduce another set of values to maintain and another opportunity for drift.

https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-e39db2a6f8774aaa1f85411c09cdfde1R25

I'm more concerned about the possibility that something, somewhere else will construct an instance of e.g. JavaMac and have it silently be registered systemwide. Why can't we just put it all in one place as:

macAlgos = { 'HmacSHA256': JavaMac(hmac.HMAC, hashes.SHA256), # ... }

bdonlan · 2018-03-08T23:39:42Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/primitives.py

+        )
+
+
+class JavaMode(JavaBridge):


So all of these components seem to be registered in the same namespace - what happens if I start asking for strange things like "AES/PKCS5Padding/GCM" or "AES/NoPadding/PKCS5Padding"?

No; they are registered to the lowest class in the hierarchy that defines __rlookup__. So in the case of JavaMode, all of its members will register with JavaMode and not affect any other JavaBridge classes.

JavaMode only knows about JCE Cipher Algorithm Mode names

JavaPadding only knows about JCE Cipher Algorithm Padding names

JavaEncryptionAlgorithm only knows about JCE Cipher Algorithm names

If you want to load an encryption transformation, you want JavaCipher.

https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-9a2c578c4e4362f654cfa62698eda1a0R22

bdonlan · 2018-03-08T23:41:52Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

+        # First try for encryption ciphers
+        # https://docs.oracle.com/javase/8/docs/api/javax/crypto/Cipher.html
+        try:
+            key_transformer = primitives.JavaEncryptionAlgorithm.from_name(self.algorithm)


does this handle compound algorithms (e.g. "AES/GCM/NoPadding") or just raw algorithms ("AES")?

JceNameLocalDelegatedKey does not know anything about mode or padding, only algorithm. It only accepts algorithm names. This is intentional, because the mode and padding can potentially change for operations over the life of a delegated key instance.

bdonlan · 2018-03-08T23:45:48Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

+        """
+        return self.__key_handler_class is primitives.JavaSymmetricEncryptionAlgorithm
+
+    def _encrypt(self, algorithm, plaintext, additional_associated_data=None):


The idea of supporting all possible operations on the same class makes me a bit nervous about attacks like this: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Where is the algorithm string and key coming from?

I don't disagree, and this is one of the things I would like to change with v2.0 of the spec. FWIW, this specific delegated key class explicitly only enables those APIs that the loaded key is likely to support[1][2] (encrypt/decrypt/wrap/unwrap for encryption keys, sign/verify for mac/signature keys).

The algorithm identifier comes from the material description[3].

The key could be anything or come from anywhere: only the cryptographic materials provider knows.

[1] https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-b899d421fd3daa12d0fb4551745d310dR117
[2] https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-b899d421fd3daa12d0fb4551745d310dR130
[3] https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-04101d472c1b1ffa6f7f73dbb6e16bb7R53

david-koenig

Reviewed authentication code and serialization so far.

david-koenig · 2018-03-08T20:19:05Z

src/dynamodb_encryption_sdk/internal/crypto/authentication.py

+        data='TABLE>{}<TABLE'.format(table_name).encode('utf-8')
+    ))
+    for key in sorted(item.keys()):
+        action = attribute_actions.action(key)


Do we know that attribute_actions.action will always have the same full list of keys as item, or do we have to handle the case of a KeyError here?

This is handled by the AttributeActions class[1]. AttributeActions know two things: the default action and any override actions that have been requested for a specific attribute name. The AttributeActions().action(name) method returns the override action if defined for the requested attribute and otherwise returns the default action.

[1] https://github.com/awslabs/aws-dynamodb-encryption-python/pull/1/files#diff-5f2e39fbf77e7ae30c8e7113f38d6cf2R73

david-koenig · 2018-03-08T23:02:45Z

src/dynamodb_encryption_sdk/internal/crypto/authentication.py

+    )
+
+
+def _string_to_sign(item, table_name, attribute_actions):


It appears to me that the string to sign is in accordance with AwsCryptoToolsSpecs section on item signing

david-koenig · 2018-03-08T23:59:20Z

src/dynamodb_encryption_sdk/internal/formatting/serialize/attribute.py

@@ -0,0 +1,251 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


This looks reasonable.

david-koenig · 2018-03-09T00:01:36Z

test/vectors/serialize_attribute.json

@@ -0,0 +1,220 @@
+[


Looks good, recommend using exact same full set of test vectors for both Java and Python implementations.

…king

…rences

david-koenig

comments on material_providers/aws_kms.py only

david-koenig · 2018-03-19T19:14:29Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+    .. note::
+
+        This cryptographic materials provider makes one AWS KMS API call each time encryption
+        or decryption materials are requested. This means that one request will be made for


typo: remove "for"

the way that you fixed this is fine too.

david-koenig · 2018-03-19T19:31:25Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+        validator=attr.validators.instance_of(botocore.session.Session),
+        default=attr.Factory(botocore.session.Session)
+    )
+    _grant_tokens = attr.ib(


For attributes that are tuples or dicts, does it make sense to do a deeper validation that the elements of the tuple or dict have the right format? It looks like from the attrs documentation it is easy enough to write your own validator functions. ( https://attrs.readthedocs.io/en/stable/examples.html#decorator )

Not blocking on this comment. I consider it going above and beyond. But the more we can do to help users catch errors at class creation time, the more user-friendly we make the library.

That's a good idea. I forget when they added that functionality, but we're already requiring 17.4.0 (...which, checking, it looks like I forgot to update the requirements.txt, so I'll do that), which I'm fairly confident is newer than the decorators.

david-koenig · 2018-03-19T21:11:48Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+        )
+        return hkdf.derive(initial_material)
+
+    def _encryption_key(self, initial_material, key_info):


If I am reading correctly, _encryption_key and _mac_key methods of this class are identical except for the final argument given to the self._hkdf() method call. I would consider making a single underlying method to avoid the repetition in the code.

Fair point. Consolidating.

…erialsProvider

david-koenig

Follow up review on material_providers/aws_kms.py

This file passes my review now. Optional extra changes are mentioned in the comments.

david-koenig · 2018-03-20T18:27:08Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+    .. note::
+
+        This cryptographic materials provider makes one AWS KMS API call each time encryption
+        or decryption materials are requested. This means that one request will be made for


the way that you fixed this is fine too.

david-koenig · 2018-03-20T18:37:28Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+    )
+    _grant_tokens = attr.ib(default=attr.Factory(tuple))
+
+    @_grant_tokens.validator


If this is the only place we need to do such validations, this is fine, but it strikes me that checking whether something is a tuple of strings or a string->string dictionary is a common enough kind of validation that I might consider moving the validator functions that do that to their own module. Then you can simply list them as callables with the validator keyword on the attr.ib command, per https://attrs.readthedocs.io/en/stable/examples.html#callables . (This is closer to how the code was written before, but you don't need to use the attr.validators pre-made callables; you can just use your own.) The regional clients validator is very specific (a string->botocore client dict) so I would probably leave that inline with the decorator as you've done so here.

Again, not blocking on this comment.

See, this is why it's good to get new eyes on things. That has significantly changed since the last time I looked at it, and is much simpler to use now. I had actually just finished chopping this logic off into a stand-alone module (in a commit currently stacked on top of the high-level client work I've been doing), but tweaking it to work as a straightforward callable would definitely be worthwhile.

david-koenig

Looked at the materials, material providers, and delegated keys sections of the code. Code is very good and I have no suggestions for improvement but I tried to put comments at the top of each file to indicate which ones I read. My only questions are for my own understanding only, not for any needed code changes.

david-koenig · 2018-03-20T21:39:54Z

src/dynamodb_encryption_sdk/materials/__init__.py

@@ -0,0 +1,114 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:40:07Z

src/dynamodb_encryption_sdk/materials/raw.py

@@ -0,0 +1,150 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:40:45Z

src/dynamodb_encryption_sdk/materials/wrapped.py

@@ -0,0 +1,202 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:41:43Z

src/dynamodb_encryption_sdk/delegated_keys/__init__.py

@@ -0,0 +1,147 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:42:02Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

@@ -0,0 +1,281 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:51:25Z

src/dynamodb_encryption_sdk/delegated_keys/__init__.py

@@ -0,0 +1,147 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:51:37Z

src/dynamodb_encryption_sdk/delegated_keys/jce.py

@@ -0,0 +1,281 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:52:00Z

src/dynamodb_encryption_sdk/materials/__init__.py

@@ -0,0 +1,114 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:52:11Z

src/dynamodb_encryption_sdk/materials/raw.py

@@ -0,0 +1,150 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


david-koenig · 2018-03-20T21:52:25Z

src/dynamodb_encryption_sdk/materials/wrapped.py

@@ -0,0 +1,202 @@
+# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.


SalusaSecondus · 2018-03-21T17:49:23Z

src/dynamodb_encryption_sdk/delegated_keys/__init__.py

+        """
+        self._raise_not_implemented('encrypt')
+
+    def decrypt(self, algorithm, ciphertext, additional_associated_data=None):


For both decrypt and encrypt, please also take in the fieldName as a parameter. (It can be ignored by existing implementations.) This is something I deeply regret not having in Java and will need to add to support some current feature requests.

SalusaSecondus · 2018-03-21T18:06:31Z

src/dynamodb_encryption_sdk/encrypted/item.py

+    """
+    try:
+        signature_attribute = item.pop(ReservedAttributes.SIGNATURE.value)
+    except KeyError:


If no signature is found, then there is no valid signature and it must be rejected just as if a signature were present but incorrect. Otherwise, someone can silently inject plaintext data (without a signature) into a datastore and the application will never notice.

The intention here was to support partially migrated data in a table and/or use with an unencrypted/unsigned table. I thought I remembered seeing the Java client have similar behavior somewhere. Not providing some way to support this behavior seems to me like an extremely sharp edge...

This behavior's existence is also extremely sharp. It is purposefully not exposed in Java due to the risk it poses to users. I think that a migration story may need to be in a different (higher-level) object.

Ah; I see what I was remembering. The Java client skips the item if no attribute flags are set[1]. I must have crossed wires at some point and read that as "if the item wasn't encrypted/signed" rather than "if we are configured to ignore this item".

[1] https://github.com/awslabs/aws-dynamodb-encryption-java/blob/master/src/main/java/com/amazonaws/services/dynamodbv2/datamodeling/encryption/DynamoDBEncryptor.java#L225-L227

SalusaSecondus · 2018-03-21T19:17:46Z

src/dynamodb_encryption_sdk/internal/crypto/encryption.py

+    :rtype: dict
+    """
+    serialized_attribute = serialize_attribute(attribute)
+    encrypted_attribute = encryption_key.encrypt(


Remember that here we need to also pass in the fieldName.

SalusaSecondus · 2018-03-21T19:17:54Z

src/dynamodb_encryption_sdk/internal/crypto/encryption.py

+    :rtype: dict
+    """
+    encrypted_attribute = attribute[Tag.BINARY.dynamodb_tag]
+    decrypted_attribute = decryption_key.decrypt(


Remember that here we need to also pass in the fieldName.

SalusaSecondus · 2018-03-21T19:26:04Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/encryption.py

+        """
+        # TODO: I'm pretty sure these are sane defaults, but verify with someone more familiar with JCE.
+        if cipher_transformation == 'AESWrap':
+            return cls.from_transformation('AES/GCM/NoPadding')


AESWrap is the actual name and it doesn't correspond with GCM

This was a weird sharp edge that I'm not really comfortable with. Java defines AESWrap as a Cipher transformation, but it doesn't actually make a Cipher, and I was trying to map AESWrap to something that would provide similar characteristics without having to define a custom mode that doesn't actually exist in JCE names to try and emulate the behavior of AESWrap. Maybe AES/ECB/NoPadding would be a better mapping?

Let's talk in person to straighten this out. I don't understand the issue here.

SalusaSecondus · 2018-03-21T19:31:08Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/primitives.py

+JAVA_PADDING = {
+    'NoPadding': SimplePadding('NoPadding', _NoPadding),
+    'PKCS1Padding': SimplePadding('PKCS1Padding', asymmetric_padding.PKCS1v15),
+    'PKCS5Padding': BlockSizePadding('PKCS5Padding', symmetric_padding.PKCS7),


Please add a comment explaining why "PKCS5" when it really is PKCS7

SalusaSecondus · 2018-03-21T19:31:44Z

src/dynamodb_encryption_sdk/internal/crypto/jce_bridge/primitives.py

+    'NoPadding': SimplePadding('NoPadding', _NoPadding),
+    'PKCS1Padding': SimplePadding('PKCS1Padding', asymmetric_padding.PKCS1v15),
+    'PKCS5Padding': BlockSizePadding('PKCS5Padding', symmetric_padding.PKCS7),
+    'OAEPWithSHA-1AndMGF1Padding': OaepPadding(


Please add another comment here warning about Java's idiosyncrasy with the MGF hash function.

SalusaSecondus · 2018-03-21T19:41:22Z

src/dynamodb_encryption_sdk/internal/formatting/deserialize/__init__.py

+    :returns: Decoded tag
+    :rtype: bytes
+    """
+    (_, tag) = unpack_value('>cc', stream)


Remember, we've defined the first byte to be RESERVED and not part of the tag. So decode this as two 1 byte values and ensure the first is zero.

SalusaSecondus · 2018-03-21T19:49:11Z

src/dynamodb_encryption_sdk/material_providers/aws_kms.py

+        attribute_type, attribute_value = list(attribute.items())[0]
+        if attribute_type == 'B':
+            return base64.b64encode(attribute_value.value)
+        return attribute_value


What if attribute_type isn't 'S'? I think you can reject it.

…rimitives are requested from JavaCipher

…on/decryption path

…ibute and fail if actions should be taken on decrypt but no signature is found

mattsb42-aws added 14 commits March 6, 2018 16:40

initial package setup

1d3c1bc

core identifiers, structures, and helpers

144fd6b

attribute serialization and deserialization

828086f

material description serialization/deserialization

e25e397

core attribute encryption/decryption and item signing/verification logic

79d4f9f

core item encryption/decryption logic

9962be2

JCE bridge

ad56594

JCE delegated key

f543902

raw cryptographic materials

00b1a96

static cryptographic materials provider

9cbba7e

wrapped cryptographic materials and provider

57bdea2

AWS KMS cryptographic materials provider

8a33daa

cross compatibility test vectors and acceptance tests

5967b76

initial draft of MyPy types describing DynamoDB items/attributes

3ded972

mattsb42-aws requested review from bdonlan, praus, SalusaSecondus and david-koenig March 7, 2018 01:55

removing unused requirements and moving typing requirement to mypy to…

db761c1

…x environment

bdonlan reviewed Mar 8, 2018

View reviewed changes

david-koenig reviewed Mar 9, 2018

View reviewed changes

mattsb42-aws added 3 commits March 8, 2018 16:11

moving typing imports out of the required import path

6970860

Python 2 requires both lt and gt to be defined for full equality chec…

1c8d86e

…king

converting JCE bridge structures from registered enums to static refe…

33074a1

…rences

david-koenig reviewed Mar 19, 2018

View reviewed changes

mattsb42-aws added 3 commits March 19, 2018 16:26

adding deep validators for AwsKmsCryptographicMaterialsProvider

ba36159

consolidating encryption/mac key generation in AwsKmsCryptographicMat…

c2c1084

…erialsProvider

adding moto test dependency

73fc257

david-koenig reviewed Mar 20, 2018

View reviewed changes

SalusaSecondus suggested changes Mar 21, 2018

View reviewed changes

mattsb42-aws added 8 commits March 21, 2018 15:11

add better error handling if invalid JCE transformations or unknown p…

ce7808a

…rimitives are requested from JavaCipher

add comments explaining Java padding behavior and names

70e9d2c

add attribute name to delegated key encrypt/decrypt and item encrypti…

f347154

…on/decryption path

explicitely require that the reserved null byte in the tag is null

42f5c22

correctly fully ignore items when no action will be taken on any attr…

e6ec425

…ibute and fail if actions should be taken on decrypt but no signature is found

do not allow non-string values in KMS encryption context

10c546b

isolate KeyError catch to only lookup of algorithm name

8f46cee

properly handle AESWrap as an algorithm name and Cipher name

e9cb3e8

SalusaSecondus approved these changes Mar 23, 2018

View reviewed changes

mattsb42-aws merged commit 131b251 into aws:master Mar 23, 2018

mattsb42-aws deleted the core-functionality branch March 23, 2018 20:54

mattsb42-aws mentioned this pull request Mar 26, 2018

High level helpers #3

Closed

		@@ -0,0 +1,251 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,114 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,150 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,202 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,147 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

		@@ -0,0 +1,281 @@
		# Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Introduction of core functionality and tests #1

Introduction of core functionality and tests #1

Uh oh!

Conversation

mattsb42-aws commented Mar 7, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes

Places wanting specific attention

Uh oh!

bdonlan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattsb42-aws Mar 9, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

david-koenig left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

david-koenig left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

david-koenig left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

mattsb42-aws commented Mar 7, 2018 •

edited

Loading

mattsb42-aws Mar 9, 2018 •

edited

Loading