fix(ci): restore merged main static gates (#6609)

crates/ecstore/src/object_api/mod.rs

@@ -77,6 +77,7 @@ pub(crate) fn has_encrypted_part_layout_marker(metadata: &HashMap<String, String
 }
 
 pub(crate) fn legacy_encrypted_range_seek_enabled() -> bool {
+    // RUSTFS_COMPAT_TODO(backlog-1316): keep the rolling-upgrade kill switch. Remove after the minimum supported release uses the marker protocol.
     // On by default (backlog-1316 Phase A): every misfit direction falls back to the
     // conservative full read — MPUs created without a candidate marker, completions
     // that cannot revalidate the candidate against the data_dir under the uploadId

crates/kms/src/config_secret.rs

@@ -79,7 +79,13 @@ const SECRET_FIELDS: &[SecretField] = &[
         label: "kms.local.master_key",
     },
     SecretField {
-        segments: &[&["backend_config"], &["VaultKV2", "Vault"], &["auth_method"], &["Token"], &["token"]],
+        segments: &[
+            &["backend_config"],
+            &["VaultKV2", "Vault"],
+            &["auth_method"],
+            &["Token"],
+            &["token"],
+        ],
         label: "kms.vault.token",
     },
     SecretField {
@@ -93,7 +99,13 @@ const SECRET_FIELDS: &[SecretField] = &[
         label: "kms.vault.approle.secret_id",
     },
     SecretField {
-        segments: &[&["backend_config"], &["VaultTransit"], &["auth_method"], &["Token"], &["token"]],
+        segments: &[
+            &["backend_config"],
+            &["VaultTransit"],
+            &["auth_method"],
+            &["Token"],
+            &["token"],
+        ],
         label: "kms.vault_transit.token",
     },
     SecretField {
@@ -279,9 +291,7 @@ fn open_value(label: &str, sealed: &str, secret: &str) -> Result<String> {
     let encoded = sealed
         .strip_prefix(SEALED_VALUE_PREFIX)
         .expect("caller checks the sealed prefix");
-    let payload = BASE64_STANDARD
+    let payload = BASE64_STANDARD.decode(encoded).map_err(|_| sealed_value_unreadable(label))?;
-        .decode(encoded)
-        .map_err(|_| sealed_value_unreadable(label))?;
     if payload.len() <= LOCAL_KMS_MASTER_KEY_SALT_LEN + NONCE_LEN {
         return Err(sealed_value_unreadable(label));
     }

rustfs/src/admin/handlers/kms_dynamic.rs

@@ -1330,7 +1330,9 @@ mod tests {
         rustfs_kms::KmsConfig {
             backend: rustfs_kms::KmsBackend::VaultKv2,
             backend_config: rustfs_kms::BackendConfig::VaultKv2(Box::new(rustfs_kms::VaultConfig {
-                auth_method: rustfs_kms::VaultAuthMethod::Token { token: token.to_string() },
+                auth_method: rustfs_kms::VaultAuthMethod::Token {
+                    token: token.to_string(),
+                },
                 ..rustfs_kms::VaultConfig::default()
             })),
             ..rustfs_kms::KmsConfig::default()
@@ -1369,7 +1371,10 @@ mod tests {
 
         let bytes = seal_persisted_kms_config(&config, None).expect("warn-only persistence stays allowed");
         let rendered = String::from_utf8(bytes.clone()).expect("persisted config is utf-8 JSON");
-        assert!(rendered.contains("s.vault-root-token"), "without a secret the legacy plaintext format is kept");
+        assert!(
+            rendered.contains("s.vault-root-token"),
+            "without a secret the legacy plaintext format is kept"
+        );
 
         let (opened_bytes, outcome) = open_persisted_kms_config(&bytes, None).expect("plaintext config loads without a secret");
         assert_eq!(outcome.plaintext, vec!["kms.vault.token"]);