gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-13 16:46:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(kms): import canonical internal encryption header constants (#5997)

Browse Source 
kms/service.rs re-declared x-rustfs-encryption-key-id and x-rustfs-encryption-algorithm locally; the canonical owners live in rustfs-utils' object_encryption_keys module, which kms already transitively builds. Enable the http feature on the existing rustfs-utils dependency and import the two constants instead. The explanatory comment about why the algorithm header exists (SSE mode vs AEAD cipher round-trip) moves to the import site.

No dependency-graph change (cargo tree -p rustfs-kms is unchanged apart from the feature) and no behavior change: the imported values are byte-identical.

Ref rustfs/backlog#1833 (PR2).
This commit is contained in:
Zhengchao An
2026-08-12 22:20:47 +08:00
committed by GitHub
parent baadaccc30
commit 679ea238de
2 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kms/Cargo.toml
+1 -1
View File
@@ -62,7 +62,7 @@ moka = { workspace = true, features = ["future"] }
# Additional dependencies
md-5 = { workspace = true }
arc-swap = { workspace = true }
rustfs-utils = { workspace = true }
rustfs-utils = { workspace = true, features = ["http"] }
rustfs-security-governance = { workspace = true }
# `EventName` for KMS audit records. A leaf crate with no rustfs dependencies,
# so the audit sink can live outside this crate without a second, drifting
crates/kms/src/service.rs
+8 -10
View File
@@ -81,16 +81,14 @@ fn request_encryption_context(context: &ObjectEncryptionContext) -> HashMap<Stri
enc_context
}
const INTERNAL_ENCRYPTION_KEY_ID_HEADER: &str = "x-rustfs-encryption-key-id";
/// Carries the AEAD algorithm the object was sealed with.
///
/// The S3 `x-amz-server-side-encryption` header records the *SSE mode*
/// (`AES256` / `aws:kms`), not the cipher, so it cannot round-trip
/// `ChaCha20Poly1305`. Without this header a ChaCha-sealed object comes back
/// from the projection claiming `aws:kms` and is then opened with the wrong
/// cipher.
const INTERNAL_ENCRYPTION_ALGORITHM_HEADER: &str = "x-rustfs-encryption-algorithm";
// Canonical owners of the internal encryption header names. Note on
// INTERNAL_ENCRYPTION_ALGORITHM_HEADER: it carries the AEAD algorithm the
// object was sealed with. The S3 `x-amz-server-side-encryption` header records
// the *SSE mode* (`AES256` / `aws:kms`), not the cipher, so it cannot
// round-trip `ChaCha20Poly1305`. Without this header a ChaCha-sealed object
// comes back from the projection claiming `aws:kms` and is then opened with
// the wrong cipher.
use rustfs_utils::http::object_encryption_keys::{INTERNAL_ENCRYPTION_ALGORITHM_HEADER, INTERNAL_ENCRYPTION_KEY_ID_HEADER};
/// Result of object encryption
#[derive(Debug, Clone)]