gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-30 00:47:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kms): bind encryption context into DEK envelopes as AAD (#6639)

Browse Source
This commit is contained in:
唐小鸭
2026-08-26 13:58:13 +08:00
committed by GitHub
parent 51041e917e
commit a4377b6351
9 changed files with 606 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/kms/src/config.rs
+5
View File
@@ -24,6 +24,11 @@ use std::time::Duration;
use url::Url;
pub const ENV_KMS_ALLOW_INSECURE_DEV_DEFAULTS: &str = "RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS";
/// Write-side switch for binding the encryption context into DEK envelopes as
/// AES-GCM additional data. Read-side support is unconditional; see
/// [`crate::encryption::dek::envelope_aad_write_enabled`] for the rollout
/// constraint that keeps this default-off for one release.
pub const ENV_KMS_ENVELOPE_AAD: &str = "RUSTFS_KMS_ENVELOPE_AAD";
pub const ENV_KMS_ALLOW_IMMEDIATE_DELETION: &str = "RUSTFS_KMS_ALLOW_IMMEDIATE_DELETION";
pub const ENV_KMS_VAULT_ADDRESS: &str = "RUSTFS_KMS_VAULT_ADDRESS";
pub const ENV_KMS_VAULT_TOKEN: &str = "RUSTFS_KMS_VAULT_TOKEN";