rustfs/protocol/agent/v1/fixtures/inventory/secret-like-vectors.json

{
  "protocolVersion": "v1",
  "fixtureSet": "inventory",
  "fixture": "secret-like-vectors",
  "description": "An agent, a proxy, or an attacker attaches credential-shaped and customer-identifying members to an otherwise valid snapshot. Every one is an unknown optional member, so the frozen rule applies unchanged: accepted, discarded, never persisted, never echoed back, and never logged in raw form. Rejecting them instead would break additive compatibility and would put the secret text into an error message, so discarding is the safer and the frozen behaviour. Each vector carries the same content hash as the valid fixture's fully populated snapshot, which proves nothing here reaches storage. The literal values below are non-functional examples, not real credentials.",
  "baseVector": "fully populated snapshot",
  "baseContentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
  "errorMessagesNameUnknownMembers": false,
  "vectors": [
    {
      "name": "S3 access key and secret key attached to the snapshot",
      "category": "secret-like",
      "sameContentHashAs": "fully populated snapshot",
      "secretLikeMembers": ["accessKeyId", "secretAccessKey", "sessionToken"],
      "input": {
        "protocolVersion": "v1",
        "rustfsVersion": "1.4.2",
        "osVersion": { "family": "linux", "major": 6, "minor": 8 },
        "nodeCount": 8,
        "driveCount": 96,
        "capacityTotalBytes": 1099511627776,
        "capacityUsedBytes": 412316860416,
        "coarseFlags": ["cluster.degraded", "drive.offline"],
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
        "sessionToken": "FwoGZXIvYXdzEExampleSessionTokenValue"
      },
      "expected": {
        "decision": "ACCEPT",
        "reason": null,
        "httpStatus": null,
        "retained": [
          "protocolVersion",
          "rustfsVersion",
          "osVersion",
          "nodeCount",
          "driveCount",
          "capacityTotalBytes",
          "capacityUsedBytes",
          "coarseFlags"
        ],
        "discarded": ["accessKeyId", "secretAccessKey", "sessionToken"],
        "defaultsApplied": {},
        "canonicalJson": "{\"capacityTotalBytes\":1099511627776,\"capacityUsedBytes\":412316860416,\"coarseFlags\":[\"cluster.degraded\",\"drive.offline\"],\"driveCount\":96,\"nodeCount\":8,\"osVersion\":{\"family\":\"linux\",\"major\":6,\"minor\":8},\"rustfsVersion\":\"1.4.2\"}",
        "contentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
        "echoedBack": [],
        "stored": [],
        "logged": []
      }
    },
    {
      "name": "bearer token and private key material attached to the snapshot",
      "category": "secret-like",
      "sameContentHashAs": "fully populated snapshot",
      "secretLikeMembers": ["authorization", "devicePrivateKeyPem", "kmsMasterKey"],
      "input": {
        "protocolVersion": "v1",
        "rustfsVersion": "1.4.2",
        "osVersion": { "family": "linux", "major": 6, "minor": 8 },
        "nodeCount": 8,
        "driveCount": 96,
        "capacityTotalBytes": 1099511627776,
        "capacityUsedBytes": 412316860416,
        "coarseFlags": ["cluster.degraded", "drive.offline"],
        "authorization": "Bearer eyJhbGciOiJIUzI1NiJ9.e30.c2lnbmF0dXJl",
        "devicePrivateKeyPem": "-----BEGIN PRIVATE KEY-----\nMEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBleGFtcGxl\n-----END PRIVATE KEY-----",
        "kmsMasterKey": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      },
      "expected": {
        "decision": "ACCEPT",
        "reason": null,
        "httpStatus": null,
        "retained": [
          "protocolVersion",
          "rustfsVersion",
          "osVersion",
          "nodeCount",
          "driveCount",
          "capacityTotalBytes",
          "capacityUsedBytes",
          "coarseFlags"
        ],
        "discarded": ["authorization", "devicePrivateKeyPem", "kmsMasterKey"],
        "defaultsApplied": {},
        "canonicalJson": "{\"capacityTotalBytes\":1099511627776,\"capacityUsedBytes\":412316860416,\"coarseFlags\":[\"cluster.degraded\",\"drive.offline\"],\"driveCount\":96,\"nodeCount\":8,\"osVersion\":{\"family\":\"linux\",\"major\":6,\"minor\":8},\"rustfsVersion\":\"1.4.2\"}",
        "contentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
        "echoedBack": [],
        "stored": [],
        "logged": []
      }
    },
    {
      "name": "bucket object path and endpoint members attached to the snapshot",
      "category": "secret-like",
      "sameContentHashAs": "fully populated snapshot",
      "secretLikeMembers": ["buckets", "largestObjectKey", "dataPaths", "endpoint"],
      "input": {
        "protocolVersion": "v1",
        "rustfsVersion": "1.4.2",
        "osVersion": { "family": "linux", "major": 6, "minor": 8 },
        "nodeCount": 8,
        "driveCount": 96,
        "capacityTotalBytes": 1099511627776,
        "capacityUsedBytes": 412316860416,
        "coarseFlags": ["cluster.degraded", "drive.offline"],
        "buckets": ["customer-backups", "prod-media-eu"],
        "largestObjectKey": "invoices/2026/08/inv-1.pdf",
        "dataPaths": ["/var/lib/rustfs/data/disk1", "C:\\rustfs\\data"],
        "endpoint": "https://rustfs.internal:9000"
      },
      "expected": {
        "decision": "ACCEPT",
        "reason": null,
        "httpStatus": null,
        "retained": [
          "protocolVersion",
          "rustfsVersion",
          "osVersion",
          "nodeCount",
          "driveCount",
          "capacityTotalBytes",
          "capacityUsedBytes",
          "coarseFlags"
        ],
        "discarded": ["buckets", "dataPaths", "endpoint", "largestObjectKey"],
        "defaultsApplied": {},
        "canonicalJson": "{\"capacityTotalBytes\":1099511627776,\"capacityUsedBytes\":412316860416,\"coarseFlags\":[\"cluster.degraded\",\"drive.offline\"],\"driveCount\":96,\"nodeCount\":8,\"osVersion\":{\"family\":\"linux\",\"major\":6,\"minor\":8},\"rustfsVersion\":\"1.4.2\"}",
        "contentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
        "echoedBack": [],
        "stored": [],
        "logged": []
      }
    },
    {
      "name": "redacted configuration and customer identifiers attached to the snapshot",
      "category": "secret-like",
      "sameContentHashAs": "fully populated snapshot",
      "secretLikeMembers": ["configuration", "customerName", "nodeHostnames"],
      "input": {
        "protocolVersion": "v1",
        "rustfsVersion": "1.4.2",
        "osVersion": { "family": "linux", "major": 6, "minor": 8 },
        "nodeCount": 8,
        "driveCount": 96,
        "capacityTotalBytes": 1099511627776,
        "capacityUsedBytes": 412316860416,
        "coarseFlags": ["cluster.degraded", "drive.offline"],
        "configuration": { "tls": { "minVersion": "1.3" }, "erasure": "RUSTFS_ERASURE_SET_SIZE=12" },
        "customerName": "acme-corp",
        "nodeHostnames": ["node-3.storage.example.com", "10.4.2.17"]
      },
      "expected": {
        "decision": "ACCEPT",
        "reason": null,
        "httpStatus": null,
        "retained": [
          "protocolVersion",
          "rustfsVersion",
          "osVersion",
          "nodeCount",
          "driveCount",
          "capacityTotalBytes",
          "capacityUsedBytes",
          "coarseFlags"
        ],
        "discarded": ["configuration", "customerName", "nodeHostnames"],
        "defaultsApplied": {},
        "canonicalJson": "{\"capacityTotalBytes\":1099511627776,\"capacityUsedBytes\":412316860416,\"coarseFlags\":[\"cluster.degraded\",\"drive.offline\"],\"driveCount\":96,\"nodeCount\":8,\"osVersion\":{\"family\":\"linux\",\"major\":6,\"minor\":8},\"rustfsVersion\":\"1.4.2\"}",
        "contentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
        "echoedBack": [],
        "stored": [],
        "logged": []
      }
    },
    {
      "name": "secret material hidden inside osVersion and inside a coarse flag token",
      "category": "secret-like",
      "sameContentHashAs": "fully populated snapshot",
      "secretLikeMembers": ["osVersion.licenseKey", "coarseFlags[akiaiosfodnn7example]"],
      "input": {
        "protocolVersion": "v1",
        "rustfsVersion": "1.4.2",
        "osVersion": {
          "family": "linux",
          "major": 6,
          "minor": 8,
          "licenseKey": "RUSTFS-PROD-4821-9930-ACME"
        },
        "nodeCount": 8,
        "driveCount": 96,
        "capacityTotalBytes": 1099511627776,
        "capacityUsedBytes": 412316860416,
        "coarseFlags": ["cluster.degraded", "drive.offline", "akiaiosfodnn7example"]
      },
      "expected": {
        "decision": "ACCEPT",
        "reason": null,
        "httpStatus": null,
        "retained": [
          "protocolVersion",
          "rustfsVersion",
          "osVersion",
          "nodeCount",
          "driveCount",
          "capacityTotalBytes",
          "capacityUsedBytes",
          "coarseFlags"
        ],
        "discarded": ["coarseFlags[akiaiosfodnn7example]", "osVersion.licenseKey"],
        "defaultsApplied": {},
        "canonicalJson": "{\"capacityTotalBytes\":1099511627776,\"capacityUsedBytes\":412316860416,\"coarseFlags\":[\"cluster.degraded\",\"drive.offline\"],\"driveCount\":96,\"nodeCount\":8,\"osVersion\":{\"family\":\"linux\",\"major\":6,\"minor\":8},\"rustfsVersion\":\"1.4.2\"}",
        "contentHash": "e1cba9f30a26b94bb289a8a4b630a704dafaeb4960bffd38cef98e3d2581518f",
        "echoedBack": [],
        "stored": [],
        "logged": []
      }
    }
  ]
}