mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-22 20:36:38 +00:00
唐小鸭
81ef2882df
Metadata-only replication reuses the whole-object PUT/multipart transports, so in active-active topologies an inbound authorized replication write carried the source's tags, retention, and legal hold verbatim and unconditionally overwrote a category the destination had modified more recently — both sites ended permanently diverged while reporting COMPLETED (rustfs/backlog#1953, audit A4/P1-6). The receiver now judges each category independently under the object write lock: when the destination version's stored internal timestamp is strictly newer than the inbound source timestamp, the local category values and timestamp are kept; the rest of the write proceeds per the inbound metadata and the object-level result stays successful, so a local win never feeds an MRF retry loop. When the inbound category wins, its internal timestamp key is pinned to the source-authored time instead of the receiver-now() value stamped by the object-lock eval_metadata path. No stored timestamp (pre-P1-6 data) or no inbound timestamp keeps today's overwrite behavior. The put_object hook reuses the existing commit-lock WORM-gate read (no extra fanout); complete_multipart_upload adds one gated read under its held lock, and the sender's complete options now carry the three category timestamps so the multipart transport gets the same receiver behavior. Local wins restore the timestamp via insert_str so a MinIO-written single-key version still yields both compatibility keys.