overtrue d14cdedaf9 fix(s3): apply presigned signed-header rule to custom routes and harden parsing ...

Move the GHSA-g8w9-qw9q-fghr check to the first statement of S3Access::check, apply it in S3Router::check_access so admin, console, STS and extension routes that never reach the access hook enforce the same rule, read X-Amz-SignedHeaders with the exact key the verifier uses and treat a duplicate as signing nothing, and log the rejection as a warn event with the repository field shape. Add presigned GET, unsigned x-amz-copy-source and unsigned Content-Type e2e cases plus a router unit test; raise the security smoke floor to 26 and refresh the selection digests.

2026-09-08 00:18:14 +08:00

..

audit

feat(info): report all rustfs features (#6722)

2026-08-27 14:45:50 +08:00

checksums

docs(rio): record the checksum hasher verdict and pin shared vectors (#6706)

2026-08-27 10:08:09 +08:00

common

fix(heal): retain hints without verified repair receipts (#7275)

2026-09-06 16:44:30 +08:00

concurrency

refactor(concurrency): consolidate ForegroundPressure into workload owner (#6757)

2026-08-28 06:52:50 +08:00

config

fix: align object version limit handling (#7415)

2026-09-07 23:43:19 +08:00

credentials

feat: extend hotpath coverage across crates (#5505)

2026-07-31 05:42:19 +00:00

crypto

test(crypto): replace the one-file key scan with a repo-wide guard (#6246)

2026-08-19 10:59:54 +08:00

data-usage

fix(scanner): bootstrap pristine usage baseline (#6471)

2026-08-24 14:29:09 +08:00

e2e_test

fix(s3): apply presigned signed-header rule to custom routes and harden parsing

2026-09-08 00:18:14 +08:00

ecstore

fix: align object version limit handling (#7415)

2026-09-07 23:43:19 +08:00

extension-schema

feat: extend hotpath coverage across crates (#5505)

2026-07-31 05:42:19 +00:00

filemeta

fix: align object version limit handling (#7415)

2026-09-07 23:43:19 +08:00

heal

fix(heal): retain MRF replay anchors until successor proof (#7413)

2026-09-07 23:21:47 +08:00

heal-contracts

fix(heal): preserve automatic replacement recovery status (#7018)

2026-09-01 17:21:43 +00:00

iam

fix(oidc): support workload discovery and JWKS negotiation (#7348)

2026-09-07 06:38:04 +00:00

io-core

fix(logging): bound ECStore debug output (#6809)

2026-08-29 04:51:37 +00:00

io-metrics

feat(observability): diagnose node-local S3 write failures (#7407)

2026-09-07 22:24:50 +08:00

keystone

chore: adjudicate 19 bare dead_code allows across six leaf crates (#6161)

2026-08-17 11:34:47 +08:00

kms

docs: scope agent guidance and consolidate review workflows (#7419)

2026-09-07 23:58:05 +08:00

license

feat(license): add entitlement provider abstraction (#7006)

2026-09-01 19:31:35 +08:00

lifecycle

fix(scanner): require root publication proof before dirty ack (#7297)

2026-09-06 23:25:40 +08:00

lock

fix(logging): bound ECStore debug output (#6809)

2026-08-29 04:51:37 +00:00

log-analyzer

fix(ecstore): reserve decommission capacity safely (#6917)

2026-08-31 15:20:09 +08:00

madmin

feat(observability): diagnose node-local S3 write failures (#7407)

2026-09-07 22:24:50 +08:00

notify

test(targets,notify,audit): share a builder MockTarget testkit (#6717)

2026-08-27 11:28:16 +08:00

object-capacity

docs: scope agent guidance and consolidate review workflows (#7419)

2026-09-07 23:58:05 +08:00

object-data-cache

fix(logging): bound ECStore debug output (#6809)

2026-08-29 04:51:37 +00:00

obs

refactor(odm): move migration orchestration into application (#7226)

2026-09-06 01:31:58 +08:00

policy

fix(replication): close IAM snapshot, marker purge and broadcast gaps (#7195)

2026-09-06 14:12:25 +08:00

protocols

fix: preserve protocol service account claims (#7062)

2026-09-02 14:16:15 +00:00

protos

perf(ilm): reduce transition transaction mutations (#7320)

2026-09-07 02:40:57 +00:00

replication

fix(replication): resolve drifted replicas via a target version ledger (#7368)

2026-09-07 11:23:32 +00:00

rio

feat(rio): add bounded tee reader for one-read two-consumer paths (#7066)

2026-09-02 21:59:46 +08:00

rio-v2

fix(s3): align Snowball codec compatibility (#6943)

2026-08-31 13:09:51 +00:00

s3-client

fix(tier): bound remote transition requests (#7147)

2026-09-05 12:41:11 +00:00

s3-ops

feat(obs): add bounded metrics dimensions (#5645)

2026-08-03 09:03:34 +08:00

s3-types

feat(admin): self-service account management and TOTP two-factor authentication (#6596)

2026-08-26 09:35:29 +08:00

s3select-api

feat(s3-select): stream JSON document input (#6980)

2026-09-01 20:17:14 +08:00

s3select-query

feat(s3-select): stream JSON document input (#6980)

2026-09-01 20:17:14 +08:00

scanner

test(scanner): bind segment proof generations (#7416)

2026-09-07 23:43:42 +08:00

scanner-metrics

feat(tier): report cluster tier stats and count tier requests (#7110)

2026-09-04 09:40:03 +08:00

security-governance

fix(admin): refuse immediate KMS key deletion through the query string (#5589)

2026-08-02 03:46:11 +08:00

signer

perf(signer): cache signing key to avoid redundant HMAC-SHA256 (#6651)

2026-08-26 17:00:00 +08:00

storage-api

feat(scanner): send scoped dirty usage acknowledgements (#7322)

2026-09-07 05:28:50 +08:00

targets

fix(logging): bound ECStore debug output (#6809)

2026-08-29 04:51:37 +00:00

test-utils

test(ci): stabilize main fixture paths (#6523)

2026-08-24 19:34:02 +08:00

tls-runtime

feat: extend hotpath coverage across crates (#5505)

2026-07-31 05:42:19 +00:00

trusted-proxies

fix(startup): never panic when the system CA bundle is absent (#6769)

2026-08-28 00:34:51 +00:00

utils

fix: align object version limit handling (#7415)

2026-09-07 23:43:19 +08:00

zip

test(s3): add Snowball tar-codec compatibility fixtures (#7157)

2026-09-05 07:41:48 +00:00

AGENTS.md

docs: scope agent guidance and consolidate review workflows (#7419)

2026-09-07 23:58:05 +08:00