mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-27 23:47:28 +00:00
Zhengchao An
9f245e3fd4
The object_lock module evaluated WORM state through s3s wire DTOs (ObjectLockRetention, ObjectLockLegalHold, DefaultRetention, Date) and s3s header constants, keeping the storage engine coupled to the serving protocol (rustfs/backlog#1842, ARCHITECTURE.md invariant 4). This PR gives the module its own storage-level vocabulary and pushes the DTO conversions to the boundaries that already speak s3s. New crates/ecstore/src/bucket/object_lock/types.rs defines RetentionMode, LegalHoldStatus, ObjectRetention, ObjectLegalHold, and DefaultRetention with no s3s dependency. objectlock.rs parses persisted metadata into these types using the rustfs-utils lowercase header constants (the same literal keys as before, pinned by the existing g-key-002 test). objectlock_sys.rs evaluates retention/legal-hold/default-retention from them; the fail-closed error messages and decision logic are unchanged line for line where possible. Boundary conversions: - bucket/metadata_sys.rs gains default_retention_from_object_lock_config, converting the persisted s3s configuration into the storage-level DefaultRetention; a rule without a usable GOVERNANCE/COMPLIANCE mode converts to None exactly like the evaluation code always ignored it, and days/years pass through so an invalid period still fails closed at evaluation time. - check_object_lock_for_deletion_with_config becomes check_object_lock_for_deletion_with_default_retention (it only ever read the default retention); the lifecycle object_lock_boundary keeps the old s3s-typed signature and converts. - The ObjectLockApi / ObjectLockStatusExt trait impls for the s3s DTOs move next to the persisted configuration owner in bucket/metadata.rs; the traits stay in object_lock/mod.rs. - check_retention_for_modification now takes Option<RetentionMode>. The serving-layer wrappers (rustfs storage_api, set_disk options path) convert the request string with the new RetentionMode::parse_exact, which accepts only the canonical spelling — preserving the historical literal comparison where a non-canonical requested mode reads as a mode change and stays blocked. - rustfs app-layer wrappers return the storage types; the replication-overwrite gate in object_usecase.rs uses the typed API (legal_hold.is_on(), RetentionMode::Compliance). Ratchet: the ecstore-scoped s3s counter drops 42 -> 39 and the repo-wide file counter 211 -> 208 in scripts/check_s3s_footprint.sh. Verification: cargo check -p rustfs-ecstore --all-targets and -p rustfs (lib+bins); cargo clippy -p rustfs-ecstore --all-targets and -p rustfs --lib --bins (clean); cargo nextest run -p rustfs-ecstore --no-fail-fast (4534/4542; the 8 failures are the same store::rebalance / store::heal machine-baseline set that fails identically on pristine origin/main, plus one fencing flake that passes in isolation); all object_lock/retention/legal-hold tests pass; guard scripts (layer deps, migration rules, s3s footprint, logging, error-format ratchet, doc paths) pass.
101 lines
4.2 KiB
Bash
Executable File
101 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# Ratchet guard freezing the s3s dependency footprint ahead of the
|
||
# s3gate/gateway migration (rustfs/backlog#1677, review finding F1;
|
||
# acceptance criteria recorded in rustfs/backlog#1733).
|
||
#
|
||
# The migration's goal is to shrink the direct s3s surface, so new code must
|
||
# not grow it. Two counters are ratcheted, baselines verified on 2026-08-05:
|
||
#
|
||
# - files referencing s3s paths: rg -l "$S3S_PATH_PATTERN" --type rust (files)
|
||
# - s3_error! invocation lines: rg -c 's3_error!' --type rust (summed)
|
||
#
|
||
# Either count exceeding its baseline fails the check with the offending
|
||
# delta. Baselines are LOWER-ONLY: when a PR shrinks the footprint, lower the
|
||
# matching baseline in the same PR so the ratchet stays tight. Never raise a
|
||
# baseline to get green (AGENTS.md, Verification Before PR) — route new S3
|
||
# API code through the gateway abstractions instead of importing s3s
|
||
# directly.
|
||
#
|
||
# Usage: scripts/check_s3s_footprint.sh
|
||
|
||
set -euo pipefail
|
||
|
||
cd "$(dirname "$0")/.."
|
||
|
||
# Baselines verified on 2026-08-11. Lower-only; see header.
|
||
# Excludes crates/e2e_test/ — test infrastructure legitimately uses s3s
|
||
# to verify S3 behavior and does not widen the production s3s surface.
|
||
S3S_IMPORT_FILES_BASELINE=208
|
||
S3_ERROR_LINES_BASELINE=1620
|
||
# ecstore-scoped ratchet (rustfs/backlog#1842): the storage engine must not
|
||
# know S3 wire/DTO types (ARCHITECTURE.md invariant 4). The S3-*consuming*
|
||
# client was extracted to crates/s3-client, where s3s usage is legitimate;
|
||
# this counter ratchets the remaining serving-side s3s references out of
|
||
# crates/ecstore. Baseline verified on 2026-08-26.
|
||
S3S_ECSTORE_FILES_BASELINE=39
|
||
S3S_PATH_PATTERN='(^|[^"[:alnum:]_])s3s::'
|
||
E2E_TEST_GLOB='--glob=!crates/e2e_test/**'
|
||
|
||
TMP_DIR="$(mktemp -d)"
|
||
trap 'rm -rf "$TMP_DIR"' EXIT
|
||
|
||
# rg exits 1 on zero matches (a legitimate count of 0 at the end of the
|
||
# migration) and >1 on real errors; only the latter may abort the check.
|
||
run_rg_to() {
|
||
local out="$1" rg_status=0
|
||
shift
|
||
rg "$@" >"$out" || rg_status=$?
|
||
if ((rg_status > 1)); then
|
||
echo "error: 'rg $*' failed with status $rg_status" >&2
|
||
exit 1
|
||
fi
|
||
}
|
||
|
||
run_rg_to "$TMP_DIR/import_files" -l "$S3S_PATH_PATTERN" --type rust $E2E_TEST_GLOB
|
||
run_rg_to "$TMP_DIR/error_lines" -c 's3_error!' --type rust $E2E_TEST_GLOB
|
||
run_rg_to "$TMP_DIR/ecstore_files" -l "$S3S_PATH_PATTERN" --type rust crates/ecstore/src
|
||
|
||
s3s_import_files="$(grep -c . "$TMP_DIR/import_files" || true)"
|
||
s3_error_lines="$(awk -F: '{sum += $NF} END {print sum + 0}' "$TMP_DIR/error_lines")"
|
||
s3s_ecstore_files="$(grep -c . "$TMP_DIR/ecstore_files" || true)"
|
||
|
||
for value in "$s3s_import_files" "$s3_error_lines" "$s3s_ecstore_files"; do
|
||
if ! [[ "$value" =~ ^[0-9]+$ ]]; then
|
||
echo "error: could not compute s3s footprint counts (got: '$value')" >&2
|
||
exit 1
|
||
fi
|
||
done
|
||
|
||
status=0
|
||
|
||
check_ratchet() {
|
||
local label="$1" count="$2" baseline="$3" inspect_cmd="$4"
|
||
|
||
if ((count > baseline)); then
|
||
echo "❌ s3s footprint ratchet violation: $label is $count, baseline is $baseline (+$((count - baseline)))" >&2
|
||
echo " New code must not widen the s3s surface being removed by the s3gate migration" >&2
|
||
echo " (rustfs/backlog#1677 F1, rustfs/backlog#1733). Use the gateway abstractions" >&2
|
||
echo " instead of importing s3s directly. To find the offenders, compare" >&2
|
||
echo " '$inspect_cmd' against origin/main." >&2
|
||
status=1
|
||
elif ((count < baseline)); then
|
||
echo "ℹ️ s3s footprint shrank: $label is $count, baseline is $baseline ($((count - baseline)))." >&2
|
||
echo " Lower the baseline in scripts/check_s3s_footprint.sh in this PR to keep the ratchet tight." >&2
|
||
else
|
||
echo "s3s footprint OK: $label is $count (baseline: $baseline)"
|
||
fi
|
||
}
|
||
|
||
check_ratchet "files importing s3s" "$s3s_import_files" "$S3S_IMPORT_FILES_BASELINE" \
|
||
"rg -l '$S3S_PATH_PATTERN' --type rust $E2E_TEST_GLOB"
|
||
check_ratchet "s3_error! invocation lines" "$s3_error_lines" "$S3_ERROR_LINES_BASELINE" \
|
||
"rg -c 's3_error!' --type rust $E2E_TEST_GLOB"
|
||
check_ratchet "ecstore files referencing s3s" "$s3s_ecstore_files" "$S3S_ECSTORE_FILES_BASELINE" \
|
||
"rg -l '$S3S_PATH_PATTERN' --type rust crates/ecstore/src"
|
||
|
||
if ((status != 0)); then
|
||
exit 1
|
||
fi
|
||
|
||
echo "✅ s3s footprint ratchet check passed"
|