mirror of
https://github.com/rustfs/rustfs.git
synced 2026-07-26 08:18:18 +00:00
Zhengchao An
0e7b8ea16b
The header-SigV4 (sec-1), presigned-URL (sec-2), and admin-gate (sec-4) negative auth-rejection e2e suites merged earlier but only presigned_negative was actually selected by any CI profile; negative_sigv4_test and admin_auth_test compiled and sat unrun. Add both to the e2e-smoke default-filter so all three attacker-facing S3 auth-rejection suites execute on every PR. They already meet the smoke admission criteria (RustFSTestEnvironment, random ports, parallel-safe, no #[ignore], no feature gates), so this is a pure filterset change — the single e2e-in-CI wiring mechanism (backlog#1149 ci-4), not a new job. Because the filter selects by module name, a rename or deletion could silently drop a suite out of the security gate with no CI signal. Add scripts/check_security_smoke_count.sh (infra-12 count-floor mechanism): it lists what the e2e-smoke profile selects and fails if the count of security auth-rejection tests drops below the committed floor in .config/security-smoke-floor.txt (16). Invoked from the e2e-tests job, before the smoke run, so the nextest list compiles the binaries the run reuses. The GHSA-3p3x FTPS/WebDAV constant-time e2e (protocols::test_protocol_core_suite) stays out by topology: it binds fixed ports, needs the ftps,webdav features, and is #[serial], so it cannot join the random-port default-feature smoke profile as a filterset change (global ruling G5). Its GHSA-r5qv sibling is a unit test that already runs in the default CI pass. docs/testing/security-regressions.md now carries the full CI-execution map and flags the GHSA-3p3x e2e CI-lane gap as a ci-domain follow-up. Refs: backlog#1151 (sec-5)
13 lines
695 B
Plaintext
13 lines
695 B
Plaintext
# Committed floor for the number of security negative-auth tests selected by the
|
|
# e2e-smoke PR profile (see scripts/check_security_smoke_count.sh, backlog#1151
|
|
# sec-5).
|
|
#
|
|
# The floor equals the exact count of e2e_test cases whose name starts with a
|
|
# security module prefix (negative_sigv4_test, presigned_negative_test,
|
|
# admin_auth_test) that the [profile.e2e-smoke] default-filter in
|
|
# .config/nextest.toml selects, at the time this file was last updated. CI fails
|
|
# if the selected count drops below this number, so a rename or removal that
|
|
# thins the security smoke gate must update this file in the same PR.
|
|
# Adding tests does not require a bump, but bumping keeps the guard tight.
|
|
16
|