唐小鸭 6333f21a2e feat(replication): SSE-C ciphertext passthrough replication (#5898) ...

Complete the encrypted-object replication series (backlog#1783, PR-C of
3, after #5872 and #5885): SSE-C objects replicate as ciphertext
passthrough — the source holds no customer key, so the stored bytes and
their encryption metadata travel verbatim and the replica decrypts only
with the original customer key, single-part and multipart.

- Sender: SSE-C objects read raw (raw_data_movement_read), transfer at
  ciphertext size, and range multipart parts over stored part sizes.
- Receiver: authorized replication PUTs restore the stored SSE-C keys
  from the transport headers (exact lowercase forms - the read-path
  check is case-sensitive), set ObjectOptions.preserve_ciphertext, and
  skip compression, bucket-default SSE, and sse_encryption behind one
  restore-derived gate. Multipart uses an internal session marker to
  store parts verbatim and strips it on complete.
- Convergence: the replication HEAD sends
  x-rustfs-source-replication-check; the target authorizes it as
  ReplicateObjectAction and skips SSE-C read validation for that
  request only, so keyless convergence HEADs see etag/size/mtime
  instead of 400 and SSE-C replicas stop re-driving forever.
- e2e: SSE-C contract flips to a key-gated readable replica (no-key and
  wrong-key GETs fail - the direct silent-plaintext detector); new
  multipart passthrough contract with ETag/marker/stability assertions.

2026-08-09 23:53:04 +08:00

..

http

feat(replication): SSE-C ciphertext passthrough replication (#5898)

2026-08-09 23:53:04 +08:00

obj

feat: improve legacy metadata and admin compatibility (#2202)

2026-03-18 21:05:09 +08:00

os

fix(utils): map remaining Linux uapi filesystem magic values

2026-07-09 04:52:43 +08:00

compress.rs

chore(deps): tighten crate dependency features (#4896)

2026-07-16 06:55:52 +00:00

crypto.rs

build(toolchain): switch Rust channel to stable (#4775)

2026-07-12 18:59:43 +08:00

dirs.rs

refactor(utils): decouple config deps and move sys helpers (#2520)

2026-04-13 21:05:03 +08:00

dunce.rs

fix: unify path handling to use S3-standard forward slashes on all platforms (#1555)

2026-01-26 18:49:21 +08:00

egress.rs

fix(iam): preserve OIDC outbound policy errors (#5762)

2026-08-08 19:28:47 +08:00

envs.rs

fix(oidc): support separate discovery issuer (#5149)

2026-07-23 02:44:32 +00:00

hash.rs

perf(utils): reduce highway hash key setup (#5434)

2026-07-29 14:23:40 +00:00

io.rs

fix(rio): map truncated put bodies to incompletebody (#3168)

2026-06-02 11:31:51 +00:00

ip.rs

Fix KMS configuration synchronization across cluster nodes (#855)

2025-11-16 00:05:03 +08:00

lib.rs

fix(security): add shared outbound egress guard (#3567)

2026-06-18 15:30:09 +08:00

logging.rs

refactor(logging): standardize protocol and observability events (#3419)

2026-06-14 07:14:45 +08:00

net.rs

fix(ecstore): start with unresolved Kubernetes peers (#5460)

2026-07-30 11:14:38 +08:00

path.rs

perf(server): lighten internode data-plane stack (#3735)

2026-06-23 21:36:39 +08:00

retry.rs

fix: replace unwrap() with expect() in more files (#729 batch 13) (#3993)

2026-06-28 11:45:13 +08:00

string.rs

fix(ecstore): start with unresolved Kubernetes peers (#5460)

2026-07-30 11:14:38 +08:00