astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-01 13:22:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #123 from pgsty/fix/issue-113-rotation-checksum-algorithm

Browse Source 
fix: honor a requested checksum algorithm on SSE-C key rotation
This commit is contained in:
Feng Ruohang
2026-09-06 09:25:02 +08:00
committed by GitHub
parent 32e75c27bf fcc4d77895
commit 8b736dee34
2 changed files with 271 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/object-handlers.go
+12 -1
View File
@@ -1512,8 +1512,19 @@ func (api objectAPIHandlers) CopyObjectHandler(w http.ResponseWriter, r *http.Re
// data instead, the rotation has to go through the regular re-encrypting
// copy, or the destination ends up holding plaintext under metadata that
// claims the object is encrypted.
//
// A checksum algorithm the client asks for has to be computed over the object
// data, which an in-place rotation never reads, so leave the fast path and
// let the re-encrypting copy compute, store and report it. A replica-trusted
// request is not such a client: getOpts.ReplicationRequest leaves its source
// reader encrypted, so a rewrite would hash ciphertext, and a replica has to
// keep the checksum its source assigned.
// Without a requested destination checksum algorithm, an in-place SSE-C
// rotation preserves the stored checksum state, including absence; it does
// not add the default CRC64NVME.
canRotateKeyInPlace := !srcInfo.Legacy &&
!copyRewritesObjectData(srcInfo.metadataOnly, copySrcOpts, dstOpts)
!copyRewritesObjectData(srcInfo.metadataOnly, copySrcOpts, dstOpts) &&
(replicaTrusted || !hash.NewChecksumHeader(r.Header).IsSet())
// If src == dst and either
// - the object is encrypted using SSE-C and two different SSE-C keys are present