From c4fd97d0bfface966b04a24e449bba1eb85ad6d0 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Sat, 29 Aug 2026 17:28:36 +0800 Subject: [PATCH] test: align zero-byte rotation key errors After zero-byte reads authenticate SSE-C at the object layer, equal invalid rotation keys match non-empty reads and return AccessDenied before the rotation-specific distinction. Signed-off-by: Feng Ruohang --- cmd/object-copy-metadata_test.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/cmd/object-copy-metadata_test.go b/cmd/object-copy-metadata_test.go index 95d4f7d3d..53cb3ff3f 100644 --- a/cmd/object-copy-metadata_test.go +++ b/cmd/object-copy-metadata_test.go @@ -576,9 +576,11 @@ func testAPICopyObjectSSECKeyRotationNullVersionWrongKey(obj ObjectLayer, instan xhttp.AmzServerSideEncryptionCopyCustomerKey: base64.StdEncoding.EncodeToString(newKey), xhttp.AmzServerSideEncryptionCopyCustomerKeyMD5: base64.StdEncoding.EncodeToString(newMD5[:]), }) - if rec.Code != http.StatusBadRequest { + // The zero-byte read path authenticates the source key before the + // rotation-specific equal-key distinction, matching non-empty reads. + if rec.Code != http.StatusForbidden { t.Fatalf("%s: rotation with equal invalid keys returned %d, want %d: %s", - instanceType, rec.Code, http.StatusBadRequest, rec.Body.String()) + instanceType, rec.Code, http.StatusForbidden, rec.Body.String()) } after, err := obj.GetObjectInfo(t.Context(), bucketName, object, ObjectOptions{})