yandrey321 commented on PR #11788:
URL: https://github.com/apache/ozone/pull/11788#issuecomment-6535658941
> Could we also call `ServerSideEncryption.rejectCustomerKey()` for
`CompleteMultipartUpload` and `ListParts`? Both APIs accept SSE-C headers, but
these paths currently ignore them. `ListParts` is handled by
`MultipartKeyHandler`, so it bypasses the check in
`ObjectEndpoint.handleGetRequest()`.
>
> I verified that both return success with SSE-C headers present, and
completion creates a readable object in a regular bucket. Please add regression
tests for both paths. Only SSE-C rejection is needed here; encryption selection
belongs at multipart initiation.
>
> SSE-C request validation coverage in this PR ("checked" means rejecting
unsupported SSE-C, not implementing SSE-C encryption):
>
> API Status
> `PutObject` Checked
> `CopyObject` Checked, including source SSE-C headers
> `CreateMultipartUpload` Checked
> `UploadPart` Checked
> `UploadPartCopy` Checked, including source SSE-C headers
> `GetObject` Checked
> `HeadObject` Checked
> `GetObjectAttributes` Checked
> `CompleteMultipartUpload` **Missing SSE-C rejection**
> `ListParts` **Missing SSE-C rejection**
> `SelectObjectContent` API not implemented in Ozone
> `POST Object` form upload API not implemented in Ozone
> `WriteGetObjectResponse` API not implemented in Ozone; uses forwarded
SSE-C metadata rather than a customer key
> The actionable validation gaps are `CompleteMultipartUpload` and
`ListParts`, with regression tests for both.
>
> Separately, SSE response headers on `GetObject`/`HeadObject` are
explicitly deferred by this PR. Multipart completion also lacks SSE response
reporting.
>
> Generated-by: Codex (GPT-6)
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
