mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-09-18 04:20:53 +02:00

Files

T

Chris Lu 4fd67001d9 security: require go 1.26.6 and bump vulnerable deps (#11374 )

* security: require go 1.26.6 and bump vulnerable deps

A dependency scan of the 4.47 release flagged the bundled toolchain
and modules:

- github.com/golang/go < 1.26.6 (CVE-2026-39821, CVE-2026-56853,
  CVE-2026-56859, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865,
  CVE-2026-33818, CVE-2026-46600): raise the go directive to 1.26.6
  so every built artifact requires the fixed toolchain.
- google.golang.org/grpc (CVE-2026-84445, CVE-2026-84304): move to
  the fixed dev pseudo-version; released tags through v1.85.0-dev
  remain in the affected range.
- github.com/pelletier/go-toml/v2 <= v2.4.2 (unbounded parser
  recursion): v2.4.3.
- alpine libcrypto3/libssl3 < 3.5.8-r0 (CVE-2026-75803,
  CVE-2026-63073, CVE-2026-63075, CVE-2026-63076, CVE-2026-63072,
  CVE-2026-54874, CVE-2026-18798, CVE-2026-14456, CVE-2026-14457):
  the release images already apk-upgrade the final stage; extend the
  same to the telemetry and admin-integration images.

Same bumps applied to the test/kafka, test/sftp,
kafka-client-loadtest, and telemetry/server modules.

* telemetry: send integration test report above the 10 GiB floor

The collect endpoint keeps reports only when TotalDiskBytes >=
proto.MinDiskBytes, but the integration test still sent 1 GiB, so the
server counted the report and skipped storing it. No cluster_id series
was ever created and /metrics lacked seaweedfs_telemetry_volume_servers.
Send just above the floor (via proto.MinDiskBytes so it cannot silently
drift again) so the expected per-cluster metrics are exported.

2026-09-17 15:09:55 -07:00

testdata

sftp: match permission paths on path-component boundaries (#10311 )

2026-07-10 22:10:01 -07:00

basic_test.go

chore: execute goimports to format the code (#7983 )

2026-01-07 13:06:08 -08:00

framework.go

chore: execute goimports to format the code (#7983 )

2026-01-07 13:06:08 -08:00

go.mod

security: require go 1.26.6 and bump vulnerable deps (#11374 )

2026-09-17 15:09:55 -07:00

go.sum

security: require go 1.26.6 and bump vulnerable deps (#11374 )

2026-09-17 15:09:55 -07:00

Makefile

fix: SFTP HomeDir path translation for user operations (#7611 )

2025-12-03 13:42:05 -08:00

README.md

fmt

2025-12-19 15:33:16 -08:00

sibling_prefix_test.go

sftp: match permission paths on path-component boundaries (#10311 )

2026-07-10 22:10:01 -07:00

README.md

SeaweedFS SFTP Integration Tests

This directory contains integration tests for the SeaweedFS SFTP server.

Prerequisites

Build the SeaweedFS binary:
```
cd ../../weed
go build -o weed .
```
Ensure ssh-keygen is available (for generating test SSH host keys)

Running Tests

Run all tests

make test

Run tests with verbose output

make test-verbose

Run a specific test

go test -v -run TestHomeDirPathTranslation

Skip long-running tests

go test -short ./...

Test Structure

framework.go - Test framework that starts SeaweedFS cluster with SFTP
basic_test.go - Basic SFTP operation tests including:
- HomeDir path translation (fixes issue #7470)
- File upload/download
- Directory operations
- Large file handling
- Edge cases

Test Configuration

Tests use testdata/userstore.json which defines test users:

Username	Password	HomeDir	Permissions
admin	adminpassword	/	Full access
testuser	testuserpassword	/sftp/testuser	Full access to home
readonly	readonlypassword	/public	Read-only

Key Tests

TestHomeDirPathTranslation

Tests the fix for issue #7470 where users with a non-root HomeDir (e.g., /sftp/testuser) could not upload files to / because the path wasn't being translated to their home directory.

The test verifies:

Uploading to / correctly maps to the user's HomeDir
Creating directories at / works
Listing / shows the user's home directory contents
All path operations respect the HomeDir translation

Debugging

To debug test failures:

Enable verbose output:
```
go test -v -run TestName
```

Keep test artifacts (don't cleanup):

config := DefaultTestConfig()
config.SkipCleanup = true

Enable debug logging:

config := DefaultTestConfig()
config.EnableDebug = true