4 people a8766f5177 s3api: apply copy bucket-default SSE after the ACL re-auth (#12436) ...

* s3api: apply copy bucket-default SSE after the ACL re-auth

CopyObject without its own x-amz-server-side-encryption header takes the
destination bucket's default encryption, which CopyObjectHandler writes
into the request headers. It did so before preparePutObjectACL, which
re-authenticates a request that carries an ACL (x-amz-acl or a grant
header) for s3:PutObjectAcl. verifySignedHeadersCoverage then found the
synthesized x-amz-server-side-encryption* headers outside SignedHeaders
and rejected the copy with SignatureDoesNotMatch.

Move the bucket-default injection after the ACL check, so the
re-authentication sees the request as the client signed it. The
destination object still gets the bucket default encryption.

* s3api: assert the copy's KMS key and stored ciphertext

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Stefan Scharlott <stefans@Stefans-MacBook-Pro.local>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-06 09:08:44 -08:00

..

admin

admin: re-send the master vacuum disable every poll so it survives leader changes (#12430)

2026-11-06 09:07:50 -08:00

cluster

vector: weed-vector registers to master; s3 discovers it there (#12146)

2026-10-28 00:58:31 -07:00

command

weed/command: skip remote bucket delete when bucket is unmounted (#12418) (#12425)

2026-11-05 05:06:41 -08:00

credential

plugin worker: stop forwarding the stream's admin token to job RPCs (#12391)

2026-11-04 05:26:12 -08:00

ec

weed/shell: resolve collection from topology when ec.decode is given only volumeId (#12424)

2026-11-05 05:01:25 -08:00

filer

filer: clear a dead test replica's reachability record before closing it (#12387)

2026-11-03 20:47:43 -08:00

filer_client

fix: resolve gRPC DNS resolution issues in Kubernetes #8384 (#8387)

2026-02-19 15:46:02 -08:00

glog

go fmt

2026-04-10 17:31:14 -07:00

iam

iam/oidc: drop single-use web-identity tokens and the jti replay cache (#12065)

2026-10-25 12:04:59 -07:00

iamapi

iam: optionally require an iam: grant for self-service access-key actions (#11937)

2026-10-21 20:06:30 -07:00

images

image: add an optional public image processing gateway (#11593)

2026-10-05 19:49:02 +08:00

kms

kms/azure: fix encrypt/decrypt round trip for Azure Key Vault (#11692)

2026-10-10 23:40:19 +08:00

mount

mount: refuse to attach opens to a draining file handle (#12219)

2026-10-29 16:06:57 -07:00

mq

mq/kafka: wait for a filer to register instead of panicking on an empty list (#12019)

2026-10-24 07:09:43 -07:00

notification

filer,pb,mount: keep per-chunk cipher keys out of logs (#12085)

2026-10-26 11:52:56 -07:00

operation

master: tell a warming-up Assign or LookupVolume client when warm-up ends (#12386)

2026-11-03 20:46:58 -08:00

pb

vector: keep ListVectors pages and segments flat as an index grows; read only keys in GetVectors (#12300)

2026-11-01 11:57:44 -08:00

placement

placement: let callers reject candidates placement cannot judge (#10581)

2026-08-05 00:18:22 -07:00

plugin/worker

plugin worker: stop forwarding the stream's admin token to job RPCs (#12391)

2026-11-04 05:26:12 -08:00

query

filer: fail the request, not the process, when chunks cannot be resolved (#11685)

2026-10-10 23:39:29 +08:00

remote_storage

weed/command: skip remote bucket delete when bucket is unmounted (#12418) (#12425)

2026-11-05 05:06:41 -08:00

replication

filer.sync: stop chunk retries with the same supersession check the skip uses (#12367)

2026-11-03 10:43:22 -08:00

s3api

s3api: apply copy bucket-default SSE after the ACL re-auth (#12436)

2026-11-06 09:08:44 -08:00

security

fix(s3): accept fresh admin tokens when context carries stale authorization (#12390) (#12397)

2026-11-04 09:42:25 -08:00

sequence

[nfs] Add NFS (#9067)

2026-04-14 20:48:24 -07:00

server

filer: hide write controls in the UI on the read-only port (#12429)

2026-11-05 10:11:52 -08:00

sftpd

sftp: fail rm and rmdir of a missing path, and mkdir of an existing one (#12168)

2026-10-28 08:11:21 -07:00

shell

weed/shell: resolve collection from topology when ec.decode is given only volumeId (#12424)

2026-11-05 05:01:25 -08:00

static

adjust logo

2026-04-23 10:05:51 -07:00

stats

volume: count EC intervals served by reconstruction (#12392)

2026-11-04 08:30:41 -08:00

storage

weed/server: verify data shards against bitrot sidecar before ec decode (#12422) (#12427)

2026-11-05 10:11:09 -08:00

telemetry

telemetry: keep only clusters that store at least 10 GiB (#11138)

2026-09-03 12:36:00 -07:00

topology

admin: re-send the master vacuum disable every poll so it survives leader changes (#12430)

2026-11-06 09:07:50 -08:00

util

master: tell a warming-up Assign or LookupVolume client when warm-up ends (#12386)

2026-11-03 20:46:58 -08:00

wdclient

s3: drop retired volume servers from the gateway location cache (#12281)

2026-10-31 15:05:00 -07:00

worker

iceberg maintenance: cache a remote-only file before reading it (#12191)

2026-10-29 11:13:23 -07:00

Makefile

Move SQL engine and PostgreSQL server to their own binaries (#8417)

2026-02-23 16:27:08 -08:00

weed.go

shell: exit non-zero when a piped command fails (#11117)

2026-09-02 22:12:51 -07:00