Chris Lu ac524e140a s3: enforce role trust policy on direct OIDC bearer authentication (#10302) ...

A raw OIDC token sent as Authorization: Bearer was validated and mapped
to a role through the provider's roleMapping, then authorized against
the role's attached policies without ever consulting the role's trust
policy. A federated user could act as a role that
AssumeRoleWithWebIdentity would refuse to issue a session for with the
same token. Run the same trust-policy validation before returning the
principal on the bearer path.

2026-07-10 12:14:18 -07:00

..

admin

admin: stop holding the shell admin lock across whole scheduler batches (#10290)

2026-07-09 20:43:55 -07:00

cluster

s3: route object reads to the key's owner filer (#9806)

2026-06-03 00:12:28 -07:00

command

fix(filer.backup): prevent silent backup data loss on transient not-found (#10295)

2026-07-10 01:47:46 -07:00

credential

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

filer

s3: keep empty-folder cleanup out of the multipart .uploads staging tree (#10273)

2026-07-08 14:30:57 -07:00

filer_client

fix: resolve gRPC DNS resolution issues in Kubernetes #8384 (#8387)

2026-02-19 15:46:02 -08:00

glog

go fmt

2026-04-10 17:31:14 -07:00

iam

iam: test that groups and roles claims reach request-time policy evaluation

2026-07-08 01:53:37 -07:00

iamapi

fix(iam): return a valid user ARN from CreateUser and GetUser (#9794)

2026-06-02 22:01:57 -07:00

images

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

kms

kms: cache decrypted data keys so cache_enabled/cache_ttl take effect (#10173)

2026-06-30 21:23:53 -07:00

mount

refactor: centralize genUploadUrl in UploadOption (#10164)

2026-06-30 20:45:43 -07:00

mq

refactor: centralize genUploadUrl in UploadOption (#10164)

2026-06-30 20:45:43 -07:00

notification

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

operation

mount: re-assign to a live volume when a write can't land (#10239)

2026-07-06 11:41:26 -07:00

pb

s3: tear down the emptied .versions directory on last-version delete; drain existing residue (#10278)

2026-07-08 18:50:54 -07:00

plugin/worker

admin: stop holding the shell admin lock across whole scheduler batches (#10290)

2026-07-09 20:43:55 -07:00

query

s3: invalidate stale reader cache locations on chunk read failure (#10156)

2026-06-30 13:27:49 -07:00

remote_storage

fix(remote/gcs): tolerate already-deleted object in DeleteFile (#10151)

2026-06-30 07:52:25 -07:00

replication

fix(filer.backup): prevent silent backup data loss on transient not-found (#10295)

2026-07-10 01:47:46 -07:00

s3api

s3: enforce role trust policy on direct OIDC bearer authentication (#10302)

2026-07-10 12:14:18 -07:00

security

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

sequence

[nfs] Add NFS (#9067)

2026-04-14 20:48:24 -07:00

server

s3: tear down the emptied .versions directory on last-version delete; drain existing residue (#10278)

2026-07-08 18:50:54 -07:00

sftpd

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

shell

fix(shell): print markVolumeWritable/markVolumeReadonly based on the writable flag (#10283)

2026-07-09 00:30:21 -07:00

static

adjust logo

2026-04-23 10:05:51 -07:00

stats

feat(metrics): Add EC rebuild/reconstruct Prometheus metrics (#10124)

2026-06-27 22:01:36 -07:00

storage

volume.fsck: fix orphan purge against the rust volume server (#10289)

2026-07-09 11:19:31 -07:00

telemetry

Prevent split-brain: Persistent ClusterID and Join Validation (#8022)

2026-01-18 14:02:34 -08:00

topology

topology/balancer: share replica selection between shell and workers (#10276)

2026-07-08 20:06:15 -07:00

util

4.39

2026-07-10 04:08:14 +00:00

wdclient

Fix stale cache fallback for empty volume locations in wdclient (#10081)

2026-06-24 16:31:32 -07:00

worker

admin: stop holding the shell admin lock across whole scheduler batches (#10290)

2026-07-09 20:43:55 -07:00

Makefile

Move SQL engine and PostgreSQL server to their own binaries (#8417)

2026-02-23 16:27:08 -08:00

weed.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00