S3 files contain metadata to uniquely associate them with keys #901
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Generate changelog in
|
✅ Successfully generated changelog entry!Need to regenerate?Simply interact with the changelog bot comment again to regenerate these entries. 📋Changelog Preview✨ Features
|
mswintermeyer
force-pushed
the
mw/s3-metadata-to-keys
branch
from
ba339ec to
33e15f0
Compare
mswintermeyer
commented
Nov 25, 2025
| private static final String DEFAULT_CIPHER_ALGORITHM = AesCtrCipher.ALGORITHM; | ||
| private static final String S3_METADATA_KEY = "crypto-file-key-suffix"; | ||
| private static final String S3_METADATA_KEY_HEADER = | ||
| Constants.FS_S3A_CREATE_HEADER + ".x-amz-meta-" + S3_METADATA_KEY; |
Contributor
Author
There was a problem hiding this comment.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this PR
There's currently a race condition possible that can make files impossible to decrypt, if a file is re-uploaded to s3.
If a service implementing the S3 API takes a long time to process a file creation request (e.g. while ceph is resharding), if the file is re-uploaded during that time, there are no guarantees on which write wins. That means that a file could exist from one upload, but the key material from the other upload, and since they don't match the file can't be decrypted.
After this PR
Fix the race for s3, by always using a unique suffix/identifier for the file key (so they won't ever overwrite each other) and attaching metadata to the primary file with that identifier.
There's now a risk that if a file is re-uploaded, two key material files could exist for it, and one will be useless and never get deleted. But that's reasonable tradeoff to having files that cannot be decrypted.
==COMMIT_MSG==
S3 files contain metadata to uniquely associate them with keys, to protect against a race condition when a file is uploaded twice
==COMMIT_MSG==
Possible downsides?