fix: remove vendor encryption key, close proxy-set path, tighten DCO gate - #3
Merged
Conversation
Follow-up to the rebranding review. - support inspect no longer falls back to MinIO's support public key when the operator has not supplied one. That fallback encrypted locally saved object data to a key only MinIO holds, so the output was neither local nor recoverable by the operator who produced it. Without a key, the server generates one and returns it to the caller, who is its only holder; an operator-supplied support_public.pem still takes precedence. The encrypted upload path fails closed instead of reaching for a vendor key, and the key blob is gone from the binary entirely. - support proxy set configured the server's outbound path to SUBNET, so it now exits with the stable disabled error; show and remove keep working so operators can inspect and clear a legacy setting. - the DCO exemption keyed on the display name, which any author can choose; it now requires a GitHub-issued bot address. - source builds printed 'Copyright (c) 2025-0000 PGSTY'; the placeholder now falls back to the current year, with release ldflags unchanged. - PR template section renamed to match the no-CLA policy, and CONTRIBUTING states that assistive-tooling trailers carry no authorship or copyright and that the human signatory remains responsible. - fixed 6 pre-existing whitespace errors surfaced by the brand sweep. Regression coverage: fail-closed encryption test, plus a brand-gate rule rejecting any embedded public key in cmd/. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the rebranding review (PR #2). Addresses the three P1 findings plus the minor items.
P1
Vendor encryption key removed.
support inspectfell back to MinIO's support public key when the operator had not supplied one (cmd/support-inspect.go), so locally saved raw object data was encrypted to a key only MinIO holds — neither local nor recoverable by the operator who produced it. Now: an operator-suppliedsupport_public.pemstill takes precedence; without one, madmin's no-key path has the server generate a key and return it to the caller, who is its only holder (this is the path--legacyalready used, and the key is printed once). The encrypted upload path incmd/subnet-file-uploader.gofails closed rather than reaching for a vendor key, and the key blob no longer exists anywhere in the binary.support proxy setclosed. It wrotesubnet proxy=…to the target server — configuring its outbound path to SUBNET. Now exits with the stable disabled error, consistent withcallhome enable.showandremovekeep working so operators can inspect and clear a legacy setting.DCO exemption tightened. The bot exemption keyed on the display name, which any author can set; it now requires a GitHub-issued bot address (
*[bot]@users.noreply.github.com).Minor
Copyright (c) 2025-0000 PGSTY; the0000placeholder now falls back to the current year (release ldflags path unchanged)Co-Authored-By:naming an AI) are informational only — no authorship, no copyright claim; the human signatory remains responsibleRegression coverage
TestEncryptedUploadRequiresAnExplicitKey— encrypted upload with no configured key must fail closedcmd/Verification
go build ./...,go vet ./...,make lint(0 issues),go test ./... -count=1all green;git diff --checkclean. Smoke:support proxy setexits 1 with the disabled error,support proxy removeunaffected,--versionshows2025-2026 PGSTYin a source build.Not addressed here (needs owner action)
Branch protection on
main— no ruleset exists, which is why PR #2 could be merged before checks finished. Recommend requiring a PR plus the Go, vetchecks, DCO and Analysis checks. Separately, the migration manual's Phase 0 legal review of the Silo/mclinaming and trademark wording remains outstanding and cannot be satisfied by code or CI.🤖 Generated with Claude Code