)]}'
{"id":"openstack%2Fswift~1003079","triplet_id":"openstack%2Fswift~master~I8b126d54e34f74d3cdb08cae626811caa3daba82","project":"openstack/swift","branch":"master","attention_set":{},"removed_from_attention_set":{"34930":{"account":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"last_update":"2026-09-10 14:33:57.000000000","reason":"Change was abandoned"},"6968":{"account":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"last_update":"2026-09-10 14:33:57.000000000","reason":"Change was abandoned"},"39146":{"account":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"last_update":"2026-09-02 13:57:53.000000000","reason":"\u003cGERRIT_ACCOUNT_39146\u003e replied on the change","reason_account":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"}},"1179":{"account":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"last_update":"2026-09-10 14:33:57.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"I8b126d54e34f74d3cdb08cae626811caa3daba82","subject":"sq? s3api: Store the checksum value as sensitive sysmeta","status":"ABANDONED","created":"2026-08-31 15:59:23.000000000","updated":"2026-09-10 14:33:57.000000000","total_comment_count":11,"unresolved_comment_count":5,"has_review_started":true,"meta_rev_id":"07ca5d86cb88887a32aabe70503aaae32204dbd0","_number":1003079,"virtual_id_number":1003079,"owner":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-09-02 09:57:45.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-31 16:02:48.000000000","updated_by":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"reviewer":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"state":"REVIEWER"},{"updated":"2026-08-31 16:02:48.000000000","updated_by":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"reviewer":{"_account_id":34930,"name":"Jianjian Huo","email":"jhuo@nvidia.com","username":"jhuo"},"state":"REVIEWER"},{"updated":"2026-08-31 17:08:41.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 23:54:09.000000000","updated_by":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"reviewer":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"state":"CC"},{"updated":"2026-09-01 13:01:26.000000000","updated_by":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"reviewer":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"state":"REVIEWER"}],"messages":[{"id":"88d362cf92d0d550bd824fb1b88bd94b2ce05463","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"date":"2026-08-31 15:59:23.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5dabb041031daedcd3559861ea565bc39967cae3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 17:08:41.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/06aae783456445c083f16d780a6576e2\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b882a77ce99a4edaaf6d435148b6d6ff : SUCCESS in 5m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1fac96d22350445a8aff6a21d2b9a0ec : SUCCESS in 3m 56s\n- grenade https://zuul.opendev.org/t/openstack/build/e4073c481e7c483f8a527e77373f0542 : SUCCESS in 55m 23s\n- grenade-skip-level-always https://zuul.opendev.org/t/openstack/build/9e83805e08314da8b1e8e898f60cba5f : SUCCESS in 47m 52s\n- tempest-integrated-object-storage https://zuul.opendev.org/t/openstack/build/ae1da755f1c243948d4182dd881a3df3 : SUCCESS in 43m 47s\n- openstacksdk-functional-devstack https://zuul.opendev.org/t/openstack/build/5c5c1e6464d2402ba6bae0cace1c95e2 : SUCCESS in 1h 02m 00s\n- swift-tox-func-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/4946859adc1f453cb554569325ba6b9c : SUCCESS in 20m 34s (non-voting)\n- swift-tox-func-encryption-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/9628fe9274f84034bb4803615dff9393 : SUCCESS in 22m 22s (non-voting)\n- swift-tox-func-ec-py39-centos-9-stream-fips https://zuul.opendev.org/t/openstack/build/efe46bdf7ebc46fd9f722812d5a69bd0 : SUCCESS in 11m 41s (non-voting)\n- swift-build-image https://zuul.opendev.org/t/openstack/build/0b1063c15cb34e9ca27fc6d9c25d0994 : SUCCESS in 4m 40s (non-voting)\n- swift-tox-py37 https://zuul.opendev.org/t/openstack/build/911d898f475f4471b8d78e75ac91ddd0 : SUCCESS in 27m 02s\n- swift-tox-py310 https://zuul.opendev.org/t/openstack/build/3a7c6ed292454591828b194defb463d0 : SUCCESS in 22m 26s\n- swift-tox-py313 https://zuul.opendev.org/t/openstack/build/9a001e18e2fd43408ac9f5ec3dd05e69 : SUCCESS in 12m 30s\n- swift-tox-py314 https://zuul.opendev.org/t/openstack/build/b9b6321abe6745569ca02dbc2913cc88 : SUCCESS in 20m 32s\n- swift-tox-func-py312 https://zuul.opendev.org/t/openstack/build/b152abf0fd6d4e459391d5418fc1b21c : SUCCESS in 14m 03s\n- swift-tox-func-encryption-py312 https://zuul.opendev.org/t/openstack/build/1e09f06f48d045019ddf8a52e6fcc836 : SUCCESS in 16m 38s\n- swift-tox-func-ec-py312 https://zuul.opendev.org/t/openstack/build/8de4559b4d954f3eb5e3bc1fc9b7567e : SUCCESS in 15m 23s\n- swift-tox-func-py39-centos-9-stream https://zuul.opendev.org/t/openstack/build/a71ed87a108a487cafb60209686eb957 : SUCCESS in 10m 08s\n- swift-func-cors https://zuul.opendev.org/t/openstack/build/5db7b98712e64d03970bd0911a78ab07 : SUCCESS in 5m 02s\n- swift-tox-func-ceph-s3tests-tempauth https://zuul.opendev.org/t/openstack/build/123174df718749c1a343cb3de536270d : FAILURE in 32m 23s (non-voting)\n- swift-tox-func-s3api-compat-tests-tempauth https://zuul.opendev.org/t/openstack/build/6fef0a82dc924a8daab266eadfa72dc8 : SUCCESS in 9m 45s\n- swift-probetests-centos-9-stream https://zuul.opendev.org/t/openstack/build/a1f118be22e841eabbf99f006a58cbcd : SUCCESS in 1h 03m 33s\n- swift-dsvm-functional https://zuul.opendev.org/t/openstack/build/1bef38bd2a9c447ba11be8082e58fe5d : SUCCESS in 42m 33s\n- swift-dsvm-functional-ipv6 https://zuul.opendev.org/t/openstack/build/1a1b81f16f614402a51a2683b4d0772e : SUCCESS in 44m 26s\n- swift-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/0a07e3b0f763410bbe5b8e7ac51911bc : SUCCESS in 13m 43s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/64381e10964d4c2ca71716525b3eef3a : SUCCESS in 4m 21s\n- swift-multinode-rolling-upgrade https://zuul.opendev.org/t/openstack/build/4df60a75f92c44bf94d8e6da60a5b8c0 : SUCCESS in 17m 18s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/52fbef3daaa44f5a89ed09bfeb4155ad : SUCCESS in 1h 01m 30s\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-ec-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/zuul/zuul-jobs/playbooks/unittests/post.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job swift-tox-func-encryption-py39-centos-9-stream-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"2174b28ebd5f7aeea103e29ac6eefe0292b377eb","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 17:09:51.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/52dcc8e7b8f4469694db556a4237c207\n\n- swift-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/ff77a6af9c9349d78d9ee13e6751245d : SUCCESS in 1h 01m 25s","accounts_in_message":[],"_revision_number":1},{"id":"f67e74a56acdcf074cc9db8cd346b35e63ff95ba","author":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"date":"2026-08-31 23:54:09.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"aff1b814f01686233f41eaee16d30bde206ef692","author":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"date":"2026-09-01 13:01:26.000000000","message":"Patch Set 1: Code-Review+1\n\n(6 comments)","accounts_in_message":[],"_revision_number":1},{"id":"1983c98182143778e6c913ce74fded0db85f4814","author":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"date":"2026-09-01 15:31:28.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"5433d78ef78f6b02c066adab844fd192a9cf5ea0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"date":"2026-09-02 09:55:58.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review+1 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"42e2bdb1e76ff4a0e1672786d77b46e3deb83660","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-02 09:56:25.000000000","message":"Patch Set 2:\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/swift for 1003079,2","accounts_in_message":[],"_revision_number":2},{"id":"b57557f225b495427d49fc44b8c29f112a37d8d2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-02 09:57:45.000000000","message":"Patch Set 2: Verified-1\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/swift for 1003079,2","accounts_in_message":[],"_revision_number":2},{"id":"612fff87c1df835f6645d350ad1ed945e6fdd7f2","author":{"_account_id":39146,"name":"Nathaniel Martes","display_name":"Nate Martes","email":"natemartes09@gmail.com","username":"nmartes"},"date":"2026-09-02 13:57:53.000000000","message":"Patch Set 2:\n\n(3 comments)","accounts_in_message":[],"_revision_number":2},{"id":"07ca5d86cb88887a32aabe70503aaae32204dbd0","tag":"autogenerated:gerrit:abandon","author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"date":"2026-09-10 14:33:57.000000000","message":"Abandoned\n\nimplemented in https://review.opendev.org/c/openstack/swift/+/991516 ~ patchset 91","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"8b202da411b88d4743c34b85271389c9e7f5afda","revisions":{"a3f1007c6c9198d290985c4e21c0f27b4baa6b29":{"kind":"REWORK","_number":1,"created":"2026-08-31 15:59:23.000000000","uploader":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"ref":"refs/changes/79/1003079/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/79/1003079/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/79/1003079/1"}}},"commit":{"parents":[{"commit":"29817c61f412cf5e2a5f32c4e572200bf6c9a432","subject":"s3api: Checksum Persistence for Full Object Upload PUTs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/29817c61f412cf5e2a5f32c4e572200bf6c9a432"}]}],"author":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-08-31 12:58:58.000000000","tz":120},"committer":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-08-31 15:58:58.000000000","tz":120},"subject":"crypto: Encrypt sysmeta that is a digest of the object body","message":"crypto: Encrypt sysmeta that is a digest of the object body\n\nThe s3api middleware persists the checksum of a PUT object body as\nx-object-sysmeta-s3api-checksum-value. Under the encryption pipeline\nthat value was written in the clear, so an attacker who gains access to\nthe disks could use it to confirm a guess at the content of an encrypted\nobject. The encrypter already avoids this for the Etag, which it\npersists encrypted.\n\nEncrypt such sysmeta with the object key, in the same way as the\nplaintext Etag, and persist it as x-object-sysmeta-crypto-meta-\u003cname\u003e.\nThe decrypter restores it to its original header name before s3api\nreads it, so checksums are still returned on GET and HEAD.\n\nValues arriving in request headers are encrypted as well as those set in\nfooters, so a checksum propagated by the copy middleware is re-encrypted\nwith the destination object key.\n\nObject versioning reuses that request for a zero-byte symlink PUT, which\nwould leave the digest in the clear, so drop s3api checksum sysmeta from\nthe symlink. It describes the version object\u0027s body, not the symlink.\n\nObjects written before this change keep their plaintext sysmeta and are\nstill read correctly.\n\nRelated-Change: Ie957413640289c458db35c6e65dbdc0e71652322\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I8b126d54e34f74d3cdb08cae626811caa3daba82\nSigned-off-by: Christian Schwede \u003ccschwede@mailbox.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/a3f1007c6c9198d290985c4e21c0f27b4baa6b29"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/a3f1007c6c9198d290985c4e21c0f27b4baa6b29"}]},"branch":"refs/heads/master"},"8b202da411b88d4743c34b85271389c9e7f5afda":{"kind":"REWORK","_number":2,"created":"2026-09-02 09:55:58.000000000","uploader":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"ref":"refs/changes/79/1003079/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/swift","ref":"refs/changes/79/1003079/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/swift refs/changes/79/1003079/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/swift refs/changes/79/1003079/2"}}},"commit":{"parents":[{"commit":"29817c61f412cf5e2a5f32c4e572200bf6c9a432","subject":"s3api: Checksum Persistence for Full Object Upload PUTs","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/29817c61f412cf5e2a5f32c4e572200bf6c9a432"}]}],"author":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-09-02 07:34:29.000000000","tz":120},"committer":{"name":"Christian Schwede","email":"cschwede@mailbox.org","date":"2026-09-02 09:55:00.000000000","tz":120},"subject":"sq? s3api: Store the checksum value as sensitive sysmeta","message":"sq? s3api: Store the checksum value as sensitive sysmeta\n\nThe checksum is a digest of the plaintext object body. With the\nencryption pipeline, s3api wrote the checksum to disk in the clear, next\nto the ciphertext. An attacker who gets access to the disks can use the\nchecksum to confirm a guess at the content of an encrypted object.\n\nStore the checksum value in the x-object-sysmeta-sensitive- namespace.\nThe encrypter then encrypts the value with the object key. The algorithm\nand the type are not digests of the body, and they do not move.\n\nis_s3api_sysmeta() also matches the sensitive namespace. Because of this,\ns3api keeps the value out of the response headers, and the copy hook\nstill removes the value from the sink of a copy.\n\nObject versioning removes the algorithm and the type from the zero-byte\nsymlink that it writes for a versioned object. These describe the version\nobject, not the symlink. The sensitive sysmeta code in\nIf9d53f4f1e548dc735813ed9adbc33088037272c removes the value.\n\nDepends-On: If9d53f4f1e548dc735813ed9adbc33088037272c\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I8b126d54e34f74d3cdb08cae626811caa3daba82\nSigned-off-by: Christian Schwede \u003ccschwede@mailbox.org\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/8b202da411b88d4743c34b85271389c9e7f5afda"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/swift/commit/8b202da411b88d4743c34b85271389c9e7f5afda"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}