aboutsummaryrefslogtreecommitdiff
path: root/weed
diff options
context:
space:
mode:
Diffstat (limited to 'weed')
-rw-r--r--weed/notification/webhook/webhook_queue.go16
-rw-r--r--weed/s3api/s3_constants/header.go5
-rw-r--r--weed/s3api/s3api_object_handlers.go48
-rw-r--r--weed/s3api/s3api_object_handlers_put.go164
-rw-r--r--weed/s3api/s3api_object_lock_headers_test.go662
-rw-r--r--weed/s3api/s3api_object_retention.go16
6 files changed, 889 insertions, 22 deletions
diff --git a/weed/notification/webhook/webhook_queue.go b/weed/notification/webhook/webhook_queue.go
index d8f9a0734..f5853dc2d 100644
--- a/weed/notification/webhook/webhook_queue.go
+++ b/weed/notification/webhook/webhook_queue.go
@@ -196,7 +196,21 @@ func (w *Queue) logDeadLetterMessages() error {
for {
select {
case msg := <-ch:
- glog.Errorf("received dead letter message: %s, key: %s", string(msg.Payload), msg.Metadata["key"])
+ if msg == nil {
+ glog.Errorf("received nil message from dead letter channel")
+ continue
+ }
+ key := "unknown"
+ if msg.Metadata != nil {
+ if keyValue, exists := msg.Metadata["key"]; exists {
+ key = keyValue
+ }
+ }
+ payload := ""
+ if msg.Payload != nil {
+ payload = string(msg.Payload)
+ }
+ glog.Errorf("received dead letter message: %s, key: %s", payload, key)
case <-w.ctx.Done():
return
}
diff --git a/weed/s3api/s3_constants/header.go b/weed/s3api/s3_constants/header.go
index e0db5ef9a..52bcda548 100644
--- a/weed/s3api/s3_constants/header.go
+++ b/weed/s3api/s3_constants/header.go
@@ -52,7 +52,10 @@ const (
AmzAclWriteAcp = "X-Amz-Grant-Write-Acp"
// S3 Object Lock headers
- AmzBucketObjectLockEnabled = "X-Amz-Bucket-Object-Lock-Enabled"
+ AmzBucketObjectLockEnabled = "X-Amz-Bucket-Object-Lock-Enabled"
+ AmzObjectLockMode = "X-Amz-Object-Lock-Mode"
+ AmzObjectLockRetainUntilDate = "X-Amz-Object-Lock-Retain-Until-Date"
+ AmzObjectLockLegalHold = "X-Amz-Object-Lock-Legal-Hold"
// S3 conditional copy headers
AmzCopySourceIfMatch = "X-Amz-Copy-Source-If-Match"
diff --git a/weed/s3api/s3api_object_handlers.go b/weed/s3api/s3api_object_handlers.go
index 6b811a024..0aa96b21a 100644
--- a/weed/s3api/s3api_object_handlers.go
+++ b/weed/s3api/s3api_object_handlers.go
@@ -6,6 +6,7 @@ import (
"io"
"net/http"
"net/url"
+ "strconv"
"strings"
"time"
@@ -195,6 +196,9 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
// Set version ID in response header
w.Header().Set("x-amz-version-id", targetVersionId)
+
+ // Add object lock metadata to response headers if present
+ s3a.addObjectLockHeadersToResponse(w, entry)
} else {
// Handle regular GET (non-versioned)
destUrl = s3a.toFilerUrl(bucket, object)
@@ -271,6 +275,9 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
// Set version ID in response header
w.Header().Set("x-amz-version-id", targetVersionId)
+
+ // Add object lock metadata to response headers if present
+ s3a.addObjectLockHeadersToResponse(w, entry)
} else {
// Handle regular HEAD (non-versioned)
destUrl = s3a.toFilerUrl(bucket, object)
@@ -435,3 +442,44 @@ func passThroughResponse(proxyResponse *http.Response, w http.ResponseWriter) (s
}
return statusCode, bytesTransferred
}
+
+// addObjectLockHeadersToResponse extracts object lock metadata from entry Extended attributes
+// and adds the appropriate S3 headers to the response
+func (s3a *S3ApiServer) addObjectLockHeadersToResponse(w http.ResponseWriter, entry *filer_pb.Entry) {
+ if entry == nil || entry.Extended == nil {
+ return
+ }
+
+ // Check if this entry has any object lock metadata (indicating it's from an object lock enabled bucket)
+ hasObjectLockMode := false
+ hasRetentionDate := false
+
+ // Add object lock mode header if present
+ if modeBytes, exists := entry.Extended[s3_constants.ExtObjectLockModeKey]; exists && len(modeBytes) > 0 {
+ w.Header().Set(s3_constants.AmzObjectLockMode, string(modeBytes))
+ hasObjectLockMode = true
+ }
+
+ // Add retention until date header if present
+ if dateBytes, exists := entry.Extended[s3_constants.ExtRetentionUntilDateKey]; exists && len(dateBytes) > 0 {
+ dateStr := string(dateBytes)
+ // Convert Unix timestamp to ISO8601 format for S3 compatibility
+ if timestamp, err := strconv.ParseInt(dateStr, 10, 64); err == nil {
+ retainUntilDate := time.Unix(timestamp, 0).UTC()
+ w.Header().Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+ hasRetentionDate = true
+ } else {
+ glog.Errorf("addObjectLockHeadersToResponse: failed to parse retention until date from stored metadata (dateStr: %s): %v", dateStr, err)
+ }
+ }
+
+ // Add legal hold header - AWS S3 behavior: always include legal hold for object lock enabled buckets
+ if legalHoldBytes, exists := entry.Extended[s3_constants.ExtLegalHoldKey]; exists && len(legalHoldBytes) > 0 {
+ // Return stored S3 standard "ON"/"OFF" values directly
+ w.Header().Set(s3_constants.AmzObjectLockLegalHold, string(legalHoldBytes))
+ } else if hasObjectLockMode || hasRetentionDate {
+ // If this entry has object lock metadata (indicating object lock enabled bucket)
+ // but no legal hold specifically set, default to "OFF" as per AWS S3 behavior
+ w.Header().Set(s3_constants.AmzObjectLockLegalHold, s3_constants.LegalHoldOff)
+ }
+}
diff --git a/weed/s3api/s3api_object_handlers_put.go b/weed/s3api/s3api_object_handlers_put.go
index 29c31b6bd..ebdfc8567 100644
--- a/weed/s3api/s3api_object_handlers_put.go
+++ b/weed/s3api/s3api_object_handlers_put.go
@@ -3,9 +3,11 @@ package s3api
import (
"crypto/md5"
"encoding/json"
+ "errors"
"fmt"
"io"
"net/http"
+ "strconv"
"strings"
"time"
@@ -20,6 +22,18 @@ import (
stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
)
+// Object lock validation errors
+var (
+ ErrObjectLockVersioningRequired = errors.New("object lock headers can only be used on versioned buckets")
+ ErrInvalidObjectLockMode = errors.New("invalid object lock mode")
+ ErrInvalidLegalHoldStatus = errors.New("invalid legal hold status")
+ ErrInvalidRetentionDateFormat = errors.New("invalid retention until date format")
+ ErrRetentionDateMustBeFuture = errors.New("retention until date must be in the future")
+ ErrObjectLockModeRequiresDate = errors.New("object lock mode requires retention until date")
+ ErrRetentionDateRequiresMode = errors.New("retention until date requires object lock mode")
+ ErrGovernanceBypassVersioningRequired = errors.New("governance bypass header can only be used on versioned buckets")
+)
+
func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request) {
// http://docs.aws.amazon.com/AmazonS3/latest/dev/UploadingObjects.html
@@ -85,13 +99,24 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
glog.V(1).Infof("PutObjectHandler: bucket %s, object %s, versioningEnabled=%v", bucket, object, versioningEnabled)
- // Check object lock permissions before PUT operation (only for versioned buckets)
- bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
- if err := s3a.checkObjectLockPermissionsForPut(r, bucket, object, bypassGovernance, versioningEnabled); err != nil {
- s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+ // Validate object lock headers before processing
+ if err := s3a.validateObjectLockHeaders(r, versioningEnabled); err != nil {
+ glog.V(2).Infof("PutObjectHandler: object lock header validation failed for bucket %s, object %s: %v", bucket, object, err)
+ s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(err))
return
}
+ // For non-versioned buckets, check if existing object has object lock protections
+ // that would prevent overwrite (PUT operations overwrite existing objects in non-versioned buckets)
+ if !versioningEnabled {
+ bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+ if err := s3a.checkObjectLockPermissions(r, bucket, object, "", bypassGovernance); err != nil {
+ glog.V(2).Infof("PutObjectHandler: object lock permissions check failed for %s/%s: %v", bucket, object, err)
+ s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+ return
+ }
+ }
+
if versioningEnabled {
// Handle versioned PUT
glog.V(1).Infof("PutObjectHandler: using versioned PUT for %s/%s", bucket, object)
@@ -287,6 +312,12 @@ func (s3a *S3ApiServer) putVersionedObject(r *http.Request, bucket, object strin
}
versionEntry.Extended[s3_constants.ExtETagKey] = []byte(etag)
+ // Extract and store object lock metadata from request headers
+ if err := s3a.extractObjectLockMetadataFromRequest(r, versionEntry); err != nil {
+ glog.Errorf("putVersionedObject: failed to extract object lock metadata: %v", err)
+ return "", "", s3err.ErrInvalidRequest
+ }
+
// Update the version entry with metadata
err = s3a.mkFile(bucketDir, versionObjectPath, versionEntry.Chunks, func(updatedEntry *filer_pb.Entry) {
updatedEntry.Extended = versionEntry.Extended
@@ -341,3 +372,128 @@ func (s3a *S3ApiServer) updateLatestVersionInDirectory(bucket, object, versionId
return nil
}
+
+// extractObjectLockMetadataFromRequest extracts object lock headers from PUT requests
+// and stores them in the entry's Extended attributes
+func (s3a *S3ApiServer) extractObjectLockMetadataFromRequest(r *http.Request, entry *filer_pb.Entry) error {
+ if entry.Extended == nil {
+ entry.Extended = make(map[string][]byte)
+ }
+
+ // Extract object lock mode (GOVERNANCE or COMPLIANCE)
+ if mode := r.Header.Get(s3_constants.AmzObjectLockMode); mode != "" {
+ entry.Extended[s3_constants.ExtObjectLockModeKey] = []byte(mode)
+ glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing object lock mode: %s", mode)
+ }
+
+ // Extract retention until date
+ if retainUntilDate := r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate); retainUntilDate != "" {
+ // Parse the ISO8601 date and convert to Unix timestamp for storage
+ parsedTime, err := time.Parse(time.RFC3339, retainUntilDate)
+ if err != nil {
+ glog.Errorf("extractObjectLockMetadataFromRequest: failed to parse retention until date, expected format: %s, error: %v", time.RFC3339, err)
+ return ErrInvalidRetentionDateFormat
+ }
+ entry.Extended[s3_constants.ExtRetentionUntilDateKey] = []byte(strconv.FormatInt(parsedTime.Unix(), 10))
+ glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing retention until date (timestamp: %d)", parsedTime.Unix())
+ }
+
+ // Extract legal hold status
+ if legalHold := r.Header.Get(s3_constants.AmzObjectLockLegalHold); legalHold != "" {
+ // Store S3 standard "ON"/"OFF" values directly
+ if legalHold == s3_constants.LegalHoldOn || legalHold == s3_constants.LegalHoldOff {
+ entry.Extended[s3_constants.ExtLegalHoldKey] = []byte(legalHold)
+ glog.V(2).Infof("extractObjectLockMetadataFromRequest: storing legal hold: %s", legalHold)
+ } else {
+ glog.Errorf("extractObjectLockMetadataFromRequest: unexpected legal hold value provided, expected 'ON' or 'OFF'")
+ return ErrInvalidLegalHoldStatus
+ }
+ }
+
+ return nil
+}
+
+// validateObjectLockHeaders validates object lock headers in PUT requests
+func (s3a *S3ApiServer) validateObjectLockHeaders(r *http.Request, versioningEnabled bool) error {
+ // Extract object lock headers from request
+ mode := r.Header.Get(s3_constants.AmzObjectLockMode)
+ retainUntilDateStr := r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate)
+ legalHold := r.Header.Get(s3_constants.AmzObjectLockLegalHold)
+
+ // Check if any object lock headers are present
+ hasObjectLockHeaders := mode != "" || retainUntilDateStr != "" || legalHold != ""
+
+ // Object lock headers can only be used on versioned buckets
+ if hasObjectLockHeaders && !versioningEnabled {
+ return ErrObjectLockVersioningRequired
+ }
+
+ // Validate object lock mode if present
+ if mode != "" {
+ if mode != s3_constants.RetentionModeGovernance && mode != s3_constants.RetentionModeCompliance {
+ return ErrInvalidObjectLockMode
+ }
+ }
+
+ // Validate retention date if present
+ if retainUntilDateStr != "" {
+ retainUntilDate, err := time.Parse(time.RFC3339, retainUntilDateStr)
+ if err != nil {
+ return ErrInvalidRetentionDateFormat
+ }
+
+ // Retention date must be in the future
+ if retainUntilDate.Before(time.Now()) {
+ return ErrRetentionDateMustBeFuture
+ }
+ }
+
+ // If mode is specified, retention date must also be specified
+ if mode != "" && retainUntilDateStr == "" {
+ return ErrObjectLockModeRequiresDate
+ }
+
+ // If retention date is specified, mode must also be specified
+ if retainUntilDateStr != "" && mode == "" {
+ return ErrRetentionDateRequiresMode
+ }
+
+ // Validate legal hold if present
+ if legalHold != "" {
+ if legalHold != s3_constants.LegalHoldOn && legalHold != s3_constants.LegalHoldOff {
+ return ErrInvalidLegalHoldStatus
+ }
+ }
+
+ // Check for governance bypass header - only valid for versioned buckets
+ bypassGovernance := r.Header.Get("x-amz-bypass-governance-retention") == "true"
+
+ // Governance bypass headers are only valid for versioned buckets (like object lock headers)
+ if bypassGovernance && !versioningEnabled {
+ return ErrGovernanceBypassVersioningRequired
+ }
+
+ return nil
+}
+
+// mapValidationErrorToS3Error maps object lock validation errors to appropriate S3 error codes
+func mapValidationErrorToS3Error(err error) s3err.ErrorCode {
+ switch {
+ case errors.Is(err, ErrObjectLockVersioningRequired):
+ return s3err.ErrInvalidRequest
+ case errors.Is(err, ErrInvalidObjectLockMode):
+ return s3err.ErrInvalidRequest
+ case errors.Is(err, ErrInvalidLegalHoldStatus):
+ return s3err.ErrInvalidRequest
+ case errors.Is(err, ErrInvalidRetentionDateFormat):
+ return s3err.ErrMalformedDate
+ case errors.Is(err, ErrRetentionDateMustBeFuture),
+ errors.Is(err, ErrObjectLockModeRequiresDate),
+ errors.Is(err, ErrRetentionDateRequiresMode):
+ return s3err.ErrInvalidRequest
+ case errors.Is(err, ErrGovernanceBypassVersioningRequired):
+ return s3err.ErrInvalidRequest
+ default:
+ return s3err.ErrInvalidRequest
+ }
+}
diff --git a/weed/s3api/s3api_object_lock_headers_test.go b/weed/s3api/s3api_object_lock_headers_test.go
new file mode 100644
index 000000000..111aa0fa9
--- /dev/null
+++ b/weed/s3api/s3api_object_lock_headers_test.go
@@ -0,0 +1,662 @@
+package s3api
+
+import (
+ "fmt"
+ "net/http/httptest"
+ "strconv"
+ "testing"
+ "time"
+
+ "errors"
+
+ "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+ "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+ "github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+ "github.com/stretchr/testify/assert"
+)
+
+// TestExtractObjectLockMetadataFromRequest tests the function that extracts
+// object lock headers from PUT requests and stores them in Extended attributes.
+// This test would have caught the bug where object lock headers were ignored.
+func TestExtractObjectLockMetadataFromRequest(t *testing.T) {
+ s3a := &S3ApiServer{}
+
+ t.Run("Extract COMPLIANCE mode and retention date", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ // Verify mode was stored
+ assert.Contains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
+ assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+
+ // Verify retention date was stored
+ assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+ storedTimestamp, err := strconv.ParseInt(string(entry.Extended[s3_constants.ExtRetentionUntilDateKey]), 10, 64)
+ assert.NoError(t, err)
+ storedTime := time.Unix(storedTimestamp, 0)
+ assert.WithinDuration(t, retainUntilDate, storedTime, 1*time.Second)
+ })
+
+ t.Run("Extract GOVERNANCE mode and retention date", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(12 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+ assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+ })
+
+ t.Run("Extract legal hold ON", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+ assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+ })
+
+ t.Run("Extract legal hold OFF", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+ assert.Equal(t, "OFF", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+ })
+
+ t.Run("Handle all object lock headers together", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ // All metadata should be stored
+ assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+ assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+ assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
+ })
+
+ t.Run("Handle no object lock headers", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ // No object lock headers set
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ // No object lock metadata should be stored
+ assert.NotContains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
+ assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+ assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+ })
+
+ t.Run("Handle invalid retention date - should return error", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date")
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
+
+ // Mode should be stored but not invalid date
+ assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
+ assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
+ })
+
+ t.Run("Handle invalid legal hold value - should return error", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID")
+
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
+
+ // No legal hold metadata should be stored due to error
+ assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
+ })
+}
+
+// TestAddObjectLockHeadersToResponse tests the function that adds object lock
+// metadata from Extended attributes to HTTP response headers.
+// This test would have caught the bug where HEAD responses didn't include object lock metadata.
+func TestAddObjectLockHeadersToResponse(t *testing.T) {
+ s3a := &S3ApiServer{}
+
+ t.Run("Add COMPLIANCE mode and retention date to response", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ retainUntilTime := time.Now().Add(24 * time.Hour)
+
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtObjectLockModeKey: []byte("COMPLIANCE"),
+ s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // Verify headers were set
+ assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+
+ // Verify the date format is correct
+ returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
+ parsedTime, err := time.Parse(time.RFC3339, returnedDate)
+ assert.NoError(t, err)
+ assert.WithinDuration(t, retainUntilTime, parsedTime, 1*time.Second)
+ })
+
+ t.Run("Add GOVERNANCE mode to response", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ })
+
+ t.Run("Add legal hold ON to response", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtLegalHoldKey: []byte("ON"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Add legal hold OFF to response", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtLegalHoldKey: []byte("OFF"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Add all object lock headers to response", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ retainUntilTime := time.Now().Add(12 * time.Hour)
+
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
+ s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+ s3_constants.ExtLegalHoldKey: []byte("ON"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // All headers should be set
+ assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle entry with no object lock metadata", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ "other-metadata": []byte("some-value"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // No object lock headers should be set for entries without object lock metadata
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle entry with object lock mode but no legal hold - should default to OFF", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // Should set mode and default legal hold to OFF
+ assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle entry with retention date but no legal hold - should default to OFF", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ retainUntilTime := time.Now().Add(24 * time.Hour)
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // Should set retention date and default legal hold to OFF
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle nil entry gracefully", func(t *testing.T) {
+ w := httptest.NewRecorder()
+
+ // Should not panic
+ s3a.addObjectLockHeadersToResponse(w, nil)
+
+ // No headers should be set
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle entry with nil Extended map gracefully", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: nil,
+ }
+
+ // Should not panic
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // No headers should be set
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+ })
+
+ t.Run("Handle invalid retention timestamp gracefully", func(t *testing.T) {
+ w := httptest.NewRecorder()
+ entry := &filer_pb.Entry{
+ Extended: map[string][]byte{
+ s3_constants.ExtObjectLockModeKey: []byte("COMPLIANCE"),
+ s3_constants.ExtRetentionUntilDateKey: []byte("invalid-timestamp"),
+ },
+ }
+
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // Mode should be set but not retention date due to invalid timestamp
+ assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ })
+}
+
+// TestObjectLockHeaderRoundTrip tests the complete round trip:
+// extract from request → store in Extended attributes → add to response
+func TestObjectLockHeaderRoundTrip(t *testing.T) {
+ s3a := &S3ApiServer{}
+
+ t.Run("Complete round trip for COMPLIANCE mode", func(t *testing.T) {
+ // 1. Create request with object lock headers
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+ // 2. Extract and store in Extended attributes
+ entry := &filer_pb.Entry{
+ Extended: make(map[string][]byte),
+ }
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ // 3. Add to response headers
+ w := httptest.NewRecorder()
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ // 4. Verify round trip preserved all data
+ assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
+
+ returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
+ parsedTime, err := time.Parse(time.RFC3339, returnedDate)
+ assert.NoError(t, err)
+ assert.WithinDuration(t, retainUntilDate, parsedTime, 1*time.Second)
+ })
+
+ t.Run("Complete round trip for GOVERNANCE mode", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(12 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ entry := &filer_pb.Entry{Extended: make(map[string][]byte)}
+ err := s3a.extractObjectLockMetadataFromRequest(req, entry)
+ assert.NoError(t, err)
+
+ w := httptest.NewRecorder()
+ s3a.addObjectLockHeadersToResponse(w, entry)
+
+ assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
+ assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
+ })
+}
+
+// TestValidateObjectLockHeaders tests the validateObjectLockHeaders function
+// to ensure proper validation of object lock headers in PUT requests
+func TestValidateObjectLockHeaders(t *testing.T) {
+ s3a := &S3ApiServer{}
+
+ t.Run("Valid COMPLIANCE mode with retention date on versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("Valid GOVERNANCE mode with retention date on versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(12 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("Valid legal hold ON on versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("Valid legal hold OFF on versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("Invalid object lock mode", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "INVALID_MODE")
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrInvalidObjectLockMode))
+ })
+
+ t.Run("Invalid legal hold status", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID_STATUS")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
+ })
+
+ t.Run("Object lock headers on non-versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrObjectLockVersioningRequired))
+ })
+
+ t.Run("Invalid retention date format", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date-format")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
+ })
+
+ t.Run("Retention date in the past", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+ pastDate := time.Now().Add(-24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, pastDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrRetentionDateMustBeFuture))
+ })
+
+ t.Run("Mode without retention date", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrObjectLockModeRequiresDate))
+ })
+
+ t.Run("Retention date without mode", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(24 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrRetentionDateRequiresMode))
+ })
+
+ t.Run("Governance bypass header on non-versioned bucket", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set("x-amz-bypass-governance-retention", "true")
+
+ err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+ assert.Error(t, err)
+ assert.True(t, errors.Is(err, ErrGovernanceBypassVersioningRequired))
+ })
+
+ t.Run("Governance bypass header on versioned bucket should pass", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ req.Header.Set("x-amz-bypass-governance-retention", "true")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("No object lock headers should pass", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ // No object lock headers set
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+
+ t.Run("Mixed valid headers should pass", func(t *testing.T) {
+ req := httptest.NewRequest("PUT", "/bucket/object", nil)
+ retainUntilDate := time.Now().Add(48 * time.Hour)
+ req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
+ req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
+ req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
+
+ err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+ assert.NoError(t, err)
+ })
+}
+
+// TestMapValidationErrorToS3Error tests the error mapping function
+func TestMapValidationErrorToS3Error(t *testing.T) {
+ tests := []struct {
+ name string
+ inputError error
+ expectedCode s3err.ErrorCode
+ }{
+ {
+ name: "ErrObjectLockVersioningRequired",
+ inputError: ErrObjectLockVersioningRequired,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrInvalidObjectLockMode",
+ inputError: ErrInvalidObjectLockMode,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrInvalidLegalHoldStatus",
+ inputError: ErrInvalidLegalHoldStatus,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrInvalidRetentionDateFormat",
+ inputError: ErrInvalidRetentionDateFormat,
+ expectedCode: s3err.ErrMalformedDate,
+ },
+ {
+ name: "ErrRetentionDateMustBeFuture",
+ inputError: ErrRetentionDateMustBeFuture,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrObjectLockModeRequiresDate",
+ inputError: ErrObjectLockModeRequiresDate,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrRetentionDateRequiresMode",
+ inputError: ErrRetentionDateRequiresMode,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "ErrGovernanceBypassVersioningRequired",
+ inputError: ErrGovernanceBypassVersioningRequired,
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ {
+ name: "Unknown error defaults to ErrInvalidRequest",
+ inputError: fmt.Errorf("unknown error"),
+ expectedCode: s3err.ErrInvalidRequest,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ result := mapValidationErrorToS3Error(tt.inputError)
+ assert.Equal(t, tt.expectedCode, result)
+ })
+ }
+}
+
+// TestObjectLockPermissionLogic documents the correct behavior for object lock permission checks
+// in PUT operations for both versioned and non-versioned buckets
+func TestObjectLockPermissionLogic(t *testing.T) {
+ t.Run("Non-versioned bucket PUT operation logic", func(t *testing.T) {
+ // In non-versioned buckets, PUT operations overwrite existing objects
+ // Therefore, we MUST check if the existing object has object lock protections
+ // that would prevent overwrite before allowing the PUT operation.
+ //
+ // This test documents the expected behavior:
+ // 1. Check object lock headers validity (handled by validateObjectLockHeaders)
+ // 2. Check if existing object has object lock protections (handled by checkObjectLockPermissions)
+ // 3. If existing object is under retention/legal hold, deny the PUT unless governance bypass is valid
+
+ t.Log("For non-versioned buckets:")
+ t.Log("- PUT operations overwrite existing objects")
+ t.Log("- Must check existing object lock protections before allowing overwrite")
+ t.Log("- Governance bypass headers can be used to override GOVERNANCE mode retention")
+ t.Log("- COMPLIANCE mode retention and legal holds cannot be bypassed")
+ })
+
+ t.Run("Versioned bucket PUT operation logic", func(t *testing.T) {
+ // In versioned buckets, PUT operations create new versions without overwriting existing ones
+ // Therefore, we do NOT need to check existing object permissions since we're not modifying them.
+ // We only need to validate the object lock headers for the new version being created.
+ //
+ // This test documents the expected behavior:
+ // 1. Check object lock headers validity (handled by validateObjectLockHeaders)
+ // 2. Skip checking existing object permissions (since we're creating a new version)
+ // 3. Apply object lock metadata to the new version being created
+
+ t.Log("For versioned buckets:")
+ t.Log("- PUT operations create new versions without overwriting existing objects")
+ t.Log("- No need to check existing object lock protections")
+ t.Log("- Only validate object lock headers for the new version being created")
+ t.Log("- Each version has independent object lock settings")
+ })
+
+ t.Run("Governance bypass header validation", func(t *testing.T) {
+ // Governance bypass headers should only be used in specific scenarios:
+ // 1. Only valid on versioned buckets (consistent with object lock headers)
+ // 2. For non-versioned buckets: Used to override existing object's GOVERNANCE retention
+ // 3. For versioned buckets: Not typically needed since new versions don't conflict with existing ones
+
+ t.Log("Governance bypass behavior:")
+ t.Log("- Only valid on versioned buckets (header validation)")
+ t.Log("- For non-versioned buckets: Allows overwriting objects under GOVERNANCE retention")
+ t.Log("- For versioned buckets: Not typically needed for PUT operations")
+ t.Log("- Must have s3:BypassGovernanceRetention permission")
+ })
+}
diff --git a/weed/s3api/s3api_object_retention.go b/weed/s3api/s3api_object_retention.go
index 6747ac84c..8ef80a885 100644
--- a/weed/s3api/s3api_object_retention.go
+++ b/weed/s3api/s3api_object_retention.go
@@ -611,22 +611,6 @@ func (s3a *S3ApiServer) isObjectLockAvailable(bucket string) error {
return nil
}
-// checkObjectLockPermissionsForPut checks object lock permissions for PUT operations
-// This is a shared helper to avoid code duplication in PUT handlers
-func (s3a *S3ApiServer) checkObjectLockPermissionsForPut(request *http.Request, bucket, object string, bypassGovernance bool, versioningEnabled bool) error {
- // Object Lock only applies to versioned buckets (AWS S3 requirement)
- if !versioningEnabled {
- return nil
- }
-
- // For PUT operations, we check permissions on the current object (empty versionId)
- if err := s3a.checkObjectLockPermissions(request, bucket, object, "", bypassGovernance); err != nil {
- glog.V(2).Infof("checkObjectLockPermissionsForPut: object lock check failed for %s/%s: %v", bucket, object, err)
- return err
- }
- return nil
-}
-
// handleObjectLockAvailabilityCheck is a helper function to check object lock availability
// and write the appropriate error response if not available. This reduces code duplication
// across all retention handlers.
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-21 09:44:54 +0000