smengcl opened a new pull request, #11596: URL: https://github.com/apache/ozone/pull/11596
Generated-by: Claude Code (Opus 5.5) ## What changes were proposed in this pull request? THREAT_MODEL.md does not state what a GDPR bucket guarantees. This adds a §9 entry: a GDPR bucket is a crypto-erasure aid (on delete the OM removes the per-key secret, or in a TDE bucket the encrypted data key, so the remaining blocks cannot be read), not encryption at rest, which TDE provides (§8 item 6). The entry also lists what the feature does not cover: the secret is returned to readers of the key and has copies in the Ratis log, RocksDB files, OM DB copies and OM snapshots; stored blocks are not authenticated; and only the Ozone shell marks keys for GDPR encryption, so keys written through the S3 Gateway or ofs/o3fs are not encrypted. The §1 revisions line is updated. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-17096 ## How was this patch tested? Documentation only. Statements checked against the code: `GDPRSymmetricKey`, `OmKeyArgs.Builder.addAllMetadataGdpr`, `RpcClient.createSecureOutputStream`/`createInputStream`/`createFile`, `OmUtils.prepareKeyForDelete`, `PutKeyHandler`/`CopyKeyHandler`, and the S3 Gateway metadata filter in `EndpointBase`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
