This is an automated email from the ASF dual-hosted git repository. rishabhdaim pushed a commit to branch OAK-12285 in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
commit 3c9263af61326ead1b0ca8f26218277d4706535d Author: rishabhdaim <[email protected]> AuthorDate: Fri Jun 26 10:52:47 2026 +0530 OAK-12285 : fixed issue where SSE-KMS presigned urls were getting skipped when sseCustomerKey was configured --- .../oak/blob/cloud/s3/S3DataRecordAccessProviderTest.java | 9 ++++++--- .../jackrabbit/oak/blob/cloud/s3/S3DataStoreUtils.java | 3 +-- .../org/apache/jackrabbit/oak/blob/cloud/s3/TestS3Ds.java | 9 +++++++-- .../directaccess/AbstractDataRecordAccessProviderTest.java | 12 ++++++++---- 4 files changed, 22 insertions(+), 11 deletions(-) diff --git a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataRecordAccessProviderTest.java b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataRecordAccessProviderTest.java index fc095532ad..78d6319008 100644 --- a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataRecordAccessProviderTest.java +++ b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataRecordAccessProviderTest.java @@ -185,7 +185,8 @@ public class S3DataRecordAccessProviderTest extends AbstractDataRecordAccessProv @Override @Test public void testGetDownloadURIIT() throws DataStoreException, IOException { - assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + assumeTrue("Presigned GET URLs are skipped for SSE-C", + !isSSECustomerKeyEncryption()); DataRecord dataRecord = null; DataRecordAccessProvider store = getDataStore(); try { @@ -214,7 +215,8 @@ public class S3DataRecordAccessProviderTest extends AbstractDataRecordAccessProv @Override @Test public void testGetDownloadURIWithCustomHeadersIT() throws DataStoreException, IOException { - assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + assumeTrue("Presigned GET URLs are skipped for SSE-C", + !isSSECustomerKeyEncryption()); String umlautFilename = "Umläutfile.png"; String umlautfilenameIso88591 = new String( StandardCharsets.ISO_8859_1.encode(umlautFilename).array(), @@ -301,7 +303,8 @@ public class S3DataRecordAccessProviderTest extends AbstractDataRecordAccessProv @Override @Test public void testGetExpiredReadURIFailsIT() throws DataStoreException, IOException { - assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + assumeTrue("Presigned GET URLs are skipped for SSE-C", + !isSSECustomerKeyEncryption()); assumeTrue("S3Mock does not enforce presigned URL expiry", !S3EmulatorSupport.isAvailable()); DataRecord dataRecord = null; ConfigurableDataRecordAccessProvider store = getDataStore(); diff --git a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataStoreUtils.java b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataStoreUtils.java index 4cb3b6626a..8064b9b652 100644 --- a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataStoreUtils.java +++ b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/S3DataStoreUtils.java @@ -96,8 +96,7 @@ public class S3DataStoreUtils extends DataStoreUtils { */ public static boolean isSseCustomerKeyEncrypted() { final Properties s3Config = getS3Config(); - return Objects.equals(Utils.getDataEncryption(s3Config), DataEncryption.SSE_C) - || Objects.nonNull(s3Config.getProperty(S3Constants.S3_SSE_C_KEY)); + return Objects.equals(Utils.getDataEncryption(s3Config), DataEncryption.SSE_C); } /** diff --git a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/TestS3Ds.java b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/TestS3Ds.java index 5826a0de23..8a240a0154 100644 --- a/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/TestS3Ds.java +++ b/oak-blob-cloud/src/test/java/org/apache/jackrabbit/oak/blob/cloud/s3/TestS3Ds.java @@ -112,6 +112,10 @@ public class TestS3Ds extends AbstractDataStoreTest { return DateUtils.addMinutes(new Date(), -1); } + protected boolean isSSECustomerKeyEncryption() { + return Objects.equals(Utils.getDataEncryption(props), DataEncryption.SSE_C); + } + protected void setEncryptionData() {} @BeforeClass @@ -162,7 +166,7 @@ public class TestS3Ds extends AbstractDataStoreTest { @Test public void testGetDownloadURI() throws IOException, RepositoryException { - Assume.assumeTrue("SSE-C doesn't support presigned GET URLs", !isSseCustomerKeyEncrypted()); + Assume.assumeTrue("Presigned GET URLs are skipped for SSE-C", !isSSECustomerKeyEncryption()); DataStore ds = createDataStore(); byte[] data = new byte[dataLength]; @@ -186,7 +190,8 @@ public class TestS3Ds extends AbstractDataStoreTest { @Test public void testDataMigration() { - Assume.assumeTrue("For SSE-C we can't change encryption without manual intervention", !isSseCustomerKeyEncrypted()); + Assume.assumeTrue("For SSE-C we can't change encryption without manual intervention", + !isSSECustomerKeyEncryption()); try { String encryption = props.getProperty(S3_ENCRYPTION); diff --git a/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/datastore/directaccess/AbstractDataRecordAccessProviderTest.java b/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/datastore/directaccess/AbstractDataRecordAccessProviderTest.java index e2b71803a1..84cb600972 100644 --- a/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/datastore/directaccess/AbstractDataRecordAccessProviderTest.java +++ b/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/datastore/directaccess/AbstractDataRecordAccessProviderTest.java @@ -91,7 +91,8 @@ public abstract class AbstractDataRecordAccessProviderTest { // @Test public void testGetDownloadURIProvidesValidURIIT() throws DataStoreException { - Assume.assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + Assume.assumeTrue("Presigned GET URLs are skipped when sseCustomerKey is configured", + !isSSECustomerKeyEncryption()); DataRecord record = null; ConfigurableDataRecordAccessProvider dataStore = getDataStore(); try { @@ -157,7 +158,8 @@ public abstract class AbstractDataRecordAccessProviderTest { @Test public void testGetDownloadURIIT() throws DataStoreException, IOException { - Assume.assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + Assume.assumeTrue("Presigned GET URLs are skipped when sseCustomerKey is configured", + !isSSECustomerKeyEncryption()); DataRecord record = null; DataRecordAccessProvider dataStore = getDataStore(); try { @@ -180,7 +182,8 @@ public abstract class AbstractDataRecordAccessProviderTest { @Test public void testGetDownloadURIWithCustomHeadersIT() throws DataStoreException, IOException { - Assume.assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + Assume.assumeTrue("Presigned GET URLs are skipped when sseCustomerKey is configured", + !isSSECustomerKeyEncryption()); String umlautFilename = "Uml\u00e4utfile.png"; String umlautFilename_ISO_8859_1 = new String( StandardCharsets.ISO_8859_1.encode(umlautFilename).array(), @@ -257,7 +260,8 @@ public abstract class AbstractDataRecordAccessProviderTest { @Test public void testGetExpiredReadURIFailsIT() throws DataStoreException, IOException { - Assume.assumeTrue("SSE-C doesn't support presigned GET URLs", !isSSECustomerKeyEncryption()); + Assume.assumeTrue("Presigned GET URLs are skipped when sseCustomerKey is configured", + !isSSECustomerKeyEncryption()); DataRecord record = null; ConfigurableDataRecordAccessProvider dataStore = getDataStore(); try {
