From a7422c6ca7a7879b03b5802fa07d55ed081333ba Mon Sep 17 00:00:00 2001 From: Ryan Emery Date: Mon, 29 Sep 2025 10:27:29 -0700 Subject: [PATCH 1/2] Adding duvet for a specific Ruby test server --- .gitmodules | 3 + test-server/ruby-v2-server/.duvet/.gitignore | 1 + test-server/ruby-v2-server/.duvet/config.toml | 18 ++ .../content-metadata-mapkeys.toml | 217 ++++++++++++++++++ .../determining-s3ec-object-status.toml | 60 +++++ .../content-metadata/v1-v2-shared.toml | 24 ++ .../data-format/content-metadata/v3-only.toml | 112 +++++++++ .../metadata-strategy/instruction-file.toml | 66 ++++++ .../metadata-strategy/object-metadata.toml | 28 +++ .../v1-v2-instruction-files.toml | 12 + .../v3-instruction-files.toml | 81 +++++++ .../ruby-v2-server/.duvet/snapshot.txt | 83 +++++++ test-server/ruby-v2-server/Makefile | 8 +- test-server/specification | 1 + 14 files changed, 713 insertions(+), 1 deletion(-) create mode 100644 test-server/ruby-v2-server/.duvet/.gitignore create mode 100644 test-server/ruby-v2-server/.duvet/config.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml create mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml create mode 100644 test-server/ruby-v2-server/.duvet/snapshot.txt create mode 160000 test-server/specification diff --git a/.gitmodules b/.gitmodules index ce2abc73..9af1f468 100644 --- a/.gitmodules +++ b/.gitmodules @@ -12,3 +12,6 @@ path = test-server/php-v3-server/local-php-sdk url = git@github.com:aws/private-aws-sdk-php-staging.git branch = s3ec/improved +[submodule "test-server/specification"] + path = test-server/specification + url = git@github.com:awslabs/private-aws-encryption-sdk-specification-staging.git diff --git a/test-server/ruby-v2-server/.duvet/.gitignore b/test-server/ruby-v2-server/.duvet/.gitignore new file mode 100644 index 00000000..a9a1bd38 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/.gitignore @@ -0,0 +1 @@ +reports/ diff --git a/test-server/ruby-v2-server/.duvet/config.toml b/test-server/ruby-v2-server/.duvet/config.toml new file mode 100644 index 00000000..0bb7d893 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/config.toml @@ -0,0 +1,18 @@ +'$schema' = "https://awslabs.github.io/duvet/config/v0.4.0.json" + +[[source]] +pattern = "local-ruby-sdk/gems/aws-sdk-s3/lib/**/*.rb" +comment-style = { meta = "##=", content = "##%" } + +# Include required specifications here +[[specification]] +source = "../specification/s3-encryption/data-format/content-metadata.md" +[[specification]] +source = "../specification/s3-encryption/data-format/metadata-strategy.md" + +[report.html] +enabled = true + +# Enable snapshots to prevent requirement coverage regressions +[report.snapshot] +enabled = true diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml new file mode 100644 index 00000000..f9235a85 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml @@ -0,0 +1,217 @@ +target = "../specification/s3-encryption/data-format/content-metadata.md#content-metadata-mapkeys" + +# Content Metadata MapKeys +# +# Metadata is stored as a string -> string map (see TODO for further specification of "string"). +# Metadata is responsible for storing data which is critical for decryption of the object. +# The mapkeys contained in the metadata depends on the format version used. +# The "x-amz-meta-" prefix is automatically added by the S3 server and MUST NOT be included in implementation code. +# The "x-amz-" prefix denotes that the metadata is owned by an Amazon product and MUST be prepended to all S3EC metadata mapkeys. +# +# When the object is encrypted using the V1 format: +# +# - The mapkey "x-amz-unencrypted-content-length" SHOULD be present for V1 format objects. +# - The mapkey "x-amz-key" MUST be present for V1 format objects. +# - The mapkey "x-amz-matdesc" MUST be present for V1 format objects. +# - The mapkey "x-amz-iv" MUST be present for V1 format objects. +# +# When the object is encrypted using the V2 format: +# +# - The mapkey "x-amz-key-v2" MUST be present for V2 format objects. +# - The mapkey "x-amz-matdesc" MUST be present for V2 format objects. +# - The mapkey "x-amz-iv" MUST be present for V2 format objects. +# - The mapkey "x-amz-wrap-alg" MUST be present for V2 format objects. +# - The mapkey "x-amz-cek-alg" MUST be present for V2 format objects. +# - The mapkey "x-amz-tag-len" MUST be present for V2 format objects. +# +# The V3 format introduces the use of compression to reduce the size of S3EC-specific metadata. +# The V3 format uses the following mapkeys: +# +# - The mapkey "x-amz-c" MUST be present for V3 format objects. +# - This mapkey ("x-amz-c") SHOULD be represented by a constant named "CONTENT_CIPHER_V3" or similar in the implementation code. +# - This mapkey is the V3 version of the "x-amz-cek-alg" mapkey. +# - The mapkey "x-amz-3" MUST be present for V3 format objects. +# - This mapkey ("x-amz-3") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_V3" or similar in the implementation code. +# - This mapkey is the V3 version of the "x-amz-key" and "x-amz-key-v2" mapkeys. +# - The mapkey "x-amz-m" SHOULD be present for V3 format objects. +# - This mapkey ("x-amz-m") SHOULD be represented by a constant named "MAT_DESC_V3" or similar in the implementation code. +# - This mapkey is the V3 version of the "x-amz-matdesc" mapkey. +# - The mapkey "x-amz-t" SHOULD be present for V3 format objects. +# - This mapkey ("x-amz-t") SHOULD be represented by a constant named "ENCRYPTION_CONTEXT_V3" or similar in the implementation code. +# - This mapkey is new for V3 and serves to distinguish KMS Encryption Context from Raw Keyring Material Description. +# - The mapkey "x-amz-w" MUST be present for V3 format objects. +# - This mapkey ("x-amz-w") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_ALGORITHM_V3" or similar in the implementation code. +# - This mapkey is the V3 version of "x-amz-wrap-alg" mapkey. +# - The mapkey "x-amz-d" MUST be present for V3 format objects. +# - This mapkey ("x-amz-d") SHOULD be represented by a constant named "KEY_COMMITMENT_V3" or similar in the implementation code. +# - This mapkey is new for V3 and refers to the Key Commitment value used by committing algorithm suites. +# - The mapkey "x-amz-i" MUST be present for V3 format objects. +# - This mapkey ("x-amz-i") SHOULD be represented by a constant named "MESSAGE_ID_V3" or similar in the implementation code. +# - This mapkey is new for V3 and refers to the Message ID value used by committing algorithm suites. +# +# In general, the storage medium is independent from the format, with the exception of the V3 format. +# In the V3 format, the mapkeys "x-amz-c", "x-amz-d", and "x-amz-i" MUST be stored exclusively in the Object Metadata. +# See [metadata-strategy](./metadata-strategy.md) for more details. + +[[spec]] +level = "MUST" +quote = ''' +The "x-amz-meta-" prefix is automatically added by the S3 server and MUST NOT be included in implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +The "x-amz-" prefix denotes that the metadata is owned by an Amazon product and MUST be prepended to all S3EC metadata mapkeys. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- The mapkey "x-amz-unencrypted-content-length" SHOULD be present for V1 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-key" MUST be present for V1 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-matdesc" MUST be present for V1 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-iv" MUST be present for V1 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-key-v2" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-matdesc" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-iv" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-wrap-alg" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-cek-alg" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-tag-len" MUST be present for V2 format objects. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-c" MUST be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-c") SHOULD be represented by a constant named "CONTENT_CIPHER_V3" or similar in the implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-3" MUST be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-3") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_V3" or similar in the implementation code. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- The mapkey "x-amz-m" SHOULD be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-m") SHOULD be represented by a constant named "MAT_DESC_V3" or similar in the implementation code. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- The mapkey "x-amz-t" SHOULD be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-t") SHOULD be represented by a constant named "ENCRYPTION_CONTEXT_V3" or similar in the implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-w" MUST be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-w") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_ALGORITHM_V3" or similar in the implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-d" MUST be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-d") SHOULD be represented by a constant named "KEY_COMMITMENT_V3" or similar in the implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The mapkey "x-amz-i" MUST be present for V3 format objects. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +- This mapkey ("x-amz-i") SHOULD be represented by a constant named "MESSAGE_ID_V3" or similar in the implementation code. +''' + +[[spec]] +level = "MUST" +quote = ''' +In the V3 format, the mapkeys "x-amz-c", "x-amz-d", and "x-amz-i" MUST be stored exclusively in the Object Metadata. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml new file mode 100644 index 00000000..9a06cf0e --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml @@ -0,0 +1,60 @@ +target = "../specification/s3-encryption/data-format/content-metadata.md#determining-s3ec-object-status" + +# Determining S3EC Object Status +# +# Whether or not an object is determined to be a valid object encrypted by S3EC is done via the following logic: +# +# V1: +# +# - If the metadata contains "x-amz-iv" and "x-amz-key" then the object MUST be considered as an S3EC-encrypted object using the V1 format. +# +# V2: +# +# - If the metadata contains "x-amz-iv" and "x-amz-metadata-x-amz-key-v2" then the object MUST be considered as an S3EC-encrypted object using the V2 format. +# +# V3: +# +# - If the metadata contains "x-amz-3" and "x-amz-d" and "x-amz-i" then the object MUST be considered an S3EC-encrypted object using the V3 format. +# +# This logic applies only to objects using ObjectMetadata to store cryptographic metadata. +# If the object matches none of the V1/V2/V3 formats, the S3EC MUST attempt to get the instruction file. +# +# If there are multiple mapkeys which are meant to be exclusive, such as "x-amz-key", "x-amz-key-v2", and "x-amz-3" then the S3EC SHOULD throw an exception. +# In general, if there is any deviation from the above format, with the exception of additional unrelated mapkeys, then the S3EC SHOULD throw an exception. + +[[spec]] +level = "MUST" +quote = ''' +- If the metadata contains "x-amz-iv" and "x-amz-key" then the object MUST be considered as an S3EC-encrypted object using the V1 format. +''' + +[[spec]] +level = "MUST" +quote = ''' +- If the metadata contains "x-amz-iv" and "x-amz-metadata-x-amz-key-v2" then the object MUST be considered as an S3EC-encrypted object using the V2 format. +''' + +[[spec]] +level = "MUST" +quote = ''' +- If the metadata contains "x-amz-3" and "x-amz-d" and "x-amz-i" then the object MUST be considered an S3EC-encrypted object using the V3 format. +''' + +[[spec]] +level = "MUST" +quote = ''' +If the object matches none of the V1/V2/V3 formats, the S3EC MUST attempt to get the instruction file. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +If there are multiple mapkeys which are meant to be exclusive, such as "x-amz-key", "x-amz-key-v2", and "x-amz-3" then the S3EC SHOULD throw an exception. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +In general, if there is any deviation from the above format, with the exception of additional unrelated mapkeys, then the S3EC SHOULD throw an exception. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml new file mode 100644 index 00000000..d45b598b --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml @@ -0,0 +1,24 @@ +target = "../specification/s3-encryption/data-format/content-metadata.md#v1-v2-shared" + +# V1/V2 Shared +# +# The following mapkeys are used in both the V1 and V2 format. +# +# _x-amz-matdesc_ +# +# A JSON string containing the Material Description OR Encryption Context used when encrypting the data key. +# See TODO-link for more details on Material Description and Encryption Context. +# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. +# See TODO-link for more details on the S3 double-encoding scheme. +# The default value is the an empty JSON map (`{}`). +# +# _x-amz-iv_ +# +# The base64-encoded bytes used as the IV when encrypting the content. + +[[spec]] +level = "MAY" +quote = ''' +This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml new file mode 100644 index 00000000..310e732c --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml @@ -0,0 +1,112 @@ +target = "../specification/s3-encryption/data-format/content-metadata.md#v3-only" + +# V3 Only +# +# _x-amz-m_ +# +# A JSON string representing the Material Description of the key material used to encrypt the data key. +# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. +# The Material Description MUST only be read when there is no Encryption Context. +# The default Material Description value MUST be set to an empty map (`{}`). +# See TODO-link for more details on the S3 double-encoding scheme. +# +# _x-amz-t_ +# +# A JSON string representing the AWS KMS Encryption Context associated with the encrypted object. +# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. +# The Encryption Context value MUST take precedence over Material Description when decoding. +# See TODO-link for more details on the S3 double-encoding scheme. +# +# _x-amz-w_ +# +# The wrapping algorithm used to encrypt the data key. +# The V3 format uses compression here such that each wrapping algorithm is represented by a two digit string. +# The valid values and their mapping to pre-existing values are: +# +# - 01 +# - AESWrap +# - The wrapping algorithm value "01" MUST be translated to AESWrap upon retrieval, and vice versa on write. +# - 02 +# - AES/GCM +# - The wrapping algorithm value "02" MUST be translated to AES/GCM upon retrieval, and vice versa on write. +# - 11 +# - kms +# - The wrapping algorithm value "11" MUST be translated to kms upon retrieval, and vice versa on write. +# - 12 +# - kms+context +# - The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write. +# - 21 +# - RSA/ECB/OAEPWithSHA-256AndMGF1Padding +# - The wrapping algorithm value "21" MUST be translated to RSA/ECB/OAEPWithSHA-256AndMGF1Padding upon retrieval, and vice versa on write. +# - 22 +# - RSA-OAEP-SHA1 +# - The wrapping algorithm value "22" MUST be translated to RSA-OAEP-SHA1 upon retrieval, and vice versa on write. +# +# _x-amz-d_ +# +# The base64-encoded bytes representing the Key Commitment associated with the encrypted object. +# +# _x-amz-i_ +# +# The base64-encoded bytes representing the Message ID associated with the encrypted object. + +[[spec]] +level = "MAY" +quote = ''' +This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. +''' + +[[spec]] +level = "MUST" +quote = ''' +The Material Description MUST only be read when there is no Encryption Context. +''' + +[[spec]] +level = "MUST" +quote = ''' +The default Material Description value MUST be set to an empty map (`{}`). +''' + +[[spec]] +level = "MUST" +quote = ''' +The Encryption Context value MUST take precedence over Material Description when decoding. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "01" MUST be translated to AESWrap upon retrieval, and vice versa on write. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "02" MUST be translated to AES/GCM upon retrieval, and vice versa on write. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "11" MUST be translated to kms upon retrieval, and vice versa on write. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "21" MUST be translated to RSA/ECB/OAEPWithSHA-256AndMGF1Padding upon retrieval, and vice versa on write. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The wrapping algorithm value "22" MUST be translated to RSA-OAEP-SHA1 upon retrieval, and vice versa on write. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml new file mode 100644 index 00000000..1717e630 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml @@ -0,0 +1,66 @@ +target = "../specification/s3-encryption/data-format/metadata-strategy.md#instruction-file" + +# Instruction File +# +# Instruction Files are a separate S3 object which contain content metadata. +# The S3EC MUST support writing some or all (depending on format) content metadata to an Instruction File. +# The content metadata stored in the Instruction File MUST be serialized to a JSON string. +# The serialized JSON string MUST be the only contents of the Instruction File. +# +# Instruction File writes MUST NOT be enabled by default. +# Instruction File writes MUST be optionally configured during client creation or on each PutObject request. +# The default Instruction File behavior uses the same S3 object key as its associated object suffixed with ".instruction". +# +# The S3EC MAY support re-encryption/key rotation via Instruction Files. +# Further details on Instruction File re-encryption can be found in (TODO). +# The S3EC MUST NOT support providing a custom Instruction File suffix on ordinary writes; custom suffixes MUST only be used during re-encryption. +# The S3EC SHOULD support providing a custom Instruction File suffix on GetObject requests, regardless of whether or not re-encryption is supported. + +[[spec]] +level = "MUST" +quote = ''' +The S3EC MUST support writing some or all (depending on format) content metadata to an Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +The content metadata stored in the Instruction File MUST be serialized to a JSON string. +''' + +[[spec]] +level = "MUST" +quote = ''' +The serialized JSON string MUST be the only contents of the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +Instruction File writes MUST NOT be enabled by default. +''' + +[[spec]] +level = "MUST" +quote = ''' +Instruction File writes MUST be optionally configured during client creation or on each PutObject request. +''' + +[[spec]] +level = "MAY" +quote = ''' +The S3EC MAY support re-encryption/key rotation via Instruction Files. +''' + +[[spec]] +level = "MUST" +quote = ''' +The S3EC MUST NOT support providing a custom Instruction File suffix on ordinary writes; custom suffixes MUST only be used during re-encryption. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +The S3EC SHOULD support providing a custom Instruction File suffix on GetObject requests, regardless of whether or not re-encryption is supported. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml new file mode 100644 index 00000000..5a80b66e --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml @@ -0,0 +1,28 @@ +target = "../specification/s3-encryption/data-format/metadata-strategy.md#object-metadata" + +# Object Metadata +# +# Object Metadata refers to the set of mapkey-value pairs stored alongside an object in S3. +# By default, the S3EC MUST store content metadata in the S3 Object Metadata. +# When an encrypted object is stored in S3 with non-US-ASCII Materials Description or Encryption Context, the S3 Server will apply an esoteric "double encoding" to the metadata. +# The S3EC SHOULD support decoding the S3 Server's "double encoding". +# If the S3EC does not support decoding the S3 Server's "double encoding" then it MUST return the content metadata untouched. + +[[spec]] +level = "MUST" +quote = ''' +By default, the S3EC MUST store content metadata in the S3 Object Metadata. +''' + +[[spec]] +level = "SHOULD" +quote = ''' +The S3EC SHOULD support decoding the S3 Server's "double encoding". +''' + +[[spec]] +level = "MUST" +quote = ''' +If the S3EC does not support decoding the S3 Server's "double encoding" then it MUST return the content metadata untouched. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml new file mode 100644 index 00000000..e34118ea --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml @@ -0,0 +1,12 @@ +target = "../specification/s3-encryption/data-format/metadata-strategy.md#v1-v2-instruction-files" + +# V1/V2 Instruction Files +# +# In the V1/V2 message format, all of the content metadata MUST be stored in the Instruction File. + +[[spec]] +level = "MUST" +quote = ''' +In the V1/V2 message format, all of the content metadata MUST be stored in the Instruction File. +''' + diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml new file mode 100644 index 00000000..47ec29a9 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml @@ -0,0 +1,81 @@ +target = "../specification/s3-encryption/data-format/metadata-strategy.md#v3-instruction-files" + +# V3 Instruction Files +# +# In the V3 message format, only the content metadata related to the encrypted data is stored in the Instruction File. +# In the V3 message format, the content metadata related to the encrypted content is stored in the Object Metadata. +# +# - The V3 message format MUST store the mapkey "x-amz-c" and its value in the Object Metadata when writing with an Instruction File. +# - The V3 message format MUST NOT store the mapkey "x-amz-c" and its value in the Instruction File. +# - The V3 message format MUST store the mapkey "x-amz-d" and its value in the Object Metadata when writing with an Instruction File. +# - The V3 message format MUST NOT store the mapkey "x-amz-d" and its value in the Instruction File. +# - The V3 message format MUST store the mapkey "x-amz-i" and its value in the Object Metadata when writing with an Instruction File. +# - The V3 message format MUST NOT store the mapkey "x-amz-i" and its value in the Instruction File. +# +# - The V3 message format MUST store the mapkey "x-amz-3" and its value in the Instruction File. +# - The V3 message format MUST store the mapkey "x-amz-w" and its value in the Instruction File. +# - The V3 message format MUST store the mapkey "x-amz-m" and its value (when present in the content metadata) in the Instruction File. +# - The V3 message format MUST store the mapkey "x-amz-t" and its value (when present in the content metadata) in the Instruction File. +# +# This is done to facilitate data key re-encryption via Instruction File. + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-c" and its value in the Object Metadata when writing with an Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST NOT store the mapkey "x-amz-c" and its value in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-d" and its value in the Object Metadata when writing with an Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST NOT store the mapkey "x-amz-d" and its value in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-i" and its value in the Object Metadata when writing with an Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST NOT store the mapkey "x-amz-i" and its value in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-3" and its value in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-w" and its value in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-m" and its value (when present in the content metadata) in the Instruction File. +''' + +[[spec]] +level = "MUST" +quote = ''' +- The V3 message format MUST store the mapkey "x-amz-t" and its value (when present in the content metadata) in the Instruction File. +''' + diff --git a/test-server/ruby-v2-server/.duvet/snapshot.txt b/test-server/ruby-v2-server/.duvet/snapshot.txt new file mode 100644 index 00000000..9c23c073 --- /dev/null +++ b/test-server/ruby-v2-server/.duvet/snapshot.txt @@ -0,0 +1,83 @@ +SPECIFICATION: [Content Metadata](../specification/s3-encryption/data-format/content-metadata.md) + SECTION: [Content Metadata MapKeys](#content-metadata-mapkeys) + TEXT[!MUST]: The "x-amz-meta-" prefix is automatically added by the S3 server and MUST NOT be included in implementation code. + TEXT[!MUST]: The "x-amz-" prefix denotes that the metadata is owned by an Amazon product and MUST be prepended to all S3EC metadata mapkeys. + TEXT[!SHOULD]: - The mapkey "x-amz-unencrypted-content-length" SHOULD be present for V1 format objects. + TEXT[!MUST]: - The mapkey "x-amz-key" MUST be present for V1 format objects. + TEXT[!MUST]: - The mapkey "x-amz-matdesc" MUST be present for V1 format objects. + TEXT[!MUST]: - The mapkey "x-amz-iv" MUST be present for V1 format objects. + TEXT[!MUST]: - The mapkey "x-amz-key-v2" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-matdesc" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-iv" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-wrap-alg" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-cek-alg" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-tag-len" MUST be present for V2 format objects. + TEXT[!MUST]: - The mapkey "x-amz-c" MUST be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-c") SHOULD be represented by a constant named "CONTENT_CIPHER_V3" or similar in the implementation code. + TEXT[!MUST]: - The mapkey "x-amz-3" MUST be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-3") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_V3" or similar in the implementation code. + TEXT[!SHOULD]: - The mapkey "x-amz-m" SHOULD be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-m") SHOULD be represented by a constant named "MAT_DESC_V3" or similar in the implementation code. + TEXT[!SHOULD]: - The mapkey "x-amz-t" SHOULD be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-t") SHOULD be represented by a constant named "ENCRYPTION_CONTEXT_V3" or similar in the implementation code. + TEXT[!MUST]: - The mapkey "x-amz-w" MUST be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-w") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_ALGORITHM_V3" or similar in the implementation code. + TEXT[!MUST]: - The mapkey "x-amz-d" MUST be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-d") SHOULD be represented by a constant named "KEY_COMMITMENT_V3" or similar in the implementation code. + TEXT[!MUST]: - The mapkey "x-amz-i" MUST be present for V3 format objects. + TEXT[!SHOULD]: - This mapkey ("x-amz-i") SHOULD be represented by a constant named "MESSAGE_ID_V3" or similar in the implementation code. + TEXT[!MUST]: In the V3 format, the mapkeys "x-amz-c", "x-amz-d", and "x-amz-i" MUST be stored exclusively in the Object Metadata. + + SECTION: [Determining S3EC Object Status](#determining-s3ec-object-status) + TEXT[!MUST]: - If the metadata contains "x-amz-iv" and "x-amz-key" then the object MUST be considered as an S3EC-encrypted object using the V1 format. + TEXT[!MUST]: - If the metadata contains "x-amz-iv" and "x-amz-metadata-x-amz-key-v2" then the object MUST be considered as an S3EC-encrypted object using the V2 format. + TEXT[!MUST]: - If the metadata contains "x-amz-3" and "x-amz-d" and "x-amz-i" then the object MUST be considered an S3EC-encrypted object using the V3 format. + TEXT[!MUST]: If the object matches none of the V1/V2/V3 formats, the S3EC MUST attempt to get the instruction file. + TEXT[!SHOULD]: If there are multiple mapkeys which are meant to be exclusive, such as "x-amz-key", "x-amz-key-v2", and "x-amz-3" then the S3EC SHOULD throw an exception. + TEXT[!SHOULD]: In general, if there is any deviation from the above format, with the exception of additional unrelated mapkeys, then the S3EC SHOULD throw an exception. + + SECTION: [V1/V2 Shared](#v1-v2-shared) + TEXT[!MAY]: This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. + + SECTION: [V3 Only](#v3-only) + TEXT[!MAY]: This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. + TEXT[!MUST]: The Material Description MUST only be read when there is no Encryption Context. + TEXT[!MUST]: The default Material Description value MUST be set to an empty map (`{}`). + TEXT[!MUST]: The Encryption Context value MUST take precedence over Material Description when decoding. + TEXT[!MUST]: - The wrapping algorithm value "01" MUST be translated to AESWrap upon retrieval, and vice versa on write. + TEXT[!MUST]: - The wrapping algorithm value "02" MUST be translated to AES/GCM upon retrieval, and vice versa on write. + TEXT[!MUST]: - The wrapping algorithm value "11" MUST be translated to kms upon retrieval, and vice versa on write. + TEXT[!MUST]: - The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write. + TEXT[!MUST]: - The wrapping algorithm value "21" MUST be translated to RSA/ECB/OAEPWithSHA-256AndMGF1Padding upon retrieval, and vice versa on write. + TEXT[!MUST]: - The wrapping algorithm value "22" MUST be translated to RSA-OAEP-SHA1 upon retrieval, and vice versa on write. + +SPECIFICATION: [Content Metadata Strategy](../specification/s3-encryption/data-format/metadata-strategy.md) + SECTION: [Object Metadata](#object-metadata) + TEXT[!MUST]: By default, the S3EC MUST store content metadata in the S3 Object Metadata. + TEXT[!SHOULD]: The S3EC SHOULD support decoding the S3 Server's "double encoding". + TEXT[!MUST]: If the S3EC does not support decoding the S3 Server's "double encoding" then it MUST return the content metadata untouched. + + SECTION: [Instruction File](#instruction-file) + TEXT[!MUST]: The S3EC MUST support writing some or all (depending on format) content metadata to an Instruction File. + TEXT[!MUST]: The content metadata stored in the Instruction File MUST be serialized to a JSON string. + TEXT[!MUST]: The serialized JSON string MUST be the only contents of the Instruction File. + TEXT[!MUST]: Instruction File writes MUST NOT be enabled by default. + TEXT[!MUST]: Instruction File writes MUST be optionally configured during client creation or on each PutObject request. + TEXT[!MAY]: The S3EC MAY support re-encryption/key rotation via Instruction Files. + TEXT[!MUST]: The S3EC MUST NOT support providing a custom Instruction File suffix on ordinary writes; custom suffixes MUST only be used during re-encryption. + TEXT[!SHOULD]: The S3EC SHOULD support providing a custom Instruction File suffix on GetObject requests, regardless of whether or not re-encryption is supported. + + SECTION: [V1/V2 Instruction Files](#v1-v2-instruction-files) + TEXT[!MUST]: In the V1/V2 message format, all of the content metadata MUST be stored in the Instruction File. + + SECTION: [V3 Instruction Files](#v3-instruction-files) + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-c" and its value in the Object Metadata when writing with an Instruction File. + TEXT[!MUST]: - The V3 message format MUST NOT store the mapkey "x-amz-c" and its value in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-d" and its value in the Object Metadata when writing with an Instruction File. + TEXT[!MUST]: - The V3 message format MUST NOT store the mapkey "x-amz-d" and its value in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-i" and its value in the Object Metadata when writing with an Instruction File. + TEXT[!MUST]: - The V3 message format MUST NOT store the mapkey "x-amz-i" and its value in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-3" and its value in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-w" and its value in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-m" and its value (when present in the content metadata) in the Instruction File. + TEXT[!MUST]: - The V3 message format MUST store the mapkey "x-amz-t" and its value (when present in the content metadata) in the Instruction File. diff --git a/test-server/ruby-v2-server/Makefile b/test-server/ruby-v2-server/Makefile index 5d552aac..15751f6a 100644 --- a/test-server/ruby-v2-server/Makefile +++ b/test-server/ruby-v2-server/Makefile @@ -26,4 +26,10 @@ stop-server: fi wait-for-server: - $(MAKE) -C .. wait-for-port PORT=8086 \ No newline at end of file + $(MAKE) -C .. wait-for-port PORT=8086 + +duvet: + duvet report + +view-report-mac: + open .duvet/reports/report.html diff --git a/test-server/specification b/test-server/specification new file mode 160000 index 00000000..e82ef6b9 --- /dev/null +++ b/test-server/specification @@ -0,0 +1 @@ +Subproject commit e82ef6b9c29a550f89b76cd790381743b8c07ad5 From 578628701e57d5c2d4eac19d47ae1a984cb0935e Mon Sep 17 00:00:00 2001 From: Ryan Emery Date: Mon, 29 Sep 2025 11:47:19 -0700 Subject: [PATCH 2/2] remove the toml files --- test-server/ruby-v2-server/.duvet/.gitignore | 1 + .../content-metadata-mapkeys.toml | 217 ------------------ .../determining-s3ec-object-status.toml | 60 ----- .../content-metadata/v1-v2-shared.toml | 24 -- .../data-format/content-metadata/v3-only.toml | 112 --------- .../metadata-strategy/instruction-file.toml | 66 ------ .../metadata-strategy/object-metadata.toml | 28 --- .../v1-v2-instruction-files.toml | 12 - .../v3-instruction-files.toml | 81 ------- 9 files changed, 1 insertion(+), 600 deletions(-) delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml delete mode 100644 test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml diff --git a/test-server/ruby-v2-server/.duvet/.gitignore b/test-server/ruby-v2-server/.duvet/.gitignore index a9a1bd38..0745fbc6 100644 --- a/test-server/ruby-v2-server/.duvet/.gitignore +++ b/test-server/ruby-v2-server/.duvet/.gitignore @@ -1 +1,2 @@ reports/ +requirements/ \ No newline at end of file diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml deleted file mode 100644 index f9235a85..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/content-metadata-mapkeys.toml +++ /dev/null @@ -1,217 +0,0 @@ -target = "../specification/s3-encryption/data-format/content-metadata.md#content-metadata-mapkeys" - -# Content Metadata MapKeys -# -# Metadata is stored as a string -> string map (see TODO for further specification of "string"). -# Metadata is responsible for storing data which is critical for decryption of the object. -# The mapkeys contained in the metadata depends on the format version used. -# The "x-amz-meta-" prefix is automatically added by the S3 server and MUST NOT be included in implementation code. -# The "x-amz-" prefix denotes that the metadata is owned by an Amazon product and MUST be prepended to all S3EC metadata mapkeys. -# -# When the object is encrypted using the V1 format: -# -# - The mapkey "x-amz-unencrypted-content-length" SHOULD be present for V1 format objects. -# - The mapkey "x-amz-key" MUST be present for V1 format objects. -# - The mapkey "x-amz-matdesc" MUST be present for V1 format objects. -# - The mapkey "x-amz-iv" MUST be present for V1 format objects. -# -# When the object is encrypted using the V2 format: -# -# - The mapkey "x-amz-key-v2" MUST be present for V2 format objects. -# - The mapkey "x-amz-matdesc" MUST be present for V2 format objects. -# - The mapkey "x-amz-iv" MUST be present for V2 format objects. -# - The mapkey "x-amz-wrap-alg" MUST be present for V2 format objects. -# - The mapkey "x-amz-cek-alg" MUST be present for V2 format objects. -# - The mapkey "x-amz-tag-len" MUST be present for V2 format objects. -# -# The V3 format introduces the use of compression to reduce the size of S3EC-specific metadata. -# The V3 format uses the following mapkeys: -# -# - The mapkey "x-amz-c" MUST be present for V3 format objects. -# - This mapkey ("x-amz-c") SHOULD be represented by a constant named "CONTENT_CIPHER_V3" or similar in the implementation code. -# - This mapkey is the V3 version of the "x-amz-cek-alg" mapkey. -# - The mapkey "x-amz-3" MUST be present for V3 format objects. -# - This mapkey ("x-amz-3") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_V3" or similar in the implementation code. -# - This mapkey is the V3 version of the "x-amz-key" and "x-amz-key-v2" mapkeys. -# - The mapkey "x-amz-m" SHOULD be present for V3 format objects. -# - This mapkey ("x-amz-m") SHOULD be represented by a constant named "MAT_DESC_V3" or similar in the implementation code. -# - This mapkey is the V3 version of the "x-amz-matdesc" mapkey. -# - The mapkey "x-amz-t" SHOULD be present for V3 format objects. -# - This mapkey ("x-amz-t") SHOULD be represented by a constant named "ENCRYPTION_CONTEXT_V3" or similar in the implementation code. -# - This mapkey is new for V3 and serves to distinguish KMS Encryption Context from Raw Keyring Material Description. -# - The mapkey "x-amz-w" MUST be present for V3 format objects. -# - This mapkey ("x-amz-w") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_ALGORITHM_V3" or similar in the implementation code. -# - This mapkey is the V3 version of "x-amz-wrap-alg" mapkey. -# - The mapkey "x-amz-d" MUST be present for V3 format objects. -# - This mapkey ("x-amz-d") SHOULD be represented by a constant named "KEY_COMMITMENT_V3" or similar in the implementation code. -# - This mapkey is new for V3 and refers to the Key Commitment value used by committing algorithm suites. -# - The mapkey "x-amz-i" MUST be present for V3 format objects. -# - This mapkey ("x-amz-i") SHOULD be represented by a constant named "MESSAGE_ID_V3" or similar in the implementation code. -# - This mapkey is new for V3 and refers to the Message ID value used by committing algorithm suites. -# -# In general, the storage medium is independent from the format, with the exception of the V3 format. -# In the V3 format, the mapkeys "x-amz-c", "x-amz-d", and "x-amz-i" MUST be stored exclusively in the Object Metadata. -# See [metadata-strategy](./metadata-strategy.md) for more details. - -[[spec]] -level = "MUST" -quote = ''' -The "x-amz-meta-" prefix is automatically added by the S3 server and MUST NOT be included in implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -The "x-amz-" prefix denotes that the metadata is owned by an Amazon product and MUST be prepended to all S3EC metadata mapkeys. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- The mapkey "x-amz-unencrypted-content-length" SHOULD be present for V1 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-key" MUST be present for V1 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-matdesc" MUST be present for V1 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-iv" MUST be present for V1 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-key-v2" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-matdesc" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-iv" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-wrap-alg" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-cek-alg" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-tag-len" MUST be present for V2 format objects. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-c" MUST be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-c") SHOULD be represented by a constant named "CONTENT_CIPHER_V3" or similar in the implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-3" MUST be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-3") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_V3" or similar in the implementation code. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- The mapkey "x-amz-m" SHOULD be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-m") SHOULD be represented by a constant named "MAT_DESC_V3" or similar in the implementation code. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- The mapkey "x-amz-t" SHOULD be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-t") SHOULD be represented by a constant named "ENCRYPTION_CONTEXT_V3" or similar in the implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-w" MUST be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-w") SHOULD be represented by a constant named "ENCRYPTED_DATA_KEY_ALGORITHM_V3" or similar in the implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-d" MUST be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-d") SHOULD be represented by a constant named "KEY_COMMITMENT_V3" or similar in the implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The mapkey "x-amz-i" MUST be present for V3 format objects. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -- This mapkey ("x-amz-i") SHOULD be represented by a constant named "MESSAGE_ID_V3" or similar in the implementation code. -''' - -[[spec]] -level = "MUST" -quote = ''' -In the V3 format, the mapkeys "x-amz-c", "x-amz-d", and "x-amz-i" MUST be stored exclusively in the Object Metadata. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml deleted file mode 100644 index 9a06cf0e..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/determining-s3ec-object-status.toml +++ /dev/null @@ -1,60 +0,0 @@ -target = "../specification/s3-encryption/data-format/content-metadata.md#determining-s3ec-object-status" - -# Determining S3EC Object Status -# -# Whether or not an object is determined to be a valid object encrypted by S3EC is done via the following logic: -# -# V1: -# -# - If the metadata contains "x-amz-iv" and "x-amz-key" then the object MUST be considered as an S3EC-encrypted object using the V1 format. -# -# V2: -# -# - If the metadata contains "x-amz-iv" and "x-amz-metadata-x-amz-key-v2" then the object MUST be considered as an S3EC-encrypted object using the V2 format. -# -# V3: -# -# - If the metadata contains "x-amz-3" and "x-amz-d" and "x-amz-i" then the object MUST be considered an S3EC-encrypted object using the V3 format. -# -# This logic applies only to objects using ObjectMetadata to store cryptographic metadata. -# If the object matches none of the V1/V2/V3 formats, the S3EC MUST attempt to get the instruction file. -# -# If there are multiple mapkeys which are meant to be exclusive, such as "x-amz-key", "x-amz-key-v2", and "x-amz-3" then the S3EC SHOULD throw an exception. -# In general, if there is any deviation from the above format, with the exception of additional unrelated mapkeys, then the S3EC SHOULD throw an exception. - -[[spec]] -level = "MUST" -quote = ''' -- If the metadata contains "x-amz-iv" and "x-amz-key" then the object MUST be considered as an S3EC-encrypted object using the V1 format. -''' - -[[spec]] -level = "MUST" -quote = ''' -- If the metadata contains "x-amz-iv" and "x-amz-metadata-x-amz-key-v2" then the object MUST be considered as an S3EC-encrypted object using the V2 format. -''' - -[[spec]] -level = "MUST" -quote = ''' -- If the metadata contains "x-amz-3" and "x-amz-d" and "x-amz-i" then the object MUST be considered an S3EC-encrypted object using the V3 format. -''' - -[[spec]] -level = "MUST" -quote = ''' -If the object matches none of the V1/V2/V3 formats, the S3EC MUST attempt to get the instruction file. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -If there are multiple mapkeys which are meant to be exclusive, such as "x-amz-key", "x-amz-key-v2", and "x-amz-3" then the S3EC SHOULD throw an exception. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -In general, if there is any deviation from the above format, with the exception of additional unrelated mapkeys, then the S3EC SHOULD throw an exception. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml deleted file mode 100644 index d45b598b..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v1-v2-shared.toml +++ /dev/null @@ -1,24 +0,0 @@ -target = "../specification/s3-encryption/data-format/content-metadata.md#v1-v2-shared" - -# V1/V2 Shared -# -# The following mapkeys are used in both the V1 and V2 format. -# -# _x-amz-matdesc_ -# -# A JSON string containing the Material Description OR Encryption Context used when encrypting the data key. -# See TODO-link for more details on Material Description and Encryption Context. -# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. -# See TODO-link for more details on the S3 double-encoding scheme. -# The default value is the an empty JSON map (`{}`). -# -# _x-amz-iv_ -# -# The base64-encoded bytes used as the IV when encrypting the content. - -[[spec]] -level = "MAY" -quote = ''' -This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml deleted file mode 100644 index 310e732c..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/content-metadata/v3-only.toml +++ /dev/null @@ -1,112 +0,0 @@ -target = "../specification/s3-encryption/data-format/content-metadata.md#v3-only" - -# V3 Only -# -# _x-amz-m_ -# -# A JSON string representing the Material Description of the key material used to encrypt the data key. -# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. -# The Material Description MUST only be read when there is no Encryption Context. -# The default Material Description value MUST be set to an empty map (`{}`). -# See TODO-link for more details on the S3 double-encoding scheme. -# -# _x-amz-t_ -# -# A JSON string representing the AWS KMS Encryption Context associated with the encrypted object. -# This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. -# The Encryption Context value MUST take precedence over Material Description when decoding. -# See TODO-link for more details on the S3 double-encoding scheme. -# -# _x-amz-w_ -# -# The wrapping algorithm used to encrypt the data key. -# The V3 format uses compression here such that each wrapping algorithm is represented by a two digit string. -# The valid values and their mapping to pre-existing values are: -# -# - 01 -# - AESWrap -# - The wrapping algorithm value "01" MUST be translated to AESWrap upon retrieval, and vice versa on write. -# - 02 -# - AES/GCM -# - The wrapping algorithm value "02" MUST be translated to AES/GCM upon retrieval, and vice versa on write. -# - 11 -# - kms -# - The wrapping algorithm value "11" MUST be translated to kms upon retrieval, and vice versa on write. -# - 12 -# - kms+context -# - The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write. -# - 21 -# - RSA/ECB/OAEPWithSHA-256AndMGF1Padding -# - The wrapping algorithm value "21" MUST be translated to RSA/ECB/OAEPWithSHA-256AndMGF1Padding upon retrieval, and vice versa on write. -# - 22 -# - RSA-OAEP-SHA1 -# - The wrapping algorithm value "22" MUST be translated to RSA-OAEP-SHA1 upon retrieval, and vice versa on write. -# -# _x-amz-d_ -# -# The base64-encoded bytes representing the Key Commitment associated with the encrypted object. -# -# _x-amz-i_ -# -# The base64-encoded bytes representing the Message ID associated with the encrypted object. - -[[spec]] -level = "MAY" -quote = ''' -This string MAY be encoded by the esoteric double-encoding scheme used by the S3 web server. -''' - -[[spec]] -level = "MUST" -quote = ''' -The Material Description MUST only be read when there is no Encryption Context. -''' - -[[spec]] -level = "MUST" -quote = ''' -The default Material Description value MUST be set to an empty map (`{}`). -''' - -[[spec]] -level = "MUST" -quote = ''' -The Encryption Context value MUST take precedence over Material Description when decoding. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "01" MUST be translated to AESWrap upon retrieval, and vice versa on write. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "02" MUST be translated to AES/GCM upon retrieval, and vice versa on write. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "11" MUST be translated to kms upon retrieval, and vice versa on write. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "12" MUST be translated to kms+context upon retrieval, and vice versa on write. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "21" MUST be translated to RSA/ECB/OAEPWithSHA-256AndMGF1Padding upon retrieval, and vice versa on write. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The wrapping algorithm value "22" MUST be translated to RSA-OAEP-SHA1 upon retrieval, and vice versa on write. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml deleted file mode 100644 index 1717e630..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/instruction-file.toml +++ /dev/null @@ -1,66 +0,0 @@ -target = "../specification/s3-encryption/data-format/metadata-strategy.md#instruction-file" - -# Instruction File -# -# Instruction Files are a separate S3 object which contain content metadata. -# The S3EC MUST support writing some or all (depending on format) content metadata to an Instruction File. -# The content metadata stored in the Instruction File MUST be serialized to a JSON string. -# The serialized JSON string MUST be the only contents of the Instruction File. -# -# Instruction File writes MUST NOT be enabled by default. -# Instruction File writes MUST be optionally configured during client creation or on each PutObject request. -# The default Instruction File behavior uses the same S3 object key as its associated object suffixed with ".instruction". -# -# The S3EC MAY support re-encryption/key rotation via Instruction Files. -# Further details on Instruction File re-encryption can be found in (TODO). -# The S3EC MUST NOT support providing a custom Instruction File suffix on ordinary writes; custom suffixes MUST only be used during re-encryption. -# The S3EC SHOULD support providing a custom Instruction File suffix on GetObject requests, regardless of whether or not re-encryption is supported. - -[[spec]] -level = "MUST" -quote = ''' -The S3EC MUST support writing some or all (depending on format) content metadata to an Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -The content metadata stored in the Instruction File MUST be serialized to a JSON string. -''' - -[[spec]] -level = "MUST" -quote = ''' -The serialized JSON string MUST be the only contents of the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -Instruction File writes MUST NOT be enabled by default. -''' - -[[spec]] -level = "MUST" -quote = ''' -Instruction File writes MUST be optionally configured during client creation or on each PutObject request. -''' - -[[spec]] -level = "MAY" -quote = ''' -The S3EC MAY support re-encryption/key rotation via Instruction Files. -''' - -[[spec]] -level = "MUST" -quote = ''' -The S3EC MUST NOT support providing a custom Instruction File suffix on ordinary writes; custom suffixes MUST only be used during re-encryption. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -The S3EC SHOULD support providing a custom Instruction File suffix on GetObject requests, regardless of whether or not re-encryption is supported. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml deleted file mode 100644 index 5a80b66e..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/object-metadata.toml +++ /dev/null @@ -1,28 +0,0 @@ -target = "../specification/s3-encryption/data-format/metadata-strategy.md#object-metadata" - -# Object Metadata -# -# Object Metadata refers to the set of mapkey-value pairs stored alongside an object in S3. -# By default, the S3EC MUST store content metadata in the S3 Object Metadata. -# When an encrypted object is stored in S3 with non-US-ASCII Materials Description or Encryption Context, the S3 Server will apply an esoteric "double encoding" to the metadata. -# The S3EC SHOULD support decoding the S3 Server's "double encoding". -# If the S3EC does not support decoding the S3 Server's "double encoding" then it MUST return the content metadata untouched. - -[[spec]] -level = "MUST" -quote = ''' -By default, the S3EC MUST store content metadata in the S3 Object Metadata. -''' - -[[spec]] -level = "SHOULD" -quote = ''' -The S3EC SHOULD support decoding the S3 Server's "double encoding". -''' - -[[spec]] -level = "MUST" -quote = ''' -If the S3EC does not support decoding the S3 Server's "double encoding" then it MUST return the content metadata untouched. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml deleted file mode 100644 index e34118ea..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v1-v2-instruction-files.toml +++ /dev/null @@ -1,12 +0,0 @@ -target = "../specification/s3-encryption/data-format/metadata-strategy.md#v1-v2-instruction-files" - -# V1/V2 Instruction Files -# -# In the V1/V2 message format, all of the content metadata MUST be stored in the Instruction File. - -[[spec]] -level = "MUST" -quote = ''' -In the V1/V2 message format, all of the content metadata MUST be stored in the Instruction File. -''' - diff --git a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml b/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml deleted file mode 100644 index 47ec29a9..00000000 --- a/test-server/ruby-v2-server/.duvet/requirements/specification/s3-encryption/data-format/metadata-strategy/v3-instruction-files.toml +++ /dev/null @@ -1,81 +0,0 @@ -target = "../specification/s3-encryption/data-format/metadata-strategy.md#v3-instruction-files" - -# V3 Instruction Files -# -# In the V3 message format, only the content metadata related to the encrypted data is stored in the Instruction File. -# In the V3 message format, the content metadata related to the encrypted content is stored in the Object Metadata. -# -# - The V3 message format MUST store the mapkey "x-amz-c" and its value in the Object Metadata when writing with an Instruction File. -# - The V3 message format MUST NOT store the mapkey "x-amz-c" and its value in the Instruction File. -# - The V3 message format MUST store the mapkey "x-amz-d" and its value in the Object Metadata when writing with an Instruction File. -# - The V3 message format MUST NOT store the mapkey "x-amz-d" and its value in the Instruction File. -# - The V3 message format MUST store the mapkey "x-amz-i" and its value in the Object Metadata when writing with an Instruction File. -# - The V3 message format MUST NOT store the mapkey "x-amz-i" and its value in the Instruction File. -# -# - The V3 message format MUST store the mapkey "x-amz-3" and its value in the Instruction File. -# - The V3 message format MUST store the mapkey "x-amz-w" and its value in the Instruction File. -# - The V3 message format MUST store the mapkey "x-amz-m" and its value (when present in the content metadata) in the Instruction File. -# - The V3 message format MUST store the mapkey "x-amz-t" and its value (when present in the content metadata) in the Instruction File. -# -# This is done to facilitate data key re-encryption via Instruction File. - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-c" and its value in the Object Metadata when writing with an Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST NOT store the mapkey "x-amz-c" and its value in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-d" and its value in the Object Metadata when writing with an Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST NOT store the mapkey "x-amz-d" and its value in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-i" and its value in the Object Metadata when writing with an Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST NOT store the mapkey "x-amz-i" and its value in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-3" and its value in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-w" and its value in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-m" and its value (when present in the content metadata) in the Instruction File. -''' - -[[spec]] -level = "MUST" -quote = ''' -- The V3 message format MUST store the mapkey "x-amz-t" and its value (when present in the content metadata) in the Instruction File. -''' -