Historical access-control checks
The table records a bounded earlier lab run and must be rerun on the accepted candidate and configured pipeline:
| Check | Result |
|---|---|
| Cross-account read/write | 403 denied |
| Container ACL: public-read / restrict / revoke | correct, matches Python |
| No-token / bad-token | 401 |
| Unsupported method (TRACE) | 405 |
| Path-traversal object name | stored as a literal, no filesystem escape |
| ETag integrity on PUT | 422 on md5 mismatch (after the fix below) |
| Metadata length | 400 over the 256-char limit (after the fix below) |
Supply chain and unsafe
- Run
cargo auditagainst the exact current lockfiles and archive the output; an older zero-vulnerability count expires as advisories and dependencies move. unsafe— a small, reviewed surface: FFI (the erasure-coding codec) and syscall wrappers (getifaddrs,flock, xattr). No transmutes or ambient global-state hacks.
Control-plane auth
The swift-deploy-rs control API is token-guarded — plan,
validate, and apply all require the token; only /healthz is public. The
swift-console holds a per-session token and is meant to listen
on loopback behind the cluster load balancer.
Validation fixes shipped
Three input-validation/format deviations from Python were found and fixed:
ETag integrity. The proxy dropped the client ETag before fan-out, so the
object server’s md5 check never fired and a corrupt upload returned 201. The
proxy now forwards it; a mismatch is 422.
ETag format. The object server correctly returns a quoted ETag (matching
Python’s diskfile and the golden oracle); the proxy now strips the quotes for
the client (normalize_etag), so the client sees the bare md5.
Metadata length. Object writes now run check_metadata; an oversized
X-Object-Meta-* value is rejected with 400 instead of stored.
Hardening notes
Runtime and control-plane hardening
- bind
swift-console,swift-deploy ui, andcosbench-rs serveto loopback or a dedicated management network; - place TLS and operator authentication at the management ingress;
- keep deploy tokens, Swift/S3 credentials, TLS keys, TempURL keys, and hash secrets outside Git and reports;
- use strict SSH host keys and avoid
--allow-passwordunless a reviewed plan requires it; - authorize disk, firewall, SSH, and host reconfiguration independently;
- cap file descriptors, memory, request sizes, upload lifetimes, connections, active requests, and blocking queues;
- verify logs redact auth tokens and signature-bearing query strings.