Repository navigation
feat: audit log, TLS and e2e for the S3 mode, docs and AWS sketch (#220) - #229
Merged
Merged
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
db-core's S3 store speaks http:// only. With --features tls an https:// endpoint (AWS) goes through a Transport over ureq with rustls and ring, trusting the platform's certificate store; the image builds with it and carries the CA bundle. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…R-019 (#220) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Not needed: nothing exercises it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
5 tasks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Finishes #220 after #225 and #226 (sightings in S3, Garage compose profile).
audit.rs): withFRANK_STORE, one object per line underaudit/YYYY-MM-DD/<ns>-<pid>-<n>.jsonl, read back by prefix in order, retention deletes the days' objects.objects.rs):tlsfeature, a db-coreTransportoverureq+ rustls/ring and the platform store, on in the image (CA bundle copied intoscratch,gccin the build stage).deny.tomland acargo deny checkCI job; the SBOM comes from the binary's auditable data, so it includes the TLS crates.S3=1 make e2e: throwaway Garage on its own network; checks the bucket holds the table.a_local_table_copied_to_a_store_is_the_same_table), ADR-019, CHANGELOG.Decisions to check
FRANK_WAL_DIRis not added: the WAL already lives in<data>/s3/sightings, and<data>is the EFS volume on AWS. Say if you want the separate setting.CDLA-Permissive-2.0andZlibare in thedeny.tomlallow-list (webpki-roots via the platform verifier; foldhash).Test plan
cargo fmt,clippy -D warnings(with and withouttls),cargo test --workspace,make check-mvl-limit,cargo deny checkmake e2eandS3=1 make e2eon the rebuilt imageCloses #220
🤖 Generated with Claude Code