oscerd opened a new pull request, #25027:
URL: https://github.com/apache/camel/pull/25027

   ### Motivation
   
   [CAMEL-21314](https://issues.apache.org/jira/browse/CAMEL-21314). 
`S3CopyObjectCustomerKeyIT` was failing and ended up disabled as a "Broken 
test". It turns out the test was right and the **producer is broken**: copying 
an object that was stored with SSE-C does not work at all.
   
   `copyObject` only set the *destination* SSE-C parameters (`sseCustomerKey`, 
`sseCustomerKeyMD5`, `sseCustomerAlgorithm`). When the *source* object is 
itself SSE-C encrypted, S3 also needs the copy-source customer key in order to 
decrypt it, and rejects the request otherwise — which is exactly the failure 
reported on the issue:
   
   ```
   InvalidRequest: SSE-C encrypted objects require customer key headers. 
(Service: S3, Status Code: 400)
   ```
   
   (the issue also quotes the equivalent `The object was stored using a form of 
Server Side Encryption. The correct parameters must be provided to retrieve the 
object.`)
   
   So this is a real user-facing bug, not just a test problem: `copyObject` 
against any SSE-C encrypted object fails.
   
   ### Changes
   
   - `AWS2S3Producer.copyObject` now also sets `copySourceSSECustomerKey`, 
`copySourceSSECustomerKeyMD5` and `copySourceSSECustomerAlgorithm`, alongside 
the existing destination parameters, from the same configured customer key — 
the source was written with that key and the destination is re-encrypted with 
it.
   - Re-enabled `S3CopyObjectCustomerKeyIT` (dropped `@Disabled("Broken test")` 
and the now-unused import).
   
   ### Testing
   
   Verified end-to-end against localstack, including a control run to confirm 
the fix is what makes the difference:
   
   - **Without** the producer change (fix stashed, test enabled): 
`S3CopyObjectCustomerKeyIT` fails with `InvalidRequest: SSE-C encrypted objects 
require customer key headers ... Status Code: 400`.
   - **With** the fix: `Tests run: 1, Failures: 0, Errors: 0` — the IT passes, 
and the module's 41 unit tests pass alongside it.
   - Full reactor `mvn clean install -DskipTests` from root: success, no stale 
generated files.
   
   ### Backport
   
   The same destination-only handling is present on `camel-4.18.x` and 
`camel-4.14.x` (verified: neither branch sets any `copySourceSSECustomerKey*` 
parameter), so this is a backport candidate for both once merged here.
   
   _Claude Code on behalf of Andrea Cosentino (@oscerd)._
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to