gnodet-bot commented on code in PR #28553:
URL: https://github.com/apache/camel/pull/28553#discussion_r4386815754
##########
components/camel-minio/src/main/java/org/apache/camel/component/minio/MinioProducer.java:
##########
@@ -256,11 +272,26 @@ private void copyObject(MinioClient minioClient, Exchange
exchange) throws Excep
.bucket(bucketName)
.object(sourceKey);
+ if (getConfiguration().getServerSideEncryptionCustomerKey() !=
null) {
+
copySourceBuilder.ssec(getConfiguration().getServerSideEncryptionCustomerKey());
+ }
+
CopyObjectArgs.Builder copyObjectRequest = CopyObjectArgs.builder()
.bucket(destinationBucketName)
.object(destinationKey)
.source(copySourceBuilder.build());
+ if (getConfiguration().getServerSideEncryption() != null
+ && getConfiguration().getServerSideEncryptionCustomerKey()
!= null) {
+ throw new IllegalArgumentException(
+ "Only one of serverSideEncryption or
serverSideEncryptionCustomerKey may be configured, not both");
Review Comment:
⚠️ **Behavioral concern:** The guard here prevents configuring both
`serverSideEncryption` and `serverSideEncryptionCustomerKey` simultaneously —
but it blocks a valid S3 use case: **decrypting an SSE-C source and
re-encrypting the destination with SSE-S3** (or vice versa). This is a common
cross-encryption copy pattern.
`MinioConsumer.moveAfterRead()` (same component, not in this PR) already
supports exactly this — it applies `serverSideEncryptionCustomerKey` to the
source via `ssec()` and `serverSideEncryption` to the destination via `sse()`
independently, with no mutual exclusion guard.
The guard creates an inconsistency: a configuration that works for the
consumer will throw `IllegalArgumentException` in the producer's `copyObject`.
Consider splitting the validation into separate, context-aware checks:
- Validate that `source.ssec()` and `destination.sse()` are semantically
valid *for their respective roles*, rather than treating any co-presence as an
error.
- Or at minimum, document that the cross-encryption copy pattern is
intentionally unsupported in the producer (and consider aligning with the
consumer's behavior).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
