CLDSRV-1060: Check the governance bypass permission on DeleteObject (hotfix/9.2.36) by leif-scality · Pull Request #6360 · scality/cloudserver

leif-scality · 2026-11-09T16:44:04Z

Cherry-picked from #6354. The conflicts were formatting only. 9.2.36 has no AWS SDK v3, so the functional test uses the v2 SDK and creates its IAM users itself.

bert-e · 2026-11-09T16:44:15Z

Hello leif-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/bypass_source_branch_lineage`	Bypass the cross-branch contamination check	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request.
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-11-09T16:44:21Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-1060 contains:

9.3.28
9.4.13
9.5.3
9.6.0

Considering where you are trying to merge, I expected to find at least:

9.2.36.1

Please check the Fix Version/s of CLDSRV-1060, or the target
branch of this pull request.

github-actions · 2026-11-09T16:44:54Z

LGTM

Review by Claude Code

codecov · 2026-11-09T16:48:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.32%. Comparing base (5c81933) to head (3e47956).
⚠️ Report is 4 commits behind head on hotfix/9.2.36.
✅ All tests successful. No failed tests found.

Additional details and impacted files

Files with missing lines	Coverage Δ
...i/apiUtils/authorization/prepareRequestContexts.js	`95.34% <100.00%> (ø)`

... and 2 files with indirect coverage changes

@@                Coverage Diff                @@
##           hotfix/9.2.36    #6360      +/-   ##
=================================================
- Coverage          84.36%   84.32%   -0.04%     
=================================================
  Files                204      204              
  Lines              13162    13162              
=================================================
- Hits               11104    11099       -5     
- Misses              2058     2063       +5

Flag	Coverage Δ
file-ft-tests	`67.74% <100.00%> (-0.04%)`	⬇️
kmip-ft-tests	`28.21% <0.00%> (ø)`
mongo-v0-ft-tests	`69.00% <100.00%> (+<0.01%)`	⬆️
mongo-v1-ft-tests	`68.97% <100.00%> (-0.02%)`	⬇️
multiple-backend	`35.29% <100.00%> (+0.02%)`	⬆️
sur-tests	`36.59% <100.00%> (+0.85%)`	⬆️
sur-tests-inflights	`37.63% <100.00%> (ø)`
unit	`69.95% <100.00%> (ø)`
utapi-v2-tests	`34.50% <100.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-11-09T17:16:57Z

LGTM

Review by Claude Code

dvasilas

Prefex using cherry-pick -x so that we get cherry picked from ... and we can find the initial commit.

The bypass action was added to the authorization only when sourceVersionId was set, which is the version of a copy source and is never set on a delete. So a delete of a specific version with x-amz-bypass-governance-retention removed a GOVERNANCE-locked version with only s3:DeleteObjectVersion, and a Deny on s3:BypassGovernanceRetention was ignored. Authorize s3:BypassGovernanceRetention on every delete of a specific version that sends the header. Call prepareRequestContexts in the unit tests as the API does for a delete, without a copy source, and add functional tests with IAM users against Vault. (cherry picked from commit 8cfe61b)

9.2.36 has neither the AWS SDK v3 nor the IAM test helper, so create the IAM users with the v2 IAM client, as bucketPolicyBypassPort.js does.

The latest is 26 with breaks with tests needing python 3.9 (cherry picked from commit 8d58737)

github-actions · 2026-11-10T10:34:43Z

LGTM

Review by Claude Code

leif-scality · 2026-11-10T11:40:07Z

/approve

bert-e · 2026-11-10T11:40:16Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-1060 contains:

9.3.28
9.4.13
9.5.3
9.6.0

Considering where you are trying to merge, I expected to find at least:

9.2.36.1

Please check the Fix Version/s of CLDSRV-1060, or the target
branch of this pull request.

The following options are set: approve

leif-scality · 2026-11-10T11:47:27Z

ping

bert-e · 2026-11-10T11:47:40Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ hotfix/9.2.36

The following branches have NOT changed:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0
development/9.1
development/9.2
development/9.3
development/9.4
development/9.5
development/9.6

Please check the status of the associated issue CLDSRV-1060.

Goodbye leif-scality.

The following options are set: approve

SylvainSenechal approved these changes Nov 9, 2026

View reviewed changes

francoisferrand approved these changes Nov 9, 2026

View reviewed changes

dvasilas approved these changes Nov 10, 2026

View reviewed changes

leif-scality and others added 4 commits November 10, 2026 11:07

CLDSRV-1060: Use the AWS SDK v2 in the functional test

63de57a

9.2.36 has neither the AWS SDK v3 nor the IAM test helper, so create the IAM users with the v2 IAM client, as bucketPolicyBypassPort.js does.

Bump version to 9.2.36-3

ec4da93

CLDSRV-1020: Pin CI ubuntu 24.04

3e47956

The latest is 26 with breaks with tests needing python 3.9 (cherry picked from commit 8d58737)

leif-scality force-pushed the bugfix/CLDSRV-1060-9.2.36 branch from a6a2d10 to 3e47956 Compare November 10, 2026 10:33

bert-e merged commit 3e47956 into hotfix/9.2.36 Nov 10, 2026
51 of 55 checks passed

bert-e deleted the bugfix/CLDSRV-1060-9.2.36 branch November 10, 2026 11:47

This was referenced Nov 10, 2026

CLDSRV-1060: Check the governance bypass permission on DeleteObject (hotfix/9.0.32) #6364

Closed

CLDSRV-1060: Check the governance bypass permission on DeleteObject (hotfix/9.2.24) #6365

Closed

Navigation Menu

Repository navigation

CLDSRV-1060: Check the governance bypass permission on DeleteObject (hotfix/9.2.36) - #6360

CLDSRV-1060: Check the governance bypass permission on DeleteObject (hotfix/9.2.36)#6360
bert-e merged 4 commits into
hotfix/9.2.36from
bugfix/CLDSRV-1060-9.2.36

leif-scality commented Nov 9, 2026

Uh oh!

bert-e commented Nov 9, 2026

Uh oh!

bert-e commented Nov 9, 2026

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

codecov Bot commented Nov 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

dvasilas left a comment

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

leif-scality commented Nov 10, 2026

Uh oh!

bert-e commented Nov 10, 2026

Uh oh!

leif-scality commented Nov 10, 2026

Uh oh!

bert-e commented Nov 10, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

leif-scality commented Nov 9, 2026

Uh oh!

bert-e commented Nov 9, 2026

Hello leif-scality,

Uh oh!

bert-e commented Nov 9, 2026

Incorrect fix version

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

codecov Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

dvasilas left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

leif-scality commented Nov 10, 2026

Uh oh!

bert-e commented Nov 10, 2026

Incorrect fix version

Uh oh!

leif-scality commented Nov 10, 2026

Uh oh!

bert-e commented Nov 10, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

codecov Bot commented Nov 9, 2026 •

edited

Loading