feat:Add Dual Layer Server-Side Encryption via DSSE-KMS#62539
Open
cuppett wants to merge 4 commits into
Open
Conversation
Follow-up to nextcloud#57623 (SSE-KMS). Adds a single `sse` objectstore argument (none/sse-s3/sse-c/sse-kms/sse-kms-dsse) so DSSE-KMS, encryption context, and S3 Bucket Keys can be configured without ambiguous or silently conflicting combinations of booleans. `sse_c_key` and `sse_kms_enabled` remain as deprecated aliases so existing configs keep working unchanged. Assisted-by: ClaudeCode:claude-opus-5 Signed-off-by: Stephen Cuppett <steve@cuppett.com>
…t exception Conflicting sse* arguments now resolve deterministically instead of throwing: sse_c_key + sse_kms_enabled both set falls back to SSE-C, matching the behaviour already released in Nextcloud 34, and an explicit sse argument always overrides the deprecated keys. Every resolution is recorded and logged once via getConnection(), including a warning on any SSE-C usage, so the fallback is no longer silent. sse_kms_bucket_key with sse-kms-dsse also moves from a hard exception to a warning: verified against a live bucket that S3 accepts the request and simply does not apply the bucket key, rather than rejecting it as AWS's own documentation suggests. Adds a live test suite (S3EncryptionModesLiveTest) exercising the full sse mode matrix and cross-mode reads against a real AWS bucket and KMS key, and extends the offline S3ServerSideEncryptionTest with precedence, warning, and logger-emission coverage. Assisted-by: ClaudeCode:claude-opus-5 Signed-off-by: Stephen Cuppett <steve@cuppett.com>
The SSE-C deprecation warning added in the previous commit hedged that upstream hadn't announced a deprecation. That was wrong: SSE-C is deprecated since Nextcloud 34 because Amazon S3 disabled SSE-C by default for new buckets in April 2026 (independently reproduced against a live bucket). Corrects the warning text and a comment that had denied the deprecation, and adds the admin-facing signal that was missing: a SetupCheck surfaced in Settings > Overview, following the same version+reason phrasing convention used elsewhere for deprecated config values (e.g. FilenameValidator, PhpOutdated). Assisted-by: ClaudeCode:claude-opus-5 Signed-off-by: Stephen Cuppett <steve@cuppett.com>
cuppett
requested review from
Altahrim,
leftybournes,
provokateurin and
salmart-dev
and removed request for
a team
July 25, 2026 16:39
cuppett
added
3. to review
cuppett
changed the title
Signed-off-by: Stephen Cuppett <steve@cuppett.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends the SSE-KMS support merged in #57623 with AWS DSSE-KMS, and replaces the two
booleans that PR introduced (
sse_c_key,sse_kms_enabled) with a singlessemodeargument (
''/sse-s3/sse-c/sse-kms/sse-kms-dsse), since a third modecouldn't be added to that config shape without either a second mutually-exclusive
boolean or a discriminator.
sseobjectstore argument selects the encryption mode explicitly.sse_c_keyand
sse_kms_enabledremain as deprecated aliases — existing configs keep workingunchanged, resolved by the same precedence Nextcloud 34 already shipped (SSE-C wins
if both are set), but the fallback is now logged instead of silent.
sse_kms_encryption_contextandsse_kms_bucket_key, the two SSE-KMS featuresthat make it useful for the multi-tenant case feat(objectstore): Add AWS SSE-KMS encryption support for S3 storage #57623 described (encryption context
for
kms:EncryptionContextpolicy conditions on a shared bucket; bucket keys forKMS request cost reduction).
SSE-C by default for new buckets in April 2026, which we hit directly during live
testing against a fresh bucket. Adds a
SetupCheck(Settings → Overview) so this isactually visible to admins, not just a log line.
from feat(objectstore): Add AWS SSE-KMS encryption support for S3 storage #57623: docs: document S3 SSE-KMS support and deprecate SSE-C documentation#15375. It predates the
sseargument, DSSE-KMS,encryption context, and bucket keys added here, so it'll need a follow-up once this
merges.
Tested against a real AWS bucket + KMS key (all
ssemodes, cross-mode reads, SSE-Cnegative-read path, multipart under DSSE) and against MinIO for the non-AWS regression
path.
TODO
admin-s3-sse-clinkToDocs()redirect key once docs: document S3 SSE-KMS support and deprecate SSE-C documentation#15375'ss3-sse-canchor existssse,sse-kms-dsse,sse_kms_encryption_context,sse_kms_bucket_keyChecklist
3. to review, feature component)stable32)AI (if applicable)