Documentation
¶
Overview ¶
Package s3test gives a test a real S3 to walk.
The archive walks are the part of this repository that has been wrong twice, and both times the tests passed: a walk that covered one tenant, and a listing that stopped at the first thousand keys. Both hid behind storetest.Memory, which returns everything, in any layout, on one page. A double kinder than the thing it stands in for is not a test.
So these tests run against LocalStack, which pages ListObjectsV2 at a thousand like AWS and honours Delimiter and continuation tokens the same way.
What it does and does not enforce was measured rather than assumed, because the first version of this comment guessed and guessed wrong. It refuses to delete a version held by a compliance retention, which is the guarantee the whole archive rests on and is asserted here. It does not implement PutObjectRetention at all — it answers MethodNotAllowed where AWS answers AccessDenied — so nothing here may claim that a retention cannot be shortened. That claim is checked against real S3 instead, on demand, by the test in realbucket_test.go.
Index ¶
Constants ¶
const URLEnv = "AUDIT_S3_URL"
URLEnv names the S3 endpoint the tests run against.
It is an endpoint, not a product: LocalStack, MinIO or a real bucket all satisfy it. Which one a deployment or CI points at is a choice that can change without touching a test, which matters because the licence and the maintenance status of every S3 fake are somebody else's to change.
Variables ¶
This section is empty.
Functions ¶
func Fill ¶
Fill writes n objects under one profile and tenant in one hour of ingest time, as v1 keys, so that a test can cross a listing page. Their keys sort in the order they are returned.
func KMS ¶ added in v0.7.0
KMS is a KMS client on the same endpoint as the S3 tests, which skips the test when there is none.
func Open ¶
Open returns a store over a bucket of this test's own.
Object Lock has to be asked for when a bucket is created and cannot be added afterwards, so with lock the bucket is made with it and the store writes in compliance mode: the writer's path on the record tier. Without, the bucket has no Object Lock and the store writes with lock mode none: the writer's path on the attested tier, and the exports bucket's shape. Both are real paths, and the harness serves both so that neither is the kinder double.
The bucket's name ends in a random suffix, because a locked bucket cannot be taken away afterwards and so the same name cannot be asked for twice. See release.
Types ¶
type Raw ¶
Raw is a store together with the client and bucket underneath it.
It exists for the tests that have to attempt what store.Store deliberately offers no way to do — delete an object — because showing that the bucket refuses is the only way to know the archive's central claim is true rather than merely unexercised.
Source Files