[tcarmet]

When a copy named a specific version of its source (?versionId=, including null), the source read was checked as a GetObject, while the identity check had been made for GetObjectVersion. So the requester's identity policy was never applied, and bucket policy statements on s3:GetObjectVersion were ignored. A copy of a specific version is now authorized like a GetObject of that version, and its quota is still evaluated. As a result, a bucket policy Deny meant to protect every version must cover s3:GetObjectVersion (or s3:GetObject*), not only s3:GetObject.

[bert-e]

Hello tcarmet,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Incorrect fix version

The Fix Version/s in issue CLDSRV-1039 contains:

• None

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

• 9.3.24

• 9.4.9

• 9.5.0

• 9.6.0

Please check the Fix Version/s of CLDSRV-1039, or the target
branch of this pull request.

[jonathan-gramain]

This looks kinda convoluted to me, as actionNeedQuotaCheckCopy is a super simple function that may not deserve to be in Arsenal IMHO.

I think one of the following could be done:

• the whole logic could probably be just pasted there and then the new objectGetVersion case be inserted naturally in the tested condition
• the copy-specific actions may be inserted in the actionNeedQuotaCheck constant object in arsenal, and the extra source action condition can be pasted in here, but this may have side-effects as actionNeedQuotaCheck is used elsewhere.