GovOPlaN/govoplan-files
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(files): document pinned SMB validation

Browse Source
This commit is contained in:
zemion
2026-08-21 23:20:15 +02:00
parent 378f4d6ac5
commit 62047e7a20
2 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dev/connectors/README.md
+14 -6
View File
@@ -139,12 +139,20 @@ cd /mnt/DATA/git/govoplan-files/dev/connectors
``` ```
The script reads `.env` from this directory when present and seeds tiny WebDAV, The script reads `.env` from this directory when present and seeds tiny WebDAV,
Nextcloud, SMB, and MinIO fixtures. WebDAV and Nextcloud are browsed and imported Nextcloud, SMB, and MinIO fixtures. WebDAV and Nextcloud use the pinned HTTP
through the pinned connector transport. SMB and S3 product access deliberately transport. SMB uses the Files-owned `smbprotocol` connection cache so initial
fails closed until their SDK transports support peer pinning, so their fixtures connections, reconnects, aliases, and DFS referral targets are pinned. S3 uses
are retained for transport development and reported as expected optional skips. pinned botocore pools for retries, redirects, discovery, and aliases. Every
The `--require-smb` and `--require-s3` switches are useful only while developing socket destination is revalidated when it opens, including when private-network
that transport support and currently make the smoke check fail by design. access is enabled for these local fixtures.
SMB and S3 are optional by default: a missing provider dependency or unavailable
target is reported as `SKIP`. Use `--require-smb` and `--require-s3` to turn such
provider failures into a non-zero smoke result during deployment validation. The
bundled Samba service is a deterministic single-share target, not a DFS
topology. Referral and reconnect behavior is covered by the transport contract
tests; deployments using DFS must additionally run the required SMB smoke check
against their actual referral topology and record the resolved peers.
SMB smoke checks need the optional Python dependency in the environment running SMB smoke checks need the optional Python dependency in the environment running
the script: the script:
docs/FILES_HANDBOOK.md
+10
View File
@@ -1034,6 +1034,16 @@ attempt. Botocore retries, redirects, endpoint discovery, and aliases, plus SMB
reconnects and DFS referrals, must pass through the pinned factories. A changed reconnects and DFS referrals, must pass through the pinned factories. A changed
or unsupported SDK seam must fail before a usable client/session is returned. or unsupported SDK seam must fail before a usable client/session is returned.
SMB deployments use `smbprotocol>=1.13`; signing is required by default and SMB
encryption can be required per connector profile. Private targets additionally
require the governed private-network setting, but that setting never bypasses
per-connection address validation. The bundled development Samba target checks
live initial browse/import behavior with `smoke.py --require-smb`. It is a
single-share fixture rather than a DFS topology: reconnect and referral handling
is enforced by the transport contract suite, while operators using DFS must run
the same required smoke check against their institutional referral topology and
record the initial and referred peers as deployment evidence.
### Imported evidence and sync ### Imported evidence and sync
Given a permitted WebDAV file is imported, its managed response and audit event Given a permitted WebDAV file is imported, its managed response and audit event