[cxymds]

The security suite did not cover the root AssumeRole regression reported in rustfs/rustfs#9279. Add STS-106 through STS-112 to reproduce the original form-encoded POST using curl's aws:amz:us-east-1:s3 signer, require complete and unexpired temporary credentials, and verify a signed ListBuckets request with the returned session token.

The new cases require startup to reject 4- and 7-byte root secrets and a 2-byte access key, while accepting the 3-byte access-key / 8-byte secret boundary and an 8-byte UTF-8 secret. Startup probes use the installed candidate binary in isolated loopback processes with private temporary volumes. Unexpected HTTP errors, unrelated startup failures, timeouts, and cleanup failures cannot pass. A framed SSH source transfer followed by continuous heartbeats detects channel EOF or five seconds without a heartbeat. Signal handlers record cancellation so teardown finishes its wait, SIGKILL fallback, and private-directory removal before returning status 130, including repeated cancellation during cleanup. Startup rejection requires a diagnostic identifying the invalid credential; informational policy logs and unrelated errors cannot pass. Public diagnostics omit secrets, tokens, and raw server logs.

Register the cases in all three security-suite topologies, add local contract coverage to the security CI workflow, and document standalone execution. These startup assertions target the intended fix: versions that still accept short credentials are expected to fail them, even when AssumeRole returns HTTP 200 or 403.

Validation:

• python3 -B -m unittest -v test_sts_root_regression.py test_rustfs_security.py test_sensitive_diagnostics.py: 37 tests passed, including independent SigV4 verification, the reported HTTP 500 response, malformed/missing credentials, informational-log false positives, non-PTY channel EOF, stalled heartbeats, and cancellation during forced cleanup.
• bash -n rustfs-security-test.sh, actionlint .github/workflows/security-script-tests.yml, and whitespace checks passed.
• Local RustFS 1.0.0-beta.7: all three valid-credential cases passed; all three short-credential cases correctly failed because that version still permits startup. Every temporary instance was cleaned up.
• The 1.0.5 image and an upstream fixed build have not been run. Shared test VMs were not used.

Related: rustfs/rustfs#9279

[Copilot]

🟡 Changes recommended

Disconnects or cancellation can leave child processes and private data behind, while startup-rejection checks can falsely pass on informational policy logs.

3 open issues

• Clean up remote helper when SSH channel closes · New
• Require a credential-specific rejection diagnostic · New
• Complete teardown before propagating cancellation · New

What changed in this PR

Adds regression coverage for root AssumeRole credential boundaries reported in rustfs/rustfs#9279, integrating isolated startup probes into the security suite.

Changes:

• Registers STS-106–STS-112 across all three topologies.
• Checks credential byte-length boundaries, signed AssumeRole requests, and temporary-credential usability.
• Adds local contract tests, CI coverage, and standalone execution instructions.

File	Description
test_sts_root_regression.py	Tests signing, response validation, startup boundaries, and cleanup.
test_rustfs_security.py	Checks registration of the new cases in every topology.
scripts/​sts_root_regression.py	Implements signed requests and isolated startup probes.
rustfs-security-test.sh	Integrates STS-106–STS-112 into the suite.
README.md	Documents expected outcomes and standalone usage.
.github/​workflows/​security-script-tests.yml	Adds triggers and execution for regression contract tests.

_{Review effort: Balanced}