chore(deps): update ghcr.io/cosmian/kms docker tag to v5.28.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/cosmian/kms	minor	5.27.1 → 5.28.0

---

Release Notes

Cosmian/kms (ghcr.io/cosmian/kms)

v5.28.0

Compare Source

🔒 Security

• Extractable / NeverExtractable not enforced on key export paths (GHSA-8mmx-f92q-2gq8): Get, Export, and PKCS#12 export now enforce Extractable/NeverExtractable, deny non-extractable keys with ResultReason::Not_Extractable, require a non-empty password for sensitive PKCS#12 exports, and unconditionally latch server-managed NeverExtractable across creation/import and ReKey/ReKeyKeyPair rotations (#​1198)
• Reserved UID * bypassable via AtomicOperation::Upsert and Certify destination overwrite (GHSA-pvw2-jxwc-95xq): Database::atomic now screens both Create and Upsert against the reserved-UID guard, Certify validates/authorizes destination UIDs, and all backends (SQLite, PostgreSQL, MySQL, Redis) atomically enforce ownership on Upsert without partial tag mutations (#​1198)
• Sensitive / Extractable attribute stripping via read-only Get grant (GHSA-c75c-3cmm-48h7): DeleteAttribute now rejects server-managed attributes (including Sensitive and Extractable) under both the by-value and by-tag branches, and mutating these attributes requires explicit operation grants or ownership instead of a read-only Get grant (#​1198)
• SPIRE PKI sign-intermediate issues CA certificates to any Vault token (COSMIAN-2026-022, #​1234): POST /v1/{pki_mount}/root/sign-intermediate now requires the caller's KMS identity (spire:<AppRole name>) to hold the certify grant on the CA private key; CA keys are looked up only among keys owned by default_username, and CSRs requesting basicConstraints are rejected to preserve pathlen:0 (Upgrade action: run ckms access-rights grant spire:<AppRole name> certify --object-uid <ca-private-key-uid>)
• SPIRE transit key substitution via shared tags (COSMIAN-2026-023, #​1234): transit key resolution (sign, GET /keys/{name}, list, delete) now restricts lookups to keys owned by the caller, preventing key substitution via shared tags; creating an existing key name is idempotent
• Any user can publish a key on the unauthenticated JWKS endpoint (COSMIAN-2026-024, #​1234): /.well-known/jwks.json now publishes only keys owned by default_username, preventing unauthorized key injection via shared keys
• JOSE tag endpoints allow tag changes with any grant (COSMIAN-2026-025, #​1234): POST/DELETE /v1/crypto/keys/{kid}/tags now enforce add_attribute / delete_attribute permissions instead of general read access
• PKCS#11 module buffer overflows in C_GetAttributeValue and C_Encrypt (COSMIAN-2026-026, #​1234): caller buffer length is verified before writing output to prevent buffer overflow; returns CKR_BUFFER_TOO_SMALL; C_GenerateKey now rejects a null phKey with CKR_ARGUMENTS_BAD
• CRL/OCSP revocation status could be lost, stale or wrong (COSMIAN-2026-027, #​1234): Destroy preserves issuer link and revocation metadata so destroyed certificates remain reported as revoked (RFC 5280 §3.3); certificate serials are generated as random 159-bit integers instead of SHA-1(SPKI) to avoid serial collisions on ReCertify; OCSP response cache is keyed by full CertID, bounded, respects nextUpdate, and skips caching unknown; OCSP requires CA match for all CertIDs; automatic CRL regeneration runs on behalf of the CA owner; stored CRL is re-read from the DB every 60 s; wrapped CA keys are unwrapped for CRL/OCSP signing; Validate/Import CRL cache enforces 5-minute freshness and does not hold locks during network I/O
• SSRF check bypass via kms_public_url prefix match in CRL fetching (COSMIAN-2026-028, #​1234): URL comparison in CRL fetching compares parsed scheme, host, port, and base path, rejecting URLs with embedded credentials to prevent SSRF bypass
• Harden asymmetric DeriveKey curve validation to check the OpenSSL key Id actually constructed from each referenced object's key material, closing an Ed25519/X25519 key-type confusion edge case (both curves share a 32-byte raw key length) (#​1170)
• Remove unmaintained/unsound transitive dependencies: smol-toml 1.6.1 → 1.8.0 (CVE-2026-85730), axum-server 0.7 → 0.8 to drop unmaintained rustls-pemfile (RUSTSEC-2025-0134, #​1180), rustls 0.23.43 → 0.23.45, and upgraded kube to remove unmaintained deps

🚀 Features

Audit Logging & SIEM Export

• Add a tamper-evident, cryptographically-chained JSONL audit log of every KMIP operation (#​934): each event carries an id, prev_hash, and row_hash (SHA-256), fsync'd after every write; truncation/reordering/modification breaks the chain and is detected by the new ckms audit verify command
• Add per-BatchItem audit events with a shared UUID v4 request_id (fan-out of batch RequestMessage calls) for SIEM/log correlation
• Add a ckms audit verify --path <file|dir> CLI command: verifies each row_hash and prev_hash link, validates every *.jsonl chain in a directory, and confirms sealed audit:reanchor evidence files still exist and hash-match on disk
• Add Common Event Format (CEF) serialization (to_cef_line()) for direct ArcSight/Splunk/QRadar ingestion, with a devicePayloadId=<uuid> extension when request_id is present
• Add drop-detection: when the bounded audit channel is full, an audit:eviction sentinel event is written into the chain so lost events are detectable by ckms audit verify
• Add configurable trusted-proxy CIDR validation for X-Forwarded-For, preventing client IP spoofing in audit logs (--audit-trusted-proxy-cidrs)
• Add configurable audit failure mode (--audit-failure-mode continue|reject): reject returns HTTP 503 when an event cannot be queued
• Add an always-start recovery model (#​1126): startup no longer aborts on a corrupted audit tail — torn writes are truncated and continued (with an audit:torn-write-recovered sentinel), tampered rows trigger seal-and-roll to a forensic <name>.<ts>.<hex>.corrupt.<ext> file plus a fresh audit:reanchor chain, the entire hash chain is verified on every boot, a best-effort cross-platform exclusive lock prevents two KMS instances corrupting a shared-volume log, and an unwritable path self-heals via periodic retry
• Add optional --audit-file-max-size-bytes write-stop cap (no rotation/retention)

SPIFFE / Workload Identity (#​1206)

• Add opt-in SPIFFE JWT-SVID workload authentication (--jwt-svid-auth / KMS_JWT_SVID_AUTH / [idp_auth] jwt_svid_auth): a validated JWT without an email claim is accepted when sub starts with spiffe://, becoming the KMS user/owner (audit method JwtSvid); audience is required, and mTLS client-cert CN takes precedence over JWT-SVID
• Add ckms login spire --audience <aud> [--spiffe-id <id>] [--socket-path <path|uri>] (SPIRE Agent Workload API)
• Add POST /ui/login_svid BFF endpoint and GET /ui/auth_method advertising SPIFFE; the kms setup wizard now asks whether JWT/OIDC providers issue SPIFFE JWT-SVIDs

X25519 ECDH (#​1170)

• Add non-FIPS X25519 key agreement to KMIP DeriveKey, including repeated base-object identifiers for asymmetric two-key derivation (DeriveKey::new_single_base / new_asymmetric); shared secrets are stored as non-extractable SecretData with reciprocal derivation links
• Add ckms derive-key --x25519 --private-key-id <ID> --peer-public-key-id <ID> and a WASM export derive_key_asymmetric_ttlv_request for the Web UI
• Add an "X25519 ECDH" derivation method to the Derive Key Web UI page (private-key and peer-public-key selectors, fixed 256-bit SecretData output)

JOSE / REST Crypto API (#​1033)

• Add ECDH-ES decrypt support to /v1/crypto/decrypt (RFC 7518 §4.6): ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW with A128GCM/A192GCM/A256GCM content encryption, over P-256/P-384/P-521 (FIPS) and X25519 (non-FIPS)
• Add /v1/crypto/keys key creation for ECDH-ES* algorithms (KeyAgreement usage), and publish X25519 static public keys via /.well-known/jwks.json (kty=OKP)
• Add an ecdh_key_agreement primitive and RFC 7518 Appendix C / NIST SP 800-56A Concat KDF to cosmian_kms_crypto

Database TDE Integrations (#​1162)

• Add SAP ASE (Adaptive Server Enterprise) TDE support via cosmian_pkcs11, and IBM Db2 LUW TDE support via the native IBM GSKit KMIP client over mutual TLS

🐛 Bug Fixes

Database

• Fix kms.keys.active.count metric never updating on PostgreSQL (JSONB ? operator applied to a VARCHAR column); now casts object::jsonb and logs failures at warn! level (#​1203)
• Enable Redis TLS (rediss://) for the Redis-findex backend by enabling tls-native-tls / tokio-native-tls-comp (#​1195, #​1204)
• Add a (tag, id) index on all three SQL backends to turn tag-based Locate lookups into index-only scans (#​1224)
• Add JSON-expression indexes for keyset resolution (find_by_rotate_name), the auto-rotation scheduler, and ObjectType filters on PostgreSQL/SQLite, and make kms.keys.active.count filter on the ObjectType attribute instead of parsing every row's JSON (#​1224)
• Rewrite Locate-by-tags as per-tag INNER JOINs with EXISTS-based read-access probes, pushing LIMIT/server cap and destroyed-object exclusion into the query so the DB stops after the requested page (#​1224)

Permissions / Access Control

• GET /access/obtained and KMIP Locate now include permissions granted to the wildcard user *, consistent with per-object permission checks (#​1188)
• Fix RedisWithFindex::list_user_operations_granted mispairing permission entries with objects by zip-ing two independently-ordered HashMaps instead of joining by object uid (#​1188)

Cache

• Fix cross-node cache invalidation: the per-process object cache now performs bounded-revalidation checks against shared state so revoked/destroyed keys are not served stale from a peer node's cache (#​1199)

JOSE

• Fix /.well-known/jwks.json publishing EC keys authorized for KeyAgreement (but not Verify) with a signature use/alg claim (ES256/ES384) instead of use=enc with no alg

♻️ Refactor

• crate/server: introduce the audit middleware/extension-injection architecture and AuditFileStore single-writer task, splitting the KMIP route module into routes/kmip/ (handlers.rs, audit.rs)
• crate/access: add audit::{event, hash, cef, file_hash} with canonical event hashing, CEF serialization, and file-tail hash helpers
• crate/server_database: rework the SQL Locate query builder (locate_query.rs) and shared SQL/MySQL/SQLite query files for index-backed lookups and JSONB-aware predicates
• crate/kmip: widen DeriveKey identifier fields to Vec (KMIP 1.4 unique_identifier and 2.1 object_unique_identifier) for asymmetric derivation
• crate/crypto: add concat_kdf (RFC 7518 Appendix C) and a generic P-256/P-384/P-521 ecdh_key_agreement primitive

🧪 Testing

• Add SIEM integration suites: mise test:audit (hash-chain integrity, required fields), mise test:cef (CEF v27 format + UDP/TCP syslog with RFC 6587 octet-counting), mise test:siem (Filebeat/Fluent Bit), mise test:monitoring (OTel Collector + VictoriaMetrics + Grafana), plus live-audit-fixture generation and OpenSearch/Splunk JSONL compat checks in CI (#​1115, #​1150, #​1131)
• Add SAP ASE (test:ase) and IBM Db2 LUW (test:db2) Docker-based TDE integration suites (#​1162)
• Add X25519 DeriveKey KMIP vectors, RFC 7518 Appendix C Concat KDF known-answer vectors, and an ECDH-ES test suite (round trips, kid link-following, AAD binding, and negative key-confusion/FIPS-rejection cases)
• Add SPIFFE JWT-SVID end-to-end suite (spire-jwt-svid) minting an SVID against a live SPIRE server
• Add always-sensitive and attribute-read-only security regression tests, plus wildcard-grant and shared-DB (KMS_TEST_DB=postgresql|mysql|redis-findex) test coverage — the full external-DB nextest run now passes 2085/2085 (#​1188)
• Expand mise test to run every task under .mise/tasks/test/, auto-skipping groups whose infra/credentials are unavailable, with a final PASS/SKIP/FAIL summary (#​1188)

⚙️ Build

• Sign Windows installers with Azure Trusted Signing (#​1101); embed Windows VERSIONINFO resources in ckms.exe, cosmian_kms.exe, cosmian_pkcs11.dll, and cosmian_cng.dll
• Flatten the Windows build artifact for signing (#​1229); set up pnpm 10 and Node 22 in the Windows packaging workflow (#​1197)
• Bump UI dependencies (brace-expansion, js-yaml, nanoid, moment, @vitest/mocker) (#​1163, #​1185, #​1230, #​1231)
• Consolidate AWS XKS, Splunk, and OpenSearch audit-compat tests into test_all.yml; pin Splunk/OpenSearch images and regenerate live audit fixtures instead of static samples

📚 Documentation

• Add audit-logging, CEF-export, and SIEM configuration references (configuration/audit-logs.md, configuration/cef-export.md, configuration/siems.md) with Mermaid sequence diagrams, plus ADRs for the single-writer design, middleware extension injection, CEF export format, always-start recovery, and SPIFFE JWT-SVID authentication
• Add SAP ASE and IBM Db2 LUW TDE integration guides with architecture walkthroughs, and update the README database integration table (#​1162)
• Add SPIFFE guides for the CLI, Web UI gateway/BFF flow, and workload authentication, plus the X25519 → HKDF → ChaCha20Poly1305 sealing workflow
• Reorganize observability docs (rename otlp-metrics.md → otlp-telemetry.md) and document the Windows signing-certificate trust model in kms_clients/installation.md

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

📊 V0.6-QA-1 Micro Benchmark Advisory

This run is advisory only (3×3s vs committed baseline); it never fails the PR. See docs/PERFORMANCE.md for the full methodology.

goos: linux
goarch: amd64
pkg: github.com/cloud37/s3-encryption-gateway/internal/crypto
cpu: AMD EPYC 9V45 96-Core Processor                
                                  │ /tmp/qa1/micro-pr.txt │
                                  │        sec/op         │
ChunkedEncrypt_Parallel-4                    80.88m ± ∞ ¹
ChunkedDecrypt_Parallel-4                    85.91m ± ∞ ¹
Engine_Encrypt_Small-4                       78.99m ± ∞ ¹
Engine_Encrypt_Medium-4                      80.10m ± ∞ ¹
Engine_Encrypt_Large-4                       31.80m ± ∞ ¹
Engine_Decrypt_Small-4                       78.71m ± ∞ ¹
Engine_Decrypt_Medium-4                      83.56m ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4            170.8m ± ∞ ¹
MPUEncryptReader_5MiB-4                      988.6µ ± ∞ ¹
MPUEncryptReader_100MiB-4                    22.08m ± ∞ ¹
MPUDecryptReader_100MiB-4                    26.09m ± ∞ ¹
EncryptWithMemoryKM-4                        140.4µ ± ∞ ¹
SEC27_ChunkedFallback_PeakHeap-4             17.86m ± ∞ ¹
geomean                                      25.80m
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ /tmp/qa1/micro-pr.txt │
                                  │          B/s          │
ChunkedEncrypt_Parallel-4                   123.6Mi ± ∞ ¹
ChunkedDecrypt_Parallel-4                   116.4Mi ± ∞ ¹
Engine_Encrypt_Small-4                      9.766Ki ± ∞ ¹
Engine_Encrypt_Medium-4                     12.48Mi ± ∞ ¹
Engine_Encrypt_Large-4                      314.5Mi ± ∞ ¹
Engine_Decrypt_Small-4                      9.766Ki ± ∞ ¹
Engine_Decrypt_Medium-4                     11.97Mi ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4           5.856Mi ± ∞ ¹
MPUEncryptReader_5MiB-4                     4.939Gi ± ∞ ¹
MPUEncryptReader_100MiB-4                   4.423Gi ± ∞ ¹
MPUDecryptReader_100MiB-4                   3.743Gi ± ∞ ¹
EncryptWithMemoryKM-4                       445.1Mi ± ∞ ¹
SEC27_ChunkedFallback_PeakHeap-4            560.1Mi ± ∞ ¹
geomean                                     48.35Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ /tmp/qa1/micro-pr.txt │
                                  │         B/op          │
ChunkedEncrypt_Parallel-4                   21.57Mi ± ∞ ¹
ChunkedDecrypt_Parallel-4                   55.25Mi ± ∞ ¹
Engine_Encrypt_Small-4                      10.92Ki ± ∞ ¹
Engine_Encrypt_Medium-4                     5.264Mi ± ∞ ¹
Engine_Encrypt_Large-4                      54.78Mi ± ∞ ¹
Engine_Decrypt_Small-4                      9.400Ki ± ∞ ¹
Engine_Decrypt_Medium-4                     3.139Mi ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4           12.66Mi ± ∞ ¹
MPUEncryptReader_5MiB-4                     169.3Ki ± ∞ ¹
MPUEncryptReader_100MiB-4                   1.940Mi ± ∞ ¹
MPUDecryptReader_100MiB-4                   101.9Mi ± ∞ ¹
EncryptWithMemoryKM-4                       349.5Ki ± ∞ ¹
SEC27_ChunkedFallback_PeakHeap-4            21.62Mi ± ∞ ¹
geomean                                     2.653Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ /tmp/qa1/micro-pr.txt │
                                  │       allocs/op       │
ChunkedEncrypt_Parallel-4                    4.262k ± ∞ ¹
ChunkedDecrypt_Parallel-4                    4.571k ± ∞ ¹
Engine_Encrypt_Small-4                        67.00 ± ∞ ¹
Engine_Encrypt_Medium-4                       114.0 ± ∞ ¹
Engine_Encrypt_Large-4                        125.0 ± ∞ ¹
Engine_Decrypt_Small-4                        55.00 ± ∞ ¹
Engine_Decrypt_Medium-4                       75.00 ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4             239.0 ± ∞ ¹
MPUEncryptReader_5MiB-4                      1.449k ± ∞ ¹
MPUEncryptReader_100MiB-4                    28.81k ± ∞ ¹
MPUDecryptReader_100MiB-4                    30.41k ± ∞ ¹
EncryptWithMemoryKM-4                         100.0 ± ∞ ¹
SEC27_ChunkedFallback_PeakHeap-4             4.331k ± ∞ ¹
geomean                                       702.1
¹ need >= 6 samples for confidence interval at level 0.95

                                 │ /tmp/qa1/micro-pr.txt │
                                 │     MiB-allocated     │
SEC27_ChunkedFallback_PeakHeap-4             21.62 ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

pkg: github.com/cloud37/s3-encryption-gateway/internal/s3
                                              │ /tmp/qa1/micro-pr.txt │
                                              │        sec/op         │
S3Client_PutObject_NoFault-4                             27.81µ ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4             164.4m ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4             765.2m ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4            907.4m ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                     1.699m ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                      109.7µ ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4              106.1µ ± ∞ ¹
geomean                                                  4.846m
¹ need >= 6 samples for confidence interval at level 0.95

                                             │ /tmp/qa1/micro-pr.txt │
                                             │          B/s          │
S3Client_PutObject_NoFault-4                           140.5Mi ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4           19.53Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4           9.766Ki ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                   588.6Mi ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                    142.4Gi ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4            9.204Ti ± ∞ ¹
geomean                                                166.3Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                              │ /tmp/qa1/micro-pr.txt │
                                              │         B/op          │
S3Client_PutObject_NoFault-4                            33.91Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4            37.03Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4            48.66Ki ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4           46.61Ki ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                    750.7Ki ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                     46.92Ki ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4             46.92Ki ± ∞ ¹
geomean                                                 64.62Ki
¹ need >= 6 samples for confidence interval at level 0.95

                                              │ /tmp/qa1/micro-pr.txt │
                                              │       allocs/op       │
S3Client_PutObject_NoFault-4                              448.0 ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4              497.0 ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4              699.0 ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4             668.0 ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                     8.613k ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                       537.0 ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4               537.0 ± ∞ ¹
geomean                                                   824.1
¹ need >= 6 samples for confidence interval at level 0.95

                                             │ /tmp/qa1/micro-pr.txt │
                                             │         MB/s          │
S3Client_PutObject_ThunderingHerd_50pct503-4             0.000 ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

pkg: github.com/kenchrcum/s3-encryption-gateway/internal/crypto
cpu: placeholder
                                  │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                  │                 sec/op                 │
ChunkedEncrypt_Parallel-4                                     29.31m ± ∞ ¹
ChunkedDecrypt_Parallel-4                                     12.30m ± ∞ ¹
Engine_Encrypt_Small-4                                        11.53m ± ∞ ¹
Engine_Encrypt_Medium-4                                       14.94m ± ∞ ¹
Engine_Encrypt_Large-4                                        33.33m ± ∞ ¹
Engine_Decrypt_Small-4                                        13.02m ± ∞ ¹
Engine_Decrypt_Medium-4                                       11.76m ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4                             28.39m ± ∞ ¹
MPUEncryptReader_5MiB-4                                       4.821m ± ∞ ¹
MPUEncryptReader_100MiB-4                                     95.31m ± ∞ ¹
MPUDecryptReader_100MiB-4                                     40.20m ± ∞ ¹
EncryptWithMemoryKM-4                                         178.5µ ± ∞ ¹
geomean                                                       13.26m
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                  │                  B/s                   │
ChunkedEncrypt_Parallel-4                                    341.2Mi ± ∞ ¹
ChunkedDecrypt_Parallel-4                                    812.9Mi ± ∞ ¹
Engine_Encrypt_Small-4                                       87.89Ki ± ∞ ¹
Engine_Encrypt_Medium-4                                      66.94Mi ± ∞ ¹
Engine_Encrypt_Large-4                                       300.1Mi ± ∞ ¹
Engine_Decrypt_Small-4                                       78.12Ki ± ∞ ¹
Engine_Decrypt_Medium-4                                      85.00Mi ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4                            35.22Mi ± ∞ ¹
MPUEncryptReader_5MiB-4                                      1.013Gi ± ∞ ¹
MPUEncryptReader_100MiB-4                                    1.024Gi ± ∞ ¹
MPUDecryptReader_100MiB-4                                    2.429Gi ± ∞ ¹
EncryptWithMemoryKM-4                                        350.1Mi ± ∞ ¹
geomean                                                      82.77Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                  │                  B/op                  │
ChunkedEncrypt_Parallel-4                                    25.13Mi ± ∞ ¹
ChunkedDecrypt_Parallel-4                                    216.5Ki ± ∞ ¹
Engine_Encrypt_Small-4                                       9.523Ki ± ∞ ¹
Engine_Encrypt_Medium-4                                      5.262Mi ± ∞ ¹
Engine_Encrypt_Large-4                                       54.78Mi ± ∞ ¹
Engine_Decrypt_Small-4                                       7.062Ki ± ∞ ¹
Engine_Decrypt_Medium-4                                      3.136Mi ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4                            12.66Mi ± ∞ ¹
MPUEncryptReader_5MiB-4                                      5.211Mi ± ∞ ¹
MPUEncryptReader_100MiB-4                                    105.2Mi ± ∞ ¹
MPUDecryptReader_100MiB-4                                    102.0Mi ± ∞ ¹
EncryptWithMemoryKM-4                                        126.7Ki ± ∞ ¹
geomean                                                      2.340Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                  │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                  │               allocs/op                │
ChunkedEncrypt_Parallel-4                                     1.539k ± ∞ ¹
ChunkedDecrypt_Parallel-4                                     1.194k ± ∞ ¹
Engine_Encrypt_Small-4                                         53.00 ± ∞ ¹
Engine_Encrypt_Medium-4                                        96.00 ± ∞ ¹
Engine_Encrypt_Large-4                                         117.0 ± ∞ ¹
Engine_Decrypt_Small-4                                         40.00 ± ∞ ¹
Engine_Decrypt_Medium-4                                        60.00 ± ∞ ¹
Engine_EncryptDecrypt_RoundTrip-4                              205.0 ± ∞ ¹
MPUEncryptReader_5MiB-4                                        176.0 ± ∞ ¹
MPUEncryptReader_100MiB-4                                     3.231k ± ∞ ¹
MPUDecryptReader_100MiB-4                                     30.45k ± ∞ ¹
EncryptWithMemoryKM-4                                          175.0 ± ∞ ¹
geomean                                                        329.4
¹ need >= 6 samples for confidence interval at level 0.95

pkg: github.com/kenchrcum/s3-encryption-gateway/internal/s3
                                              │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                              │                 sec/op                 │
S3Client_PutObject_NoFault-4                                              300.1µ ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4                              619.1m ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4                              780.1m ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4                             288.2m ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                                      2.562m ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                                       279.6µ ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4                               409.2µ ± ∞ ¹
geomean                                                                   10.29m
¹ need >= 6 samples for confidence interval at level 0.95

                                             │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                             │                  B/s                   │
S3Client_PutObject_NoFault-4                                            13.02Mi ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4                            9.766Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4                            9.766Ki ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                                    390.4Mi ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                                     55.88Gi ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4                             2.387Ti ± ∞ ¹
geomean                                                                 63.60Mi
¹ need >= 6 samples for confidence interval at level 0.95

                                              │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                              │                  B/op                  │
S3Client_PutObject_NoFault-4                                             42.90Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4                             61.74Ki ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4                             60.04Ki ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4                            61.03Ki ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                                     1.367Mi ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                                      117.6Ki ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4                              128.7Ki ± ∞ ¹
geomean                                                                  110.8Ki
¹ need >= 6 samples for confidence interval at level 0.95

                                              │ docs/perf/v0.6-qa-1/micro-baseline.txt │
                                              │               allocs/op                │
S3Client_PutObject_NoFault-4                                               542.0 ± ∞ ¹
S3Client_PutObject_ThunderingHerd_10pct503-4                               897.0 ± ∞ ¹
S3Client_PutObject_ThunderingHerd_50pct503-4                               873.0 ± ∞ ¹
S3Client_HeadObject_ThunderingHerd_50pct503-4                              828.0 ± ∞ ¹
UploadPartCopy_Chunked_64KiB_Range-4                                      9.501k ± ∞ ¹
UploadPartCopy_Legacy_16MiB_Range-4                                        753.0 ± ∞ ¹
UploadPartCopy_Plaintext_Passthrough_1GiB-4                                777.0 ± ∞ ¹
geomean                                                                   1.100k
¹ need >= 6 samples for confidence interval at level 0.95