objstorage: adjust remote.Locator to support redactability

This patch adjusts `remote.Locator` to support redaction by changing the
underlying type from a raw string to a `redact.RedactableString`. This
puts the responsibility on the constructor of a `remote.Locator` to
insert the necessary markers if redaction is required.

Author: andrew-r-thomas

event.go

@@ -73,7 +73,7 @@ func (i DataCorruptionInfo) String() string {
 func (i DataCorruptionInfo) SafeFormat(w redact.SafePrinter, _ rune) {
 	w.Printf("on-disk corruption: %s", redact.Safe(i.Path))
 	if i.IsRemote {
-		w.Printf(" (remote locator %q)", redact.Safe(i.Locator))
+		w.Printf(" (remote locator %q)", i.Locator)
 	}
 	w.Printf("; bounds: %s; details: %+v", i.Bounds.String(), i.Details)
 }

objstorage/objstorageprovider/remote.go

@@ -19,6 +19,7 @@ import (
 	"github.com/cockroachdb/pebble/objstorage/objstorageprovider/remoteobjcat"
 	"github.com/cockroachdb/pebble/objstorage/objstorageprovider/sharedcache"
 	"github.com/cockroachdb/pebble/objstorage/remote"
+	"github.com/cockroachdb/redact"
 )
 
 // remoteSubsystem contains the provider fields related to remote storage.
@@ -276,7 +277,8 @@ func (p *provider) sharedSync() error {
 
 func (p *provider) remotePath(meta objstorage.ObjectMetadata) string {
 	if meta.Remote.Locator != "" {
-		return fmt.Sprintf("remote-%s://%s", meta.Remote.Locator, remoteObjectName(meta))
+		return fmt.Sprintf("remote-%s://%s",
+			redact.Sprint(meta.Remote.Locator).Redact(), remoteObjectName(meta))
 	}
 	return "remote://" + remoteObjectName(meta)
 }

objstorage/remote/storage.go

@@ -13,14 +13,15 @@ import (
 
 // Locator is an opaque string identifying a remote.Storage implementation.
 //
-// The Locator must not contain secrets (like authentication keys). Locators are
-// stored on disk in the shared object catalog and are passed around as part of
-// RemoteObjectBacking; they can also appear in error messages.
-type Locator string
+// Locators are stored on disk in the shared object catalog and are passed around as part of
+// RemoteObjectBacking. They can also appear in error messages.
+// As such, if a Locator contains secrets, the constructor must ensure that the necessary redaction
+// is implemented.
+type Locator redact.RedactableString
 
 // SafeFormat implements redact.SafeFormatter.
-func (l Locator) SafeFormat(w redact.SafePrinter, _ rune) {
-	w.Printf("%s", redact.SafeString(l))
+func (l Locator) SafeFormat(w redact.SafePrinter, r rune) {
+	redact.RedactableString(l).SafeFormat(w, r)
 }
 
 // StorageFactory is used to return Storage implementations based on locators. A