sse-c: use different object encryption key for each object

src/api/s3/encryption.rs

@@ -641,6 +641,7 @@ mod tests {
 		let enc = EncryptionParams::SseC {
 			client_key: Aes256Gcm::generate_key(&mut OsRng),
 			client_key_md5: Default::default(), // not needed
+			object_key: Some(Aes256Gcm::generate_key(&mut OsRng)),
 			compression_level,
 		};
 

src/api/s3/get.rs

@@ -185,11 +185,7 @@ pub async fn handle_head_without_ctx(
 		&garage,
 		req.headers(),
 		&version_meta.encryption,
-		OekDerivationInfo {
-			bucket_id,
-			version_id: object_version.uuid,
-			object_key: key,
-		},
+		OekDerivationInfo::for_object(&object, object_version),
 	)?;
 
 	let checksum_mode = checksum_mode(&req);
@@ -315,11 +311,7 @@ pub async fn handle_get_without_ctx(
 		&garage,
 		req.headers(),
 		&last_v_meta.encryption,
-		OekDerivationInfo {
-			bucket_id,
-			version_id: last_v.uuid,
-			object_key: key,
-		},
+		OekDerivationInfo::for_object(&object, last_v),
 	)?;
 
 	let checksum_mode = checksum_mode(&req);