gitlab-fog-azure-rm 2.5.0 → 2.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3c8efd2c5ce76c59fe96a72faceb7470f8a1bc0e75ffdef6808434583108cdf
-  data.tar.gz: 72fce32424077553bb8c4b6e8a1a6ffa56307261352a801355b1a93878628715
+  metadata.gz: faf6ef8f40417712f91769e2ac0dea345c7451f1457919399c1aa574cf6a44a5
+  data.tar.gz: 4596861b6a717a743ff2d250f91f3bb4cafd911cb57e0efeeae14368e04162eb
 SHA512:
-  metadata.gz: 6cf9691fa2a0423b6da2f5b0874447364207d0a1e10852a11f3e14cd5fc213fc20a8de8987263e70d0f04ac59d5c044779ced3c8bb8451d13622c608f1e73f29
-  data.tar.gz: e92ddc401cdf2b5e606afd6342ef6a136e7d6dae56590fa27338cdfb42dd6a6b2f563f1cde3290274182e3d1370355cc94aefeb1b67261bb555ff031df631b8d
+  metadata.gz: f59d2e0764335c68f69462f380781e3a6f395467959f8af92f076dd4492f968d82bdc52b471f93a3fb1568e939c277e70cf6eac8fc79ed65e144b53eb1d966a2
+  data.tar.gz: ea77ec4d01cff9bebec6642ad94517c0df51246de8ab41f48241f8281841737c08da6f20ec17e9c79a9ad5d6f56bc51940c8cac169a17d226f0037c84ea5c706

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+## 2.5.1
+
+- Fix thread-safety race in SAS signer credential refresh !64
+
 ## 2.5.0
 
 - Support Ruby 4 !61

data/lib/fog/azurerm/storage.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'time'
 
 module Fog
   module AzureRM
@@ -87,6 +88,25 @@ module Fog
 
         attr_accessor :options
 
+        # Immutable snapshot of a built SharedAccessSignature and the delegation
+        # key expiry it is valid until. It is published by a single reference
+        # assignment so signature_client can read it on a lock-free fast path.
+        # A nil expiry means the signature never expires (shared-key auth, which
+        # signs with the access key rather than a user delegation key).
+        class SignatureState
+          attr_reader :client, :expiry
+
+          def initialize(client, expiry)
+            @client = client
+            @expiry = expiry
+            freeze
+          end
+
+          def covers?(requested_expiry)
+            expiry.nil? || expiry >= requested_expiry
+          end
+        end
+
         def initialize(options)
           begin
             require 'azure/storage/common'
@@ -100,8 +120,8 @@ module Fog
             raise e.message
           end
 
-          @user_delegation_key_mutex = Mutex.new
-          @blob_client_mutex = Mutex.new
+          @credential_mutex = Mutex.new
+          @signature_mutex = Mutex.new
 
           options[:environment] = options[:environment] || ENV['AZURE_ENVIRONMENT'] || ENVIRONMENT_AZURE_CLOUD
           @environment = options[:environment]
@@ -117,7 +137,7 @@ module Fog
           @azure_storage_endpoint = options[:azure_storage_endpoint]
           @azure_storage_domain = options[:azure_storage_domain]
 
-          refresh_blob_client
+          @blob_client = build_blob_client(@azure_storage_token_signer)
         end
 
         private
@@ -142,62 +162,119 @@ module Fog
           Azure::Storage::Common::Core::Auth::TokenSigner.new(cred)
         end
 
+        # Returns a SharedAccessSignature for signing a URL that expires at
+        # requested_expiry.
+        #
+        # A user delegation key is valid for up to a week
+        # (MAX_USER_DELEGATION_KEY_SECONDS), so the built signature is cached in
+        # a frozen @signature_state snapshot and reused on a lock-free fast path.
+        # This keeps signing off the lock in the common case, so an in-flight
+        # credential or delegation-key refresh on another thread never stalls it.
+        #
+        # Only the slow path (no cached signature, or the cached delegation key
+        # no longer covers the requested expiry) takes @signature_mutex, where
+        # the delegation-key fetch and the snapshot rebuild happen atomically.
+        # Holding the lock there also collapses a burst of concurrent refetches
+        # into a single fetch.
         def signature_client(requested_expiry)
-          access_key = @azure_storage_access_key.to_s
-          user_delegation_key = user_delegation_key(requested_expiry)
-
-          # invalidate cache when the delegation key changes
-          unless @signature_client_delegation_key == user_delegation_key
-            @signature_client_delegation_key = user_delegation_key
-            @signature_client = nil
+          # Keep the blob client's credentials fresh without blocking signing;
+          # see maybe_refresh_credentials.
+          maybe_refresh_credentials
+
+          state = @signature_state
+          return state.client if state&.covers?(requested_expiry)
+
+          @signature_mutex.synchronize do
+            # Re-check: another thread may have rebuilt the snapshot while we
+            # were waiting for the lock.
+            state = @signature_state
+            return state.client if state&.covers?(requested_expiry)
+
+            delegation_key = fetch_user_delegation_key(requested_expiry)
+            client = Azure::Storage::Common::Core::Auth::SharedAccessSignature.new(
+              @azure_storage_account_name,
+              @azure_storage_access_key.to_s,
+              delegation_key
+            )
+            @signature_state = SignatureState.new(client, @user_delegation_key_expiry)
+            client
           end
-
-          @signature_client ||= Azure::Storage::Common::Core::Auth::SharedAccessSignature.new(
-            @azure_storage_account_name,
-            access_key,
-            user_delegation_key
-          )
         end
 
-        def user_delegation_key(requested_expiry)
-          return nil unless @azure_storage_token_signer
+        # Refreshes the credential-derived state (@credentials, the token signer
+        # and the blob client) when the access token is near expiry. Only the
+        # SAS URL requests reach this, through signature_client; the other blob
+        # operations read @blob_client directly and do not refresh, so this does
+        # not by itself keep their token fresh across rotation.
+        #
+        # The refresh is best-effort and non-blocking: a token fetch can be slow
+        # (or hang), so only one thread performs it at a time via a try-lock, and
+        # every other thread proceeds with the current, still-valid credentials
+        # rather than waiting. This keeps a slow token endpoint from stalling all
+        # callers that share the instance.
+        #
+        # The new signer and client are built into locals first and @credentials
+        # is published last. If building raises, @credentials is unchanged so
+        # refresh_needed? stays true and the next call retries, rather than
+        # leaving the swap half-applied with a stale signer or client.
+        def maybe_refresh_credentials
+          return unless @credential_client
+
+          current = @credentials
+          return unless current.nil? || current.refresh_needed?
+          return unless @credential_mutex.try_lock
+
+          begin
+            return unless @credentials.nil? || @credentials.refresh_needed?
 
-          if @credential_client
             new_credentials = @credential_client.fetch_credentials_if_needed
-            changed = new_credentials != @credentials
+            return if new_credentials.nil? || new_credentials == @credentials
 
-            if changed
-              @credentials = new_credentials
-              @azure_storage_token_signer = token_signer
-              refresh_blob_client
-            end
+            signer = access_token_signer(new_credentials.token)
+            client = build_blob_client(signer)
+
+            @azure_storage_token_signer = signer
+            @blob_client = client
+            @credentials = new_credentials
+          ensure
+            @credential_mutex.unlock
           end
+        end
 
-          @user_delegation_key_mutex.synchronize do
-            if @user_delegation_key_expiry.nil? || @user_delegation_key_expiry < requested_expiry
-              start = Time.now
-              expiry = start + Azure::Storage::Blob::BlobConstants::MAX_USER_DELEGATION_KEY_SECONDS
-
-              @user_delegation_key = @blob_client.get_user_delegation_key(
-                start,
-                expiry
-              )
-              @user_delegation_key_expiry = expiry
-            end
+        # Returns the cached user delegation key, fetching a new one when the
+        # cache is empty or no longer covers requested_expiry. Must be called
+        # while holding @signature_mutex. Returns nil for shared-key auth, where
+        # the SAS is signed with the access key instead.
+        def fetch_user_delegation_key(requested_expiry)
+          return nil unless @azure_storage_token_signer
+
+          if @user_delegation_key_expiry.nil? || @user_delegation_key_expiry < requested_expiry
+            start = Time.now
+            expiry = start + Azure::Storage::Blob::BlobConstants::MAX_USER_DELEGATION_KEY_SECONDS
+
+            @user_delegation_key = @blob_client.get_user_delegation_key(start, expiry)
+            # Cache against the expiry Azure granted (signed_expiry), not the one
+            # we requested: Azure uses its own clock and may return an earlier
+            # time, and keying on the request would over-claim validity and emit
+            # SAS URLs that Azure rejects.
+            @user_delegation_key_expiry = Time.parse(@user_delegation_key.signed_expiry)
           end
 
           @user_delegation_key
         end
 
-        def refresh_blob_client
-          @blob_client_mutex.synchronize do
-            azure_client = create_azure_client
-            azure_client.storage_blob_host = storage_blob_host
-            @blob_client = Azure::Storage::Blob::BlobService.new(client: azure_client, api_version: @api_version)
-            @blob_client.with_filter(Fog::AzureRM::IdentityEncodingFilter.new)
-            @blob_client.with_filter(Azure::Storage::Common::Core::Filter::ExponentialRetryPolicyFilter.new)
-            @blob_client.with_filter(Azure::Core::Http::DebugFilter.new) if @debug
-          end
+        # Builds and returns a fully configured blob client. The caller publishes
+        # it with a single reference assignment (see initialize and
+        # maybe_refresh_credentials), so a concurrent reader of @blob_client never
+        # observes a client that is missing its filters mid-build.
+        def build_blob_client(signer)
+          azure_client = create_azure_client(signer)
+          azure_client.storage_blob_host = storage_blob_host
+          client = Azure::Storage::Blob::BlobService.new(client: azure_client, api_version: @api_version)
+          client.with_filter(Fog::AzureRM::IdentityEncodingFilter.new)
+          client.with_filter(Azure::Storage::Common::Core::Filter::ExponentialRetryPolicyFilter.new)
+          client.with_filter(Azure::Core::Http::DebugFilter.new) if @debug
+          client
         end
 
         def storage_blob_host
@@ -210,11 +287,11 @@ module Fog
           end
         end
 
-        def create_azure_client
+        def create_azure_client(signer)
           Azure::Storage::Common::Client.create({
             storage_account_name: @azure_storage_account_name,
             storage_access_key: @azure_storage_access_key,
-            signer: @azure_storage_token_signer
+            signer: signer
           }.compact)
         end
       end

data/lib/fog/azurerm/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AzureRM
-    VERSION = '2.5.0'.freeze
+    VERSION = '2.5.1'.freeze
   end
 end

data/test/requests/storage/test_get_blob_https_url.rb

@@ -118,18 +118,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
     requested_expiry = Time.now + 60
 
-    response = <<~MSG
-      <UserDelegationKey>
-          <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
-          <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
-          <SignedStart>2024-09-19T00:00:00Z</SignedStart>
-          <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
-          <SignedService>b</SignedService>
-          <SignedVersion>2020-02-10</SignedVersion>
-          <Value>UDELEGATIONKEYXYZ....</Value>
-          <SignedKey>rL7...ABC</SignedKey>
-      </UserDelegationKey>
-    MSG
+    response = user_delegation_key_response
 
     stub_request(:post, 'https://mockaccount.blob.core.windows.net?comp=userdelegationkey&restype=service')
       .to_return(status: 200, headers: { 'Content-Type': 'application/xml' }, body: response)
@@ -159,29 +148,19 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
     ref_time = Time.now
 
-    stubbed_times = []
-    requested_expiries = []
-    expected_user_delegation_key_starts = []
+    # Each entry: [Time.now offset from ref_time, requested-expiry offset from
+    # that time, whether a fresh delegation key is expected]. A delegation key
+    # is valid for one WEEK from its start.
+    plan = [
+      [0,          1 * HOUR, true],  # initial request
+      [5.5 * DAY,  1 * DAY,  false], # second request during expiry window
+      [6.5 * DAY,  1 * DAY,  true],  # request extending past current expiry
+      [10.5 * DAY, 1 * DAY,  false]  # second request within new expiry
+    ]
 
-    # initial request
-    stubbed_times << ref_time
-    requested_expiries << stubbed_times.last + 1 * HOUR
-    expected_user_delegation_key_starts << stubbed_times.last
-
-    # second request during expiry window
-    stubbed_times << ref_time + 5.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    # no additonal expected_user_delegation_key_starts
-
-    # request extending past current expiry
-    stubbed_times << ref_time + 6.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    expected_user_delegation_key_starts << stubbed_times.last
-
-    # second request within new expiry
-    stubbed_times << ref_time + 10.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    # no additional expected_user_delegation_key_starts
+    stubbed_times = plan.map { |now_offset,| ref_time + now_offset }
+    requested_expiries = stubbed_times.each_with_index.map { |time, i| time + plan[i][1] }
+    expected_user_delegation_key_starts = stubbed_times.select.with_index { |_, i| plan[i][2] }
 
     user_delegation_key_starts = []
     mock_user_delegation_key = lambda do |start, expiry|
@@ -190,7 +169,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
       key = Azure::Storage::Common::Service::UserDelegationKey.new
       key.signed_start = "start-#{start.to_i}"
-      key.signed_expiry = 'test-expiry'
+      key.signed_expiry = expiry.utc.iso8601 # Azure grants the full requested window here
       key.value = 'delegation-key'
       key
     end
@@ -201,7 +180,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
     end
 
     requested_expiries.each do
-      mock_token_signer.expect(:sign, 'test-signature', [/\Ar\n.+test_blob\n.+\nstart-\d+\ntest-expiry/m])
+      mock_token_signer.expect(:sign, 'test-signature', [/\Ar\n.+test_blob\n.+\nstart-\d+\n\S+/m])
     end
 
     Time.stub :now, -> { stubbed_times.first } do
@@ -220,6 +199,42 @@ class TestGetBlobHttpsUrl < Minitest::Test
     assert_equal expected_user_delegation_key_starts, user_delegation_key_starts
   end
 
+  # Regression: the delegation-key cache keys on the expiry Azure granted
+  # (signed_expiry), not the requested one. Keying on the request would serve a
+  # cached key for a window Azure already ended, so this asserts a refetch.
+  def test_delegation_key_cache_uses_signed_expiry_not_requested
+    service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+    blob_client = service.instance_variable_get(:@blob_client)
+
+    ref_time = Time.now
+    granted_expiry = (ref_time + 2 * DAY).utc # Azure grants far less than the 1-week request
+
+    starts = []
+    mock_key = lambda do |start, _expiry|
+      starts << start
+      key = Azure::Storage::Common::Service::UserDelegationKey.new
+      key.signed_start = "start-#{start.to_i}"
+      key.signed_expiry = granted_expiry.iso8601
+      key.value = 'delegation-key'
+      key
+    end
+    mock_new_signer = ->(_token) { mock_token_signer }
+    2.times { mock_token_signer.expect(:sign, 'test-signature', [String]) }
+
+    Time.stub :now, -> { ref_time } do
+      blob_client.stub :get_user_delegation_key, mock_key do
+        Azure::Core::Auth::Signer.stub :new, mock_new_signer do
+          service.get_blob_https_url('test_container', 'test_blob', ref_time + 1 * HOUR)
+          # Requested expiry is past Azure's granted window but within start+MAX.
+          service.get_blob_https_url('test_container', 'test_blob', ref_time + 3 * DAY)
+        end
+      end
+    end
+
+    assert_equal 2, starts.length,
+                 'expected a refetch once the requested expiry exceeded the granted signed_expiry'
+  end
+
   def test_get_blob_https_url_mock
     assert_equal "#{@url}?#{@token}", @mock_service.get_blob_https_url('test_container', 'test_blob', Time.now.utc + 3600)
     assert_equal "#{@url}?#{@token}", @mock_service.get_object_url('test_container', 'test_blob', Time.now.utc + 3600)
@@ -247,18 +262,9 @@ class TestGetBlobHttpsUrl < Minitest::Test
       )
 
     # Setup user delegation key responses
-    delegation_response = <<~MSG
-      <UserDelegationKey>
-          <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
-          <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
-          <SignedStart>2024-09-19T00:00:00Z</SignedStart>
-          <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
-          <SignedService>b</SignedService>
-          <SignedVersion>2020-02-10</SignedVersion>
-          <Value>UDELEGATIONKEY_INITIAL</Value>
-          <SignedKey>rL7...INITIAL</SignedKey>
-      </UserDelegationKey>
-    MSG
+    delegation_response = user_delegation_key_response(
+      value: 'UDELEGATIONKEY_INITIAL', signed_key: 'rL7...INITIAL'
+    )
 
     stub_request(:post, 'https://mockaccount.blob.core.windows.net?comp=userdelegationkey&restype=service')
       .to_return(

data/test/requests/storage/test_storage_thread_safety.rb

@@ -0,0 +1,138 @@
+require File.expand_path '../../test_helper', __dir__
+require 'uri'
+require 'azure/storage/common'
+require 'azure/storage/blob'
+require 'azure/core/auth/signer'
+
+# Tests for the concurrency guarantees of SAS signing. Each drives the public
+# get_blob_https_url (which calls signature_client and maybe_refresh_credentials)
+# and checks one property in isolation, so no private methods or stress loops
+# are needed.
+class TestStorageThreadSafety < Minitest::Test
+  CONTAINER = 'test_container'.freeze
+  BLOB = 'test_blob'.freeze
+
+  # A blob client stand-in that needs no network. Optionally parks on its first
+  # with_filter call so a test can inspect state while a rebuild is in progress.
+  class FakeBlobClient
+    def initialize(&on_first_filter)
+      @filters = []
+      @on_first_filter = on_first_filter
+    end
+
+    def with_filter(filter)
+      @on_first_filter.call if @filters.empty? && @on_first_filter
+      @filters << filter
+      self
+    end
+
+    def generate_uri(path, *)
+      URI.parse("https://mockaccount.blob.core.windows.net/#{path}")
+    end
+
+    def get_user_delegation_key(*)
+      key = Azure::Storage::Common::Service::UserDelegationKey.new
+      key.value = 'ZGVsZWdhdGlvbg==' # any string; Base64.decode64 is lenient
+      key.signed_expiry = '2999-12-31T23:59:59Z' # far future so the cached key covers the request
+      key
+    end
+  end
+
+  # Stands in for @signature_mutex and fails the test if the lock is taken.
+  class RaisingMutex
+    def synchronize
+      raise 'signature_client took the lock when it should have hit the cache'
+    end
+  end
+
+  def setup
+    @service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+  end
+
+  def in_one_hour
+    Time.now.utc + 3600
+  end
+
+  def credentials(expires_at)
+    Fog::AzureRM::Identity::Credentials.new('token', expires_at)
+  end
+
+  def credential_client(&fetch)
+    client = Object.new
+    client.define_singleton_method(:fetch_credentials_if_needed, &fetch)
+    client
+  end
+
+  # A cached signature that still covers the requested expiry is returned
+  # without taking @signature_mutex, so signing never waits on a refresh.
+  def test_cached_signature_is_returned_without_locking
+    @service.instance_variable_set(:@blob_client, FakeBlobClient.new)
+    @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) # builds and caches it
+
+    @service.instance_variable_set(:@signature_mutex, RaisingMutex.new)
+
+    url = @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour)
+    assert_match %r{\Ahttps://mockaccount\.blob\.core\.windows\.net/#{CONTAINER}/#{BLOB}\?}, url
+  end
+
+  # While one thread is stuck in a slow token fetch, another caller must still
+  # return instead of blocking on the credential lock.
+  def test_a_slow_credential_refresh_does_not_block_other_callers
+    entered_fetch = Queue.new
+    finish_fetch = Queue.new
+    fresh = credentials(Time.now + 3600)
+
+    slow_client = credential_client do
+      entered_fetch << true
+      finish_fetch.pop # simulate a slow or hanging token endpoint
+      fresh
+    end
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { FakeBlobClient.new }) do
+      @service.instance_variable_set(:@blob_client, FakeBlobClient.new)
+      @service.instance_variable_set(:@credential_client, slow_client)
+      @service.instance_variable_set(:@credentials, credentials(Time.now - 1))
+
+      refreshing = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      entered_fetch.pop # the refresh now holds @credential_mutex inside the fetch
+
+      other = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      returned = other.join(5)
+
+      begin
+        refute_nil returned, 'a second caller blocked while one thread was refreshing credentials'
+      ensure
+        finish_fetch << true
+        [refreshing, other].each(&:join)
+      end
+    end
+  end
+
+  # A rebuilt blob client is published only once it is fully built, so a
+  # concurrent reader never sees one that is missing its filters.
+  def test_rebuilt_blob_client_is_published_only_when_fully_built
+    original = @service.instance_variable_get(:@blob_client)
+    fresh = credentials(Time.now + 3600)
+    @service.instance_variable_set(:@credential_client, credential_client { fresh })
+    @service.instance_variable_set(:@credentials, credentials(Time.now - 1))
+
+    mid_build = Queue.new
+    resume = Queue.new
+    half_built = FakeBlobClient.new do
+      mid_build << true
+      resume.pop
+    end
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { half_built }) do
+      builder = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      mid_build.pop # the new client exists but its filters are not applied yet
+      observed = @service.instance_variable_get(:@blob_client)
+      resume << true
+      builder.join
+
+      refute_same half_built, observed, 'the half-built client was published before its filters were applied'
+      assert_same original, observed
+      assert_same half_built, @service.instance_variable_get(:@blob_client)
+    end
+  end
+end

data/test/test_helper.rb

@@ -79,6 +79,21 @@ def mock_token_signer
   @mock_token_signer ||= Minitest::Mock.new(Azure::Core::Auth::Signer.new('access-token'))
 end
 
+def user_delegation_key_response(value: 'UDELEGATIONKEYXYZ....', signed_key: 'rL7...ABC')
+  <<~MSG
+    <UserDelegationKey>
+        <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
+        <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
+        <SignedStart>2024-09-19T00:00:00Z</SignedStart>
+        <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
+        <SignedService>b</SignedService>
+        <SignedVersion>2020-02-10</SignedVersion>
+        <Value>#{value}</Value>
+        <SignedKey>#{signed_key}</SignedKey>
+    </UserDelegationKey>
+  MSG
+end
+
 # Mock Class for Blob
 class MockBlob
   def initialize

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-fog-azure-rm
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.5.1
 platform: ruby
 authors:
 - Shaffan Chaudhry
@@ -18,7 +18,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-31 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: codeclimate-test-reporter
@@ -476,6 +476,7 @@ files:
 - test/requests/storage/test_release_blob_lease.rb
 - test/requests/storage/test_release_container_lease.rb
 - test/requests/storage/test_save_page_blob.rb
+- test/requests/storage/test_storage_thread_safety.rb
 - test/requests/storage/test_wait_blob_copy_operation_to_finish.rb
 - test/test_helper.rb
 - test/unit/test_credentials.rb