Failed physical restore logs password-derived and KMS key material in rootservice.log

Self Checks

• I have read the Contributing Guide.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

OceanBase version

OceanBase CE 5.0.2.0, source revision d128661ca4f5b3d167c1928e556d70d2f901baef, Release+ASan.

Self Hosted

Self Hosted (Source)

Environment

Ubuntu 22.04.5 LTS, x86_64, one-zone loopback observer. The retained logs were mode 0600. All paths and values in this test were synthetic and local.

Steps to reproduce

Run as root@sys on a disposable cluster:

SET DECRYPTION IDENTIFIED BY 'EDBF_REPORT_RESTORE_PASSWORD';
SET @kms_encrypt_info='EDBF_REPORT_UNUSED_KMS_INFO';

ALTER SYSTEM RESTORE edbf_restore_probe
  FROM 'file:///tmp/edbf-missing-backup'
  WITH 'kms_encrypt=true&invalid_probe=true'
  WITH KEY FROM 'file:///tmp/edbf-missing-key'
  ENCRYPTED BY 'EDBF_REPORT_KMS_ENCRYPT_KEY';

The nonexistent local paths make the request fail without contacting storage or KMS. Inspect the new run's rootservice.log; the authoritative raw log is bundled as artifacts/rootservice.log:

WDIAG [RS.RESTORE] fill_physical_restore_job ... fail to parse restore_option(
  arg={tenant_name:"edbf_restore_probe",
       passwd_array:"<password-derived stage2 value>",
       kms_uri:"file:///tmp/edbf-missing-key",
       kms_encrypt_key:"EDBF_REPORT_KMS_ENCRYPT_KEY", ...})

The source sink is src/rootserver/restore/ob_restore_util.cpp:51:

LOG_WARN("fail to parse restore_option", K(ret), K(arg), K(job_id));

ObPhysicalRestoreTenantArg stringification includes passwd_array_, kms_uri_, kms_encrypt_key_, and other restore fields. In the authoritative run, retained-log probes found the password-derived value and synthetic KMS encryption key. The separate kms_info sentinel was not observed and is not claimed here.

artifacts.zip

✔️ Expected Behavior

Restore failures should log identifiers, option names, and the error code while redacting password, key, token, and credential fields.

❌ Actual Behavior

The rootservice warning serializes the complete restore argument, including password-derived and KMS encryption-key carriers. The observer remained healthy; this is a diagnostic-data exposure, not a crash or proof that the key was used successfully.