Skip to content

v0.5.2

Choose a tag to compare

View all tags
@mcteamster mcteamster released this 18 Sep 02:32
· 14 commits to main since this release
v0.5.2
This tag was signed with the committer’s verified signature.
mcteamster
SSH Key Fingerprint: w5t+th9/F8+qrbTY1N1SkCTRAmmx3ULJ9YYuXUnXn3A
Verified
Learn about vigilant mode.
65eaf96
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

TRN-169: Fix presigned evac/supply URLs requiring Bearer auth

Presigned URLs returned by evac and supply were returning HTTP 401 without an Authorization header. Root cause: Caddy's blanket Bearer check fired before the request reached the Python transport (which already bypassed Bearer correctly for /files/ routes).

Fix: Add a ga-transport-files-presigned Caddy route matching /files/*?sig=*, ordered before the Bearer-gated files route. Presigned URLs are now fully self-authenticating — any HTTP client (bare curl, browser, S3 SDK) can use them without an Authorization header.

Changes:

  • scripts/install.sh: new Caddy route exempting /files/*?sig=* from Bearer auth
  • transport/auth.py: document the intentional Bearer bypass in _dispatch_file
  • tests/unit/test_auth.py: 4 new tests for the presigned bypass
  • tests/unit/test_hardening.py: regression guard for Caddy route ordering
  • docs/architecture.md: presigned URLs documented as self-authenticating

Note: Requires re-running ./install.sh to regenerate the Caddy config on existing deployments.

Assets 2
Loading