Repository navigation
feat(upload): signed upload URLs - #13
Closed
chenrui333 wants to merge 1 commit into
Closed
chenrui333 wants to merge 1 commit into
chenrui333 wants to merge 1 commit into
Conversation
`signed_upload_url` now carries a per-upload signature, like the SAS query of an Azure Blob URL: a random 256-bit value issued with each upload and returned as `?sig=`. Single-shot, block and blocklist requests must present it. Requests without the right signature, and requests for unknown uploads, are answered 403; an authorized part whose upload is deleted while it streams still gets 404. Only the SHA-256 of the signature is stored (`uploads.capabilityHash`, migration `$9_upload_capability_hash`) and it is compared in constant time. The migration keeps a `capabilityHash` column that already exists instead of failing on it. Requests to upload URLs with a method other than PUT are answered 405 instead of being forwarded to the Results service, and upload storage errors are logged by the route without the request URL. Clients already keep the signed URL's query and append their own parameters, so no client change is needed. Uploads that are in progress while a server is upgraded were issued URLs without a signature and can no longer receive parts; `cleanup:uploads` removes them once idle. See ADR 0011. Signed-off-by: Rui Chen <rui@chenrui.dev>
Owner
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Oct 24, 2026
Owner
Author
|
Superseded by upstream v10.0.0 (falcondev-oss#308). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on
fix/redact-query-strings-in-logs.signed_upload_urlnow carries a per-upload signature in its query (like the SAS of an Azure Blob URL), and the upload endpoint requires it on single-shot, block and blocklist requests. The signature is a random 256-bit value; only its SHA-256 is stored, in a nullableuploads.capabilityHashcolumn added by an existence-guarded$9_upload_capability_hashmigration, and it is compared in constant time. Upload URLs accept onlyPUTand answer other methods with 405 instead of forwarding them to the Results service. Clients already preserve the URL query, so@actions/cache, BuildKit and other Azure-style clients need no change. Uploads in flight during the upgrade lose their URLs.Tests: sqlite+filesystem 75 passed / 5 skipped; postgres and mysql 20 passed each; the migration test covers fresh and already-present columns.