Carlo DiCelico
a5101d796f
- config: require an https GCS endpoint and HMAC credentials when signed URLs are enabled, and reject combining them with STS assume role (alongside the existing GCS IAM auth check). - s3 store: build the presign client once and reuse it across Sign() calls. - changes: note bootstrap package downloads are covered too. - tests: assert the presigned URL shape and cover the STS assume-role rejection.
2 lines
312 B
Plaintext
2 lines
312 B
Plaintext
- Added the `s3_software_installers_signed_url` configuration option to serve software installer, in-house app, and bootstrap package downloads via GCS presigned URLs (the GCS counterpart to CloudFront URL signing), so clients download directly from object storage instead of streaming through the Fleet server.
|