George Karr
bc537a37d3
**Related issue:** Resolves #49553 ## Summary When `s3_software_installers_signed_url` is enabled, Fleet returns a GCS SigV4 presigned URL for software installer, in-house app, and bootstrap package downloads, so clients fetch directly from GCS instead of streaming through the Fleet server. This unblocks packages over 50MB on GCP Cloud Run over HTTP1, while keeping live query working. Startup validation requires a GCS endpoint and HMAC credentials, and rejects combining the option with GCS IAM auth. Builds on community PR #47729 with review fixes. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ### Manual testing steps - [x] Confirm GCS parses our presigned URL format. A live GET with a wrong secret returned `SignatureDoesNotMatch`, so GCS reached signature validation. - [x] Full round-trip against live GCS with real HMAC credentials: upload, presign, and download. GCS returned HTTP 200 with the exact bytes. - [x] On a GCS-backed premium instance, installed a package on a host. Orbit received a `storage.googleapis.com` presigned URL and the host downloaded the package straight from the bucket. ## New Fleet configuration settings - [x] Setting(s) is/are explicitly excluded from GitOps <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added support for delivering software installers, in-house apps, and bootstrap packages through Google Cloud Storage presigned URLs. * Downloads can be served directly from cloud storage instead of through the Fleet server. * **Improvements** * Added validation for supported endpoints and authentication settings. * Improved URL generation across supported signing methods. * Downloads fall back to Fleet URLs when signing cannot be completed. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Welcome to the "source available" section of the Fleet codebase. Please note files and functionality under this directory are covered by the Fleet EE License, and require a valid Fleet subscription for production use. See the full license for details.