CodeRabbit review on #47729:
- config: validate the endpoint by parsed hostname instead of a substring
match, so a look-alike host or a path containing "storage.googleapis.com"
no longer satisfies the GCS requirement. Accepts storage.googleapis.com and
*.storage.googleapis.com (with or without an explicit scheme).
- s3 store: reject software_installers_signed_url combined with GCS IAM
(bearer) auth at store init. Presigning needs SigV4 HMAC credentials, but
IAM auth uses placeholder static creds plus bearer middleware that presigning
drops, which would yield unusable signed URLs.
- logs: make the installer/in-house-app signing error messages mode-agnostic
("check signed URL configuration") since they now cover GCS presigning too.
- tests: add coverage for strict host validation and the signed-URL + IAM-auth
rejection.
7-1337
8c01492d20