Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Do not assume public artifacts have prefix public/

Abierto
#407 2 comentarios 0 reacciones 1 asignado Ver en GitHub

@petemoore ya está trabajando en esto.

Desde el 7/5/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Scanning the taskgraph codebase, there are several pieces of code that check whether an artifact name has prefix public/ to determine whether scopes are required to fetch it. Unfortunately this is not the correct way to determine whether an API call to fetch the artifact requires scopes.

The anonymous role determines the set of scopes that all calls are granted. Typically this includes queue:get-artifact:public/* but that is not a requirement, and in locked down taskcluster deployments this scope may not be included in the anonymous role. Furthermore, the anonymous role may include other scopes with prefix queue:get-artifact: meaning that not only public/* artifacts are public.

The bottom line is: the correct way to check whether an artifact is public is to see if an unauthorized request satisfies the scope queue:get-artifact:<artifact-name> e.g. by calling authorize (node.js) or e.g. scopes.Satisfies (go) or alternatively just fetch the artifact with an unauthorized HEAD request and check for a 200 http status code response.

In python, it looks like you can either expand the scopes of the anonymous role, or make an unauthorised call to auth.currentScopes to fetch anonymous scopes. Then call scopeMatch to see if the anonymous role satisfies the scope queue:get-artifact:<artifact-name> for the artifact name you are interested in.

Note, you should not try to parse the anonymous scopes yourself, but instead rely on one of these libraries to take care of the delicate matters of scope/role expansion, * matching, handling parameterized roles, etc.

Lenguaje dominante
Python
Estrellas
26
Forks
55
Merge medio
2 d 6 min
PR fusionados (30 d)
15

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de taskcluster/taskgraph

Todos los issues de taskcluster/taskgraph

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.