Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Do not assume public artifacts have prefix public/

Aperta
#407 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

@petemoore ci sta già lavorando.

Dal 7/5/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Scanning the taskgraph codebase, there are several pieces of code that check whether an artifact name has prefix public/ to determine whether scopes are required to fetch it. Unfortunately this is not the correct way to determine whether an API call to fetch the artifact requires scopes.

The anonymous role determines the set of scopes that all calls are granted. Typically this includes queue:get-artifact:public/* but that is not a requirement, and in locked down taskcluster deployments this scope may not be included in the anonymous role. Furthermore, the anonymous role may include other scopes with prefix queue:get-artifact: meaning that not only public/* artifacts are public.

The bottom line is: the correct way to check whether an artifact is public is to see if an unauthorized request satisfies the scope queue:get-artifact:<artifact-name> e.g. by calling authorize (node.js) or e.g. scopes.Satisfies (go) or alternatively just fetch the artifact with an unauthorized HEAD request and check for a 200 http status code response.

In python, it looks like you can either expand the scopes of the anonymous role, or make an unauthorised call to auth.currentScopes to fetch anonymous scopes. Then call scopeMatch to see if the anonymous role satisfies the scope queue:get-artifact:<artifact-name> for the artifact name you are interested in.

Note, you should not try to parse the anonymous scopes yourself, but instead rely on one of these libraries to take care of the delicate matters of scope/role expansion, * matching, handling parameterized roles, etc.

Lingua principale
Python
Stelle
26
Fork
55
Merge medio
2g 6m
PR unite (30g)
15

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di taskcluster/taskgraph

Tutte le issue di taskcluster/taskgraph

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.