Skip to content

Include sha256 sums in S3 artifact uploads#1048

Draft
zanieb wants to merge 1 commit intomainfrom
zb/s3-sha
Draft

Include sha256 sums in S3 artifact uploads#1048
zanieb wants to merge 1 commit intomainfrom
zb/s3-sha

Conversation

@zanieb
Copy link
Copy Markdown
Member

@zanieb zanieb commented Mar 25, 2026

No description provided.

@zanieb zanieb added the ci:skip label Mar 25, 2026
Comment on lines +82 to +83
.filter(|(source, _)| present_filenames.contains(*source))
.map(|(_, dest)| dest)
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be filter_map?

// we can supply a content checksum on every PUT. S3 will reject the upload if
// the data it receives does not match, guarding against silent corruption.
// In dry-run mode we skip reading the file entirely so the command can still be
// used to validate naming and missing-artifact handling on a fresh dist/.
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// used to validate naming and missing-artifact handling on a fresh dist/.
// used to validate naming and missing-artifact handling on a fresh dist.

Comment on lines +242 to +246
let shasums_sha256 = shasums_content.as_ref().map(|content| {
let mut hasher = Sha256::new();
hasher.update(content.as_bytes());
Sha256Sum::from_bytes(hasher.finalize().into())
});
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sha256Sum::from_content seems like a reasonable helper


if let Some(digest) = sha256 {
req = req.checksum_sha256(digest.to_base64());
}
Copy link
Copy Markdown
Collaborator

@indygreg indygreg Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

File files where we don't have the checksum precomputed, we can compute it here (we have the file locally). This will prevent a file from getting corrupted during upload.

i.e. I would always send the SHA-256 to the S3 API.

Copy link
Copy Markdown
Member Author

@zanieb zanieb Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

None is only used for dry-run, I'm not sure we should bother computing it there (though I agree it'd be nice not to use an Option and have a footgun)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can add a guard that only let's it be null during dry-run, in the above branch where we early exit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants