55b68228da
feat(storage): redirect blob pulls to backend URLs ( #4092 )
...
* feat(storage): redirect blob pulls to backend URLs
* fix: rebase conflicts
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* refactor: rename redirect field
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* test: relax brittle TestPeriodicGC substore log assertion
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* feat(storage): improve blob redirect config handling and validation
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix(storage): address PR review feedback for blob redirect
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* feat(storage): apply latest PR review fixes for blob redirect
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* test: fix blob redirect and verify test regressions
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix(storage): enforce redirectBlobURL validation and add redirect tests
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix(storage): fix err113/noctx lint errors in storage driver tests
- Replace httptest.NewRequest with httptest.NewRequestWithContext in
s3, gcs, and imagestore driver tests (noctx)
- Replace dynamic errors.New in s3 driver test with a package-level
static sentinel error (err113)
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* test(storage): use temp dirs in imagestore redirect tests
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix: handle ranged blob redirects and add regression tests
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix: validate blob digest consistently in GetBlob
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* test: fix GetBlobPartialFn mock return values for range requests
The test 'does not redirect ranged blob requests' was failing because the mock
was returning incorrect length values. For a range request 'bytes=0-0' (1 byte),
it was returning 4 bytes, which caused a length mismatch check in GetBlob to
return HTTP 500.
Fix the mock to dynamically calculate the correct length: to - from + 1
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix(storage): preserve signed URL bytes in normalizeBlobRedirectURL
Preserve the original URL bytes from backend storage drivers (important
for signed/presigned URLs) while only lowercasing the scheme prefix.
URL re-serialization via net/url can invalidate signatures through path
escaping or canonicalization.
Add regression tests covering signed URL query parameters and mixed-case
scheme handling.
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix(storage): address PR review comments for blob redirect
- Return signed redirect URLs unchanged; validate scheme/CRLF/host only,
no URL normalization that would corrupt signed URL bytes
- Add inline comments for all non-obvious decisions: range bypass, soft
fallback on invalid URL, local driver empty return, subpath resolution,
redirectBlobURL config constraint on local/empty driver
- Expand TestNormalizeBlobRedirectURL to cover allowed schemes (http/https),
parse failure, missing host, and CRLF injection cases
- Add TestIsBlobRedirectEnabled covering subpath-only enablement with
default store disabled
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* test(storage): address remaining blob redirect review comments
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
* fix: gofumpt formatting in routes_test.go
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
---------
Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com >
Co-authored-by: Akash Kumar <meakash7902@gmail.com >
2026-06-15 14:36:07 -07:00
9e13be8b61
fix(api): support multipart range blob pulls ( #3995 )
...
* fix(api): support multipart range blob pulls
Signed-off-by: Akash Kumar <meakash7902@gmail.com >
* fix(api): tighten multipart range response
- Drop the redundant deferred closeRangeReaders; the deferred cleanup
registered when the slice is created already covers all paths.
- Stop copying the request Accept header into each multipart part's
Content-Type. Accept can be a list of media ranges (e.g.
"application/octet-stream,*/*"), which is not a valid Content-Type and
may confuse multipart parsers. RFC 9110 lets us omit it entirely.
- Set Docker-Content-Digest on the partial-content response so range
pulls expose the same header as a full GET.
- Drop the over-broad build tag on routes_internal_test.go; the parser
unit test does not need any extension build tags.
Signed-off-by: Akash Kumar <meakash7902@gmail.com >
---------
Signed-off-by: Akash Kumar <meakash7902@gmail.com >
2026-04-27 08:17:08 +03:00
Ramkumar Chinchani