Do not assume public artifacts have prefix public/

[petemoore]

Scanning the taskgraph codebase, there are several pieces of code that check whether an artifact name has prefix public/ to determine whether scopes are required to fetch it. Unfortunately this is not the correct way to determine whether an API call to fetch the artifact requires scopes.

The anonymous role determines the set of scopes that all calls are granted. Typically this includes queue:get-artifact:public/* but that is not a requirement, and in locked down taskcluster deployments this scope may not be included in the anonymous role. Furthermore, the anonymous role may include other scopes with prefix queue:get-artifact: meaning that not only public/* artifacts are public.

The bottom line is: the correct way to check whether an artifact is public is to see if an unauthorized request satisfies the scope queue:get-artifact:<artifact-name> e.g. by calling authorize (node.js) or e.g. scopes.Satisfies (go) or alternatively just fetch the artifact with an unauthorized HEAD request and check for a 200 http status code response.

In python, it looks like you can either expand the scopes of the anonymous role, or make an unauthorised call to auth.currentScopes to fetch anonymous scopes. Then call scopeMatch to see if the anonymous role satisfies the scope queue:get-artifact:<artifact-name> for the artifact name you are interested in.

Note, you should not try to parse the anonymous scopes yourself, but instead rely on one of these libraries to take care of the delicate matters of scope/role expansion, * matching, handling parameterized roles, etc.

[ahal]

Thanks for the report, makes sense.

I do worry that making a network request for each artifact we need to check will be expensive. I wonder if in some cases an educated guess like what we're doing here is good enough. Or maybe there's a way to query the prefixes the anonymous role uses once and go with that?

[petemoore]

Thanks for the report, makes sense.

I do worry that making a network request for each artifact we need to check will be expensive. I wonder if in some cases an educated guess like what we're doing here is good enough. Or maybe there's a way to query the prefixes the anonymous role uses once and go with that?

Good point! In python, you can cache the results of the anonymous role, and the scopeMatch routine I think doesn't make any external network request.