Method Describe

pkg/blobmanager/s3/backend.go:179–225

(ctx context.Context, digest string)

}

func (b *Backend) Describe(ctx context.Context, digest string) (*pb.CASResource, error) {
	input := &s3.HeadObjectInput{
		Bucket: aws.String(b.bucket),
		Key:    aws.String(resourceName(digest)),
	}

	if b.checksumVerificationEnabled() {
		// Enable checksum verification
		input.ChecksumMode = types.ChecksumModeEnabled
	}

	// and read the object back
	resp, err := b.client.HeadObject(ctx, input)

	// check error is aws error
	if err != nil {
		var apiErr smithy.APIError
		if errors.As(err, &apiErr) && apiErr.ErrorCode() == "NotFound" {
			return nil, backend.NewErrNotFound("artifact")
		}

		return nil, fmt.Errorf("failed to read from bucket: %w", err)
	}

	// Check integrity of the remote object
	if resp.ChecksumSHA256 != nil && *resp.ChecksumSHA256 != hexSha256ToBinaryB64(digest) {
		return nil, fmt.Errorf("failed to validate integrity of object, got=%s, want=%s", *resp.ChecksumSHA256, hexSha256ToBinaryB64(digest))
	}

	// Check asset author is Chainloop that way we can ignore files uploaded by other tools
	// note: this is not a security mechanism, an additional check will be put in place for tamper check
	author, ok := resp.Metadata[annotationNameAuthor]
	if !ok || author != backend.AuthorAnnotation {
		return nil, errors.New("asset not uploaded by Chainloop")
	}

	fileName, ok := resp.Metadata[annotationNameFilename]
	if !ok {
		return nil, fmt.Errorf("couldn't find file metadata")
	}

	return &pb.CASResource{
		FileName: fileName,
		Size:     *resp.ContentLength,
		Digest:   digest,
	}, nil
}

func (b *Backend) Download(ctx context.Context, w io.Writer, digest string) error {
	exists, err := b.Exists(ctx, digest)