elektrine/magpie
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: honor MAGPIE_PUBLIC_BUCKETS for unsigned media reads
All checks were successful
Deploy / Deploy over SSH (push) Successful in 1m25s
Details
CI / Test and build (push) Successful in 1m38s
Details

Browse source 
Production still set MAGPIE_PUBLIC_BUCKETS=app-uploads, but only
MAGPIE_PUBLIC_PREFIXES was read, so media.elektrine.com returned
SignatureDoesNotMatch 403. Accept bare bucket public reads and the
legacy PUBLIC_BUCKETS env.
This commit is contained in:
Maxfield Luke 2026-07-29 05:50:22 -04:00
parent aa43ce2562
commit 6a717adca2
3 changed files with 53 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

28
main.go
View file

@ -184,7 +184,12 @@ func configFromEnv() Config {
replicationMaxAttempts := mustParseInt("MAGPIE_REPLICATION_MAX_ATTEMPTS", defaultReplicationMaxAttempts)
maxRestoreBytes := mustParseBytes("MAGPIE_MAX_RESTORE_BYTES", defaultMaxRestoreBytes)
allowedBuckets := parseSet(os.Getenv("MAGPIE_ALLOWED_BUCKETS"))
// MAGPIE_PUBLIC_BUCKETS is a legacy whole-bucket public-read list (e.g. app-uploads).
// MAGPIE_PUBLIC_PREFIXES is preferred and takes bucket/prefix values.
publicPrefixes := parsePublicPrefixes(os.Getenv("MAGPIE_PUBLIC_PREFIXES"))
for bucket := range parseSet(os.Getenv("MAGPIE_PUBLIC_BUCKETS")) {
publicPrefixes[bucket] = true
}
rateLimitPerMinute := mustParseInt("MAGPIE_RATE_LIMIT_PER_MINUTE", 600)
trustProxyHeaders := mustParseBool("MAGPIE_TRUST_PROXY_HEADERS", false)
allowUnsignedLocal := mustParseBool("MAGPIE_ALLOW_UNSIGNED_PAYLOADS", false)
@ -297,16 +302,21 @@ func parsePublicPrefixes(raw string) map[string]bool {
if value == "none" || value == "false" || value == "0" {
return map[string]bool{}
}
if strings.TrimSpace(raw) != "" {
prefixes := parseSet(raw)
for prefix := range prefixes {
if err := ValidateKey(strings.TrimSuffix(prefix, "/")); err != nil || !strings.Contains(strings.Trim(prefix, "/"), "/") {
log.Fatal("MAGPIE_PUBLIC_PREFIXES entries must be bucket/prefix values")
}
}
return prefixes
if strings.TrimSpace(raw) == "" {
return map[string]bool{}
}
return map[string]bool{}
prefixes := parseSet(raw)
for prefix := range prefixes {
cleaned := strings.Trim(prefix, "/")
if cleaned == "" {
log.Fatal("MAGPIE_PUBLIC_PREFIXES entries must not be empty")
}
// Allow bare bucket names (whole-bucket public read) or bucket/prefix paths.
if err := ValidateKey(cleaned); err != nil {
log.Fatal("MAGPIE_PUBLIC_PREFIXES entries must be valid bucket or bucket/prefix values")
}
}
return prefixes
}
func printUsage() {