From 7a0f207e69531da54b8131bf4953f02a89411502 Mon Sep 17 00:00:00 2001 From: Christoph Brandau Date: Tue, 30 Jun 2026 15:53:07 +0200 Subject: [PATCH] Ensure public read policy on S3 artifacts bucket The Tauri updater requires anonymous read access to fetch application artifacts. This change ensures that the S3 bucket used for storing these artifacts always has a public read policy applied, both upon initial creation and during subsequent checks. --- cicd_tool/main.py | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/cicd_tool/main.py b/cicd_tool/main.py index 6ed83d3..10341f1 100644 --- a/cicd_tool/main.py +++ b/cicd_tool/main.py @@ -81,6 +81,23 @@ def _create_minio_client() -> Minio: ) +def _public_read_policy(bucket_name: str) -> str: + """Anonymous read-only policy so the Tauri updater can fetch artifacts.""" + return json.dumps( + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": {"AWS": ["*"]}, + "Action": ["s3:GetObject"], + "Resource": [f"arn:aws:s3:::{bucket_name}/*"], + } + ], + } + ) + + def _ensure_bucket(client: Minio, bucket_name: str) -> None: if not bucket_name: raise ConfigurationError("S3_BUCKET is required") @@ -88,6 +105,12 @@ def _ensure_bucket(client: Minio, bucket_name: str) -> None: exists = client.bucket_exists(bucket_name) if not exists: client.make_bucket(bucket_name) + print(f"Created bucket '{bucket_name}'.") + + # Always (re)apply public read so a freshly created -- or previously private -- + # bucket can be read anonymously by the updater. + client.set_bucket_policy(bucket_name, _public_read_policy(bucket_name)) + print(f"Ensured public read policy on bucket '{bucket_name}'.") def _collect_artifacts() -> List[Path]: