From 53c7484709c52980b32cb22793b8396cb23c337c Mon Sep 17 00:00:00 2001 From: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co> Date: Tue, 30 Jun 2026 22:08:29 -0400 Subject: [PATCH] fix(deps): pin aws-creds to fork with EKS Pod Identity support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The relay pod on bb-block authenticates to S3 via EKS Pod Identity (AWS_CONTAINER_CREDENTIALS_FULL_URI + AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE), but aws-creds 0.39.1 (pulled transitively via rust-s3 0.37.2) only reads the ECS RELATIVE_URI form and sends no Authorization header. Result: "failed to initialize media storage: Could not get valid credentials", blocking both S3 media and git CAS storage. Pin aws-creds to tlongwell-block/rust-s3@c9fce362, which adopts the aws-creds portion of durch/rust-s3#449: FULL_URI fallback, bearer token from the token file/env, Authorization header, and a loopback allowlist (169.254.170.23 / [fd00:ec2::23]) that only sends the token to the documented Pod Identity agent addresses. The fix is refresh-safe — it sets expiration from the response, so rust-s3's auto-refresh re-fetches on token expiry rather than silently 403ing after ~6h. Scope is minimal: only aws-creds is redirected; rust-s3 stays on crates.io 0.37.2, and no S3 call sites or the git CAS change. Temporary pin pending upstream merge of #449. Verified: buzz-media (42 passed) and buzz-relay (429 passed, incl. the git-CAS unit tests) full suites green against the fork. Live S3/MinIO probes remain env-gated and are validated on-cluster post-deploy. Co-authored-by: Tyler Longwell Signed-off-by: Tyler Longwell --- Cargo.lock | 3 +-- Cargo.toml | 9 +++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3481cafc15..43c859eb68 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -397,8 +397,7 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "aws-creds" version = "0.39.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ca3b85155d265df828f84e53886ed9e427aed979dd8a39f5b8b2162c77e142d7" +source = "git+https://github.com/tlongwell-block/rust-s3?rev=c9fce3620dd434c1f810101d672cf384268dbb0f#c9fce3620dd434c1f810101d672cf384268dbb0f" dependencies = [ "attohttpc", "home", diff --git a/Cargo.toml b/Cargo.toml index e4c979da32..1ce18b5112 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -148,3 +148,12 @@ lto = "fat" codegen-units = 1 panic = "abort" strip = true + +# Temporary fork pin: aws-creds 0.39.1 (via rust-s3) cannot read EKS Pod Identity +# credentials (AWS_CONTAINER_CREDENTIALS_FULL_URI + AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE), +# which the relay pod on bb-block requires for S3 media + git storage. This pins +# aws-creds to a fork that adopts the aws-creds portion of durch/rust-s3#449 +# (FULL_URI + token-file + Authorization header, refresh-safe, with a loopback +# allowlist for the auth token). Revert to crates.io once #449 lands upstream. +[patch.crates-io] +aws-creds = { git = "https://github.com/tlongwell-block/rust-s3", rev = "c9fce3620dd434c1f810101d672cf384268dbb0f" }