james/nixery
1
0
Fork 0
mirror of https://code.tvl.fyi/depot.git:/tools/nixery.git synced 2024-10-22 20:33:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: document unset GOOGLE_APPLICATION_CREDENTIALS

Browse Source 
In case the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is not
set, a redirect to storage.googleapis.com is issued, which means the
underlying bucket objects need to be publicly accessible.

This wasn't really obvious until now, so further clarify it.
This commit is contained in:
Florian Klink 2021-04-29 16:02:26 +02:00 committed by Vincent Ambo
parent fd3dc4422f
commit 8aef070dc6
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -94,6 +94,10 @@ account key, Nixery will also use this key to create [signed URLs][] for layers
in the storage bucket. This makes it possible to serve layers from a bucket
without having to make them publicly available.
In case the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is not set, a
redirect to storage.googleapis.com is issued, which means the underlying bucket
objects need to be publicly accessible.
### Storage
Nixery supports multiple different storage backends in which its build cache and

4
storage/gcs.go
View File

@ -222,6 +222,10 @@ func signingOptsFromEnv() (*storage.SignedURLOptions, error) {
// Signing the URL allows unauthenticated clients to retrieve objects from the
// bucket.
//
// In case signing is not configured, a redirect to storage.googleapis.com is
// issued, which means the underlying bucket objects need to be publicly
// accessible.
//
// The Docker client is known to follow redirects, but this might not be true
// for all other registry clients.
func (b *GCSBackend) constructLayerUrl(digest string) (string, error) {