Do not assume public artifacts have prefix public/
@petemoore is already working on this.
Since May 7, 2026.
Assessment
This issue has not been assessed yet.
Description
Scanning the taskgraph codebase, there are several pieces of code that check whether an artifact name has prefix public/ to determine whether scopes are required to fetch it. Unfortunately this is not the correct way to determine whether an API call to fetch the artifact requires scopes.
The anonymous role determines the set of scopes that all calls are granted. Typically this includes queue:get-artifact:public/* but that is not a requirement, and in locked down taskcluster deployments this scope may not be included in the anonymous role. Furthermore, the anonymous role may include other scopes with prefix queue:get-artifact: meaning that not only public/* artifacts are public.
The bottom line is: the correct way to check whether an artifact is public is to see if an unauthorized request satisfies the scope queue:get-artifact:<artifact-name> e.g. by calling authorize (node.js) or e.g. scopes.Satisfies (go) or alternatively just fetch the artifact with an unauthorized HEAD request and check for a 200 http status code response.
In python, it looks like you can either expand the scopes of the anonymous role, or make an unauthorised call to auth.currentScopes to fetch anonymous scopes. Then call scopeMatch to see if the anonymous role satisfies the scope queue:get-artifact:<artifact-name> for the artifact name you are interested in.
Note, you should not try to parse the anonymous scopes yourself, but instead rely on one of these libraries to take care of the delicate matters of scope/role expansion, * matching, handling parameterized roles, etc.
- Dominant language
- Python
- Stars
- 26
- Forks
- 55
- Avg merge
- 2d 6m
- Merged PRs (30d)
- 15
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from taskcluster/taskgraph
-
Dependency Dashboard Open
Difficulty 5/5 Over a week Newbie friendliness 20/100
taskcluster/taskgraph#952 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
taskcluster/taskgraph#915 ·
-
feature
Difficulty 3/5 1-2 days Newbie friendliness 35/100
taskcluster/taskgraph#911 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
taskcluster/taskgraph#882 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
taskcluster/taskgraph#865 · 1 comment ·
All issues in taskcluster/taskgraph
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
zostera/django-bootstrap4#894 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
use-agent-os/agent-os#3276 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
zephyrproject-rtos/zephyr#119726 ·
-
area/auth bug comp/agent P3 platform/discord type/security
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NousResearch/hermes-agent#117848 ·