jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(backups): state snapshot 403 on Debian 12's curl 7.88 #223

Merged
jfraeys merged 1 commit from jfraeys/fix/state-snapshot-curl-7-88 into main 2026-10-16 13:02:10 -04:00
Conversation 0 Commits 1 Files changed 2 +6 -2
jfraeys commented 2026-10-16 12:46:00 -04:00
Owner
Copy link

After #222 was deployed, every request from infra-state-snapshot returned 403 on services (the log: 'could not list the state bucket'), so each backup run reported dumps=FAILURE / DEGRADED. Probed on the host with read-only requests: all shapes 403 without an x-amz-content-sha256 header, 200 with it (list and object, %3A path). curl 7.88.1 does not add the header; 8.x does. The script now sends the empty-body hash. test-state-snapshot.sh requires the header; a run of the script against the real bucket from curl 8.7 still writes all 6 workspaces.

The backup data itself was not affected: primary and secondary restic both reported SUCCESS.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

After #222 was deployed, every request from infra-state-snapshot returned 403 on services (the log: 'could not list the state bucket'), so each backup run reported dumps=FAILURE / DEGRADED. Probed on the host with read-only requests: all shapes 403 without an x-amz-content-sha256 header, 200 with it (list and object, %3A path). curl 7.88.1 does not add the header; 8.x does. The script now sends the empty-body hash. test-state-snapshot.sh requires the header; a run of the script against the real bucket from curl 8.7 still writes all 6 workspaces. The backup data itself was not affected: primary and secondary restic both reported SUCCESS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
fix(backups): send x-amz-content-sha256 in the state snapshot (curl 7.88 on Debian 12 omits it; S3 answers 403)
All checks were successful
Lint / lint (pull_request) Successful in 1m59s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
fd34aa5838
 
The deployed snapshot failed on services with 403 on every request, leaving the backup DEGRADED
(dumps=FAILURE). With the empty-body hash header the same requests return 200 on the host's curl 7.88.1.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!223
No description provided.