Releases: redirect without downloading the artifact

[adamshiervani]

/releases/app/latest and /releases/system_recovery/latest downloaded the whole artifact on every cache miss to compare it with its .sha256 sidecar, then redirected.

 list versions → newest → resolveArtifactPath
-  GetObject artifact (tens to hundreds of MB) + GetObject .sha256 → verifyHash
+  HeadObject
   302

Found on staging: four concurrent redirect requests during scripts/compare-releases.sh made the instance download several recovery images at once, the platform marked it unhealthy, and the requests came back as 504 no_healthy_upstream. One at a time they pass.

Verification at request time bought nothing: the sidecar is written by the same release script that uploads the file, and sync-releases.ts verifies hash and GPG signature when it registers a release. The redirect now only checks the object exists.

Tests: the two "hash does not match" cases are gone with the behaviour; the "file missing" cases mock HeadObject instead of GetObject.

Net: +18 / −102.

---

Note

Medium Risk
Redirect paths no longer detect tampered or corrupt objects at request time; clients rely on publish/sync verification and downstream download checks instead.

Overview
Latest redirect endpoints (/releases/app/latest and /releases/system_recovery/latest) no longer download the full artifact plus its .sha256 sidecar on cache misses to run verifyHash. They now only HeadObject via s3ObjectExists and return a 302 when the object is present.

This avoids concurrent redirect traffic pulling large recovery images through the API (which caused staging 504 / unhealthy upstream). Integrity is documented as enforced at publish (release script writes the sidecar) and sync (sync-releases.ts verifies hash and signature), not on every redirect.

Tests drop the hash mismatch → InternalServerError cases, mock HeadObject for existence in legacy redirect helpers, and assert NotFound when HeadObject returns 404 instead of missing GetObject bodies.

^{Reviewed by Cursor Bugbot for commit e554314. Bugbot is set up for automated code reviews on this repo. Configure here.}

[adamshiervani]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e554314. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T20:16:32.501906Z	e554314	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.