blob/all: add an option to set a blob to be "public"

[kaihendry]

I'm puzzled how I can't find any gocloud.dev for this typical use case, so can I assume there is no abstraction for it yet?

https://stackoverflow.com/questions/54121278/how-to-set-public-read-using-go-cloud-s3blob

[go-cloud-bot]

Please edit the title of this issue with the name of the affected package, or "all", followed by a colon, followed by a short summary of the issue. Example: blob/gcsblob: not blobby enough.

[zombiezen]

That's correct, there is no abstraction for it yet. We have not found a portable design to surface ACLs that does not violate the seam between developers and operators that Go Cloud tries to create.

[vangent]

Can you give a bit more context on what you're trying to do? You have an AWS bucket, and you want to make some specific blobs in that bucket public-read?

• You could set public-read for the whole bucket.
• You could used SignedURL to create a publicly usable URL for a specific blob.

[vangent]

If making specific blobs in a bucket publicly readable (but not the whole bucket) is common, we might be able to add support for that (without supporting other kinds of ACLs, which is difficult across providers).

[kaihendry]

I'm making my whole bucket public in my case: https://github.com/kaihendry/picofeed

Nonetheless a signed URL function, could be fun. I mean is there an API telling my the public URL for a Object? That would be useful, since I am always struggling to work that out.

[vangent]

is there an API telling my the public URL for a Object

SignedURL (https://godoc.org/gocloud.dev/blob#Bucket.SignedURL) is different than that; it creates a new limited-time public URL that can be used to view an object that's not inherently public.

[vangent]

I'm going to change this issue to be about adding a new feature to be able to set a specific blob "public"; we'll see what the demand is for this before doing it.

[felipeweb]

I use As function to do this but it’s useful to have an easier way to do this

[vangent]

I did a bit of research on this.

GCS

• (read, write, owner) x (all users, all authenticated users)
• https://godoc.org/cloud.google.com/go/storage#ObjectHandle.ACL
• https://godoc.org/cloud.google.com/go/storage#ACLHandle.Set

AWS S3

• BucketCannedACLPublicRead, BucketCannedACLPublicReadWrite, BucketCannedACLAuthenticatedRead, probably more.
• https://godoc.org/github.com/aws/aws-sdk-go/service/s3/s3manager#UploadInput
• https://godoc.org/github.com/aws/aws-sdk-go/service/s3#AccessControlPolicy

Azure

• Not supported; ACLs are only set at the container/bucket level, not on individual blobs.

[vsaroopchand]

@kaihendry The bucket is presumed to be created and configured; the Azure blob driver does not create buckets. If you must create buckets, use bucket.As() to obtain the Azure SDK type and create the container with your desired settings.