Skip to main content

max / goingson

sync: pass content hash to SyncKit blob_upload/blob_download The SDK now AAD-binds and re-verifies the blob content hash; thread the hash (already in scope at both call sites) into the updated signatures. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-06-19 22:29 UTC
Commit: 264fca225246da0ea9488a4923c9b1d98928df36
Parent: e583829
1 file changed, +5 insertions, -3 deletions
M src-tauri/src/sync_service/blob_sync.rs +5 -3
@@ -66,7 +66,7 @@ pub async fn upload_pending_blobs(
66 66 }
67 67 };
68 68
69 - if let Err(e) = client.blob_upload(&upload_resp.upload_url, data).await {
69 + if let Err(e) = client.blob_upload(hash, &upload_resp.upload_url, data).await {
70 70 warn!("Failed to upload blob {}: {}", short(hash), e);
71 71 continue;
72 72 }
@@ -126,8 +126,10 @@ pub async fn download_missing_blobs(
126 126 }
127 127 };
128 128
129 - // Download and decrypt
130 - let data = match client.blob_download(&download_url).await {
129 + // Download and decrypt. The SDK now AAD-binds and re-verifies the content
130 + // hash itself; the local check below stays as belt-and-braces before the
131 + // file is committed under its hash name.
132 + let data = match client.blob_download(hash, &download_url).await {
131 133 Ok(d) => d,
132 134 Err(e) => {
133 135 warn!("Failed to download blob {}: {}", short(hash), e);