-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: buildscripts
-
None
-
Build OnDeck
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Adds `buildscripts/task_artifacts.py` and Evergreen’s `upload task artifact` function as a replacement for `s3.put` for task artifacts. It provides task prefixes, conditional writes, restart support, validated filenames and content types, matching visibility/ACLs, download-only headers, Intelligent-Tiering, and signed artifact links. Adoption requires migrating upload configurations; existing producers retain their current uploads until the next PR. The migration updates both artifact producers and consumers.
The helper does not authenticate identity or restrict arbitrary task code. Task expansions remain task-controlled; enforcing ownership requires trusted scoped credentials. Documentation includes `s3:PutObjectAcl`. Security owners must confirm disclosure timing before merging.
Merge order: [Uploader](https://github.com/10gen/mongo/pull/64926) → [Migration](https://github.com/10gen/mongo/pull/64927) → [Lint](https://github.com/10gen/mongo/pull/64803).
- is related to
-
SERVER-137930 Migrate internal artifact producers and consumers to task-owned uploads
-
- In Progress
-
-
SERVER-137931 Enforce task-owned artifact uploads in Evergreen lint
-
- In Progress
-
-
SERVER-137929 Validate package provenance against producer task chains
-
- Closed
-