iremcaginyurtturk opened a new pull request, #1503: URL: https://github.com/apache/iceberg-go/pull/1503
## Problem `createGCSBucket` (`io/gocloud/gcs.go`) builds the authenticated HTTP client from Application Default Credentials — or an anonymous client when ADC is absent — and ignores the credentials parsed from the `gcs.jsonkey` (`GCSJSONKey`) and `gcs.keypath` (`GCSKeyPath`) properties. `ParseGCSConfig` turns those into client options, but they are passed to `gcsblob.OpenBucket` alongside the pre-built client, whose transport takes precedence — so the explicit credentials never authenticate requests. **Effect:** with a catalog configured with explicit GCS service-account credentials but **no** `GOOGLE_APPLICATION_CREDENTIALS` in the environment, GCS reads/writes go out **anonymously** and fail with `HTTP 403 AccessDenied`. The credentials only take effect if the same account is also exported via ADC. ## Fix Resolve credentials from `gcs.jsonkey` / `gcs.keypath` first (via the non-deprecated `CredentialsFromJSONWithType`, defaulting to a service-account key and honouring `gcs.credtype`) and build the client's token source from them. Fall back to ADC (which may be nil → anonymous client) only when neither property is set. ## Testing Added `io/gocloud/gcs_test.go` unit tests (using `authorized_user` credentials to stay hermetic — no RSA key or network): - inline JSON key (`gcs.jsonkey`) yields explicit credentials, not ADC; - key-file path (`gcs.keypath`) yields explicit credentials; - a missing key file is a hard error, not a silent ADC fallback. Also verified end-to-end against a real GCS bucket: with `GOOGLE_APPLICATION_CREDENTIALS` unset, a write authenticated purely from `gcs.keypath` and succeeded (previously anonymous → 403). `go test ./io/gocloud/` passes; `staticcheck` is clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
