feat(cas): scope CAS downloader tokens to a single digest

MI
9h ago
+516-17

CAS downloader tokens can now be scoped to a single artifact digest. A scoped token can read only that digest, so a download URL handed to a less trusted environment cannot be used to read other artifacts in the same CAS backend.

  • Add an optional digest claim to CAS downloader tokens. Tokens without the claim keep the current behavior.
  • The CAS enforces the claim in the HTTP download handler, the bytestream read path and ResourceService.Describe. Describe now also requires the downloader role.
  • CASCredentialsService.Get and CASRedirectService.GetDownloadURL accept a new scope_to_digest field to mint a scoped token.
  • The /download/<digest> redirect, chainloop artifact download and the control plane CAS client now request scoped tokens.

Inline backends have no download URL, so they are not affected.

Refs SEC-634

AI disclosure: this change was produced with assistance from Claude Code.