From 374aaa7447da227cc2612c0c58b1e22cb3049330 Mon Sep 17 00:00:00 2001 From: Anthony Lukach Date: Wed, 22 Jul 2026 10:56:48 -0700 Subject: [PATCH] feat(backend): enable GCS backend (multistore gcp + wasm-compatible signing) Enable the `gcp` feature on `multistore` and `multistore-cf-workers` so `BackendType::Gcs` builds a GoogleCloudStorageBuilder instead of erroring with "GCS backend support not enabled". This lets source.coop data connections with provider "gcs" reach an actual storage client. object_store's GCS credential module signs JWTs with ring's SystemRandom, whose SecureRandom impl on wasm32-unknown-unknown is gated behind ring's `wasm32_unknown_unknown_js` feature. ring is a transitive dep, so opt into that feature via a direct wasm-target entry; without it the Workers build fails to compile. (source.coop uses keyless Workload Identity Federation, so the signing path isn't exercised at runtime, but the code must compile.) Verified: cargo check + clippy (-D warnings) + fmt all pass for wasm32-unknown-unknown. Co-Authored-By: Claude Opus 4.8 (1M context) --- Cargo.lock | 2 ++ Cargo.toml | 10 ++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8e52768..3622efc 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1084,6 +1084,7 @@ dependencies = [ "rand 0.10.1", "reqwest", "ring", + "rustls-pki-types", "serde", "serde_json", "serde_urlencoded", @@ -1745,6 +1746,7 @@ dependencies = [ "multistore-sts", "percent-encoding", "reqwest", + "ring", "serde", "serde_json", "sha2", diff --git a/Cargo.toml b/Cargo.toml index 3303d06..5a357ce 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -32,7 +32,7 @@ path = "tests/object_path.rs" [dependencies] # Multistore -multistore = { version = "0.6.3", features = ["azure"] } +multistore = { version = "0.6.3", features = ["azure", "gcp"] } multistore-oidc-provider = "0.6.3" multistore-path-mapping = "0.6.3" multistore-sts = "0.6.3" @@ -57,7 +57,13 @@ tracing = "0.1" # Pulled in transitively via object_store -> rand. getrandom doesn't support # wasm32-unknown-unknown unless the `wasm_js` backend is enabled, so opt in here. getrandom = { version = "0.4", features = ["wasm_js"] } -multistore-cf-workers = { version = "0.6.3", features = ["azure"] } +# object_store's GCS credential signing calls ring's SystemRandom, whose +# SecureRandom impl on wasm32-unknown-unknown is gated behind ring's +# `wasm32_unknown_unknown_js` feature (enables getrandom 0.2's js backend). +# ring is transitive (via object_store); this direct entry only turns the +# feature on for the wasm target. +ring = { version = "0.17", features = ["wasm32_unknown_unknown_js"] } +multistore-cf-workers = { version = "0.6.3", features = ["azure", "gcp"] } # On wasm32-unknown-unknown reqwest selects its browser `fetch` backend by # target arch (not a cargo feature), so the default TLS/backend features are # unnecessary here. We only use `Client::new()`, `.send()` and `.text()`, none