commit 43823161edeedbf5b9ce7c0b13e0c05c39ac02a1
author Jeremy Bettis <jbettis@google.com> Wed Oct 15 15:50:19 2025
committer Chromeos LUCI <chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Oct 15 17:20:16 2025
tree 886e7e661f8385f2c9cc3b91d015cad1ae262c0c
parent 1e64bfa45a53bcdb66f3428b67de0d7a233d2957

lib: subtool: Correct acl logic for trash bucket

constants.TRASH_BUCKET is a gs url and bucket_override is a bucket name,
so don't compare them until after building the gs_uri.

BUG=b:447087099
TEST=None

Change-Id: Ied4f53b332f93b94fe271742ccb1244ec28bc786
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/chromite/+/7046357
Commit-Queue: Mike Frysinger <vapier@chromium.org>
Tested-by: Jeremy Bettis <jbettis@chromium.org>
Commit-Queue: Jeremy Bettis <jbettis@chromium.org>
Auto-Submit: Jeremy Bettis <jbettis@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

lib/subtool_lib.py

diff --git a/lib/subtool_lib.py b/lib/subtool_lib.py
index bae871f..615e82c 100644
--- a/lib/subtool_lib.py
+++ b/lib/subtool_lib.py
@@ -1020,11 +1020,6 @@
     ) -> None:
         """Uploads a single bundle to GCS."""
         bucket = bucket_override or gcs_metadata.bucket
-        acl = "public-read"
-        # Our trash bucket doesn't support public ACLs.  Since we only upload
-        # to it for testing purposes, use the bucket default.
-        if bucket_override == constants.TRASH_BUCKET:
-            acl = None
 
         url_parts = []
         if gcs_metadata.prefix:
@@ -1044,6 +1039,11 @@
             suburl="/".join(url_parts),
             for_gsutil=True,
         )
+        acl = "public-read"
+        # Our trash bucket doesn't support public ACLs.  Since we only upload
+        # to it for testing purposes, use the bucket default.
+        if gs_uri.startswith(constants.TRASH_BUCKET):
+            acl = None
 
         logger.debug("URI for %s: %s", gcs_metadata.package_name, gs_uri)