Skykey: Can download without providing private skykey
Overview
Based on the documentation, it should be impossible to download content from skynet without providing a skykey if that content was uploaded using a private skykey. But it seems that this is not the case:
My reproduction steps are:
- create a private key:
curl -X POST -H "User-Agent: Sia-Agent" -H "Authorization: Basic OmUwZTQ0ZDYyMDQxM2VlODA1ODgzYTE4ZWFkNGEzMjQ3" http://localhost:9980/skynet/createskykey -d "name=08ddb812138111ebadc10242ac120002&type=private-id"
- upload a file with that key:
curl -X POST -H "User-Agent: Sia-Agent" -H "Authorization: Basic OmUwZTQ0ZDYyMDQxM2VlODA1ODgzYTE4ZWFkNGEzMjQ3" -H "Content-Type: text/html" -F "files[]=@./index.html" http://localhost:9980/skynet/skyfile/ivohi?filename=ivohi&skykeyname=08ddb812138111ebadc10242ac120002
- download that file without specifying the key:
curl -H "User-Agent: Sia-Agent" -H "Authorization: Basic OmUwZTQ0ZDYyMDQxM2VlODA1ODgzYTE4ZWFkNGEzMjQ3" http://localhost:9980/skynet/skylink/AAAUz04zdgDTAAAg8dvamoWjFUCo51aWk6e0Nmwp3ASgLw
Additionally, it seems impossible to provide a skykey on download, as skynetSkylinkHandlerGET
never refers to that. Maybe the implementation is unfinished or maybe there's another piece missing.