Patch release with two fixes found while porting 1.7.0 to the ODC connector.

Fixed

• Object_UpdateMetadata could write stale metadata onto new content. Setting the metageneration precondition explicitly turned off the SDK's automatic generation precondition, and replacing an object's content resets its metageneration to 1. So if another writer replaced the content between the read and the update, the update still succeeded and applied the old ContentType and custom metadata to the new content. The update is now guarded by both the generation and the metageneration it read, and that case fails with the existing "changed by another request, retry" error.
• Object_Copy into a bucket that doesn't exist reported the source as missing. It now checks whether the source still exists and names the missing destination bucket, the same way Object_Move has done since 1.7.0. Both actions share this logic.

A security and reliability release. It’s a drop-in replacement for 1.6.1, with no changes to actions, inputs or outputs. Some invalid calls that used to fail late, or succeed with a wrong result, are now rejected up front.

Security

• Keyless access (Workload Identity Federation) with a caller-supplied SubjectToken: each token now gets its own cached credentials. Before, callers with the same provider and service account shared one cached credential, so one caller could reuse another caller’s access token for up to an hour.
• An expired SubjectToken is rejected before anything is sent to Google.
• TokenEndpoint must use https:// and can’t contain a user name or password. Redirects from the identity provider aren’t followed, so the client secret is never sent anywhere else.
• Error messages no longer repeat the identity provider’s response, only its error code and description.
• Object_GetSignedUrl refuses an empty ObjectName, which would have signed a URL for the whole bucket.

Fixed

• Object_Move onto the same object (same bucket and name) deleted the object. It’s now refused. If another writer replaces the source during a move, the new source isn’t deleted.
• Object_Exists and Object_GetMetadata returned an error instead of Exists = False for a missing object in a bucket whose name contains “bucket”.
• Download and Delete signed URLs no longer fail with SignatureDoesNotMatch when a ContentType is given. It’s now signed only for Upload URLs.
• Object_Download no longer fails the integrity check on valid files stored with gzip encoding.
• Bucket_Create with an empty Location now uses Google’s default location, and Object_Upload accepts empty files and an empty ContentType.
• Clearer error messages for identity provider failures, network failures and timeouts.
• Text outputs are empty instead of null when Google leaves a field out.

Improved

• Cached credentials expire after 60 minutes without use and the caches are size-limited, so rotated keys and per-user tokens no longer pile up.

Good to know

• Object_GetSignedUrl: an empty Operation now gives a Download URL.
• Object_GetSignedUrl: ExpirationMinutes must be between 1 and 10080 (7 days, Google’s limit for a signed URL). Longer values are rejected up front instead of failing at Google.
• Consumer modules only need a dependency refresh.

Google now recommends its latest Cloud Storage client libraries, which validate upload checksums end to end by default. This release adopts them. It’s a drop-in replacement for 1.6.0.

Improved

• Corrupted uploads are rejected before they’re stored. Object_Upload sends a CRC32C checksum of the exact file bytes, and Google rejects the upload if the data changed in transit.
  • Nothing is stored, and an existing file with the same name is never overwritten with bad data.
  • Before, the check ran after the file was stored, and an overwritten file could be lost.
• Clear error message. A rejected upload now explains that nothing was stored and that the upload can be retried.

Updated

• Google Cloud Storage client 5.0.0 (Google’s recommended minimum for .NET).
• The other Google client libraries, refreshed to their latest releases.

Good to know

• Uploads through signed URLs go directly from the browser to Google, so they aren’t covered by this automatic check.