Repository navigation
Conversation
jtomson
marked this pull request as ready for review
November 3, 2026 19:59
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
We leave IMGPROXY_USE_ETAG off, so the frame always gets an md5 of the body to check its cached copy against. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jtomson
force-pushed
the
render-etag-md5
branch
from
November 3, 2026 20:03
54c0673 to
d892281
Compare
jtomson
marked this pull request as draft
November 3, 2026 20:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
When a render isn't cached yet, imgproxy returns it without an ETag. Once it's in the render bucket, S3 serves it with an ETag that is the hex md5 of the bytes. So frames only get a usable digest on cache hits, and in a sample from a frame's OkHttp cache 10 of 16 images had none.
This sets the ETag on the cache-miss response to the same quoted hex md5 S3 would return, so every image response carries a digest the frame can check its cached copy against. It's set regardless of IMGPROXY_USE_ETAG, which we leave off. imgproxy's own ETag is a sha256 of the options and source, not of the body, so the frame can't check against it.
How I tested it
Added TestSetRenderETagIsQuotedHexMD5 for the header format.
go test . passes.
Checked a live cache hit through imgproxy.pushd.com. It's served by S3 through CloudFront with SSE-S3 (AES256), and the ETag matched the md5 of the 724,337-byte body exactly. CloudFront passes it through unchanged.
The cache-miss ETag is the md5 of the same bytes that go to S3 in a single PutObject, so the two should match. After deploy I'll request an unrendered URL twice and confirm the miss and hit ETags are identical.
🤖 Generated with Claude Code