S3Presigner credential refresh fails after ~60 minutes when using IRSA

[achdmbp]

When running OpenVSX on Kubernetes with IRSA and AWS S3 storage (without CDN), the getLocation() method fails after approximately 60 minutes with credential refresh errors, causing all extension downloads to return 500.

This is a regression from the IRSA support added in #1327 — the S3Client is correctly cached as a singleton, but the S3Presigner is created and destroyed on every call via try-with-resources, which kills the HTTP connection pool needed for credential refresh.

Steps to Reproduce

1. Deploy OpenVSX with IRSA and S3 storage (no CDN), following the same setup as feat: Add IRSA and session token support to AWS Storage Service #1327
2. Publish an extension and verify it downloads successfully
3. Wait 63+ minutes
4. Request any extension asset — returns 500

Environment

• OpenShift (ROSA) with IRSA
• OpenVSX v0.32.3
• AWS SDK for Java v2
• S3 storage enabled, CDN disabled

Root Cause

// Current code - creates and destroys presigner on every call
private URI getLocation(String objectKey) {
    ...
    try (var presigner = getS3Presigner()) {  // new presigner each time
        var presignedRequest = presigner.presignGetObject(presignRequest);
        return presignedRequest.httpRequest().getUri();
    }  // closes presigner → kills HTTP pool → credential refresh breaks
}

Closing the S3Presigner shuts down the DefaultCredentialsProvider's internal HTTP client used for STS AssumeRoleWithWebIdentity calls. After ~60 minutes when cached IRSA credentials expire, the SDK cannot refresh them because the HTTP connection pool is dead.

Note: S3Client does not have this issue because it is already cached as a singleton field in the same class.

Fix

Cache the S3Presigner as a singleton field (same pattern already used for S3Client). Will submit a PR shortly.

[netomi]

The S3Presigner was always built for every request with a try-with-resources block:

53e29d4#diff-8ebfefff93756b86ee9578580d836a2695b9ba9f3122377a07ecee4479b872a4R199

so its not a regression but it was always like this imho

[achdmbp]

The S3Presigner was always built for every request with a try-with-resources block:

53e29d4#diff-8ebfefff93756b86ee9578580d836a2695b9ba9f3122377a07ecee4479b872a4R199

so its not a regression but it was always like this imho

thank you for the correction. yes you're right. it was always like this. would you agree that we need to have it as a singleton so we can refresh the token when it needs to? AFAIK, the IRSA token itself should be rotated automatically whenever it expires.

[netomi]

I need to review the claim first, but creating a new presigner for each request seems like a waste