lakectl fs cat panics with nil pointer dereference when pre-signed URL fails

[DavidBoublil]

Description

lakectl fs cat panics with a nil pointer dereference when GetObject returns a nil response. This can happen in any case where the request fails before an HTTP response is received (e.g. pre-signed URL generation failure, network error, etc.).

Panic

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x40 pc=0x...]

goroutine 1 [running]:
github.com/treeverse/lakefs/cmd/lakectl/cmd.init.func73(...)
    lakefs-oss/cmd/lakectl/cmd/fs_cat.go:31

Root Cause

In cmd/lakectl/cmd/fs_cat.go, DieOnHTTPError(resp) is called before checking err. When GetObject returns a nil response with a non-nil error, DieOnHTTPError(nil) dereferences the nil pointer, causing the panic.

resp, err = client.GetObject(cmd.Context(), ...)
DieOnHTTPError(resp)  // panics if resp is nil
body = resp.Body      // also panics if resp is nil
if err != nil {       // err checked too late
    DieErr(err)
}

Fix

Check err before calling DieOnHTTPError, and ensure DieOnHTTPError is nil-safe:

resp, err = client.GetObject(cmd.Context(), ...)
if err != nil {
    DieErr(err)
}
DieOnHTTPError(resp)
body = resp.Body

Steps to Reproduce

1. Run lakeFS with a GCS blockstore using Application Default Credentials (no service account key)
2. Run: lakectl fs cat lakefs://<repo>/<branch>/<file> (with pre-sign enabled, which is the default)
3. Observe panic instead of a clean error message

Workaround

Use --pre-sign=false:

lakectl fs cat --pre-sign=false lakefs://<repo>/<branch>/<file>

[DavidBoublil]

Tracked in treeverse/lakeFS-Enterprise#2293, fixed in treeverse/lakeFS-Enterprise#2292.