1 files changed, 10 insertions, 4 deletions
diff --git a/src/libstore/http-binary-cache-store.cc b/src/libstore/http-binary-cache-store.cc
index 9614d0b4cf35..8a719db150aa 100644
--- a/src/libstore/http-binary-cache-store.cc
+++ b/src/libstore/http-binary-cache-store.cc
@@ -10,7 +10,7 @@ private:
 
     Path cacheUri;
 
-    ref<Downloader> downloader;
+    Pool<Downloader> downloaders;
 
 public:
 
@@ -18,7 +18,9 @@ public:
         const Path & secretKeyFile, const Path & _cacheUri)
         : BinaryCacheStore(localStore, secretKeyFile)
         , cacheUri(_cacheUri)
-        , downloader(makeDownloader())
+        , downloaders(
+            std::numeric_limits<size_t>::max(),
+            []() { return makeDownloader(); })
     {
         if (cacheUri.back() == '/')
             cacheUri.pop_back();
@@ -36,25 +38,29 @@ protected:
     bool fileExists(const std::string & path) override
     {
         try {
+            auto downloader(downloaders.get());
             DownloadOptions options;
             options.showProgress = DownloadOptions::no;
             options.head = true;
             downloader->download(cacheUri + "/" + path, options);
             return true;
         } catch (DownloadError & e) {
-            if (e.error == Downloader::NotFound)
+            /* S3 buckets return 403 if a file doesn't exist and the
+               bucket is unlistable, so treat 403 as 404. */
+            if (e.error == Downloader::NotFound || e.error == Downloader::Forbidden)
                 return false;
             throw;
         }
     }
 
-    void upsertFile(const std::string & path, const std::string & data)
+    void upsertFile(const std::string & path, const std::string & data) override
     {
         throw Error("uploading to an HTTP binary cache is not supported");
     }
 
     std::string getFile(const std::string & path) override
     {
+        auto downloader(downloaders.get());
         DownloadOptions options;
         options.showProgress = DownloadOptions::no;
         return downloader->download(cacheUri + "/" + path, options).data;