Function get_blob 

pub async fn get_blob(
    __arg0: State<AppState>,
    query: Result<Query<GetBlobQuery>, QueryRejection>,
) -> Response

GET /xrpc/com.atproto.sync.getBlob

The bytes as they were uploaded, having first been checked against the name they are filed under. A store that finds the wrong bytes answers BlobCorrupt and serves none of them: the CID is a hash, so a reader has every reason to trust what comes back, and that is exactly why a server that can tell must not serve it.

A store backed by object storage may answer with a redirect instead, and this handler passes one through. See Fetch.

Every answer carries BLOB_CONTENT_SECURITY_POLICY.