From 91867941fa73afea7869b7c71ede82e5ef8927da Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Fri, 31 Oct 2025 20:00:08 +0100 Subject: [PATCH] libstore/s3: sign payloads if the request demands it This fixes problems with S3 implementations that have mandatory payload signing, e.g. Garage v2, AWS S3 itself, etc. The problem manifested itself when the AWS SDK threw some error codes 99 (NETWORK_CONNECTION) with no messages and retried until it finally came to a moment where the state machinery decided to send a `Transfer-Encoding` header in a `Content-Encoding`/`Content-Length`-set request with signed headers (even though payload signing is disabled), causing the server to reject the transfer and crash the copy. I did not debug super far what went wrong in AWS SDK, but I can confirm this change makes transfers possible to finish with Garage v2. Change-Id: Icc9e6a9f2afb0d760cf2d1e27816decd385a1d85 Signed-off-by: Raito Bezarius --- lix/libstore/s3-binary-cache-store.cc | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/lix/libstore/s3-binary-cache-store.cc b/lix/libstore/s3-binary-cache-store.cc index 1e52c08ff..6f3d32dcf 100644 --- a/lix/libstore/s3-binary-cache-store.cc +++ b/lix/libstore/s3-binary-cache-store.cc @@ -134,17 +134,22 @@ S3Helper::S3Helper( const std::string & profile, const std::string & region, const std::string & scheme, - const std::string & endpoint) + const std::string & endpoint +) : config(makeConfig(region, scheme, endpoint)) , client(make_ref( - profile == "" - ? std::dynamic_pointer_cast( - std::make_shared()) - : std::dynamic_pointer_cast( - std::make_shared(profile.c_str())), - *config, - Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never, - endpoint.empty())) + profile == "" ? std::dynamic_pointer_cast( + std::make_shared() + ) + : std::dynamic_pointer_cast( + std::make_shared( + profile.c_str() + ) + ), + *config, + Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::RequestDependent, + endpoint.empty() + )) { }