Documentation
¶
Overview ¶
Package s3sig implements the subset of AWS Signature Version 4 needed to authenticate S3-style requests against xolu's S3 gateway. It provides both Sign (used by tests and tooling) and Verify (used by the server), built on a single shared canonical-request derivation so the two cannot drift.
Scope: this covers header-based SigV4 (Authorization header), the form real S3 clients (aws-cli, boto3, minio-go) produce. It does not implement presigned-URL (query-parameter) signing or chunked/streaming signed payloads. The payload hash is taken from the x-amz-content-sha256 header as the client provides it (including the literal "UNSIGNED-PAYLOAD"), matching standard S3 client behaviour.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrMalformed indicates the Authorization header could not be parsed. ErrMalformed = errors.New("s3sig: malformed Authorization header") // ErrMismatch indicates the recomputed signature did not match. ErrMismatch = errors.New("s3sig: signature mismatch") )
Functions ¶
func Sign ¶
func Sign(secret string, c Components, signedHeaders []string) string
Sign builds a complete SigV4 Authorization header value for the given request facts and secret. It is the inverse of Verify and shares the same canonical derivation, so a header produced by Sign always verifies with the same secret. Intended for tests and tooling (the server only verifies).
signedHeaders must name the headers present in the headers map that should be signed; they are lower-cased and sorted internally.
func SortedSignedHeaders ¶
SortedSignedHeaders returns the signed header names sorted, as SigV4 requires.
Types ¶
type Components ¶
type Components struct {
AccessKey string // from Credential
Date string // yyyymmdd, from Credential scope
Region string // from Credential scope
Service string // from Credential scope (normally "s3")
SignedHeaders []string // lower-case header names, in signed order
Signature string // hex signature presented by the client
Method string // HTTP method
CanonURI string // canonical (path) URI
CanonQuery string // canonical query string
Headers map[string]string // request headers (canonical-cased keys ok; looked up case-insensitively)
PayloadHash string // value of x-amz-content-sha256
AmzDate string // value of x-amz-date (full timestamp)
}
Components is the parsed content of a SigV4 Authorization header plus the request facts needed to recompute the signature.
func ParseAuthorization ¶
func ParseAuthorization(auth string) (Components, error)
ParseAuthorization parses a SigV4 "Authorization" header value into its Credential / SignedHeaders / Signature parts. Request facts (method, URI, etc.) must be filled in by the caller before Verify.
func (Components) Compute ¶
func (c Components) Compute(secret string) string
Compute returns the hex signature for the components using the given secret.
func (Components) Verify ¶
func (c Components) Verify(secret string) error
Verify recomputes the signature with the secret and constant-time compares it to the presented one.
Source Files