aws-sdk-cloudfront 1.154.0 → 1.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 954fa182dffe203eea931bf9910d6648ffb3a539694fc89ae1d09d1440964965
-  data.tar.gz: fef6f98963a4de65fe744d812ac30ed45091d9b41cb1c4abfdb1956b3b03cd78
+  metadata.gz: 545f6bfeb8d3e33647c6d81747ada8268a025e092d3fb5ba3ec2ad7cb7ad4270
+  data.tar.gz: 8a324be000901cd6e71880a49ea30e89c4c4c8431e0ff7578cd28da4e2da4ba4
 SHA512:
-  metadata.gz: 9ea4f808206542ea0c10945ee3fd56205ff1b3333c9265c1096bba34ed9e5b620b5029f73fa2122b8422bf1ffedf849615d3ed1006e3a9e82f72c90907bdd131
-  data.tar.gz: cb37d3b7ce1f67044044a014636e39964562cebef3a2ff33427c7d62a51f41779de15c3123ebc88686a76721d2707566ce7b96bfa3fa81c961e8482ecaf67886
+  metadata.gz: 530f9271542b77f5d66ac0258b940ebfedbc714942286b7721b9cc0cd136f72d6c69ed0245619bdb8d4ca628aeb6d00842175ce083a056daa569c49f5f2107ea
+  data.tar.gz: 05ef8a82a99cd8ec4080fd37a537590be62b2d128f0c939c6c22da513427fb5d0be05e8e3a7325d06e4bbde30a64cf0ca56b8d3a36aa35e1c5fc013424b38565

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.155.0 (2026-09-23)
+------------------
+
+* Feature - CloudFront signers now support SHA-256 signatures via the `:hash_algorithm` option (`'SHA1'` or `'SHA256'`, defaults to `'SHA1'`). Signers also validate that the private key is RSA or ECDSA (P-256), and custom policies are now minified before signing.
+
 1.154.0 (2026-09-11)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.154.0
+1.155.0

data/lib/aws-sdk-cloudfront/client.rb

@@ -13815,7 +13815,7 @@ module Aws::CloudFront
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudfront'
-      context[:gem_version] = '1.154.0'
+      context[:gem_version] = '1.155.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudfront/cookie_signer.rb

@@ -12,12 +12,20 @@ module Aws
     #
     #     signer = Aws::CloudFront::CookieSigner.new(
     #       key_pair_id: "cf-keypair-id",
-    #       private_key_path: "./unit_test_dummy_key"
+    #       private_key_path: "./private_key.pem"
     #     )
     #     cookies = signer.signed_cookie(url,
     #       policy: policy.to_json
     #     )
     #
+    # Pass `hash_algorithm: 'SHA256'` to sign with SHA-256 instead of SHA-1:
+    #
+    #     signer = Aws::CloudFront::CookieSigner.new(
+    #       key_pair_id: "cf-keypair-id",
+    #       private_key_path: "./private_key.pem",
+    #       hash_algorithm: "SHA256"
+    #     )
+    #
     class CookieSigner
       include Signer
 

data/lib/aws-sdk-cloudfront/signer.rb

@@ -8,13 +8,18 @@ require 'openssl'
 module Aws
   module CloudFront
     module Signer
+      # @api private
+      SUPPORTED_HASH_ALGORITHMS = %w[SHA1 SHA256].freeze
+
       # @option options [String] :key_pair_id
       # @option options [String] :private_key
       # @option options [String] :private_key_path
+      # @option options [String] :hash_algorithm ('SHA1') 'SHA1' or 'SHA256'
       def initialize(options = {})
         @key_pair_id = key_pair_id(options)
-        @cipher = OpenSSL::Digest.new('SHA1')
-        @private_key = OpenSSL::PKey.read(private_key(options))
+        @hash_algorithm = hash_algorithm(options)
+        @cipher = OpenSSL::Digest.new(@hash_algorithm)
+        @private_key = load_private_key(private_key(options))
       end
 
       private
@@ -78,7 +83,7 @@ module Aws
       def signature(params = {})
         signature_content = {}
         if params[:policy]
-          policy = params[:policy].gsub('/\s/s', '')
+          policy = params[:policy].gsub(/\s/, '')
           signature_content['Policy'] = encode(policy)
         elsif params[:resource] && params[:expires]
           policy = canned_policy(params[:resource], params[:expires])
@@ -90,12 +95,18 @@ module Aws
 
         signature_content['Signature'] = encode(sign_policy(policy))
         signature_content['Key-Pair-Id'] = @key_pair_id
+        # omitted for SHA1 to keep existing signed URLs and cookies unchanged
+        signature_content['Hash-Algorithm'] = @hash_algorithm if @hash_algorithm == 'SHA256'
         signature_content
       end
 
       # create the signature string with policy signed
       def sign_policy(policy)
         @private_key.sign(@cipher, policy)
+      rescue OpenSSL::PKey::PKeyError => e
+        msg = "failed to sign with #{@hash_algorithm}: #{e.message}"
+        msg += ", consider `hash_algorithm: 'SHA256'`" if @hash_algorithm == 'SHA1'
+        raise ArgumentError, msg
       end
 
       # create canned policy that used for signing
@@ -121,6 +132,16 @@ module Aws
         options[:key_pair_id]
       end
 
+      def hash_algorithm(options)
+        algorithm = (options[:hash_algorithm] || 'SHA1').to_s.upcase
+        unless SUPPORTED_HASH_ALGORITHMS.include?(algorithm)
+          msg = ":hash_algorithm must be one of #{SUPPORTED_HASH_ALGORITHMS.join(', ')}"
+          raise ArgumentError, msg
+        end
+
+        algorithm
+      end
+
       def private_key(options)
         if options[:private_key]
           options[:private_key]
@@ -131,6 +152,23 @@ module Aws
           raise ArgumentError, msg
         end
       end
+
+      def load_private_key(pem)
+        key = OpenSSL::PKey.read(pem)
+        case key
+        when OpenSSL::PKey::RSA
+          key
+        when OpenSSL::PKey::EC
+          curve = key.group.curve_name
+          raise ArgumentError, "unsupported ECDSA curve `#{curve}', must be prime256v1" unless curve == 'prime256v1'
+
+          key
+        else
+          raise ArgumentError, "unsupported private key type #{key.class}, must be RSA or ECDSA"
+        end
+      rescue OpenSSL::PKey::PKeyError
+        raise ArgumentError, 'invalid private key, must be a PEM-encoded RSA or ECDSA private key'
+      end
     end
   end
 end

data/lib/aws-sdk-cloudfront/url_signer.rb

@@ -12,12 +12,20 @@ module Aws
     #
     #     signer = Aws::CloudFront::UrlSigner.new(
     #       key_pair_id: "cf-keypair-id",
-    #       private_key_path: "./unit_test_dummy_key"
+    #       private_key_path: "./private_key.pem"
     #     )
     #     url = signer.signed_url(url,
     #       policy: policy.to_json
     #     )
     #
+    # Pass `hash_algorithm: 'SHA256'` to sign with SHA-256 instead of SHA-1:
+    #
+    #     signer = Aws::CloudFront::UrlSigner.new(
+    #       key_pair_id: "cf-keypair-id",
+    #       private_key_path: "./private_key.pem",
+    #       hash_algorithm: "SHA256"
+    #     )
+    #
     class UrlSigner
       include Signer
 

data/lib/aws-sdk-cloudfront.rb

@@ -55,7 +55,7 @@ module Aws::CloudFront
   autoload :EndpointProvider, 'aws-sdk-cloudfront/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-cloudfront/endpoints'
 
-  GEM_VERSION = '1.154.0'
+  GEM_VERSION = '1.155.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudfront
 version: !ruby/object:Gem::Version
-  version: 1.154.0
+  version: 1.155.0
 platform: ruby
 authors:
 - Amazon Web Services