aws-sigv4 1.9.1 → 1.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6c968ea3d1cff2c3e6ff056a38658ce9af6f2f9b3d5fce948003a063c1f785e
-  data.tar.gz: '008ac56a37950824779768b8e3e942a711a0cae225231e9f9897e0426a18d121'
+  metadata.gz: 58318b8045877e5842f7c0793c856e30b6bba8425988a4929bca3aaaf64fcc06
+  data.tar.gz: c9de352d0dee1c35637e86d1d4a3a8817d3ee6a4c3595f8e86436cf216d0a35d
 SHA512:
-  metadata.gz: 49dfbb860585de3ca7f1f84e3ff2fa059025098fe3a0baf4ab4c4fd1ff6bdb4dab85b17b040ebc7fa5db743d1f5da9a4b0975187d2bf60aabfc29e9674b22ee3
-  data.tar.gz: 315d89e1c67bfc3938f267dcf50e47842f7cac514b07df07cc642be2bc99fbc55dd7256f564868c6f3e61ee125aa71d26a98af01c734a924aaa0ae5ac8e084e4
+  metadata.gz: b22918d3e6a784f4198b9b3583b6ce34e492819ec401862333d29f7c456402fe10718f7e9f30479d5097b89b19d8030400647572ee7204b8729093b16290f3f2
+  data.tar.gz: c15f22f66888fa2bbe1822bd833c2bc87c216b3c082ba1961682e0dcd2f5c0f427c2126ffb04354a3ba2b47c5a3fb375ad2381be543021b089687f589a4565fd

data/CHANGELOG.md

@@ -1,6 +1,31 @@
 Unreleased Changes
 ------------------
 
+1.12.1 (2025-06-10)
+------------------
+
+* Issue - Only load required `cgi` modules for Ruby 3.5.
+
+1.12.0 (2025-06-02)
+------------------
+
+* Feature - AWS SDK for Ruby no longer supports Ruby runtime versions 2.5 and 2.6.
+
+1.11.0 (2025-01-10)
+------------------
+
+* Feature - Add RBS signature files to support static type checking
+
+1.10.1 (2024-10-21)
+------------------
+
+* Issue - Fix sigv4a signing issue with derive_asymmetric_key for certain credentials.
+
+1.10.0 (2024-09-17)
+------------------
+
+* Feature - Remove CRT `sigv4a` signing capability.
+
 1.9.1 (2024-07-29)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.9.1
+1.12.1

data/lib/aws-sigv4/asymmetric_credentials.rb

@@ -11,8 +11,6 @@ module Aws
 
       N_MINUS_2 = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551 - 2
 
-      # @param [String] :access_key_id
-      # @param [String] :secret_access_key
       # @return [OpenSSL::PKey::EC, Hash]
       def self.derive_asymmetric_key(access_key_id, secret_access_key)
         check_openssl_support!
@@ -60,6 +58,16 @@ module Aws
         x
       end
 
+      # @return [Array] value of the BigNumber as a big-endian unsigned byte array.
+      def self.bn_to_be_bytes(bn)
+        bytes = []
+        while bn > 0
+          bytes << (bn & 0xff)
+          bn = bn >> 8
+        end
+        bytes.reverse
+      end
+
       # Prior to openssl3 we could directly set public and private key on EC
       # However, openssl3 deprecated those methods and we must now construct
       # a der with the keys and load the EC from it.
@@ -67,7 +75,7 @@ module Aws
         # format reversed from: OpenSSL::ASN1.decode_all(OpenSSL::PKey::EC.new.to_der)
         asn1 = OpenSSL::ASN1::Sequence([
           OpenSSL::ASN1::Integer(OpenSSL::BN.new(1)),
-          OpenSSL::ASN1::OctetString([d.to_s(16)].pack('H*')),
+          OpenSSL::ASN1::OctetString(bn_to_be_bytes(d).pack('C*')),
           OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::ObjectId("prime256v1")], 0, :CONTEXT_SPECIFIC),
           OpenSSL::ASN1::ASN1Data.new(
             [OpenSSL::ASN1::BitString(public_key.to_octet_string(:uncompressed))],

data/lib/aws-sigv4/request.rb

@@ -7,7 +7,7 @@ module Aws
     class Request
 
       # @option options [required, String] :http_method
-      # @option options [required, HTTP::URI, HTTPS::URI, String] :endpoint
+      # @option options [required, String, URI::HTTP, URI::HTTPS] :endpoint
       # @option options [Hash<String,String>] :headers ({})
       # @option options [String, IO] :body ('')
       def initialize(options = {})
@@ -30,12 +30,12 @@ module Aws
         @http_method
       end
 
-      # @param [String, HTTP::URI, HTTPS::URI] endpoint
+      # @param [String, URI::HTTP, URI::HTTPS] endpoint
       def endpoint=(endpoint)
         @endpoint = URI.parse(endpoint.to_s)
       end
 
-      # @return [HTTP::URI, HTTPS::URI]
+      # @return [URI::HTTP, URI::HTTPS]
       def endpoint
         @endpoint
       end

data/lib/aws-sigv4/signer.rb

@@ -5,7 +5,8 @@ require 'tempfile'
 require 'time'
 require 'uri'
 require 'set'
-require 'cgi'
+require "cgi/escape"
+require "cgi/util" if RUBY_VERSION < "3.5"
 require 'pathname'
 require 'aws-eventstream'
 
@@ -74,15 +75,6 @@ module Aws
     # and `#session_token`.
     #
     class Signer
-
-      @@use_crt =
-        begin
-          require 'aws-crt'
-          true
-        rescue LoadError
-          false
-        end
-
       # @overload initialize(service:, region:, access_key_id:, secret_access_key:, session_token:nil, **options)
       #   @param [String] :service The service signing name, e.g. 's3'.
       #   @param [String] :region The region name, e.g. 'us-east-1'. When signing
@@ -154,13 +146,6 @@ module Aws
         @signing_algorithm = options.fetch(:signing_algorithm, :sigv4)
         @normalize_path = options.fetch(:normalize_path, true)
         @omit_session_token = options.fetch(:omit_session_token, false)
-
-        if @signing_algorithm == 'sigv4-s3express'.to_sym &&
-           Signer.use_crt? && Aws::Crt::GEM_VERSION <= '0.1.9'
-          raise ArgumentError,
-                'This version of aws-crt does not support S3 Express. Please
-                 update this gem to at least version 0.2.0.'
-        end
       end
 
       # @return [String]
@@ -221,7 +206,7 @@ module Aws
       # @option request [required, String] :http_method One of
       #   'GET', 'HEAD', 'PUT', 'POST', 'PATCH', or 'DELETE'
       #
-      # @option request [required, String, URI::HTTPS, URI::HTTP] :url
+      # @option request [required, String, URI::HTTP, URI::HTTPS] :url
       #   The request URI. Must be a valid HTTP or HTTPS URI.
       #
       # @option request [optional, Hash] :headers ({}) A hash of headers
@@ -236,9 +221,6 @@ module Aws
       #   a `#headers` method. The headers must be applied to your request.
       #
       def sign_request(request)
-
-        return crt_sign_request(request) if Signer.use_crt?
-
         creds, _ = fetch_credentials
 
         http_method = extract_http_method(request)
@@ -344,7 +326,6 @@ module Aws
       #   signature value (a binary string) used at ':chunk-signature' needs to converted to
       #   hex-encoded string using #unpack
       def sign_event(prior_signature, payload, encoder)
-        # Note: CRT does not currently provide event stream signing, so we always use the ruby implementation.
         creds, _ = fetch_credentials
         time = Time.now
         headers = {}
@@ -403,7 +384,7 @@ module Aws
       # @option options [required, String] :http_method The HTTP request method,
       #   e.g. 'GET', 'HEAD', 'PUT', 'POST', 'PATCH', or 'DELETE'.
       #
-      # @option options [required, String, HTTPS::URI, HTTP::URI] :url
+      # @option options [required, String, URI::HTTP, URI::HTTPS] :url
       #   The URI to sign.
       #
       # @option options [Hash] :headers ({}) Headers that should
@@ -431,9 +412,6 @@ module Aws
       # @return [HTTPS::URI, HTTP::URI]
       #
       def presign_url(options)
-
-        return crt_presign_url(options) if Signer.use_crt?
-
         creds, expiration = fetch_credentials
 
         http_method = extract_http_method(options)
@@ -801,129 +779,12 @@ module Aws
         end
       end
 
-      ### CRT Code
-
-      # the credentials used by CRT must be a
-      # CRT StaticCredentialsProvider object
-      def crt_fetch_credentials
-        creds, expiration = fetch_credentials
-        crt_creds = Aws::Crt::Auth::StaticCredentialsProvider.new(
-          creds.access_key_id,
-          creds.secret_access_key,
-          creds.session_token
-        )
-        [crt_creds, expiration]
-      end
-
-      def crt_sign_request(request)
-        creds, _ = crt_fetch_credentials
-        http_method = extract_http_method(request)
-        url = extract_url(request)
-        headers = downcase_headers(request[:headers])
-
-        datetime =
-          if headers.include? 'x-amz-date'
-            Time.parse(headers.delete('x-amz-date'))
-          end
-
-        content_sha256 = headers.delete('x-amz-content-sha256')
-        content_sha256 ||= sha256_hexdigest(request[:body] || '')
-
-        sigv4_headers = {}
-        sigv4_headers['host'] = headers['host'] || host(url)
-
-        # Modify the user-agent to add usage of crt-signer
-        # This should be temporary during developer preview only
-        if headers.include? 'user-agent'
-          headers['user-agent'] = "#{headers['user-agent']} crt-signer/#{@signing_algorithm}/#{Aws::Sigv4::VERSION}"
-          sigv4_headers['user-agent'] = headers['user-agent']
-        end
-
-        headers = headers.merge(sigv4_headers) # merge so we do not modify given headers hash
-
-        config = Aws::Crt::Auth::SigningConfig.new(
-          algorithm: @signing_algorithm,
-          signature_type: :http_request_headers,
-          region: @region,
-          service: @service,
-          date: datetime,
-          signed_body_value: content_sha256,
-          signed_body_header_type: @apply_checksum_header ?
-                                     :sbht_content_sha256 : :sbht_none,
-          credentials: creds,
-          unsigned_headers: @unsigned_headers,
-          use_double_uri_encode: @uri_escape_path,
-          should_normalize_uri_path: @normalize_path,
-          omit_session_token: @omit_session_token
-        )
-        http_request = Aws::Crt::Http::Message.new(
-          http_method, url.to_s, headers
-        )
-        signable = Aws::Crt::Auth::Signable.new(http_request)
-
-        signing_result = Aws::Crt::Auth::Signer.sign_request(config, signable)
-
-        Signature.new(
-          headers: sigv4_headers.merge(
-            downcase_headers(signing_result[:headers])
-          ),
-          string_to_sign: 'CRT_INTERNAL',
-          canonical_request: 'CRT_INTERNAL',
-          content_sha256: content_sha256,
-          extra: {config: config, signable: signable}
-        )
-      end
-
-      def crt_presign_url(options)
-        creds, expiration = crt_fetch_credentials
-
-        http_method = extract_http_method(options)
-        url = extract_url(options)
-        headers = downcase_headers(options[:headers])
-        headers['host'] ||= host(url)
-
-        datetime = Time.strptime(headers.delete('x-amz-date'), "%Y%m%dT%H%M%S%Z") if headers['x-amz-date']
-        datetime ||= (options[:time] || Time.now)
-
-        content_sha256 = headers.delete('x-amz-content-sha256')
-        content_sha256 ||= options[:body_digest]
-        content_sha256 ||= sha256_hexdigest(options[:body] || '')
-
-        config = Aws::Crt::Auth::SigningConfig.new(
-          algorithm: @signing_algorithm,
-          signature_type: :http_request_query_params,
-          region: @region,
-          service: @service,
-          date: datetime,
-          signed_body_value: content_sha256,
-          signed_body_header_type: @apply_checksum_header ?
-                                     :sbht_content_sha256 : :sbht_none,
-          credentials: creds,
-          unsigned_headers: @unsigned_headers,
-          use_double_uri_encode: @uri_escape_path,
-          should_normalize_uri_path: @normalize_path,
-          omit_session_token: @omit_session_token,
-          expiration_in_seconds: presigned_url_expiration(options, expiration, datetime)
-        )
-        http_request = Aws::Crt::Http::Message.new(
-          http_method, url.to_s, headers
-        )
-        signable = Aws::Crt::Auth::Signable.new(http_request)
-
-        signing_result = Aws::Crt::Auth::Signer.sign_request(config, signable, http_method, url.to_s)
-        url = URI.parse(signing_result[:path])
-
-        if options[:extra] && options[:extra].is_a?(Hash)
-          options[:extra][:config] = config
-          options[:extra][:signable] = signable
-        end
-        url
-      end
-
       class << self
 
+        # Kept for backwards compatability
+        # Always return false since we are not using crt signing functionality
         def use_crt?
-          @@use_crt
+          false
         end
 
         # @api private

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: aws-sigv4
 version: !ruby/object:Gem::Version
-  version: 1.9.1
+  version: 1.12.1
 platform: ruby
 authors:
 - Amazon Web Services
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-eventstream
@@ -32,7 +31,6 @@ dependencies:
         version: 1.0.2
 description: Amazon Web Services Signature Version 4 signing library. Generates sigv4
   signature for HTTP requests.
-email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -53,7 +51,6 @@ licenses:
 metadata:
   source_code_uri: https://github.com/aws/aws-sdk-ruby/tree/version-3/gems/aws-sigv4
   changelog_uri: https://github.com/aws/aws-sdk-ruby/tree/version-3/gems/aws-sigv4/CHANGELOG.md
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -61,15 +58,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.5'
+      version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 3.6.7
 specification_version: 4
 summary: AWS Signature Version 4 library.
 test_files: []