fog-aws 3.33.2 → 3.33.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef6d261effc88541b56e982050d0003a3ed126e5380a3928f3a622eea66633b9
-  data.tar.gz: 0ba63812241e5c5694e62271c22bf9e654db0ae96f8b481ddd18c3d6731aa295
+  metadata.gz: 342e946932ceb6c12ce470df9e37ffa2f55b9d6a024093b713e6f45feae9f6e0
+  data.tar.gz: ff426f59d76f172e598dbea47141718ad28c593bc8ab369b7ff49aba59439163
 SHA512:
-  metadata.gz: 0dab6002b97b2a17003ea277b62572ea04583f8dd109c77ef4dc8db17cec0d5b97e69fe475bba60791f08ee4ffb0bd14283880d3989f3a70bde4f6b5581ff52b
-  data.tar.gz: cc0419e84ba54e19b5e4909f94e2133816e40ffd3fac80ec96257c1046071a331b777e11a184d5a88abe84dc1a348f3f9aecc9527f90b047d346e3e631a072be
+  metadata.gz: 3d388030bcc2d14866b610127a8d82b37803d10d98be2156abccd1a49ab983de1b03a54fcd55731808a2f25506b02aed6bb1d0ca327ef9be9763945e0cec8bd5
+  data.tar.gz: e26cffa774d294514ef9d89eef55f86dd933d0d4e6afd5858d42b19fa798febb44b030bc209fab4840e03291e9727911961a80db0f6dcedbdfbd7946f287d80f

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [v3.33.3](https://github.com/fog/fog-aws/tree/v3.33.3) (2026-08-28)
+
+[Full Changelog](https://github.com/fog/fog-aws/compare/v3.33.0...v3.33.1)
+
+**Merged pull requests:**
+
+- fix thread safety of shared Fog::Storage connections [\#759](https://github.com/fog/fog-aws/pull/759) ([stanhu](https://github.com/stanhu))
+
+- fix flaky describe_spot_price_history [\#760](https://github.com/fog/fog-aws/pull/760) ([stanhu](https://github.com/stanhu))
+
+- Bump actions/checkout from 6 to 7 [\#758](https://github.com/fog/fog-aws/pull/758) ([dependabot](https://github.com/apps/dependabot))
+
+- Bump actions/dependency-review-action from 4 to 5 [\#757](https://github.com/fog/fog-aws/pull/757) ([dependabot](https://github.com/apps/dependabot))
+
+- Bump fog/.github/.github/workflows/ci.yml from 1.5.0 to 1.6.0 [\#756](https://github.com/fog/fog-aws/pull/756) ([dependabot](https://github.com/apps/dependabot))
+
 ## [v3.33.2](https://github.com/fog/fog-aws/tree/v3.33.2) (2026-04-20)
 
 [Full Changelog](https://github.com/fog/fog-aws/compare/v3.33.0...v3.33.1)

data/lib/fog/aws/requests/compute/describe_spot_price_history.rb

@@ -86,7 +86,9 @@ module Fog
           end
           zones = all_zones if zones.nil?
 
-          max_results = params['MaxResults'] || Fog::Mock.random_numbers(3).to_i
+          # Fog::Mock.random_numbers(3) can return "000", which .to_i turns
+          # into 0 and then trips the validation below, so guarantee at least 1.
+          max_results = params['MaxResults'] || [Fog::Mock.random_numbers(3).to_i, 1].max
           if !(max_results.is_a?(Integer) && max_results > 0)
             max_results_error = "InvalidParameterValue => Invalid value '#{max_results}' for maxResults"
             raise Fog::AWS::Compute::Error, max_results_error

data/lib/fog/aws/requests/storage/post_object_hidden_fields.rb

@@ -25,15 +25,18 @@ module Fog
         def post_object_hidden_fields(options = {})
           options = options.dup
           if policy = options['policy']
+            # Grab the correlated credential state once so the credential,
+            # security token, and signature all come from the same snapshot.
+            credentials = @credentials
             date = Fog::Time.now
-            credential = "#{@aws_access_key_id}/#{@signer.credential_scope(date)}"
+            credential = "#{credentials.aws_access_key_id}/#{credentials.signer.credential_scope(date)}"
             extra_conditions = [
               {'x-amz-date' => date.to_iso8601_basic},
               {'x-amz-credential' => credential},
               {'x-amz-algorithm' => Fog::AWS::SignatureV4::ALGORITHM}
             ]
 
-            extra_conditions << {'x-amz-security-token' => @aws_session_token } if @aws_session_token
+            extra_conditions << {'x-amz-security-token' => credentials.aws_session_token } if credentials.aws_session_token
 
             policy_with_auth_fields = policy.merge('conditions' => policy['conditions'] + extra_conditions)
 
@@ -41,10 +44,10 @@ module Fog
             options['X-Amz-Credential'] = credential
             options['X-Amz-Date'] = date.to_iso8601_basic
             options['X-Amz-Algorithm'] = Fog::AWS::SignatureV4::ALGORITHM
-            if @aws_session_token
-              options['X-Amz-Security-Token'] = @aws_session_token
+            if credentials.aws_session_token
+              options['X-Amz-Security-Token'] = credentials.aws_session_token
             end
-            options['X-Amz-Signature'] = @signer.derived_hmac(date).sign(options['policy']).unpack('H*').first
+            options['X-Amz-Signature'] = credentials.signer.derived_hmac(date).sign(options['policy']).unpack('H*').first
           end
           options
         end

data/lib/fog/aws/storage.rb

@@ -129,6 +129,32 @@ module Fog
       request :upload_part
       request :upload_part_copy
 
+      # Immutable snapshot of the credential-derived state needed to sign a
+      # request: the access key id, secret, session token, and the matching
+      # signer (v4) or HMAC (v2). These values are correlated. Under
+      # +use_iam_profile+ they are all replaced together whenever credentials
+      # are refreshed.
+      #
+      # Bundling them into one frozen object stored in a single instance
+      # variable lets a caller read a consistent set with one atomic
+      # reference read (see Real#request). Reading the fields as separate
+      # instance variables lets a refresh land between two reads and pair, for
+      # example, an old session token with a new signer, which S3 rejects with
+      # a 403. Keeping this connection safe to share across threads depends on
+      # never mutating an instance; build a new one and swap the reference.
+      class Credentials
+        attr_reader :aws_access_key_id, :aws_secret_access_key, :aws_session_token, :signer, :hmac
+
+        def initialize(aws_access_key_id: nil, aws_secret_access_key: nil, aws_session_token: nil, signer: nil, hmac: nil)
+          @aws_access_key_id     = aws_access_key_id
+          @aws_secret_access_key = aws_secret_access_key
+          @aws_session_token     = aws_session_token
+          @signer                = signer
+          @hmac                  = hmac
+          freeze
+        end
+      end
+
       module Utils
         attr_accessor :region
         attr_accessor :disable_content_md5_validation
@@ -145,9 +171,10 @@ module Fog
         attr_reader :max_copy_chunk_size
 
         def cdn
+          credentials = @credentials
           @cdn ||= Fog::AWS::CDN.new(
-            :aws_access_key_id => @aws_access_key_id,
-            :aws_secret_access_key => @aws_secret_access_key,
+            :aws_access_key_id => credentials.aws_access_key_id,
+            :aws_secret_access_key => credentials.aws_secret_access_key,
             :use_iam_profile => @use_iam_profile
           )
         end
@@ -223,6 +250,10 @@ module Fog
         end
 
         def v4_signed_params_for_url(params, expires)
+          # Read the correlated credential state once, as a single reference,
+          # so a concurrent refresh cannot pair a stale session token with a
+          # freshly rebuilt signer.
+          credentials = @credentials
           now = Fog::Time.now
 
           expires = expires - now.to_i
@@ -232,35 +263,36 @@ module Fog
           params[:query]['X-Amz-Expires'] = expires
           params[:query]['X-Amz-Date'] = now.to_iso8601_basic
 
-          if @aws_session_token
-            params[:query]['X-Amz-Security-Token'] = @aws_session_token
+          if credentials.aws_session_token
+            params[:query]['X-Amz-Security-Token'] = credentials.aws_session_token
           end
 
           params = request_params(params)
           params[:headers][:host] = params[:host]
           params[:headers][:host] += ":#{params[:port]}" if params.fetch(:port, nil)
 
-          signature_query_params = @signer.signature_parameters(params, now, "UNSIGNED-PAYLOAD")
+          signature_query_params = credentials.signer.signature_parameters(params, now, "UNSIGNED-PAYLOAD")
           params[:query] = (params[:query] || {}).merge(signature_query_params)
           params
         end
 
         def v2_signed_params_for_url(params, expires)
-          if @aws_session_token
+          credentials = @credentials
+          if credentials.aws_session_token
             params[:headers]||= {}
-            params[:headers]['x-amz-security-token'] = @aws_session_token
+            params[:headers]['x-amz-security-token'] = credentials.aws_session_token
           end
-          signature = signature_v2(params, expires)
+          signature = signature_v2(params, expires, credentials.hmac)
 
           params = request_params(params)
 
           signature_query_params = {
-            'AWSAccessKeyId' => @aws_access_key_id,
+            'AWSAccessKeyId' => credentials.aws_access_key_id,
             'Signature' => signature,
             'Expires' => expires,
           }
           params[:query] = (params[:query] || {}).merge(signature_query_params)
-          params[:query]['x-amz-security-token'] = @aws_session_token if @aws_session_token
+          params[:query]['x-amz-security-token'] = credentials.aws_session_token if credentials.aws_session_token
           params
         end
 
@@ -511,25 +543,32 @@ module Fog
         end
 
         def data
-          self.class.data[@region][@aws_access_key_id]
+          self.class.data[@region][@credentials.aws_access_key_id]
         end
 
         def reset_data
-          self.class.data[@region].delete(@aws_access_key_id)
+          self.class.data[@region].delete(@credentials.aws_access_key_id)
         end
 
         def setup_credentials(options)
           @aws_credentials_refresh_threshold_seconds = options[:aws_credentials_refresh_threshold_seconds]
-
-          @aws_access_key_id = options[:aws_access_key_id]
-          @aws_secret_access_key = options[:aws_secret_access_key]
-          @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
-          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 's3')
+          aws_access_key_id     = options[:aws_access_key_id]
+          aws_secret_access_key = options[:aws_secret_access_key]
+          signer = Fog::AWS::SignatureV4.new(aws_access_key_id, aws_secret_access_key, @region, 's3')
+
+          # Swap the whole credential set as one reference so concurrent
+          # readers always observe a complete, self-consistent snapshot.
+          @credentials = Credentials.new(
+            :aws_access_key_id     => aws_access_key_id,
+            :aws_secret_access_key => aws_secret_access_key,
+            :aws_session_token     => options[:aws_session_token],
+            :signer                => signer
+          )
         end
 
-        def signature_v2(params, expires)
+        def signature_v2(params, expires, hmac = nil)
           'foo'
         end
 
@@ -612,16 +651,30 @@ module Fog
             @aws_credentials_refresh_threshold_seconds = options[:aws_credentials_refresh_threshold_seconds]
           end
 
-          @aws_access_key_id     = options[:aws_access_key_id]
-          @aws_secret_access_key = options[:aws_secret_access_key]
-          @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
+          aws_access_key_id     = options[:aws_access_key_id]
+          aws_secret_access_key = options[:aws_secret_access_key]
+
+          signer = hmac = nil
           if @signature_version == 4
-            @signer = Fog::AWS::SignatureV4.new(@aws_access_key_id, @aws_secret_access_key, @region, 's3')
+            signer = Fog::AWS::SignatureV4.new(aws_access_key_id, aws_secret_access_key, @region, 's3')
           elsif @signature_version == 2
-            @hmac = Fog::HMAC.new('sha1', @aws_secret_access_key)
-          end
+            hmac = Fog::HMAC.new('sha1', aws_secret_access_key)
+          end
+
+          # Publish the new credentials as a single frozen reference. This is
+          # the only write to the correlated credential state, so a reader
+          # that grabs @credentials once (see #request) can never observe a
+          # torn mix of old and new values, even while a refresh is running
+          # on another thread.
+          @credentials = Credentials.new(
+            :aws_access_key_id     => aws_access_key_id,
+            :aws_secret_access_key => aws_secret_access_key,
+            :aws_session_token     => options[:aws_session_token],
+            :signer                => signer,
+            :hmac                  => hmac
+          )
         end
 
         def connection(scheme, host, port)
@@ -641,18 +694,33 @@ module Fog
         def request(params, &block)
           refresh_credentials_if_expired
 
+          # Read the correlated credential state exactly once, into a local, so
+          # a concurrent refresh cannot swap the signer out from under the
+          # session token partway through this request. See the Credentials
+          # class for the full rationale.
+          perform_request(params, @credentials, &block)
+        end
+
+        # Signs and dispatches a single request using the given credential
+        # snapshot. Splitting this out of #request lets the redirect retry in
+        # #_request reuse one consistent snapshot (with a signer rebuilt for
+        # the new region) instead of re-reading, and keeps #request's public
+        # signature unchanged.
+        def perform_request(params, credentials, &block)
+          signer = credentials.signer
+
           date = Fog::Time.now
 
           params = params.dup
           stringify_query_keys(params)
           params[:headers] = (params[:headers] || {}).dup
 
-          params[:headers]['x-amz-security-token'] = @aws_session_token if @aws_session_token
+          params[:headers]['x-amz-security-token'] = credentials.aws_session_token if credentials.aws_session_token
 
           if @signature_version == 2
             expires = date.to_date_header
             params[:headers]['Date'] = expires
-            params[:headers]['Authorization'] = "AWS #{@aws_access_key_id}:#{signature_v2(params, expires)}"
+            params[:headers]['Authorization'] = "AWS #{credentials.aws_access_key_id}:#{signature_v2(params, expires, credentials.hmac)}"
           end
 
           params = request_params(params)
@@ -680,12 +748,12 @@ module Fog
             else
               params[:headers]['x-amz-content-sha256'] ||= OpenSSL::Digest::SHA256.hexdigest(params[:body] || '')
             end
-            signature_components = @signer.signature_components(params, date, params[:headers]['x-amz-content-sha256'])
-            params[:headers]['Authorization'] = @signer.components_to_header(signature_components)
+            signature_components = signer.signature_components(params, date, params[:headers]['x-amz-content-sha256'])
+            params[:headers]['Authorization'] = signer.components_to_header(signature_components)
 
             if params[:body].respond_to?(:read) && @enable_signature_v4_streaming
               body = params.delete :body
-              params[:request_block] = S3Streamer.new(body, signature_components['X-Amz-Signature'], @signer, date)
+              params[:request_block] = S3Streamer.new(body, signature_components['X-Amz-Signature'], signer, date)
             end
           end
           # FIXME: ToHashParser should make this not needed
@@ -713,23 +781,32 @@ module Fog
             new_params[:bucket_name] =  %r{<Bucket>([^<]*)</Bucket>}.match(body).captures.first
             new_params[:host] = %r{<Endpoint>([^<]*)</Endpoint>}.match(body).captures.first
             # some errors provide it directly
-            @new_region = %r{<Region>([^<]*)</Region>}.match(body) ? Regexp.last_match.captures.first : nil
+            new_region = %r{<Region>([^<]*)</Region>}.match(body) ? Regexp.last_match.captures.first : nil
           end
           Fog::Logger.warning("fog: followed redirect to #{host}, connecting to the matching region will be more performant")
-          original_region, original_signer = @region, @signer
-          @region = @new_region || case new_params[:host]
+          new_region ||= case new_params[:host]
           when /s3.amazonaws.com/, /s3-external-1.amazonaws.com/
             DEFAULT_REGION
           else
             %r{s3[\.\-]([^\.]*).amazonaws.com}.match(new_params[:host]).captures.first
           end
+          # Take a fresh, self-consistent snapshot and build a signer for the
+          # redirect region locally, then re-dispatch with it. We deliberately
+          # do not mutate @region/@signer: doing so would corrupt any
+          # concurrent request sharing this connection.
+          credentials = @credentials
           if @signature_version == 4
-            @signer = Fog::AWS::SignatureV4.new(@aws_access_key_id, @aws_secret_access_key, @region, 's3')
+            redirect_signer = Fog::AWS::SignatureV4.new(credentials.aws_access_key_id, credentials.aws_secret_access_key, new_region, 's3')
+            credentials = Credentials.new(
+              :aws_access_key_id     => credentials.aws_access_key_id,
+              :aws_secret_access_key => credentials.aws_secret_access_key,
+              :aws_session_token     => credentials.aws_session_token,
+              :signer                => redirect_signer,
+              :hmac                  => credentials.hmac
+            )
             original_params[:headers].delete('Authorization')
           end
-          response = request(original_params.merge(new_params), &block)
-          @region, @signer = original_region, original_signer
-          response
+          perform_request(original_params.merge(new_params), credentials, &block)
         end
 
         # See http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html
@@ -793,7 +870,7 @@ DATA
           end
         end
 
-        def signature_v2(params, expires)
+        def signature_v2(params, expires, hmac = @credentials.hmac)
           headers = params[:headers] || {}
 
           string_to_sign =
@@ -844,7 +921,7 @@ DATA
           end
           canonical_resource << query_string
           string_to_sign << canonical_resource
-          signed_string = @hmac.sign(string_to_sign)
+          signed_string = hmac.sign(string_to_sign)
           Base64.encode64(signed_string).chomp!
         end
 

data/lib/fog/aws/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AWS
-    VERSION = '3.33.2'.freeze
+    VERSION = '3.33.3'.freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fog-aws
 version: !ruby/object:Gem::Version
-  version: 3.33.2
+  version: 3.33.3
 platform: ruby
 authors:
 - Josh Lane