fog-aws 3.33.2 → 3.33.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef6d261effc88541b56e982050d0003a3ed126e5380a3928f3a622eea66633b9
-  data.tar.gz: 0ba63812241e5c5694e62271c22bf9e654db0ae96f8b481ddd18c3d6731aa295
+  metadata.gz: 5e72621a4d0466e68fac0029075cc8183e520b2ddf4cca61438061640545cbc7
+  data.tar.gz: e74de695ac7fc458f8d0b53862c967b34771b91871e962e607559a774de16fb0
 SHA512:
-  metadata.gz: 0dab6002b97b2a17003ea277b62572ea04583f8dd109c77ef4dc8db17cec0d5b97e69fe475bba60791f08ee4ffb0bd14283880d3989f3a70bde4f6b5581ff52b
-  data.tar.gz: cc0419e84ba54e19b5e4909f94e2133816e40ffd3fac80ec96257c1046071a331b777e11a184d5a88abe84dc1a348f3f9aecc9527f90b047d346e3e631a072be
+  metadata.gz: 15639793281c3325753b5e4bccedf7243228d636150a3449a3dedf09cff79803e3414955715c55b2572e19f628e4e831e85ab0ace7265a1d225bbfb6d5b56148
+  data.tar.gz: 44676104a31d040262c20eb86e9702fb16ed75b9e4f260864c9e3ed284bffe69ed4372b0cc72486bf5df1a54c38cb64468c6060e0839b9f22b8f37f3cfd04efe

data/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [v3.33.4](https://github.com/fog/fog-aws/tree/v3.33.4) (2026-09-28)
+
+[Full Changelog](https://github.com/fog/fog-aws/compare/v3.33.0...v3.33.1)
+
+- drop codeclimate test reporter, which forced ancient simplecov and broke ci (geemus)
+
+**Merged pull requests:**
+
+- let connection set concurrency for multipart copy \#761 (mshibuya)
+
+- bump rubyzip \#762 (dependabot)
+
+
+## [v3.33.3](https://github.com/fog/fog-aws/tree/v3.33.3) (2026-08-28)
+
+[Full Changelog](https://github.com/fog/fog-aws/compare/v3.33.0...v3.33.1)
+
+**Merged pull requests:**
+
+- fix thread safety of shared Fog::Storage connections [\#759](https://github.com/fog/fog-aws/pull/759) ([stanhu](https://github.com/stanhu))
+
+- fix flaky describe_spot_price_history [\#760](https://github.com/fog/fog-aws/pull/760) ([stanhu](https://github.com/stanhu))
+
+- Bump actions/checkout from 6 to 7 [\#758](https://github.com/fog/fog-aws/pull/758) ([dependabot](https://github.com/apps/dependabot))
+
+- Bump actions/dependency-review-action from 4 to 5 [\#757](https://github.com/fog/fog-aws/pull/757) ([dependabot](https://github.com/apps/dependabot))
+
+- Bump fog/.github/.github/workflows/ci.yml from 1.5.0 to 1.6.0 [\#756](https://github.com/fog/fog-aws/pull/756) ([dependabot](https://github.com/apps/dependabot))
+
 ## [v3.33.2](https://github.com/fog/fog-aws/tree/v3.33.2) (2026-04-20)
 
 [Full Changelog](https://github.com/fog/fog-aws/compare/v3.33.0...v3.33.1)

data/fog-aws.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'github_changelog_generator', '~> 1.16'
   spec.add_development_dependency 'rake',    '>= 12.3.3'
-  spec.add_development_dependency 'rubyzip', '~> 3.0.0'
+  spec.add_development_dependency 'rubyzip', '~> 3.6.0'
   spec.add_development_dependency 'shindo',  '~> 0.3'
 
   spec.add_dependency 'base64', '>= 0.2', '< 0.4'

data/lib/fog/aws/models/storage/file.rb

@@ -80,7 +80,7 @@ module Fog
         end
 
         def concurrency
-          @concurrency || 1
+          @concurrency || service.copy_concurrency
         end
 
         def acl

data/lib/fog/aws/requests/compute/describe_spot_price_history.rb

@@ -86,7 +86,9 @@ module Fog
           end
           zones = all_zones if zones.nil?
 
-          max_results = params['MaxResults'] || Fog::Mock.random_numbers(3).to_i
+          # Fog::Mock.random_numbers(3) can return "000", which .to_i turns
+          # into 0 and then trips the validation below, so guarantee at least 1.
+          max_results = params['MaxResults'] || [Fog::Mock.random_numbers(3).to_i, 1].max
           if !(max_results.is_a?(Integer) && max_results > 0)
             max_results_error = "InvalidParameterValue => Invalid value '#{max_results}' for maxResults"
             raise Fog::AWS::Compute::Error, max_results_error

data/lib/fog/aws/requests/storage/post_object_hidden_fields.rb

@@ -25,15 +25,18 @@ module Fog
         def post_object_hidden_fields(options = {})
           options = options.dup
           if policy = options['policy']
+            # Grab the correlated credential state once so the credential,
+            # security token, and signature all come from the same snapshot.
+            credentials = @credentials
             date = Fog::Time.now
-            credential = "#{@aws_access_key_id}/#{@signer.credential_scope(date)}"
+            credential = "#{credentials.aws_access_key_id}/#{credentials.signer.credential_scope(date)}"
             extra_conditions = [
               {'x-amz-date' => date.to_iso8601_basic},
               {'x-amz-credential' => credential},
               {'x-amz-algorithm' => Fog::AWS::SignatureV4::ALGORITHM}
             ]
 
-            extra_conditions << {'x-amz-security-token' => @aws_session_token } if @aws_session_token
+            extra_conditions << {'x-amz-security-token' => credentials.aws_session_token } if credentials.aws_session_token
 
             policy_with_auth_fields = policy.merge('conditions' => policy['conditions'] + extra_conditions)
 
@@ -41,10 +44,10 @@ module Fog
             options['X-Amz-Credential'] = credential
             options['X-Amz-Date'] = date.to_iso8601_basic
             options['X-Amz-Algorithm'] = Fog::AWS::SignatureV4::ALGORITHM
-            if @aws_session_token
-              options['X-Amz-Security-Token'] = @aws_session_token
+            if credentials.aws_session_token
+              options['X-Amz-Security-Token'] = credentials.aws_session_token
             end
-            options['X-Amz-Signature'] = @signer.derived_hmac(date).sign(options['policy']).unpack('H*').first
+            options['X-Amz-Signature'] = credentials.signer.derived_hmac(date).sign(options['policy']).unpack('H*').first
           end
           options
         end

data/lib/fog/aws/storage.rb

@@ -57,7 +57,7 @@ module Fog
       ]
 
       requires :aws_access_key_id, :aws_secret_access_key
-      recognizes :endpoint, :region, :host, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :path_style, :acceleration, :instrumentor, :instrumentor_name, :aws_signature_version, :enable_signature_v4_streaming, :virtual_host, :cname, :max_put_chunk_size, :max_copy_chunk_size, :aws_credentials_refresh_threshold_seconds, :disable_content_md5_validation, :sts_endpoint
+      recognizes :endpoint, :region, :host, :port, :scheme, :persistent, :use_iam_profile, :aws_session_token, :aws_credentials_expire_at, :path_style, :acceleration, :instrumentor, :instrumentor_name, :aws_signature_version, :enable_signature_v4_streaming, :virtual_host, :cname, :max_put_chunk_size, :max_copy_chunk_size, :copy_concurrency, :aws_credentials_refresh_threshold_seconds, :disable_content_md5_validation, :sts_endpoint
 
       secrets    :aws_secret_access_key, :hmac
 
@@ -129,6 +129,32 @@ module Fog
       request :upload_part
       request :upload_part_copy
 
+      # Immutable snapshot of the credential-derived state needed to sign a
+      # request: the access key id, secret, session token, and the matching
+      # signer (v4) or HMAC (v2). These values are correlated. Under
+      # +use_iam_profile+ they are all replaced together whenever credentials
+      # are refreshed.
+      #
+      # Bundling them into one frozen object stored in a single instance
+      # variable lets a caller read a consistent set with one atomic
+      # reference read (see Real#request). Reading the fields as separate
+      # instance variables lets a refresh land between two reads and pair, for
+      # example, an old session token with a new signer, which S3 rejects with
+      # a 403. Keeping this connection safe to share across threads depends on
+      # never mutating an instance; build a new one and swap the reference.
+      class Credentials
+        attr_reader :aws_access_key_id, :aws_secret_access_key, :aws_session_token, :signer, :hmac
+
+        def initialize(aws_access_key_id: nil, aws_secret_access_key: nil, aws_session_token: nil, signer: nil, hmac: nil)
+          @aws_access_key_id     = aws_access_key_id
+          @aws_secret_access_key = aws_secret_access_key
+          @aws_session_token     = aws_session_token
+          @signer                = signer
+          @hmac                  = hmac
+          freeze
+        end
+      end
+
       module Utils
         attr_accessor :region
         attr_accessor :disable_content_md5_validation
@@ -144,10 +170,16 @@ module Fog
         attr_reader :max_put_chunk_size
         attr_reader :max_copy_chunk_size
 
+        # Number of threads a multipart copy uses, unless the file sets its own.
+        #
+        # @return [Integer]
+        attr_reader :copy_concurrency
+
         def cdn
+          credentials = @credentials
           @cdn ||= Fog::AWS::CDN.new(
-            :aws_access_key_id => @aws_access_key_id,
-            :aws_secret_access_key => @aws_secret_access_key,
+            :aws_access_key_id => credentials.aws_access_key_id,
+            :aws_secret_access_key => credentials.aws_secret_access_key,
             :use_iam_profile => @use_iam_profile
           )
         end
@@ -222,7 +254,16 @@ module Fog
           validate_chunk_size(@max_copy_chunk_size, 'max_copy_chunk_size')
         end
 
+        def init_copy_concurrency!(options = {})
+          @copy_concurrency = options.fetch(:copy_concurrency, 1).to_i
+          raise ArgumentError.new('minimum copy_concurrency is 1') if @copy_concurrency < 1
+        end
+
         def v4_signed_params_for_url(params, expires)
+          # Read the correlated credential state once, as a single reference,
+          # so a concurrent refresh cannot pair a stale session token with a
+          # freshly rebuilt signer.
+          credentials = @credentials
           now = Fog::Time.now
 
           expires = expires - now.to_i
@@ -232,35 +273,36 @@ module Fog
           params[:query]['X-Amz-Expires'] = expires
           params[:query]['X-Amz-Date'] = now.to_iso8601_basic
 
-          if @aws_session_token
-            params[:query]['X-Amz-Security-Token'] = @aws_session_token
+          if credentials.aws_session_token
+            params[:query]['X-Amz-Security-Token'] = credentials.aws_session_token
           end
 
           params = request_params(params)
           params[:headers][:host] = params[:host]
           params[:headers][:host] += ":#{params[:port]}" if params.fetch(:port, nil)
 
-          signature_query_params = @signer.signature_parameters(params, now, "UNSIGNED-PAYLOAD")
+          signature_query_params = credentials.signer.signature_parameters(params, now, "UNSIGNED-PAYLOAD")
           params[:query] = (params[:query] || {}).merge(signature_query_params)
           params
         end
 
         def v2_signed_params_for_url(params, expires)
-          if @aws_session_token
+          credentials = @credentials
+          if credentials.aws_session_token
             params[:headers]||= {}
-            params[:headers]['x-amz-security-token'] = @aws_session_token
+            params[:headers]['x-amz-security-token'] = credentials.aws_session_token
           end
-          signature = signature_v2(params, expires)
+          signature = signature_v2(params, expires, credentials.hmac)
 
           params = request_params(params)
 
           signature_query_params = {
-            'AWSAccessKeyId' => @aws_access_key_id,
+            'AWSAccessKeyId' => credentials.aws_access_key_id,
             'Signature' => signature,
             'Expires' => expires,
           }
           params[:query] = (params[:query] || {}).merge(signature_query_params)
-          params[:query]['x-amz-security-token'] = @aws_session_token if @aws_session_token
+          params[:query]['x-amz-security-token'] = credentials.aws_session_token if credentials.aws_session_token
           params
         end
 
@@ -502,6 +544,7 @@ module Fog
 
           init_max_put_chunk_size!(options)
           init_max_copy_chunk_size!(options)
+          init_copy_concurrency!(options)
 
           @disable_content_md5_validation = options[:disable_content_md5_validation] || false
 
@@ -511,25 +554,32 @@ module Fog
         end
 
         def data
-          self.class.data[@region][@aws_access_key_id]
+          self.class.data[@region][@credentials.aws_access_key_id]
         end
 
         def reset_data
-          self.class.data[@region].delete(@aws_access_key_id)
+          self.class.data[@region].delete(@credentials.aws_access_key_id)
         end
 
         def setup_credentials(options)
           @aws_credentials_refresh_threshold_seconds = options[:aws_credentials_refresh_threshold_seconds]
-
-          @aws_access_key_id = options[:aws_access_key_id]
-          @aws_secret_access_key = options[:aws_secret_access_key]
-          @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
-          @signer = Fog::AWS::SignatureV4.new( @aws_access_key_id, @aws_secret_access_key, @region, 's3')
+          aws_access_key_id     = options[:aws_access_key_id]
+          aws_secret_access_key = options[:aws_secret_access_key]
+          signer = Fog::AWS::SignatureV4.new(aws_access_key_id, aws_secret_access_key, @region, 's3')
+
+          # Swap the whole credential set as one reference so concurrent
+          # readers always observe a complete, self-consistent snapshot.
+          @credentials = Credentials.new(
+            :aws_access_key_id     => aws_access_key_id,
+            :aws_secret_access_key => aws_secret_access_key,
+            :aws_session_token     => options[:aws_session_token],
+            :signer                => signer
+          )
         end
 
-        def signature_v2(params, expires)
+        def signature_v2(params, expires, hmac = nil)
           'foo'
         end
 
@@ -573,6 +623,7 @@ module Fog
 
           init_max_put_chunk_size!(options)
           init_max_copy_chunk_size!(options)
+          init_copy_concurrency!(options)
 
           @disable_content_md5_validation = options[:disable_content_md5_validation] || false
 
@@ -612,16 +663,30 @@ module Fog
             @aws_credentials_refresh_threshold_seconds = options[:aws_credentials_refresh_threshold_seconds]
           end
 
-          @aws_access_key_id     = options[:aws_access_key_id]
-          @aws_secret_access_key = options[:aws_secret_access_key]
-          @aws_session_token     = options[:aws_session_token]
           @aws_credentials_expire_at = options[:aws_credentials_expire_at]
 
+          aws_access_key_id     = options[:aws_access_key_id]
+          aws_secret_access_key = options[:aws_secret_access_key]
+
+          signer = hmac = nil
           if @signature_version == 4
-            @signer = Fog::AWS::SignatureV4.new(@aws_access_key_id, @aws_secret_access_key, @region, 's3')
+            signer = Fog::AWS::SignatureV4.new(aws_access_key_id, aws_secret_access_key, @region, 's3')
           elsif @signature_version == 2
-            @hmac = Fog::HMAC.new('sha1', @aws_secret_access_key)
-          end
+            hmac = Fog::HMAC.new('sha1', aws_secret_access_key)
+          end
+
+          # Publish the new credentials as a single frozen reference. This is
+          # the only write to the correlated credential state, so a reader
+          # that grabs @credentials once (see #request) can never observe a
+          # torn mix of old and new values, even while a refresh is running
+          # on another thread.
+          @credentials = Credentials.new(
+            :aws_access_key_id     => aws_access_key_id,
+            :aws_secret_access_key => aws_secret_access_key,
+            :aws_session_token     => options[:aws_session_token],
+            :signer                => signer,
+            :hmac                  => hmac
+          )
         end
 
         def connection(scheme, host, port)
@@ -641,18 +706,33 @@ module Fog
         def request(params, &block)
           refresh_credentials_if_expired
 
+          # Read the correlated credential state exactly once, into a local, so
+          # a concurrent refresh cannot swap the signer out from under the
+          # session token partway through this request. See the Credentials
+          # class for the full rationale.
+          perform_request(params, @credentials, &block)
+        end
+
+        # Signs and dispatches a single request using the given credential
+        # snapshot. Splitting this out of #request lets the redirect retry in
+        # #_request reuse one consistent snapshot (with a signer rebuilt for
+        # the new region) instead of re-reading, and keeps #request's public
+        # signature unchanged.
+        def perform_request(params, credentials, &block)
+          signer = credentials.signer
+
           date = Fog::Time.now
 
           params = params.dup
           stringify_query_keys(params)
           params[:headers] = (params[:headers] || {}).dup
 
-          params[:headers]['x-amz-security-token'] = @aws_session_token if @aws_session_token
+          params[:headers]['x-amz-security-token'] = credentials.aws_session_token if credentials.aws_session_token
 
           if @signature_version == 2
             expires = date.to_date_header
             params[:headers]['Date'] = expires
-            params[:headers]['Authorization'] = "AWS #{@aws_access_key_id}:#{signature_v2(params, expires)}"
+            params[:headers]['Authorization'] = "AWS #{credentials.aws_access_key_id}:#{signature_v2(params, expires, credentials.hmac)}"
           end
 
           params = request_params(params)
@@ -680,12 +760,12 @@ module Fog
             else
               params[:headers]['x-amz-content-sha256'] ||= OpenSSL::Digest::SHA256.hexdigest(params[:body] || '')
             end
-            signature_components = @signer.signature_components(params, date, params[:headers]['x-amz-content-sha256'])
-            params[:headers]['Authorization'] = @signer.components_to_header(signature_components)
+            signature_components = signer.signature_components(params, date, params[:headers]['x-amz-content-sha256'])
+            params[:headers]['Authorization'] = signer.components_to_header(signature_components)
 
             if params[:body].respond_to?(:read) && @enable_signature_v4_streaming
               body = params.delete :body
-              params[:request_block] = S3Streamer.new(body, signature_components['X-Amz-Signature'], @signer, date)
+              params[:request_block] = S3Streamer.new(body, signature_components['X-Amz-Signature'], signer, date)
             end
           end
           # FIXME: ToHashParser should make this not needed
@@ -713,23 +793,32 @@ module Fog
             new_params[:bucket_name] =  %r{<Bucket>([^<]*)</Bucket>}.match(body).captures.first
             new_params[:host] = %r{<Endpoint>([^<]*)</Endpoint>}.match(body).captures.first
             # some errors provide it directly
-            @new_region = %r{<Region>([^<]*)</Region>}.match(body) ? Regexp.last_match.captures.first : nil
+            new_region = %r{<Region>([^<]*)</Region>}.match(body) ? Regexp.last_match.captures.first : nil
           end
           Fog::Logger.warning("fog: followed redirect to #{host}, connecting to the matching region will be more performant")
-          original_region, original_signer = @region, @signer
-          @region = @new_region || case new_params[:host]
+          new_region ||= case new_params[:host]
           when /s3.amazonaws.com/, /s3-external-1.amazonaws.com/
             DEFAULT_REGION
           else
             %r{s3[\.\-]([^\.]*).amazonaws.com}.match(new_params[:host]).captures.first
           end
+          # Take a fresh, self-consistent snapshot and build a signer for the
+          # redirect region locally, then re-dispatch with it. We deliberately
+          # do not mutate @region/@signer: doing so would corrupt any
+          # concurrent request sharing this connection.
+          credentials = @credentials
           if @signature_version == 4
-            @signer = Fog::AWS::SignatureV4.new(@aws_access_key_id, @aws_secret_access_key, @region, 's3')
+            redirect_signer = Fog::AWS::SignatureV4.new(credentials.aws_access_key_id, credentials.aws_secret_access_key, new_region, 's3')
+            credentials = Credentials.new(
+              :aws_access_key_id     => credentials.aws_access_key_id,
+              :aws_secret_access_key => credentials.aws_secret_access_key,
+              :aws_session_token     => credentials.aws_session_token,
+              :signer                => redirect_signer,
+              :hmac                  => credentials.hmac
+            )
             original_params[:headers].delete('Authorization')
           end
-          response = request(original_params.merge(new_params), &block)
-          @region, @signer = original_region, original_signer
-          response
+          perform_request(original_params.merge(new_params), credentials, &block)
         end
 
         # See http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html
@@ -793,7 +882,7 @@ DATA
           end
         end
 
-        def signature_v2(params, expires)
+        def signature_v2(params, expires, hmac = @credentials.hmac)
           headers = params[:headers] || {}
 
           string_to_sign =
@@ -844,7 +933,7 @@ DATA
           end
           canonical_resource << query_string
           string_to_sign << canonical_resource
-          signed_string = @hmac.sign(string_to_sign)
+          signed_string = hmac.sign(string_to_sign)
           Base64.encode64(signed_string).chomp!
         end
 

data/lib/fog/aws/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AWS
-    VERSION = '3.33.2'.freeze
+    VERSION = '3.33.4'.freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fog-aws
 version: !ruby/object:Gem::Version
-  version: 3.33.2
+  version: 3.33.4
 platform: ruby
 authors:
 - Josh Lane
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 3.6.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 3.6.0
 - !ruby/object:Gem::Dependency
   name: shindo
   requirement: !ruby/object:Gem::Requirement