ruby_everywhere 0.1.7 → 0.1.9

data/lib/everywhere/javascript/bridge.js

@@ -10,10 +10,22 @@
 //   Everywhere.platform                  // "desktop" | "mobile" | "browser"
 //   Everywhere.os                        // "macos" | "windows" | "linux" | "ios" | "android" | "chromeos" | "unknown"
 //   Everywhere.native                    // true inside a RubyEverywhere app
+//   Everywhere.version                   // app version (everywhere.yml app.version); null in a plain browser tab
 //   Everywhere.notify({ title, body })   // native / web Notification / console
 //   Everywhere.confirm("Sure?")          // Promise<boolean>, native dialog when possible
 //   Everywhere.on("menu", handler)       // shell events; returns unsubscribe fn
 //   Everywhere.visit("/settings")        // Turbo.visit with location fallback
+//
+//   Everywhere.updates.supported         // true when the shell has an update feed
+//   Everywhere.updates.channel           // effective channel ("stable", "beta", …)
+//   Everywhere.updates.check()           // Promise<{available, version?, notes?, notesHtml?}>
+//   Everywhere.updates.install()         // download/verify/swap/relaunch
+//   Everywhere.updates.setChannel("beta")// Promise<{channel}>, persisted by the shell
+//   Everywhere.updates.on("available" | "none" | "progress" | "ready" | "error" | "channel", handler)
+//
+//   notes is the markdown source; notesHtml is the same notes pre-rendered to
+//   HTML (from the signed update feed — your own content), ready for a
+//   changelog modal: el.innerHTML = notesHtml.
 
 const config =
   (typeof window !== "undefined" && window.__EVERYWHERE_CONFIG__) || {}
@@ -74,6 +86,51 @@ const desktop = {
 
   clipboardRead() {
     return window.__TAURI__.clipboardManager.readText()
+  },
+
+  // Ask the shell to check its update feed; resolve off whichever update
+  // event answers first. The shell always replies to an explicit check
+  // (available / none / error), the timeout is just a safety net.
+  updatesCheck() {
+    return new Promise((resolve, reject) => {
+      const offs = []
+      let timer = null
+      const settle = (fn) => (payload) => {
+        offs.forEach((off) => off())
+        clearTimeout(timer)
+        fn(payload)
+      }
+      offs.push(this.on("update-available", settle((p) =>
+        resolve({ available: true, version: p.version,
+                  notes: p.notes ?? null, notesHtml: p.notes_html ?? null }))))
+      offs.push(this.on("update-none", settle(() => resolve({ available: false }))))
+      offs.push(this.on("update-error", settle((p) => reject(new Error(p.message)))))
+      timer = setTimeout(settle(() => resolve({ available: false, timedOut: true })), 30000)
+      window.__TAURI__.event.emit("everywhere:update-check", {})
+    })
+  },
+
+  updatesInstall() {
+    return window.__TAURI__.event.emit("everywhere:update-install", {})
+  },
+
+  // Ask the shell to switch update channels. The shell validates, persists the
+  // choice (it survives relaunches and overrides everywhere.yml), and always
+  // answers: update-channel on success, update-error on rejection.
+  updatesSetChannel(channel) {
+    return new Promise((resolve, reject) => {
+      const offs = []
+      let timer = null
+      const settle = (fn) => (payload) => {
+        offs.forEach((off) => off())
+        clearTimeout(timer)
+        fn(payload)
+      }
+      offs.push(this.on("update-channel", settle((p) => resolve({ channel: p.channel }))))
+      offs.push(this.on("update-error", settle((p) => reject(new Error(p.message)))))
+      timer = setTimeout(settle(() => reject(new Error("channel change timed out"))), 10000)
+      window.__TAURI__.event.emit("everywhere:update-set-channel", { channel })
+    })
   }
 }
 
@@ -114,6 +171,21 @@ const browser = {
       try { return await navigator.clipboard.readText() } catch (_) { return null }
     }
     return null
+  },
+
+  // Auto-updates only exist inside the shell; the browser tab is always "current".
+  updatesCheck() {
+    return Promise.resolve({ available: false, unsupported: true })
+  },
+
+  updatesInstall() {
+    console.log("[everywhere] updates unavailable in the browser")
+    return Promise.resolve()
+  },
+
+  updatesSetChannel() {
+    console.log("[everywhere] update channel unavailable in the browser")
+    return Promise.resolve({ channel: null, unsupported: true })
   }
 }
 
@@ -136,10 +208,18 @@ const platform = detectPlatform()
 const os = detectOS()
 const adapter = adapters[platform]
 
+// Mutable so setChannel can keep updates.channel truthful without a reload.
+let updatesChannel = (config.updates && config.updates.channel) || null
+
 export const Everywhere = {
   platform,
   os,
 
+  // The running app's version (everywhere.yml app.version, injected by the
+  // shell) — e.g. an About page or footer badge. null in a plain browser tab,
+  // where the page came from a server, not a versioned bundle.
+  version: config.version || null,
+
   get native() {
     return platform !== "browser"
   },
@@ -168,6 +248,45 @@ export const Everywhere = {
     read() {
       return adapter.clipboardRead()
     }
+  },
+
+  updates: {
+    // True only when the shell actually has a feed to check (everywhere.yml
+    // updates: url + public_key made it into the shipped config).
+    get supported() {
+      return platform === "desktop" && !!config.updates
+    },
+    version: config.version || null,
+
+    // The channel the shell is actually checking. The shell injects the
+    // effective value (a persisted user choice overrides everywhere.yml), and
+    // setChannel keeps it current without a reload.
+    get channel() {
+      return updatesChannel
+    },
+
+    check() {
+      return adapter.updatesCheck()
+    },
+
+    // Fire-and-forget: progress arrives via on("progress"), completion as
+    // "ready", failures as "error"; on success the shell restarts the app.
+    install() {
+      return adapter.updatesInstall()
+    },
+
+    // Switch the update feed channel (e.g. "stable" -> "beta"). Resolves once
+    // the shell has persisted it; follow with check() to scan the new channel.
+    setChannel(channel) {
+      return adapter.updatesSetChannel(channel).then((result) => {
+        if (result && result.channel) updatesChannel = result.channel
+        return result
+      })
+    },
+
+    on(event, handler) {
+      return adapter.on(`update-${event}`, handler)
+    }
   }
 }
 

data/lib/everywhere/minisign.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+require "securerandom"
+require_relative "blake2b"
+
+module Everywhere
+  # Minisign-compatible Ed25519 signing, stdlib-only (OpenSSL + our Blake2b).
+  #
+  # This is the update-artifact signing scheme: `every updates keygen` mints a
+  # keypair, `every publish` signs each artifact, and the shell verifies with
+  # the `minisign-verify` Rust crate before installing an update. Files are
+  # byte-compatible with the reference minisign tool — keys made here sign with
+  # `minisign -S`, keys made there publish here, and every `.minisig` verifies
+  # with `minisign -V`.
+  #
+  # Formats (https://jedisct1.github.io/minisign/):
+  #   public key  "Ed" || key_id[8] || ed25519_pk[32], base64, comment line above
+  #   secret key  "Ed" || "Sc" || "B2" || salt[32] || opslimit[8 LE] ||
+  #               memlimit[8 LE] || (key_id[8] || sk[64] || checksum[32]) XOR
+  #               scrypt(passphrase); checksum = BLAKE2b-256("Ed"||key_id||sk)
+  #   signature   "ED" || key_id[8] || sig[64] over BLAKE2b-512(file) —
+  #               prehashed mode, so signing never loads the artifact whole —
+  #               plus a global sig over sig||trusted_comment
+  module Minisign
+    Error = Class.new(StandardError)
+    VerifyError = Class.new(Error)
+    PassphraseError = Class.new(Error)
+
+    UNTRUSTED = "signature from ruby_everywhere secret key"
+
+    # libsodium scryptsalsa208sha256 "interactive" cost (N=2^14, r=8, p=1 —
+    # 16 MB, milliseconds to derive). The reference tool defaults to
+    # "sensitive" (1 GB); both read whatever the key file declares, so the
+    # cheaper default costs no compatibility.
+    KDF_OPSLIMIT = 524_288
+    KDF_MEMLIMIT = 16_777_216
+
+    KeyPair = Struct.new(:public_key, :secret_key, :key_id_hex, keyword_init: true)
+
+    module_function
+
+    # ---- keygen --------------------------------------------------------------
+
+    def keygen(passphrase: "")
+      pkey = OpenSSL::PKey.generate_key("ED25519")
+      key_id = SecureRandom.bytes(8)
+      sk = pkey.raw_private_key + pkey.raw_public_key # 32-byte seed + 32-byte pk
+
+      checksum = Blake2b.digest("Ed#{key_id}#{sk}", 32)
+      salt = SecureRandom.bytes(32)
+      stream = kdf_stream(passphrase, salt, KDF_OPSLIMIT, KDF_MEMLIMIT)
+
+      secret_blob = "EdScB2#{salt}#{[KDF_OPSLIMIT, KDF_MEMLIMIT].pack("Q<Q<")}" \
+                    "#{xor_bytes("#{key_id}#{sk}#{checksum}", stream)}"
+      public_blob = "Ed#{key_id}#{pkey.raw_public_key}"
+      id_hex = key_id_hex(key_id)
+
+      KeyPair.new(
+        public_key: "untrusted comment: minisign public key #{id_hex}\n#{Base64.strict_encode64(public_blob)}\n",
+        secret_key: "untrusted comment: minisign encrypted secret key\n#{Base64.strict_encode64(secret_blob)}\n",
+        key_id_hex: id_hex
+      )
+    end
+
+    # ---- signing -------------------------------------------------------------
+
+    # Returns the full .minisig content for `path`.
+    def sign_file(path, secret_key:, passphrase: "", trusted_comment: nil)
+      key_id, seed = decrypt_secret_key(secret_key, passphrase)
+      pkey = OpenSSL::PKey.new_raw_private_key("ED25519", seed)
+
+      signature = pkey.sign(nil, Blake2b.digest64_file(path))
+      trusted_comment ||= "timestamp:#{Time.now.to_i}\tfile:#{File.basename(path)}\thashed"
+      global = pkey.sign(nil, signature + trusted_comment.b)
+
+      "untrusted comment: #{UNTRUSTED}\n" \
+        "#{Base64.strict_encode64("ED#{key_id}#{signature}")}\n" \
+        "trusted comment: #{trusted_comment}\n" \
+        "#{Base64.strict_encode64(global)}\n"
+    end
+
+    # ---- verification --------------------------------------------------------
+
+    # `public_key` may be the two-line key file or just its base64 line.
+    # Raises VerifyError unless everything checks out.
+    def verify_file(path, signature:, public_key:)
+      alg, key_id, sig, trusted_comment, global = parse_signature(signature)
+      pk_key_id, pk = parse_public_key(public_key)
+
+      raise VerifyError, "signature key id #{key_id_hex(key_id)} doesn't match public key #{key_id_hex(pk_key_id)}" unless key_id == pk_key_id
+
+      pkey = OpenSSL::PKey.new_raw_public_key("ED25519", pk)
+      message = alg == "ED" ? Blake2b.digest64_file(path) : File.binread(path)
+      raise VerifyError, "file signature invalid for #{File.basename(path)}" unless pkey.verify(nil, sig, message)
+      raise VerifyError, "trusted comment signature invalid" unless pkey.verify(nil, global, sig + trusted_comment.b)
+
+      true
+    end
+
+    # The bare base64 line of a public key — what everywhere.yml stores and the
+    # shell's minisign-verify consumes.
+    def public_key_base64(content)
+      line = content.lines.map(&:strip).reject { |l| l.empty? || l.start_with?("untrusted comment:") }.first
+      raise Error, "no public key data found" unless line
+
+      blob = decode64(line, "public key")
+      raise Error, "unsupported public key format" unless blob.bytesize == 42 && blob.start_with?("Ed")
+
+      line
+    end
+
+    # ---- internals -----------------------------------------------------------
+
+    def parse_public_key(content)
+      blob = decode64(public_key_base64(content), "public key")
+      [blob.byteslice(2, 8), blob.byteslice(10, 32)]
+    end
+
+    def parse_signature(content)
+      lines = content.lines.map(&:chomp)
+      sig_b64 = lines.find { |l| !l.start_with?("untrusted comment:") && !l.strip.empty? }
+      trusted = lines.find { |l| l.start_with?("trusted comment: ") }&.delete_prefix("trusted comment: ")
+      global_b64 = lines[lines.index { |l| l.start_with?("trusted comment:") }.to_i + 1] if trusted
+      raise VerifyError, "malformed signature file" unless sig_b64 && trusted && global_b64
+
+      blob = decode64(sig_b64, "signature")
+      alg = blob.byteslice(0, 2)
+      raise VerifyError, "unsupported signature algorithm #{alg.inspect}" unless %w[ED Ed].include?(alg)
+      raise VerifyError, "malformed signature" unless blob.bytesize == 74
+
+      [alg, blob.byteslice(2, 8), blob.byteslice(10, 64), trusted, decode64(global_b64, "global signature")]
+    end
+
+    # -> [key_id, ed25519_seed]
+    def decrypt_secret_key(content, passphrase)
+      raise Error, "no secret key material given" if content.to_s.strip.empty?
+
+      line = content.lines.map(&:strip).reject { |l| l.empty? || l.start_with?("untrusted comment:") }.first
+      blob = decode64(line.to_s, "secret key")
+      kdf_alg = blob.byteslice(2, 2)
+      unless blob.bytesize == 158 && blob.start_with?("Ed") && ["Sc", "\x00\x00"].include?(kdf_alg) &&
+             blob.byteslice(4, 2) == "B2"
+        raise Error, "unsupported secret key format"
+      end
+
+      keynum = if kdf_alg == "Sc"
+        salt = blob.byteslice(6, 32)
+        opslimit, memlimit = blob.byteslice(38, 16).unpack("Q<Q<")
+        xor_bytes(blob.byteslice(54, 104), kdf_stream(passphrase, salt, opslimit, memlimit))
+      else
+        blob.byteslice(54, 104) # null KDF (minisign -W): stored in the clear
+      end
+
+      key_id = keynum.byteslice(0, 8)
+      sk = keynum.byteslice(8, 64)
+      checksum = keynum.byteslice(72, 32)
+      # Reference minisign writes an all-zero checksum for unencrypted (-W)
+      # keys and skips the check; a wrong checksum on an encrypted key means a
+      # wrong passphrase (scrypt stream decrypted to garbage).
+      unless (kdf_alg != "Sc" && checksum == ("\0" * 32).b) ||
+             OpenSSL.secure_compare(checksum, Blake2b.digest("Ed#{key_id}#{sk}", 32))
+        raise PassphraseError, "wrong passphrase (or corrupt secret key)"
+      end
+
+      [key_id, sk.byteslice(0, 32)]
+    end
+
+    def kdf_stream(passphrase, salt, opslimit, memlimit)
+      n, r, p = scrypt_params(opslimit, memlimit)
+      OpenSSL::KDF.scrypt(passphrase.to_s, salt: salt, N: n, r: r, p: p, length: 104)
+    end
+
+    # Port of libsodium's pickparams: how opslimit/memlimit (what the key file
+    # stores) map to scrypt's N/r/p.
+    def scrypt_params(opslimit, memlimit)
+      opslimit = 32_768 if opslimit < 32_768
+      r = 8
+      if opslimit < memlimit / 32
+        max_n = opslimit / (r * 4)
+        [1 << n_log2(max_n), r, 1]
+      else
+        max_n = memlimit / (r * 128)
+        n = 1 << n_log2(max_n)
+        max_rp = [(opslimit / 4) / n, 0x3fffffff].min
+        [n, r, [max_rp / r, 1].max]
+      end
+    end
+
+    def n_log2(max_n) = (1..62).find { |i| (1 << i) > max_n / 2 } || 63
+
+    def key_id_hex(key_id) = key_id.unpack1("Q<").to_s(16).upcase
+
+    def xor_bytes(a, b)
+      a.unpack("C*").zip(b.unpack("C*")).map { |x, y| x ^ y }.pack("C*")
+    end
+
+    def decode64(str, what)
+      Base64.strict_decode64(str.strip)
+    rescue ArgumentError
+      raise Error, "invalid base64 in #{what}"
+    end
+  end
+end

data/lib/everywhere/s3.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "openssl"
+require "uri"
+require "time"
+
+module Everywhere
+  # Minimal S3 client — just the four operations `every publish` needs
+  # (PUT / HEAD / GET / CopyObject), signed with AWS Signature V4, stdlib only.
+  #
+  # Deliberately not aws-sdk-s3: the gem keeps a near-zero runtime dependency
+  # footprint, and SigV4 is a stable, testable ~150 lines. Works against any
+  # S3-compatible endpoint — AWS, Cloudflare R2, DigitalOcean Spaces, MinIO.
+  #
+  # Addressing: virtual-host style for AWS proper, path style for custom
+  # endpoints (R2/Spaces/MinIO all accept it; MinIO requires it). Override
+  # with force_path_style.
+  class S3
+    Error = Class.new(StandardError)
+
+    ALGORITHM = "AWS4-HMAC-SHA256"
+    UNSIGNED = "UNSIGNED-PAYLOAD"
+
+    attr_reader :bucket
+
+    def initialize(bucket:, region: "auto", endpoint: nil, force_path_style: nil,
+                   access_key_id:, secret_access_key:, session_token: nil)
+      @bucket = bucket
+      @region = region.to_s.empty? ? "auto" : region
+      @access_key_id = access_key_id
+      @secret_access_key = secret_access_key
+      @session_token = session_token
+
+      if endpoint && !endpoint.empty?
+        @endpoint = URI(endpoint)
+        @path_style = force_path_style.nil? ? true : force_path_style
+      else
+        @endpoint = URI("https://s3.#{aws_region}.amazonaws.com")
+        @path_style = force_path_style || false
+      end
+      raise Error, "endpoint must be http(s)" unless %w[http https].include?(@endpoint.scheme)
+    end
+
+    # body: String or IO (IO must respond to #size or be paired with size:).
+    # sha256: precomputed hex payload digest; IOs default to UNSIGNED-PAYLOAD.
+    def put_object(key, body, content_type: nil, cache_control: nil, sha256: nil, size: nil)
+      headers = {}
+      headers["content-type"] = content_type if content_type
+      headers["cache-control"] = cache_control if cache_control
+      if body.is_a?(String)
+        sha256 ||= OpenSSL::Digest::SHA256.hexdigest(body)
+        headers["content-length"] = body.bytesize.to_s
+      else
+        sha256 ||= UNSIGNED
+        headers["content-length"] = (size || body.size).to_s
+      end
+      request(:put, key, headers: headers, body: body, payload_sha256: sha256)
+      true
+    end
+
+    # -> { size:, etag: } or nil when the key doesn't exist.
+    def head_object(key)
+      res = request(:head, key, allow_404: true)
+      return nil if res.code == "404"
+
+      { size: res["content-length"]&.to_i, etag: res["etag"]&.delete('"') }
+    end
+
+    # -> body String, or nil when the key doesn't exist.
+    def get_object(key)
+      res = request(:get, key, allow_404: true)
+      res.code == "404" ? nil : res.body
+    end
+
+    # Server-side copy within the bucket (how the -latest alias is refreshed
+    # without re-uploading the artifact).
+    def copy_object(source_key, dest_key, content_type: nil, cache_control: nil)
+      headers = { "x-amz-copy-source" => "/#{@bucket}/#{uri_encode_path(source_key)}" }
+      if content_type || cache_control
+        headers["x-amz-metadata-directive"] = "REPLACE"
+        headers["content-type"] = content_type if content_type
+        headers["cache-control"] = cache_control if cache_control
+      end
+      res = request(:put, dest_key, headers: headers)
+      # CopyObject reports some failures inside a 200 body.
+      raise Error, "copy #{source_key} -> #{dest_key} failed: #{res.body}" if res.body.to_s.include?("<Error>")
+
+      true
+    end
+
+    # ---- request plumbing ----------------------------------------------------
+
+    private
+
+    def request(method, key, headers: {}, body: nil, payload_sha256: nil, allow_404: false, attempt: 1)
+      uri = object_uri(key)
+      payload_sha256 ||= OpenSSL::Digest::SHA256.hexdigest("")
+      all = headers.merge(Signer.headers(
+        method: method, uri: uri, headers: headers, payload_sha256: payload_sha256,
+        access_key_id: @access_key_id, secret_access_key: @secret_access_key,
+        session_token: @session_token, region: aws_region
+      ))
+
+      req = Net::HTTP.const_get(method.capitalize).new(uri.request_uri)
+      all.each { |k, v| req[k] = v }
+      if body.is_a?(String)
+        req.body = body
+      elsif body
+        req.body_stream = body
+      end
+
+      res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", read_timeout: 300) do |http|
+        http.request(req)
+      end
+
+      return res if res.is_a?(Net::HTTPSuccess) || (allow_404 && res.code == "404")
+
+      if retryable?(res) && attempt < 3 && body_rewindable?(body)
+        sleep(attempt)
+        body.rewind if body.respond_to?(:rewind) && !body.is_a?(String)
+        return request(method, key, headers: headers, body: body, payload_sha256: payload_sha256,
+                       allow_404: allow_404, attempt: attempt + 1)
+      end
+
+      raise Error, "S3 #{method.upcase} #{key} failed (HTTP #{res.code}): #{error_detail(res)}"
+    rescue Errno::ECONNREFUSED, Errno::ECONNRESET, Net::OpenTimeout, Net::ReadTimeout, SocketError => e
+      raise Error, "S3 #{method.upcase} #{key} failed: #{e.message}" unless attempt < 3 && body_rewindable?(body)
+
+      sleep(attempt)
+      body.rewind if body.respond_to?(:rewind) && !body.is_a?(String)
+      request(method, key, headers: headers, body: body, payload_sha256: payload_sha256,
+              allow_404: allow_404, attempt: attempt + 1)
+    end
+
+    def retryable?(res) = res.code.to_i >= 500 || res.code == "429"
+
+    def body_rewindable?(body) = body.nil? || body.is_a?(String) || body.respond_to?(:rewind)
+
+    def error_detail(res)
+      code = res.body.to_s[%r{<Code>([^<]+)</Code>}, 1]
+      msg = res.body.to_s[%r{<Message>([^<]+)</Message>}, 1]
+      [code, msg].compact.join(": ").then { |s| s.empty? ? res.message : s }
+    end
+
+    def object_uri(key)
+      encoded = uri_encode_path(key)
+      if @path_style
+        URI("#{@endpoint.scheme}://#{@endpoint.host}:#{@endpoint.port}/#{@bucket}/#{encoded}")
+      else
+        host = @endpoint.host.start_with?("#{@bucket}.") ? @endpoint.host : "#{@bucket}.#{@endpoint.host}"
+        URI("#{@endpoint.scheme}://#{host}:#{@endpoint.port}/#{encoded}")
+      end
+    end
+
+    # RFC 3986 encoding per path segment ('/' preserved) — SigV4's canonical form.
+    def uri_encode_path(key)
+      key.split("/", -1).map { |seg| Signer.uri_encode(seg) }.join("/")
+    end
+
+    def aws_region = @region == "auto" ? "us-east-1" : @region
+
+    # Pure SigV4 header computation, separated for direct testing against the
+    # published AWS test vectors.
+    module Signer
+      module_function
+
+      def headers(method:, uri:, headers:, payload_sha256:, access_key_id:, secret_access_key:,
+                  session_token: nil, region:, time: Time.now.utc)
+        amz_date = time.strftime("%Y%m%dT%H%M%SZ")
+        date = time.strftime("%Y%m%d")
+
+        signed = {
+          "host" => host_header(uri),
+          "x-amz-content-sha256" => payload_sha256,
+          "x-amz-date" => amz_date
+        }
+        signed["x-amz-security-token"] = session_token if session_token
+        # Sign every x-amz-* header we send (S3 requires it) plus the core set.
+        canonical_headers = headers.select { |k, _| k.downcase.start_with?("x-amz-") || %w[range content-type content-md5 cache-control date expires].include?(k.downcase) }
+                                   .transform_keys(&:downcase).merge(signed)
+
+        sorted = canonical_headers.sort.to_h
+        header_list = sorted.keys.join(";")
+        canonical_request = [
+          method.to_s.upcase,
+          uri.path.empty? ? "/" : uri.path,
+          canonical_query(uri.query),
+          sorted.map { |k, v| "#{k}:#{v.to_s.strip}\n" }.join,
+          header_list,
+          payload_sha256
+        ].join("\n")
+
+        scope = "#{date}/#{region}/s3/aws4_request"
+        string_to_sign = [
+          ALGORITHM, amz_date, scope,
+          OpenSSL::Digest::SHA256.hexdigest(canonical_request)
+        ].join("\n")
+
+        k = %W[AWS4#{secret_access_key} #{date} #{region} s3 aws4_request]
+            .reduce { |key, data| OpenSSL::HMAC.digest("SHA256", key, data) }
+        signature = OpenSSL::HMAC.hexdigest("SHA256", k, string_to_sign)
+
+        signed.merge(
+          "authorization" => "#{ALGORITHM} Credential=#{access_key_id}/#{scope}, " \
+                             "SignedHeaders=#{header_list}, Signature=#{signature}"
+        )
+      end
+
+      # Canonical form: every param as key=value (empty value keeps the "="),
+      # sorted. Callers pass unencoded simple queries; we never need decoding.
+      def canonical_query(query)
+        return "" if query.nil? || query.empty?
+
+        query.split("&").map { |pair|
+          k, v = pair.split("=", 2)
+          "#{uri_encode(k)}=#{uri_encode(v || "")}"
+        }.sort.join("&")
+      end
+
+      def host_header(uri)
+        default_port = uri.scheme == "https" ? 443 : 80
+        uri.port == default_port ? uri.host : "#{uri.host}:#{uri.port}"
+      end
+
+      # RFC 3986 unreserved-only encoding (AWS canonical form).
+      def uri_encode(str)
+        str.to_s.gsub(/[^A-Za-z0-9\-._~]/) { |c| c.bytes.map { |b| format("%%%02X", b) }.join }
+      end
+    end
+  end
+end