sigflint 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.0.1 - 2026-10-18
+
+- A lowercase `method` (`get`) is signed as upper case (`GET`), as botocore does. `fetch` sends `get`, `put`, `post`, `delete`, `head` and `options` in upper case, so before this the signature did not match and the service answered `SignatureDoesNotMatch`. Node's `fetch` sends `patch` as written, so pass `PATCH` in upper case to both sigflint and `fetch`.
+- `end(trailers)` on a chunk signer throws a `TypeError` when a trailer name or value holds a line break. Before, the break was signed as another trailer line.
+- Correction to the 1.0.0 entry: a raw `+` in an S3 path is signed as a space, but "as S3 reads it" was not verified. Nothing has been tried against AWS S3, and a local `s3s-fs` 0.17.0 server reads a raw `+` as a plus sign and rejected the signature. Write `%2B` in the URL to mean a plus: that server accepted it from sigflint and from botocore. The signing is unchanged (`docs/guide.md`).
+- Correction to the 1.0.0 entry: a bundler that picks the `node` or `bun` condition gets the built file (`dist/`) and drops unused signers just as well; the per-signer modules (`src/`) go to the `workerd`, `worker` and `browser` conditions and to bundlers that match none of them.
+
 ## 1.0.0 - 2026-10-16
 
 First version: AWS Signature Version 4 signing for every AWS service.

package/README.md

@@ -5,6 +5,20 @@
   </picture>
 </h1>
 
+<p align="center">
+  <a href="https://github.com/bompus/sigflint/actions/workflows/ci.yml"><img src="https://github.com/bompus/sigflint/actions/workflows/ci.yml/badge.svg" alt="CI status"></a>
+  <a href="https://github.com/bompus/sigflint/releases/latest"><img src="https://badgen.net/github/release/bompus/sigflint" alt="Latest GitHub release"></a>
+  <a href="https://www.npmjs.com/package/sigflint"><img src="https://badgen.net/npm/v/sigflint" alt="Latest sigflint version on npm"></a>
+  <a href="LICENSE"><img src="https://badgen.net/badge/license/MIT/blue" alt="MIT license"></a>
+</p>
+
+<p align="center">
+  <a href="docs/guide.md#usage">Headers and presigned URLs</a>&nbsp;·
+  <a href="docs/guide.md#sigv4a-multi-region">SigV4a</a>&nbsp;·
+  <a href="docs/guide.md#chunked-uploads">Chunked uploads and event streams</a>&nbsp;·
+  <a href="package.json">No dependencies</a>
+</p>
+
 Fast AWS Signature Version 4 request signing for every AWS service, with no dependencies. It runs on Node.js, Bun, Deno, Cloudflare Workers and browsers.
 
 ```js
@@ -20,8 +34,8 @@ const response = await fetch(url, { headers });
 
 It signs requests with the `Authorization` header or as a presigned URL, for S3 and for any other service (`service: 'dynamodb'`, `'sqs'`, `'execute-api'`, ...), and it also does multi-region signatures (SigV4a), chunked uploads and event streams.
 
-- **Correct.** It returns the same signature as botocore for all 3,360 S3 requests in its test corpus, and for 1,622 requests to other services and 1,600 presigned URLs. For S3, botocore signs the request after this repository's own path and query normalization (`conformance/oracle.py`), so that step is not checked independently by the corpus; the four S3 examples published by AWS, which are in it, are. SigV4a signatures verify against the AWS CRT's, and chunk and event signatures match the AWS SDK's. See [how it is tested](docs/benchmarks.md#how-it-is-tested).
-- **Fast.** 1.3 to 3.7 µs per header or presigned-URL signature on Node and 1.5 to 5.1 µs on Bun. The other libraries take 2.4 to 507 times as long on the requests they sign correctly (one Bun presigned-URL comparison with `minio` is not clear and is left out). See [speed](docs/benchmarks.md#speed).
+- **Correct.** It returns the same signature as botocore for all 3,360 S3 requests in its test corpus, and for 1,622 requests to other services and 1,600 presigned URLs. For S3, botocore signs the request after this repository's own path and query normalization (`conformance/oracle.py`), so that step is not checked independently by the corpus; the four S3 examples published by AWS, which are in it, are. SigV4a signatures verify against the AWS CRT's, and every chunk and event signature in the test corpus matches the AWS SDK's. See [how it is tested](docs/benchmarks.md#how-it-is-tested).
+- **Fast.** 1.3 to 3.6 µs per header or presigned-URL signature on Node and 1.4 to 5.0 µs on Bun. The other libraries take 2.6 to 552 times as long on the requests they sign correctly (five Bun presigned-URL comparisons, with `aws4`, `@smithy/signature-v4` and `minio`, are not clear and are left out). See [speed](docs/benchmarks.md#speed).
 - **Small, and you pay only for what you import.** Signing headers is 5.7 kB minified, 2.8 kB gzipped; presigned URLs, SigV4a, chunked uploads and event streams each add to a bundle only when imported. Nothing to install with it. See [size](docs/benchmarks.md#size).
 - **Everywhere.** One import on Node, Bun, Deno and Cloudflare Workers, with or without `nodejs_compat`. See [runtimes](#runtimes).
 
@@ -58,7 +72,7 @@ For a large or binary body, skip hashing and send `unsignedPayload: true`. S3 ac
 const headers = await getAuthHeaders({ method: 'PUT', url, region, unsignedPayload: true }, credentials);
 ```
 
-For another S3-compatible service, pass its region name and URL (`https://us-sea-1.linodeobjects.com/bucket/key`, `http://127.0.0.1:9000/bucket/key`). These are examples of the form, not endpoints that were tried: signatures are checked against botocore, the AWS CRT, the AWS SDK's signer and the AWS documentation examples, and nothing has been sent to AWS S3 or any other server, so a service that canonicalizes requests differently from S3 may reject them.
+For another S3-compatible service, pass its region name and URL (`https://us-sea-1.linodeobjects.com/bucket/key`, `http://127.0.0.1:9000/bucket/key`). These are examples of the form, not endpoints that were tried. Signatures are checked against botocore, the AWS CRT, the AWS SDK's signer and the AWS documentation examples. Nothing has been sent to AWS S3, so a service that canonicalizes requests differently from S3 may reject them. The only server tried is a local `s3s-fs` 0.17.0 test server on loopback, once, with header-signed requests (create a bucket, `PUT`, `GET`, list): it accepted them, except that it rejected sigflint's signature for a raw `+` in the path, so write `%2B` ([how the path is read](docs/guide.md#how-it-reads-the-url)).
 
 More in the [guide](docs/guide.md): [other services](docs/guide.md#other-services), [presigned URLs](docs/guide.md#presigned-urls), [SigV4a](docs/guide.md#sigv4a-multi-region), [chunked uploads](docs/guide.md#chunked-uploads), [event streams](docs/guide.md#event-streams), why to always `await`, and the [full API](docs/guide.md#api).
 

package/dist/bun.js

@@ -156,7 +156,8 @@ function payloadHashOf(request, hexHash2) {
   return request.unsignedPayload ? "UNSIGNED-PAYLOAD" : body.length === 0 ? emptyBodyHash : hexHash2(body);
 }
 function prepare(request, credentials, payloadHash, scheme = symmetric) {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   const region = request.region ?? "";
   const service = request.service ?? "s3";
   const withHash = service === "s3" || request.unsignedPayload === true;
@@ -273,7 +274,8 @@ function createSigner({ hexHash: hexHash2, hmacHex, getSigningKey: getSigningKey
 // src/presign.js
 var encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
 function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = "") {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   if (url.protocol !== "https:" && url.protocol !== "http:") throw new TypeError("presign needs an http or https URL");
   if (url.search.length > 1 && (url.search.includes("X-Amz-Signature=") || url.search.includes("X-Amz-Algorithm="))) throw new TypeError("the URL is already presigned");
   const expires = request.expires ?? 3600;
@@ -416,7 +418,11 @@ ${scope}
 ${previous}
 ${trailerHash}`;
 function canonicalTrailers(trailers) {
-  return Object.keys(trailers).map((name) => [name.toLowerCase(), String(trailers[name]).trim()]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
+  return Object.keys(trailers).map((name) => {
+    const value = String(trailers[name]);
+    if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) throw new TypeError("a trailer name or value cannot hold a line break");
+    return [name.toLowerCase(), value.trim()];
+  }).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
 `).join("");
 }
 function frameChunk(signature, data) {
@@ -449,9 +455,9 @@ function createChunkSigner({ hexHash: hexHash2, hmacHex, getSigningKey: getSigni
       chunk: (data) => data.length === 0 ? data : frameChunk(sign(data), data),
       // a zero-length chunk would end the upload; it is not sent
       end(trailers) {
+        const text = trailers === void 0 ? void 0 : canonicalTrailers(trailers);
         const signature = sign(new Uint8Array(0));
-        if (trailers === void 0) return frameEnd(signature);
-        const text = canonicalTrailers(trailers);
+        if (text === void 0) return frameEnd(signature);
         const trailerSignature = hmacHex(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash2(text)));
         return frameEnd(signature, text, trailerSignature);
       }

package/dist/node.js

@@ -156,7 +156,8 @@ function payloadHashOf(request, hexHash2) {
   return request.unsignedPayload ? "UNSIGNED-PAYLOAD" : body.length === 0 ? emptyBodyHash : hexHash2(body);
 }
 function prepare(request, credentials, payloadHash, scheme = symmetric) {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   const region = request.region ?? "";
   const service = request.service ?? "s3";
   const withHash = service === "s3" || request.unsignedPayload === true;
@@ -273,7 +274,8 @@ function createSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: get
 // src/presign.js
 var encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
 function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = "") {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   if (url.protocol !== "https:" && url.protocol !== "http:") throw new TypeError("presign needs an http or https URL");
   if (url.search.length > 1 && (url.search.includes("X-Amz-Signature=") || url.search.includes("X-Amz-Algorithm="))) throw new TypeError("the URL is already presigned");
   const expires = request.expires ?? 3600;
@@ -416,7 +418,11 @@ ${scope}
 ${previous}
 ${trailerHash}`;
 function canonicalTrailers(trailers) {
-  return Object.keys(trailers).map((name) => [name.toLowerCase(), String(trailers[name]).trim()]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
+  return Object.keys(trailers).map((name) => {
+    const value = String(trailers[name]);
+    if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) throw new TypeError("a trailer name or value cannot hold a line break");
+    return [name.toLowerCase(), value.trim()];
+  }).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
 `).join("");
 }
 function frameChunk(signature, data2) {
@@ -449,9 +455,9 @@ function createChunkSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey
       chunk: (data2) => data2.length === 0 ? data2 : frameChunk(sign(data2), data2),
       // a zero-length chunk would end the upload; it is not sent
       end(trailers) {
+        const text = trailers === void 0 ? void 0 : canonicalTrailers(trailers);
         const signature = sign(new Uint8Array(0));
-        if (trailers === void 0) return frameEnd(signature);
-        const text = canonicalTrailers(trailers);
+        if (text === void 0) return frameEnd(signature);
         const trailerSignature = hmacHex2(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash2(text)));
         return frameEnd(signature, text, trailerSignature);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigflint",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Fast, dependency-free AWS Signature Version 4 signing for every AWS service: headers, presigned URLs, SigV4a, chunked uploads and event streams. Node.js, Bun, Deno, Cloudflare Workers and browsers.",
   "keywords": [
     "aws",

package/src/base.js

@@ -190,7 +190,7 @@ export function amzDatetime(now) {
 
 /**
  * @typedef {Object} SignRequest
- * @property {string} method - GET, HEAD, PUT, POST, DELETE
+ * @property {string} method - GET, HEAD, PUT, POST, DELETE; any case, signed in upper case (as botocore does)
  * @property {URL} url
  * @property {string} [service] - default 's3'
  * @property {string} [region] - for example us-west-2
@@ -227,7 +227,8 @@ export function payloadHashOf(request, hexHash) {
 
 /** Everything up to the hashing: the headers to return, the canonical request and the credential scope. */
 export function prepare(request, credentials, payloadHash, scheme = symmetric) {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase(); // 'get' is signed as GET, which is what fetch sends and what botocore signs
   const region = request.region ?? '';
   const service = request.service ?? 's3';
   // S3 always sends x-amz-content-sha256; other services only when the payload is unsigned

package/src/chunks.js

@@ -23,10 +23,14 @@ export function seedOf(authHeaders) {
 export const chunkStringToSign = (datetime, scope, previous, payloadHash) => `AWS4-HMAC-SHA256-PAYLOAD\n${datetime}\n${scope}\n${previous}\n${emptyHash}\n${payloadHash}`;
 export const trailerStringToSign = (datetime, scope, previous, trailerHash) => `AWS4-HMAC-SHA256-TRAILER\n${datetime}\n${scope}\n${previous}\n${trailerHash}`;
 
-/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. */
+/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. A line break in a name or value would start another trailer line, so it throws. */
 export function canonicalTrailers(trailers) {
   return Object.keys(trailers)
-    .map((name) => [name.toLowerCase(), String(trailers[name]).trim()])
+    .map((name) => {
+      const value = String(trailers[name]);
+      if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) throw new TypeError('a trailer name or value cannot hold a line break');
+      return [name.toLowerCase(), value.trim()];
+    })
     .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
     .map(([name, value]) => `${name}:${value}\n`)
     .join('');
@@ -71,9 +75,9 @@ export function createChunkSigner({ hexHash, hmacHex, getSigningKey }) {
     return {
       chunk: (data) => (data.length === 0 ? data : frameChunk(sign(data), data)), // a zero-length chunk would end the upload; it is not sent
       end(trailers) {
+        const text = trailers === undefined ? undefined : canonicalTrailers(trailers); // before sign(), so a refused trailer leaves the chain where it was
         const signature = sign(new Uint8Array(0));
-        if (trailers === undefined) return frameEnd(signature);
-        const text = canonicalTrailers(trailers);
+        if (text === undefined) return frameEnd(signature);
         const trailerSignature = hmacHex(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash(text)));
         return frameEnd(signature, text, trailerSignature);
       },

package/src/presign.js

@@ -8,7 +8,8 @@ export const encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()
  * signed; S3 URLs are always UNSIGNED-PAYLOAD, other services sign the body hash. `extra` is appended to the authentication parameters.
  */
 export function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = '') {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new TypeError('presign needs an http or https URL');
   if (url.search.length > 1 && (url.search.includes('X-Amz-Signature=') || url.search.includes('X-Amz-Algorithm='))) throw new TypeError('the URL is already presigned');
   const expires = request.expires ?? 3600;

package/src/web.js

@@ -153,9 +153,9 @@ export function chunkSigner(authHeaders, credentials) {
   return {
     chunk: async (data) => (data.length === 0 ? data : frameChunk(await sign(data), data)),
     async end(trailers) {
+      const text = trailers === undefined ? undefined : canonicalTrailers(trailers); // before sign(), so a refused trailer leaves the chain where it was
       const signature = await sign(new Uint8Array(0));
-      if (trailers === undefined) return frameEnd(signature);
-      const text = canonicalTrailers(trailers);
+      if (text === undefined) return frameEnd(signature);
       return frameEnd(signature, text, await signWith(await keyPromise, trailerStringToSign(seed.datetime, seed.scope, signature, await hexHash(text))));
     },
   };

package/types/base.d.ts

@@ -20,7 +20,7 @@ export declare const headerValue: (value: any) => string;
 export declare function amzDatetime(now: any): string;
 export type SignRequest = {
     /**
-     * - GET, HEAD, PUT, POST, DELETE
+     * - GET, HEAD, PUT, POST, DELETE; any case, signed in upper case (as botocore does)
      */
     method: string;
     url: URL;
@@ -86,7 +86,7 @@ export type Primitives = {
 };
 /**
  * @typedef {Object} SignRequest
- * @property {string} method - GET, HEAD, PUT, POST, DELETE
+ * @property {string} method - GET, HEAD, PUT, POST, DELETE; any case, signed in upper case (as botocore does)
  * @property {URL} url
  * @property {string} [service] - default 's3'
  * @property {string} [region] - for example us-west-2

package/types/chunks.d.ts

@@ -10,7 +10,7 @@ export declare function seedOf(authHeaders: any): {
 };
 export declare const chunkStringToSign: (datetime: any, scope: any, previous: any, payloadHash: any) => string;
 export declare const trailerStringToSign: (datetime: any, scope: any, previous: any, trailerHash: any) => string;
-/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. */
+/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. A line break in a name or value would start another trailer line, so it throws. */
 export declare function canonicalTrailers(trailers: any): string;
 /** The bytes of one chunk on the wire: size in hex, signature, the data. */
 export declare function frameChunk(signature: any, data: any): Uint8Array<any>;