vendor: update buildkit to v0.30.0-rc1
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
+1
-1
@@ -3,4 +3,4 @@
|
||||
package aws
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.41.4"
|
||||
const goModuleVersion = "1.41.7"
|
||||
|
||||
+20
-4
@@ -6,6 +6,7 @@ import (
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
|
||||
@@ -43,6 +44,10 @@ type Attempt struct {
|
||||
// A Meter instance for recording retry-related metrics.
|
||||
OperationMeter metrics.Meter
|
||||
|
||||
// Initial clock skew that would have been saved from a previous operation
|
||||
// call.
|
||||
ClientSkew *atomic.Int64
|
||||
|
||||
retryer aws.RetryerV2
|
||||
requestCloner RequestCloner
|
||||
}
|
||||
@@ -82,8 +87,12 @@ func (r Attempt) logf(logger logging.Logger, classification logging.Classificati
|
||||
func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeInput, next smithymiddle.FinalizeHandler) (
|
||||
out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error,
|
||||
) {
|
||||
var attemptNum int
|
||||
var attemptClockSkew time.Duration
|
||||
if r.ClientSkew != nil {
|
||||
attemptClockSkew = time.Duration(r.ClientSkew.Load())
|
||||
}
|
||||
|
||||
var attemptNum int
|
||||
var attemptResults AttemptResults
|
||||
|
||||
maxAttempts := r.retryer.MaxAttempts()
|
||||
@@ -99,6 +108,8 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
|
||||
attemptInput := in
|
||||
attemptInput.Request = r.requestCloner(attemptInput.Request)
|
||||
|
||||
ctx = internalcontext.SetAttemptSkewContext(ctx, attemptClockSkew)
|
||||
|
||||
// Record the metadata for the for attempt being started.
|
||||
attemptCtx := setRetryMetadata(ctx, retryMetadata{
|
||||
AttemptNum: attemptNum,
|
||||
@@ -107,9 +118,6 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
|
||||
AttemptClockSkew: attemptClockSkew,
|
||||
})
|
||||
|
||||
// Setting clock skew to be used on other context (like signing)
|
||||
ctx = internalcontext.SetAttemptSkewContext(ctx, attemptClockSkew)
|
||||
|
||||
var attemptResult AttemptResult
|
||||
|
||||
attemptCtx, span := tracing.StartSpan(attemptCtx, "Attempt", func(o *tracing.SpanOptions) {
|
||||
@@ -149,6 +157,14 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
|
||||
}
|
||||
}
|
||||
|
||||
// this guarantees we are staying on top of the persistent skew value
|
||||
// (either to apply it or to heal it back if the clocks realign)
|
||||
if r.ClientSkew != nil {
|
||||
if resultSkew, ok := awsmiddle.GetAttemptSkew(metadata); ok {
|
||||
r.ClientSkew.Store(resultSkew.Nanoseconds())
|
||||
}
|
||||
}
|
||||
|
||||
addAttemptResults(&metadata, attemptResults)
|
||||
return out, metadata, err
|
||||
}
|
||||
|
||||
+22
@@ -1,3 +1,25 @@
|
||||
# v1.32.17 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.32.16 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.32.15 (2026-04-16)
|
||||
|
||||
* No change notes available for this release.
|
||||
|
||||
# v1.32.14 (2026-04-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.32.13 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.32.12 (2026-03-13)
|
||||
|
||||
* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package config
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.32.12"
|
||||
const goModuleVersion = "1.32.17"
|
||||
|
||||
Generated
Vendored
Generated
Vendored
Generated
Vendored
Generated
Vendored
Generated
Vendored
Generated
Vendored
Generated
Vendored
Generated
Vendored
+1
-1
@@ -12,8 +12,8 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
"github.com/aws/aws-sdk-go-v2/config/internal/ini"
|
||||
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/ini"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/shareddefaults"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
smithyrequestcompression "github.com/aws/smithy-go/private/requestcompression"
|
||||
|
||||
+18
@@ -1,3 +1,21 @@
|
||||
# v1.19.16 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.19.15 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.19.14 (2026-04-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.19.13 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.19.12 (2026-03-13)
|
||||
|
||||
* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package credentials
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.19.12"
|
||||
const goModuleVersion = "1.19.16"
|
||||
|
||||
+14
@@ -1,3 +1,17 @@
|
||||
# v1.18.23 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.18.22 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.18.21 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.18.20 (2026-03-13)
|
||||
|
||||
* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package imds
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.18.20"
|
||||
const goModuleVersion = "1.18.23"
|
||||
|
||||
+14
@@ -1,3 +1,17 @@
|
||||
# v1.4.23 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.22 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.21 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.20 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package configsources
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.4.20"
|
||||
const goModuleVersion = "1.4.23"
|
||||
|
||||
+14
@@ -1,3 +1,17 @@
|
||||
# v2.7.23 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v2.7.22 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v2.7.21 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v2.7.20 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package endpoints
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "2.7.20"
|
||||
const goModuleVersion = "2.7.23"
|
||||
|
||||
-296
@@ -1,296 +0,0 @@
|
||||
# v1.8.6 (2026-03-13)
|
||||
|
||||
* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
|
||||
|
||||
# v1.8.5 (2026-03-03)
|
||||
|
||||
* **Bug Fix**: Modernize non codegen files with go fix
|
||||
* **Dependency Update**: Bump minimum Go version to 1.24
|
||||
|
||||
# v1.8.4 (2025-10-16)
|
||||
|
||||
* **Dependency Update**: Bump minimum Go version to 1.23.
|
||||
|
||||
# v1.8.3 (2025-02-18)
|
||||
|
||||
* **Bug Fix**: Bump go version to 1.22
|
||||
|
||||
# v1.8.2 (2025-01-24)
|
||||
|
||||
* **Bug Fix**: Refactor filepath.Walk to filepath.WalkDir
|
||||
|
||||
# v1.8.1 (2024-08-15)
|
||||
|
||||
* **Dependency Update**: Bump minimum Go version to 1.21.
|
||||
|
||||
# v1.8.0 (2024-02-13)
|
||||
|
||||
* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
|
||||
|
||||
# v1.7.3 (2024-01-22)
|
||||
|
||||
* **Bug Fix**: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.
|
||||
|
||||
# v1.7.2 (2023-12-08)
|
||||
|
||||
* **Bug Fix**: Correct loading of [services *] sections into shared config.
|
||||
|
||||
# v1.7.1 (2023-11-16)
|
||||
|
||||
* **Bug Fix**: Fix recognition of trailing comments in shared config properties. # or ; separators that aren't preceded by whitespace at the end of a property value should be considered part of it.
|
||||
|
||||
# v1.7.0 (2023-11-13)
|
||||
|
||||
* **Feature**: Replace the legacy config parser with a modern, less-strict implementation. Parsing failures within a section will now simply ignore the invalid line rather than silently drop the entire section.
|
||||
|
||||
# v1.6.0 (2023-11-09.2)
|
||||
|
||||
* **Feature**: BREAKFIX: In order to support subproperty parsing, invalid property definitions must not be ignored
|
||||
|
||||
# v1.5.2 (2023-11-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.5.1 (2023-11-07)
|
||||
|
||||
* **Bug Fix**: Fix subproperty performance regression
|
||||
|
||||
# v1.5.0 (2023-11-01)
|
||||
|
||||
* **Feature**: Adds support for configured endpoints via environment variables and the AWS shared configuration file.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.0 (2023-10-31)
|
||||
|
||||
* **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.45 (2023-10-12)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.44 (2023-10-06)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.43 (2023-09-22)
|
||||
|
||||
* **Bug Fix**: Fixed a bug where merging `max_attempts` or `duration_seconds` fields across shared config files with invalid values would silently default them to 0.
|
||||
* **Bug Fix**: Move type assertion of config values out of the parsing stage, which resolves an issue where the contents of a profile would silently be dropped with certain numeric formats.
|
||||
|
||||
# v1.3.42 (2023-08-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.41 (2023-08-18)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.40 (2023-08-17)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.39 (2023-08-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.38 (2023-07-31)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.37 (2023-07-28)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.36 (2023-07-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.35 (2023-06-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.34 (2023-04-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.33 (2023-04-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.32 (2023-03-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.31 (2023-03-10)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.30 (2023-02-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.29 (2023-02-03)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.28 (2022-12-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.27 (2022-12-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.26 (2022-10-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.25 (2022-10-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.24 (2022-09-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.23 (2022-09-14)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.22 (2022-09-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.21 (2022-08-31)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.20 (2022-08-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.19 (2022-08-11)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.18 (2022-08-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.17 (2022-08-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.16 (2022-08-01)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.15 (2022-07-05)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.14 (2022-06-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.13 (2022-06-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.12 (2022-05-17)
|
||||
|
||||
* **Bug Fix**: Removes the fuzz testing files from the module, as they are invalid and not used.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.11 (2022-04-25)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.10 (2022-03-30)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.9 (2022-03-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.8 (2022-03-23)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.7 (2022-03-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.6 (2022-02-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.5 (2022-01-28)
|
||||
|
||||
* **Bug Fix**: Fixes the SDK's handling of `duration_sections` in the shared credentials file or specified in multiple shared config and shared credentials files under the same profile. [#1568](https://github.com/aws/aws-sdk-go-v2/pull/1568). Thanks to [Amir Szekely](https://github.com/kichik) for help reproduce this bug.
|
||||
|
||||
# v1.3.4 (2022-01-14)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.3 (2022-01-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.2 (2021-12-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.1 (2021-11-19)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.0 (2021-11-06)
|
||||
|
||||
* **Feature**: The SDK now supports configuration of FIPS and DualStack endpoints using environment variables, shared configuration, or programmatically.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.5 (2021-10-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.4 (2021-10-11)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.3 (2021-09-17)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.2 (2021-08-27)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.1 (2021-08-19)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.0 (2021-08-04)
|
||||
|
||||
* **Feature**: adds error handling for defered close calls
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.1 (2021-07-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.0 (2021-07-01)
|
||||
|
||||
* **Feature**: Support for `:`, `=`, `[`, `]` being present in expression values.
|
||||
|
||||
# v1.0.1 (2021-06-25)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.0 (2021-05-20)
|
||||
|
||||
* **Release**: The `github.com/aws/aws-sdk-go-v2/internal/ini` package is now a Go Module.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
-42
@@ -1,42 +0,0 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
|
||||
"github.com/aws/smithy-go/middleware"
|
||||
)
|
||||
|
||||
// AddTimeOffsetMiddleware sets a value representing clock skew on the request context.
|
||||
// This can be read by other operations (such as signing) to correct the date value they send
|
||||
// on the request
|
||||
type AddTimeOffsetMiddleware struct {
|
||||
Offset *atomic.Int64
|
||||
}
|
||||
|
||||
// ID the identifier for AddTimeOffsetMiddleware
|
||||
func (m *AddTimeOffsetMiddleware) ID() string { return "AddTimeOffsetMiddleware" }
|
||||
|
||||
// HandleBuild sets a value for attemptSkew on the request context if one is set on the client.
|
||||
func (m AddTimeOffsetMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
|
||||
out middleware.BuildOutput, metadata middleware.Metadata, err error,
|
||||
) {
|
||||
if m.Offset != nil {
|
||||
offset := time.Duration(m.Offset.Load())
|
||||
ctx = internalcontext.SetAttemptSkewContext(ctx, offset)
|
||||
}
|
||||
return next.HandleBuild(ctx, in)
|
||||
}
|
||||
|
||||
// HandleDeserialize gets the clock skew context from the context, and if set, sets it on the pointer
|
||||
// held by AddTimeOffsetMiddleware
|
||||
func (m *AddTimeOffsetMiddleware) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
|
||||
out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
|
||||
) {
|
||||
if v := internalcontext.GetAttemptSkewContext(ctx); v != 0 {
|
||||
m.Offset.Store(v.Nanoseconds())
|
||||
}
|
||||
return next.HandleDeserialize(ctx, in)
|
||||
}
|
||||
+460
@@ -0,0 +1,460 @@
|
||||
# v1.4.24 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.23 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.22 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.21 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.20 (2026-03-05)
|
||||
|
||||
* **Bug Fix**: Read the correct auth property for SigV4A signing names.
|
||||
|
||||
# v1.4.19 (2026-03-03)
|
||||
|
||||
* **Bug Fix**: Modernize non codegen files with go fix
|
||||
* **Dependency Update**: Bump minimum Go version to 1.24
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.18 (2026-02-23)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.17 (2026-01-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.16 (2025-12-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.15 (2025-12-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
* **Dependency Update**: Upgrade to smithy-go v1.24.0. Notably this version of the library reduces the allocation footprint of the middleware system. We observe a ~10% reduction in allocations per SDK call with this change.
|
||||
|
||||
# v1.4.14 (2025-11-19.2)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.13 (2025-11-04)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
* **Dependency Update**: Upgrade to smithy-go v1.23.2 which should convey some passive reduction of overall allocations, especially when not using the metrics system.
|
||||
|
||||
# v1.4.12 (2025-10-30)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.11 (2025-10-23)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.10 (2025-10-16)
|
||||
|
||||
* **Dependency Update**: Bump minimum Go version to 1.23.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.9 (2025-09-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.8 (2025-09-23)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.7 (2025-09-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.6 (2025-08-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.5 (2025-08-27)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.23.0.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.4 (2025-08-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.3 (2025-08-11)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.2 (2025-08-04)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.1 (2025-07-30)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.4.0 (2025-07-28)
|
||||
|
||||
* **Feature**: Add support for HTTP interceptors.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.37 (2025-07-19)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.36 (2025-06-17)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.22.4.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.35 (2025-06-10)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.34 (2025-02-27)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.33 (2025-02-18)
|
||||
|
||||
* **Bug Fix**: Bump go version to 1.22
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.32 (2025-02-05)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.31 (2025-01-31)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.30 (2025-01-30)
|
||||
|
||||
* **Bug Fix**: Do not sign Transfer-Encoding header in Sigv4[a]. Fixes a signer mismatch issue with S3 Accelerate.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.29 (2025-01-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
* **Dependency Update**: Upgrade to smithy-go v1.22.2.
|
||||
|
||||
# v1.3.28 (2025-01-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.27 (2025-01-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.26 (2024-12-19)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.25 (2024-12-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.24 (2024-11-18)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.22.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.23 (2024-11-06)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.22 (2024-10-28)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.21 (2024-10-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.20 (2024-10-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.19 (2024-10-04)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.18 (2024-09-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.17 (2024-09-03)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.16 (2024-08-15)
|
||||
|
||||
* **Dependency Update**: Bump minimum Go version to 1.21.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.15 (2024-07-10.2)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.14 (2024-07-10)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.13 (2024-06-28)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.12 (2024-06-19)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.11 (2024-06-18)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.10 (2024-06-17)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.9 (2024-06-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.8 (2024-06-03)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.7 (2024-05-16)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.6 (2024-05-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.5 (2024-03-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.4 (2024-03-18)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.3 (2024-03-07)
|
||||
|
||||
* **Bug Fix**: Remove dependency on go-cmp.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.2 (2024-02-23)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.1 (2024-02-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.3.0 (2024-02-13)
|
||||
|
||||
* **Feature**: Bump minimum Go version to 1.20 per our language support policy.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.10 (2024-01-04)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.9 (2023-12-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.8 (2023-12-01)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.7 (2023-11-30)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.6 (2023-11-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.5 (2023-11-28.2)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.4 (2023-11-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.3 (2023-11-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.2 (2023-11-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.1 (2023-11-01)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.2.0 (2023-10-31)
|
||||
|
||||
* **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.6 (2023-10-12)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.5 (2023-10-06)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.4 (2023-08-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.3 (2023-08-18)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.2 (2023-08-17)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.1 (2023-08-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.1.0 (2023-07-31)
|
||||
|
||||
* **Feature**: Adds support for smithy-modeled endpoint resolution. A new rules-based endpoint resolution will be added to the SDK which will supercede and deprecate existing endpoint resolution. Specifically, EndpointResolver will be deprecated while BaseEndpoint and EndpointResolverV2 will take its place. For more information, please see the Endpoints section in our Developer Guide.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.28 (2023-07-28)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.27 (2023-07-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.26 (2023-06-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.25 (2023-04-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.24 (2023-04-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.23 (2023-03-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.22 (2023-03-10)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.21 (2023-02-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.20 (2023-02-14)
|
||||
|
||||
* No change notes available for this release.
|
||||
|
||||
# v1.0.19 (2023-02-03)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.18 (2022-12-15)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.17 (2022-12-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.16 (2022-10-24)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.15 (2022-10-21)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.14 (2022-09-20)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.13 (2022-09-14)
|
||||
|
||||
* **Bug Fix**: Fixes an issues where an error from an underlying SigV4 credential provider would not be surfaced from the SigV4a credential provider. Contribution by [sakthipriyan-aqfer](https://github.com/sakthipriyan-aqfer).
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.12 (2022-09-02)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.11 (2022-08-31)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.10 (2022-08-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.9 (2022-08-11)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.8 (2022-08-09)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.7 (2022-08-08)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.6 (2022-08-01)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.5 (2022-07-05)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.4 (2022-06-29)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.3 (2022-06-07)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.2 (2022-05-17)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.1 (2022-04-25)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.0 (2022-04-07)
|
||||
|
||||
* **Release**: New internal v4a signing module location.
|
||||
|
||||
Generated
Vendored
+141
@@ -0,0 +1,141 @@
|
||||
package v4a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ecdsa"
|
||||
"fmt"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/sdk"
|
||||
)
|
||||
|
||||
// Credentials is Context, ECDSA, and Optional Session Token that can be used
|
||||
// to sign requests using SigV4a
|
||||
type Credentials struct {
|
||||
Context string
|
||||
PrivateKey *ecdsa.PrivateKey
|
||||
SessionToken string
|
||||
|
||||
// Time the credentials will expire.
|
||||
CanExpire bool
|
||||
Expires time.Time
|
||||
}
|
||||
|
||||
// Expired returns if the credentials have expired.
|
||||
func (v Credentials) Expired() bool {
|
||||
if v.CanExpire {
|
||||
return !v.Expires.After(sdk.NowTime())
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// HasKeys returns if the credentials keys are set.
|
||||
func (v Credentials) HasKeys() bool {
|
||||
return len(v.Context) > 0 && v.PrivateKey != nil
|
||||
}
|
||||
|
||||
// SymmetricCredentialAdaptor wraps a SigV4 AccessKey/SecretKey provider and adapts the credentials
|
||||
// to a ECDSA PrivateKey for signing with SiV4a
|
||||
type SymmetricCredentialAdaptor struct {
|
||||
SymmetricProvider aws.CredentialsProvider
|
||||
|
||||
asymmetric atomic.Value
|
||||
m sync.Mutex
|
||||
}
|
||||
|
||||
// Retrieve retrieves symmetric credentials from the underlying provider.
|
||||
func (s *SymmetricCredentialAdaptor) Retrieve(ctx context.Context) (aws.Credentials, error) {
|
||||
symCreds, err := s.retrieveFromSymmetricProvider(ctx)
|
||||
if err != nil {
|
||||
return aws.Credentials{}, err
|
||||
}
|
||||
|
||||
if asymCreds := s.getCreds(); asymCreds == nil {
|
||||
return symCreds, nil
|
||||
}
|
||||
|
||||
s.m.Lock()
|
||||
defer s.m.Unlock()
|
||||
|
||||
asymCreds := s.getCreds()
|
||||
if asymCreds == nil {
|
||||
return symCreds, nil
|
||||
}
|
||||
|
||||
// if the context does not match the access key id clear it
|
||||
if asymCreds.Context != symCreds.AccessKeyID {
|
||||
s.asymmetric.Store((*Credentials)(nil))
|
||||
}
|
||||
|
||||
return symCreds, nil
|
||||
}
|
||||
|
||||
// RetrievePrivateKey returns credentials suitable for SigV4a signing
|
||||
func (s *SymmetricCredentialAdaptor) RetrievePrivateKey(ctx context.Context) (Credentials, error) {
|
||||
if asymCreds := s.getCreds(); asymCreds != nil {
|
||||
return *asymCreds, nil
|
||||
}
|
||||
|
||||
s.m.Lock()
|
||||
defer s.m.Unlock()
|
||||
|
||||
if asymCreds := s.getCreds(); asymCreds != nil {
|
||||
return *asymCreds, nil
|
||||
}
|
||||
|
||||
symmetricCreds, err := s.retrieveFromSymmetricProvider(ctx)
|
||||
if err != nil {
|
||||
return Credentials{}, fmt.Errorf("failed to retrieve symmetric credentials: %v", err)
|
||||
}
|
||||
|
||||
privateKey, err := deriveKeyFromAccessKeyPair(symmetricCreds.AccessKeyID, symmetricCreds.SecretAccessKey)
|
||||
if err != nil {
|
||||
return Credentials{}, fmt.Errorf("failed to derive assymetric key from credentials")
|
||||
}
|
||||
|
||||
creds := Credentials{
|
||||
Context: symmetricCreds.AccessKeyID,
|
||||
PrivateKey: privateKey,
|
||||
SessionToken: symmetricCreds.SessionToken,
|
||||
CanExpire: symmetricCreds.CanExpire,
|
||||
Expires: symmetricCreds.Expires,
|
||||
}
|
||||
|
||||
s.asymmetric.Store(&creds)
|
||||
|
||||
return creds, nil
|
||||
}
|
||||
|
||||
func (s *SymmetricCredentialAdaptor) getCreds() *Credentials {
|
||||
v := s.asymmetric.Load()
|
||||
|
||||
if v == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
c := v.(*Credentials)
|
||||
if c != nil && c.HasKeys() && !c.Expired() {
|
||||
return c
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *SymmetricCredentialAdaptor) retrieveFromSymmetricProvider(ctx context.Context) (aws.Credentials, error) {
|
||||
credentials, err := s.SymmetricProvider.Retrieve(ctx)
|
||||
if err != nil {
|
||||
return aws.Credentials{}, err
|
||||
}
|
||||
|
||||
return credentials, nil
|
||||
}
|
||||
|
||||
// CredentialsProvider is the interface for a provider to retrieve credentials
|
||||
// to sign requests with.
|
||||
type CredentialsProvider interface {
|
||||
RetrievePrivateKey(context.Context) (Credentials, error)
|
||||
}
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
package v4a
|
||||
|
||||
import "fmt"
|
||||
|
||||
// SigningError indicates an error condition occurred while performing SigV4a signing
|
||||
type SigningError struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
func (e *SigningError) Error() string {
|
||||
return fmt.Sprintf("failed to sign request: %v", e.Err)
|
||||
}
|
||||
|
||||
// Unwrap returns the underlying error cause
|
||||
func (e *SigningError) Unwrap() error {
|
||||
return e.Err
|
||||
}
|
||||
Generated
Vendored
+2
-2
@@ -1,6 +1,6 @@
|
||||
// Code generated by internal/repotools/cmd/updatemodulemeta DO NOT EDIT.
|
||||
|
||||
package ini
|
||||
package v4a
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.8.6"
|
||||
const goModuleVersion = "1.4.24"
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
package crypto
|
||||
|
||||
import "fmt"
|
||||
|
||||
// ConstantTimeByteCompare is a constant-time byte comparison of x and y. This function performs an absolute comparison
|
||||
// if the two byte slices assuming they represent a big-endian number.
|
||||
//
|
||||
// error if len(x) != len(y)
|
||||
// -1 if x < y
|
||||
// 0 if x == y
|
||||
// +1 if x > y
|
||||
func ConstantTimeByteCompare(x, y []byte) (int, error) {
|
||||
if len(x) != len(y) {
|
||||
return 0, fmt.Errorf("slice lengths do not match")
|
||||
}
|
||||
|
||||
xLarger, yLarger := 0, 0
|
||||
|
||||
for i := 0; i < len(x); i++ {
|
||||
xByte, yByte := int(x[i]), int(y[i])
|
||||
|
||||
x := ((yByte - xByte) >> 8) & 1
|
||||
y := ((xByte - yByte) >> 8) & 1
|
||||
|
||||
xLarger |= x &^ yLarger
|
||||
yLarger |= y &^ xLarger
|
||||
}
|
||||
|
||||
return xLarger - yLarger, nil
|
||||
}
|
||||
+113
@@ -0,0 +1,113 @@
|
||||
package crypto
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/hmac"
|
||||
"encoding/asn1"
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"hash"
|
||||
"math"
|
||||
"math/big"
|
||||
)
|
||||
|
||||
type ecdsaSignature struct {
|
||||
R, S *big.Int
|
||||
}
|
||||
|
||||
// ECDSAKey takes the given elliptic curve, and private key (d) byte slice
|
||||
// and returns the private ECDSA key.
|
||||
func ECDSAKey(curve elliptic.Curve, d []byte) *ecdsa.PrivateKey {
|
||||
return ECDSAKeyFromPoint(curve, (&big.Int{}).SetBytes(d))
|
||||
}
|
||||
|
||||
// ECDSAKeyFromPoint takes the given elliptic curve and point and returns the
|
||||
// private and public keypair
|
||||
func ECDSAKeyFromPoint(curve elliptic.Curve, d *big.Int) *ecdsa.PrivateKey {
|
||||
pX, pY := curve.ScalarBaseMult(d.Bytes())
|
||||
|
||||
privKey := &ecdsa.PrivateKey{
|
||||
PublicKey: ecdsa.PublicKey{
|
||||
Curve: curve,
|
||||
X: pX,
|
||||
Y: pY,
|
||||
},
|
||||
D: d,
|
||||
}
|
||||
|
||||
return privKey
|
||||
}
|
||||
|
||||
// ECDSAPublicKey takes the provide curve and (x, y) coordinates and returns
|
||||
// *ecdsa.PublicKey. Returns an error if the given points are not on the curve.
|
||||
func ECDSAPublicKey(curve elliptic.Curve, x, y []byte) (*ecdsa.PublicKey, error) {
|
||||
xPoint := (&big.Int{}).SetBytes(x)
|
||||
yPoint := (&big.Int{}).SetBytes(y)
|
||||
|
||||
if !curve.IsOnCurve(xPoint, yPoint) {
|
||||
return nil, fmt.Errorf("point(%v, %v) is not on the given curve", xPoint.String(), yPoint.String())
|
||||
}
|
||||
|
||||
return &ecdsa.PublicKey{
|
||||
Curve: curve,
|
||||
X: xPoint,
|
||||
Y: yPoint,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// VerifySignature takes the provided public key, hash, and asn1 encoded signature and returns
|
||||
// whether the given signature is valid.
|
||||
func VerifySignature(key *ecdsa.PublicKey, hash []byte, signature []byte) (bool, error) {
|
||||
var ecdsaSignature ecdsaSignature
|
||||
|
||||
_, err := asn1.Unmarshal(signature, &ecdsaSignature)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
return ecdsa.Verify(key, hash, ecdsaSignature.R, ecdsaSignature.S), nil
|
||||
}
|
||||
|
||||
// HMACKeyDerivation provides an implementation of a NIST-800-108 of a KDF (Key Derivation Function) in Counter Mode.
|
||||
// For the purposes of this implantation HMAC is used as the PRF (Pseudorandom function), where the value of
|
||||
// `r` is defined as a 4 byte counter.
|
||||
func HMACKeyDerivation(hash func() hash.Hash, bitLen int, key []byte, label, context []byte) ([]byte, error) {
|
||||
// verify that we won't overflow the counter
|
||||
n := int64(math.Ceil((float64(bitLen) / 8) / float64(hash().Size())))
|
||||
if n > 0x7FFFFFFF {
|
||||
return nil, fmt.Errorf("unable to derive key of size %d using 32-bit counter", bitLen)
|
||||
}
|
||||
|
||||
// verify the requested bit length is not larger then the length encoding size
|
||||
if int64(bitLen) > 0x7FFFFFFF {
|
||||
return nil, fmt.Errorf("bitLen is greater than 32-bits")
|
||||
}
|
||||
|
||||
fixedInput := bytes.NewBuffer(nil)
|
||||
fixedInput.Write(label)
|
||||
fixedInput.WriteByte(0x00)
|
||||
fixedInput.Write(context)
|
||||
if err := binary.Write(fixedInput, binary.BigEndian, int32(bitLen)); err != nil {
|
||||
return nil, fmt.Errorf("failed to write bit length to fixed input string: %v", err)
|
||||
}
|
||||
|
||||
var output []byte
|
||||
|
||||
h := hmac.New(hash, key)
|
||||
|
||||
for i := int64(1); i <= n; i++ {
|
||||
h.Reset()
|
||||
if err := binary.Write(h, binary.BigEndian, int32(i)); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
_, err := h.Write(fixedInput.Bytes())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
output = append(output, h.Sum(nil)...)
|
||||
}
|
||||
|
||||
return output[:bitLen/8], nil
|
||||
}
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
package v4
|
||||
|
||||
const (
|
||||
// EmptyStringSHA256 is the hex encoded sha256 value of an empty string
|
||||
EmptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
|
||||
|
||||
// UnsignedPayload indicates that the request payload body is unsigned
|
||||
UnsignedPayload = "UNSIGNED-PAYLOAD"
|
||||
|
||||
// AmzAlgorithmKey indicates the signing algorithm
|
||||
AmzAlgorithmKey = "X-Amz-Algorithm"
|
||||
|
||||
// AmzSecurityTokenKey indicates the security token to be used with temporary credentials
|
||||
AmzSecurityTokenKey = "X-Amz-Security-Token"
|
||||
|
||||
// AmzDateKey is the UTC timestamp for the request in the format YYYYMMDD'T'HHMMSS'Z'
|
||||
AmzDateKey = "X-Amz-Date"
|
||||
|
||||
// AmzCredentialKey is the access key ID and credential scope
|
||||
AmzCredentialKey = "X-Amz-Credential"
|
||||
|
||||
// AmzSignedHeadersKey is the set of headers signed for the request
|
||||
AmzSignedHeadersKey = "X-Amz-SignedHeaders"
|
||||
|
||||
// AmzSignatureKey is the query parameter to store the SigV4 signature
|
||||
AmzSignatureKey = "X-Amz-Signature"
|
||||
|
||||
// TimeFormat is the time format to be used in the X-Amz-Date header or query parameter
|
||||
TimeFormat = "20060102T150405Z"
|
||||
|
||||
// ShortTimeFormat is the shorten time format used in the credential scope
|
||||
ShortTimeFormat = "20060102"
|
||||
|
||||
// ContentSHAKey is the SHA256 of request body
|
||||
ContentSHAKey = "X-Amz-Content-Sha256"
|
||||
)
|
||||
+82
@@ -0,0 +1,82 @@
|
||||
package v4
|
||||
|
||||
import (
|
||||
sdkstrings "github.com/aws/aws-sdk-go-v2/internal/strings"
|
||||
)
|
||||
|
||||
// Rules houses a set of Rule needed for validation of a
|
||||
// string value
|
||||
type Rules []Rule
|
||||
|
||||
// Rule interface allows for more flexible rules and just simply
|
||||
// checks whether or not a value adheres to that Rule
|
||||
type Rule interface {
|
||||
IsValid(value string) bool
|
||||
}
|
||||
|
||||
// IsValid will iterate through all rules and see if any rules
|
||||
// apply to the value and supports nested rules
|
||||
func (r Rules) IsValid(value string) bool {
|
||||
for _, rule := range r {
|
||||
if rule.IsValid(value) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// MapRule generic Rule for maps
|
||||
type MapRule map[string]struct{}
|
||||
|
||||
// IsValid for the map Rule satisfies whether it exists in the map
|
||||
func (m MapRule) IsValid(value string) bool {
|
||||
_, ok := m[value]
|
||||
return ok
|
||||
}
|
||||
|
||||
// AllowList is a generic Rule for whitelisting
|
||||
type AllowList struct {
|
||||
Rule
|
||||
}
|
||||
|
||||
// IsValid for AllowList checks if the value is within the AllowList
|
||||
func (w AllowList) IsValid(value string) bool {
|
||||
return w.Rule.IsValid(value)
|
||||
}
|
||||
|
||||
// DenyList is a generic Rule for blacklisting
|
||||
type DenyList struct {
|
||||
Rule
|
||||
}
|
||||
|
||||
// IsValid for AllowList checks if the value is within the AllowList
|
||||
func (b DenyList) IsValid(value string) bool {
|
||||
return !b.Rule.IsValid(value)
|
||||
}
|
||||
|
||||
// Patterns is a list of strings to match against
|
||||
type Patterns []string
|
||||
|
||||
// IsValid for Patterns checks each pattern and returns if a match has
|
||||
// been found
|
||||
func (p Patterns) IsValid(value string) bool {
|
||||
for _, pattern := range p {
|
||||
if sdkstrings.HasPrefixFold(value, pattern) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// InclusiveRules rules allow for rules to depend on one another
|
||||
type InclusiveRules []Rule
|
||||
|
||||
// IsValid will return true if all rules are true
|
||||
func (r InclusiveRules) IsValid(value string) bool {
|
||||
for _, rule := range r {
|
||||
if !rule.IsValid(value) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
package v4
|
||||
|
||||
// IgnoredHeaders is a list of headers that are ignored during signing
|
||||
var IgnoredHeaders = Rules{
|
||||
DenyList{
|
||||
MapRule{
|
||||
"Authorization": struct{}{},
|
||||
"User-Agent": struct{}{},
|
||||
"X-Amzn-Trace-Id": struct{}{},
|
||||
"Transfer-Encoding": struct{}{},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
// RequiredSignedHeaders is a whitelist for Build canonical headers.
|
||||
var RequiredSignedHeaders = Rules{
|
||||
AllowList{
|
||||
MapRule{
|
||||
"Cache-Control": struct{}{},
|
||||
"Content-Disposition": struct{}{},
|
||||
"Content-Encoding": struct{}{},
|
||||
"Content-Language": struct{}{},
|
||||
"Content-Md5": struct{}{},
|
||||
"Content-Type": struct{}{},
|
||||
"Expires": struct{}{},
|
||||
"If-Match": struct{}{},
|
||||
"If-Modified-Since": struct{}{},
|
||||
"If-None-Match": struct{}{},
|
||||
"If-Unmodified-Since": struct{}{},
|
||||
"Range": struct{}{},
|
||||
"X-Amz-Acl": struct{}{},
|
||||
"X-Amz-Copy-Source": struct{}{},
|
||||
"X-Amz-Copy-Source-If-Match": struct{}{},
|
||||
"X-Amz-Copy-Source-If-Modified-Since": struct{}{},
|
||||
"X-Amz-Copy-Source-If-None-Match": struct{}{},
|
||||
"X-Amz-Copy-Source-If-Unmodified-Since": struct{}{},
|
||||
"X-Amz-Copy-Source-Range": struct{}{},
|
||||
"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": struct{}{},
|
||||
"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key": struct{}{},
|
||||
"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5": struct{}{},
|
||||
"X-Amz-Grant-Full-control": struct{}{},
|
||||
"X-Amz-Grant-Read": struct{}{},
|
||||
"X-Amz-Grant-Read-Acp": struct{}{},
|
||||
"X-Amz-Grant-Write": struct{}{},
|
||||
"X-Amz-Grant-Write-Acp": struct{}{},
|
||||
"X-Amz-Metadata-Directive": struct{}{},
|
||||
"X-Amz-Mfa": struct{}{},
|
||||
"X-Amz-Request-Payer": struct{}{},
|
||||
"X-Amz-Server-Side-Encryption": struct{}{},
|
||||
"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id": struct{}{},
|
||||
"X-Amz-Server-Side-Encryption-Customer-Algorithm": struct{}{},
|
||||
"X-Amz-Server-Side-Encryption-Customer-Key": struct{}{},
|
||||
"X-Amz-Server-Side-Encryption-Customer-Key-Md5": struct{}{},
|
||||
"X-Amz-Storage-Class": struct{}{},
|
||||
"X-Amz-Website-Redirect-Location": struct{}{},
|
||||
"X-Amz-Content-Sha256": struct{}{},
|
||||
"X-Amz-Tagging": struct{}{},
|
||||
},
|
||||
},
|
||||
Patterns{"X-Amz-Meta-"},
|
||||
}
|
||||
|
||||
// AllowedQueryHoisting is a whitelist for Build query headers. The boolean value
|
||||
// represents whether or not it is a pattern.
|
||||
var AllowedQueryHoisting = InclusiveRules{
|
||||
DenyList{RequiredSignedHeaders},
|
||||
Patterns{"X-Amz-"},
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
package v4
|
||||
|
||||
import (
|
||||
"crypto/hmac"
|
||||
"crypto/sha256"
|
||||
)
|
||||
|
||||
// HMACSHA256 computes a HMAC-SHA256 of data given the provided key.
|
||||
func HMACSHA256(key []byte, data []byte) []byte {
|
||||
hash := hmac.New(sha256.New, key)
|
||||
hash.Write(data)
|
||||
return hash.Sum(nil)
|
||||
}
|
||||
+75
@@ -0,0 +1,75 @@
|
||||
package v4
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// SanitizeHostForHeader removes default port from host and updates request.Host
|
||||
func SanitizeHostForHeader(r *http.Request) {
|
||||
host := getHost(r)
|
||||
port := portOnly(host)
|
||||
if port != "" && isDefaultPort(r.URL.Scheme, port) {
|
||||
r.Host = stripPort(host)
|
||||
}
|
||||
}
|
||||
|
||||
// Returns host from request
|
||||
func getHost(r *http.Request) string {
|
||||
if r.Host != "" {
|
||||
return r.Host
|
||||
}
|
||||
|
||||
return r.URL.Host
|
||||
}
|
||||
|
||||
// Hostname returns u.Host, without any port number.
|
||||
//
|
||||
// If Host is an IPv6 literal with a port number, Hostname returns the
|
||||
// IPv6 literal without the square brackets. IPv6 literals may include
|
||||
// a zone identifier.
|
||||
//
|
||||
// Copied from the Go 1.8 standard library (net/url)
|
||||
func stripPort(hostport string) string {
|
||||
colon := strings.IndexByte(hostport, ':')
|
||||
if colon == -1 {
|
||||
return hostport
|
||||
}
|
||||
if i := strings.IndexByte(hostport, ']'); i != -1 {
|
||||
return strings.TrimPrefix(hostport[:i], "[")
|
||||
}
|
||||
return hostport[:colon]
|
||||
}
|
||||
|
||||
// Port returns the port part of u.Host, without the leading colon.
|
||||
// If u.Host doesn't contain a port, Port returns an empty string.
|
||||
//
|
||||
// Copied from the Go 1.8 standard library (net/url)
|
||||
func portOnly(hostport string) string {
|
||||
colon := strings.IndexByte(hostport, ':')
|
||||
if colon == -1 {
|
||||
return ""
|
||||
}
|
||||
if i := strings.Index(hostport, "]:"); i != -1 {
|
||||
return hostport[i+len("]:"):]
|
||||
}
|
||||
if strings.Contains(hostport, "]") {
|
||||
return ""
|
||||
}
|
||||
return hostport[colon+len(":"):]
|
||||
}
|
||||
|
||||
// Returns true if the specified URI is using the standard port
|
||||
// (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
|
||||
func isDefaultPort(scheme, port string) bool {
|
||||
if port == "" {
|
||||
return true
|
||||
}
|
||||
|
||||
lowerCaseScheme := strings.ToLower(scheme)
|
||||
if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
|
||||
return true
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
package v4
|
||||
|
||||
import "time"
|
||||
|
||||
// SigningTime provides a wrapper around a time.Time which provides cached values for SigV4 signing.
|
||||
type SigningTime struct {
|
||||
time.Time
|
||||
timeFormat string
|
||||
shortTimeFormat string
|
||||
}
|
||||
|
||||
// NewSigningTime creates a new SigningTime given a time.Time
|
||||
func NewSigningTime(t time.Time) SigningTime {
|
||||
return SigningTime{
|
||||
Time: t,
|
||||
}
|
||||
}
|
||||
|
||||
// TimeFormat provides a time formatted in the X-Amz-Date format.
|
||||
func (m *SigningTime) TimeFormat() string {
|
||||
return m.format(&m.timeFormat, TimeFormat)
|
||||
}
|
||||
|
||||
// ShortTimeFormat provides a time formatted of 20060102.
|
||||
func (m *SigningTime) ShortTimeFormat() string {
|
||||
return m.format(&m.shortTimeFormat, ShortTimeFormat)
|
||||
}
|
||||
|
||||
func (m *SigningTime) format(target *string, format string) string {
|
||||
if len(*target) > 0 {
|
||||
return *target
|
||||
}
|
||||
v := m.Time.Format(format)
|
||||
*target = v
|
||||
return v
|
||||
}
|
||||
+64
@@ -0,0 +1,64 @@
|
||||
package v4
|
||||
|
||||
import (
|
||||
"net/url"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const doubleSpace = " "
|
||||
|
||||
// StripExcessSpaces will rewrite the passed in slice's string values to not
|
||||
// contain muliple side-by-side spaces.
|
||||
func StripExcessSpaces(str string) string {
|
||||
var j, k, l, m, spaces int
|
||||
// Trim trailing spaces
|
||||
for j = len(str) - 1; j >= 0 && str[j] == ' '; j-- {
|
||||
}
|
||||
|
||||
// Trim leading spaces
|
||||
for k = 0; k < j && str[k] == ' '; k++ {
|
||||
}
|
||||
str = str[k : j+1]
|
||||
|
||||
// Strip multiple spaces.
|
||||
j = strings.Index(str, doubleSpace)
|
||||
if j < 0 {
|
||||
return str
|
||||
}
|
||||
|
||||
buf := []byte(str)
|
||||
for k, m, l = j, j, len(buf); k < l; k++ {
|
||||
if buf[k] == ' ' {
|
||||
if spaces == 0 {
|
||||
// First space.
|
||||
buf[m] = buf[k]
|
||||
m++
|
||||
}
|
||||
spaces++
|
||||
} else {
|
||||
// End of multiple spaces.
|
||||
spaces = 0
|
||||
buf[m] = buf[k]
|
||||
m++
|
||||
}
|
||||
}
|
||||
|
||||
return string(buf[:m])
|
||||
}
|
||||
|
||||
// GetURIPath returns the escaped URI component from the provided URL
|
||||
func GetURIPath(u *url.URL) string {
|
||||
var uri string
|
||||
|
||||
if len(u.Opaque) > 0 {
|
||||
uri = "/" + strings.Join(strings.Split(u.Opaque, "/")[3:], "/")
|
||||
} else {
|
||||
uri = u.EscapedPath()
|
||||
}
|
||||
|
||||
if len(uri) == 0 {
|
||||
uri = "/"
|
||||
}
|
||||
|
||||
return uri
|
||||
}
|
||||
+118
@@ -0,0 +1,118 @@
|
||||
package v4a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
|
||||
internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
|
||||
"github.com/aws/smithy-go/middleware"
|
||||
smithyhttp "github.com/aws/smithy-go/transport/http"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// HTTPSigner is SigV4a HTTP signer implementation
|
||||
type HTTPSigner interface {
|
||||
SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optfns ...func(*SignerOptions)) error
|
||||
}
|
||||
|
||||
// SignHTTPRequestMiddlewareOptions is the middleware options for constructing a SignHTTPRequestMiddleware.
|
||||
type SignHTTPRequestMiddlewareOptions struct {
|
||||
Credentials CredentialsProvider
|
||||
Signer HTTPSigner
|
||||
LogSigning bool
|
||||
}
|
||||
|
||||
// SignHTTPRequestMiddleware is a middleware for signing an HTTP request using SigV4a.
|
||||
type SignHTTPRequestMiddleware struct {
|
||||
credentials CredentialsProvider
|
||||
signer HTTPSigner
|
||||
logSigning bool
|
||||
}
|
||||
|
||||
// NewSignHTTPRequestMiddleware constructs a SignHTTPRequestMiddleware using the given SignHTTPRequestMiddlewareOptions.
|
||||
func NewSignHTTPRequestMiddleware(options SignHTTPRequestMiddlewareOptions) *SignHTTPRequestMiddleware {
|
||||
return &SignHTTPRequestMiddleware{
|
||||
credentials: options.Credentials,
|
||||
signer: options.Signer,
|
||||
logSigning: options.LogSigning,
|
||||
}
|
||||
}
|
||||
|
||||
// ID the middleware identifier.
|
||||
func (s *SignHTTPRequestMiddleware) ID() string {
|
||||
return "Signing"
|
||||
}
|
||||
|
||||
// HandleFinalize signs an HTTP request using SigV4a.
|
||||
func (s *SignHTTPRequestMiddleware) HandleFinalize(
|
||||
ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
|
||||
) (
|
||||
out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
|
||||
) {
|
||||
if !hasCredentialProvider(s.credentials) {
|
||||
return next.HandleFinalize(ctx, in)
|
||||
}
|
||||
|
||||
req, ok := in.Request.(*smithyhttp.Request)
|
||||
if !ok {
|
||||
return out, metadata, fmt.Errorf("unexpected request middleware type %T", in.Request)
|
||||
}
|
||||
|
||||
signingName, signingRegion := awsmiddleware.GetSigningName(ctx), awsmiddleware.GetSigningRegion(ctx)
|
||||
payloadHash := v4.GetPayloadHash(ctx)
|
||||
if len(payloadHash) == 0 {
|
||||
return out, metadata, &SigningError{Err: fmt.Errorf("computed payload hash missing from context")}
|
||||
}
|
||||
|
||||
credentials, err := s.credentials.RetrievePrivateKey(ctx)
|
||||
if err != nil {
|
||||
return out, metadata, &SigningError{Err: fmt.Errorf("failed to retrieve credentials: %w", err)}
|
||||
}
|
||||
|
||||
signerOptions := []func(o *SignerOptions){
|
||||
func(o *SignerOptions) {
|
||||
o.Logger = middleware.GetLogger(ctx)
|
||||
o.LogSigning = s.logSigning
|
||||
},
|
||||
}
|
||||
|
||||
// existing DisableURIPathEscaping is equivalent in purpose
|
||||
// to authentication scheme property DisableDoubleEncoding
|
||||
disableDoubleEncoding, overridden := internalauth.GetDisableDoubleEncoding(ctx)
|
||||
if overridden {
|
||||
signerOptions = append(signerOptions, func(o *SignerOptions) {
|
||||
o.DisableURIPathEscaping = disableDoubleEncoding
|
||||
})
|
||||
}
|
||||
|
||||
err = s.signer.SignHTTP(ctx, credentials, req.Request, payloadHash, signingName, []string{signingRegion}, time.Now().UTC(), signerOptions...)
|
||||
if err != nil {
|
||||
return out, metadata, &SigningError{Err: fmt.Errorf("failed to sign http request, %w", err)}
|
||||
}
|
||||
|
||||
return next.HandleFinalize(ctx, in)
|
||||
}
|
||||
|
||||
func hasCredentialProvider(p CredentialsProvider) bool {
|
||||
if p == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
// RegisterSigningMiddleware registers the SigV4a signing middleware to the stack. If a signing middleware is already
|
||||
// present, this provided middleware will be swapped. Otherwise the middleware will be added at the tail of the
|
||||
// finalize step.
|
||||
func RegisterSigningMiddleware(stack *middleware.Stack, signingMiddleware *SignHTTPRequestMiddleware) (err error) {
|
||||
const signedID = "Signing"
|
||||
_, present := stack.Finalize.Get(signedID)
|
||||
if present {
|
||||
_, err = stack.Finalize.Swap(signedID, signingMiddleware)
|
||||
} else {
|
||||
err = stack.Finalize.Add(signingMiddleware, middleware.After)
|
||||
}
|
||||
return err
|
||||
}
|
||||
+117
@@ -0,0 +1,117 @@
|
||||
package v4a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/sdk"
|
||||
"github.com/aws/smithy-go/middleware"
|
||||
smithyHTTP "github.com/aws/smithy-go/transport/http"
|
||||
)
|
||||
|
||||
// HTTPPresigner is an interface to a SigV4a signer that can sign create a
|
||||
// presigned URL for a HTTP requests.
|
||||
type HTTPPresigner interface {
|
||||
PresignHTTP(
|
||||
ctx context.Context, credentials Credentials, r *http.Request,
|
||||
payloadHash string, service string, regionSet []string, signingTime time.Time,
|
||||
optFns ...func(*SignerOptions),
|
||||
) (url string, signedHeader http.Header, err error)
|
||||
}
|
||||
|
||||
// PresignHTTPRequestMiddlewareOptions is the options for the PresignHTTPRequestMiddleware middleware.
|
||||
type PresignHTTPRequestMiddlewareOptions struct {
|
||||
CredentialsProvider CredentialsProvider
|
||||
Presigner HTTPPresigner
|
||||
LogSigning bool
|
||||
}
|
||||
|
||||
// PresignHTTPRequestMiddleware provides the Finalize middleware for creating a
|
||||
// presigned URL for an HTTP request.
|
||||
//
|
||||
// Will short circuit the middleware stack and not forward onto the next
|
||||
// Finalize handler.
|
||||
type PresignHTTPRequestMiddleware struct {
|
||||
credentialsProvider CredentialsProvider
|
||||
presigner HTTPPresigner
|
||||
logSigning bool
|
||||
}
|
||||
|
||||
// NewPresignHTTPRequestMiddleware returns a new PresignHTTPRequestMiddleware
|
||||
// initialized with the presigner.
|
||||
func NewPresignHTTPRequestMiddleware(options PresignHTTPRequestMiddlewareOptions) *PresignHTTPRequestMiddleware {
|
||||
return &PresignHTTPRequestMiddleware{
|
||||
credentialsProvider: options.CredentialsProvider,
|
||||
presigner: options.Presigner,
|
||||
logSigning: options.LogSigning,
|
||||
}
|
||||
}
|
||||
|
||||
// ID provides the middleware ID.
|
||||
func (*PresignHTTPRequestMiddleware) ID() string { return "PresignHTTPRequest" }
|
||||
|
||||
// HandleFinalize will take the provided input and create a presigned url for
|
||||
// the http request using the SigV4 presign authentication scheme.
|
||||
func (s *PresignHTTPRequestMiddleware) HandleFinalize(
|
||||
ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
|
||||
) (
|
||||
out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
|
||||
) {
|
||||
req, ok := in.Request.(*smithyHTTP.Request)
|
||||
if !ok {
|
||||
return out, metadata, &SigningError{
|
||||
Err: fmt.Errorf("unexpected request middleware type %T", in.Request),
|
||||
}
|
||||
}
|
||||
|
||||
httpReq := req.Build(ctx)
|
||||
if !hasCredentialProvider(s.credentialsProvider) {
|
||||
out.Result = &v4.PresignedHTTPRequest{
|
||||
URL: httpReq.URL.String(),
|
||||
Method: httpReq.Method,
|
||||
SignedHeader: http.Header{},
|
||||
}
|
||||
|
||||
return out, metadata, nil
|
||||
}
|
||||
|
||||
signingName := awsmiddleware.GetSigningName(ctx)
|
||||
signingRegion := awsmiddleware.GetSigningRegion(ctx)
|
||||
payloadHash := v4.GetPayloadHash(ctx)
|
||||
if len(payloadHash) == 0 {
|
||||
return out, metadata, &SigningError{
|
||||
Err: fmt.Errorf("computed payload hash missing from context"),
|
||||
}
|
||||
}
|
||||
|
||||
credentials, err := s.credentialsProvider.RetrievePrivateKey(ctx)
|
||||
if err != nil {
|
||||
return out, metadata, &SigningError{
|
||||
Err: fmt.Errorf("failed to retrieve credentials: %w", err),
|
||||
}
|
||||
}
|
||||
|
||||
u, h, err := s.presigner.PresignHTTP(ctx, credentials,
|
||||
httpReq, payloadHash, signingName, []string{signingRegion}, sdk.NowTime(),
|
||||
func(o *SignerOptions) {
|
||||
o.Logger = middleware.GetLogger(ctx)
|
||||
o.LogSigning = s.logSigning
|
||||
})
|
||||
if err != nil {
|
||||
return out, metadata, &SigningError{
|
||||
Err: fmt.Errorf("failed to sign http request, %w", err),
|
||||
}
|
||||
}
|
||||
|
||||
out.Result = &v4.PresignedHTTPRequest{
|
||||
URL: u,
|
||||
Method: httpReq.Method,
|
||||
SignedHeader: h,
|
||||
}
|
||||
|
||||
return out, metadata, nil
|
||||
}
|
||||
+92
@@ -0,0 +1,92 @@
|
||||
package v4a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
|
||||
|
||||
v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/sdk"
|
||||
"github.com/aws/smithy-go"
|
||||
"github.com/aws/smithy-go/auth"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
smithyhttp "github.com/aws/smithy-go/transport/http"
|
||||
)
|
||||
|
||||
// CredentialsAdapter adapts v4a.Credentials to smithy auth.Identity.
|
||||
type CredentialsAdapter struct {
|
||||
Credentials Credentials
|
||||
}
|
||||
|
||||
var _ auth.Identity = (*CredentialsAdapter)(nil)
|
||||
|
||||
// Expiration returns the time of expiration for the credentials.
|
||||
func (v *CredentialsAdapter) Expiration() time.Time {
|
||||
return v.Credentials.Expires
|
||||
}
|
||||
|
||||
// CredentialsProviderAdapter adapts v4a.CredentialsProvider to
|
||||
// auth.IdentityResolver.
|
||||
type CredentialsProviderAdapter struct {
|
||||
Provider CredentialsProvider
|
||||
}
|
||||
|
||||
var _ (auth.IdentityResolver) = (*CredentialsProviderAdapter)(nil)
|
||||
|
||||
// GetIdentity retrieves v4a credentials using the underlying provider.
|
||||
func (v *CredentialsProviderAdapter) GetIdentity(ctx context.Context, _ smithy.Properties) (
|
||||
auth.Identity, error,
|
||||
) {
|
||||
creds, err := v.Provider.RetrievePrivateKey(ctx)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("get credentials: %w", err)
|
||||
}
|
||||
|
||||
return &CredentialsAdapter{Credentials: creds}, nil
|
||||
}
|
||||
|
||||
// SignerAdapter adapts v4a.HTTPSigner to smithy http.Signer.
|
||||
type SignerAdapter struct {
|
||||
Signer HTTPSigner
|
||||
Logger logging.Logger
|
||||
LogSigning bool
|
||||
}
|
||||
|
||||
var _ (smithyhttp.Signer) = (*SignerAdapter)(nil)
|
||||
|
||||
// SignRequest signs the request with the provided identity.
|
||||
func (v *SignerAdapter) SignRequest(ctx context.Context, r *smithyhttp.Request, identity auth.Identity, props smithy.Properties) error {
|
||||
ca, ok := identity.(*CredentialsAdapter)
|
||||
if !ok {
|
||||
return fmt.Errorf("unexpected identity type: %T", identity)
|
||||
}
|
||||
|
||||
name, ok := smithyhttp.GetSigV4ASigningName(&props)
|
||||
if !ok {
|
||||
return fmt.Errorf("sigv4a signing name is required")
|
||||
}
|
||||
|
||||
regions, ok := smithyhttp.GetSigV4ASigningRegions(&props)
|
||||
if !ok {
|
||||
return fmt.Errorf("sigv4a signing region is required")
|
||||
}
|
||||
|
||||
hash := v4.GetPayloadHash(ctx)
|
||||
signingTime := sdk.NowTime()
|
||||
if skew := internalcontext.GetAttemptSkewContext(ctx); skew != 0 {
|
||||
signingTime.Add(skew)
|
||||
}
|
||||
err := v.Signer.SignHTTP(ctx, ca.Credentials, r.Request, hash, name, regions, signingTime, func(o *SignerOptions) {
|
||||
o.DisableURIPathEscaping, _ = smithyhttp.GetDisableDoubleEncoding(&props)
|
||||
|
||||
o.Logger = v.Logger
|
||||
o.LogSigning = v.LogSigning
|
||||
})
|
||||
if err != nil {
|
||||
return fmt.Errorf("sign http: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
+520
@@ -0,0 +1,520 @@
|
||||
package v4a
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"hash"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"net/textproto"
|
||||
"net/url"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
signerCrypto "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto"
|
||||
v4Internal "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4"
|
||||
"github.com/aws/smithy-go/encoding/httpbinding"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
)
|
||||
|
||||
const (
|
||||
// AmzRegionSetKey represents the region set header used for sigv4a
|
||||
AmzRegionSetKey = "X-Amz-Region-Set"
|
||||
amzAlgorithmKey = v4Internal.AmzAlgorithmKey
|
||||
amzSecurityTokenKey = v4Internal.AmzSecurityTokenKey
|
||||
amzDateKey = v4Internal.AmzDateKey
|
||||
amzCredentialKey = v4Internal.AmzCredentialKey
|
||||
amzSignedHeadersKey = v4Internal.AmzSignedHeadersKey
|
||||
authorizationHeader = "Authorization"
|
||||
|
||||
signingAlgorithm = "AWS4-ECDSA-P256-SHA256"
|
||||
|
||||
timeFormat = "20060102T150405Z"
|
||||
shortTimeFormat = "20060102"
|
||||
|
||||
// EmptyStringSHA256 is a hex encoded SHA-256 hash of an empty string
|
||||
EmptyStringSHA256 = v4Internal.EmptyStringSHA256
|
||||
|
||||
// Version of signing v4a
|
||||
Version = "SigV4A"
|
||||
)
|
||||
|
||||
var (
|
||||
p256 elliptic.Curve
|
||||
nMinusTwoP256 *big.Int
|
||||
|
||||
one = new(big.Int).SetInt64(1)
|
||||
)
|
||||
|
||||
func init() {
|
||||
// Ensure the elliptic curve parameters are initialized on package import rather then on first usage
|
||||
p256 = elliptic.P256()
|
||||
|
||||
nMinusTwoP256 = new(big.Int).SetBytes(p256.Params().N.Bytes())
|
||||
nMinusTwoP256 = nMinusTwoP256.Sub(nMinusTwoP256, new(big.Int).SetInt64(2))
|
||||
}
|
||||
|
||||
// SignerOptions is the SigV4a signing options for constructing a Signer.
|
||||
type SignerOptions struct {
|
||||
Logger logging.Logger
|
||||
LogSigning bool
|
||||
|
||||
// Disables the Signer's moving HTTP header key/value pairs from the HTTP
|
||||
// request header to the request's query string. This is most commonly used
|
||||
// with pre-signed requests preventing headers from being added to the
|
||||
// request's query string.
|
||||
DisableHeaderHoisting bool
|
||||
|
||||
// Disables the automatic escaping of the URI path of the request for the
|
||||
// siganture's canonical string's path. For services that do not need additional
|
||||
// escaping then use this to disable the signer escaping the path.
|
||||
//
|
||||
// S3 is an example of a service that does not need additional escaping.
|
||||
//
|
||||
// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
|
||||
DisableURIPathEscaping bool
|
||||
}
|
||||
|
||||
// Signer is a SigV4a HTTP signing implementation
|
||||
type Signer struct {
|
||||
options SignerOptions
|
||||
}
|
||||
|
||||
// NewSigner constructs a SigV4a Signer.
|
||||
func NewSigner(optFns ...func(*SignerOptions)) *Signer {
|
||||
options := SignerOptions{}
|
||||
|
||||
for _, fn := range optFns {
|
||||
fn(&options)
|
||||
}
|
||||
|
||||
return &Signer{options: options}
|
||||
}
|
||||
|
||||
// deriveKeyFromAccessKeyPair derives a NIST P-256 PrivateKey from the given
|
||||
// IAM AccessKey and SecretKey pair.
|
||||
//
|
||||
// Based on FIPS.186-4 Appendix B.4.2
|
||||
func deriveKeyFromAccessKeyPair(accessKey, secretKey string) (*ecdsa.PrivateKey, error) {
|
||||
params := p256.Params()
|
||||
bitLen := params.BitSize // Testing random candidates does not require an additional 64 bits
|
||||
counter := 0x01
|
||||
|
||||
buffer := make([]byte, 1+len(accessKey)) // 1 byte counter + len(accessKey)
|
||||
kdfContext := bytes.NewBuffer(buffer)
|
||||
|
||||
inputKey := append([]byte("AWS4A"), []byte(secretKey)...)
|
||||
|
||||
d := new(big.Int)
|
||||
for {
|
||||
kdfContext.Reset()
|
||||
kdfContext.WriteString(accessKey)
|
||||
kdfContext.WriteByte(byte(counter))
|
||||
|
||||
key, err := signerCrypto.HMACKeyDerivation(sha256.New, bitLen, inputKey, []byte(signingAlgorithm), kdfContext.Bytes())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Check key first before calling SetBytes if key key is in fact a valid candidate.
|
||||
// This ensures the byte slice is the correct length (32-bytes) to compare in constant-time
|
||||
cmp, err := signerCrypto.ConstantTimeByteCompare(key, nMinusTwoP256.Bytes())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if cmp == -1 {
|
||||
d.SetBytes(key)
|
||||
break
|
||||
}
|
||||
|
||||
counter++
|
||||
if counter > 0xFF {
|
||||
return nil, fmt.Errorf("exhausted single byte external counter")
|
||||
}
|
||||
}
|
||||
d = d.Add(d, one)
|
||||
|
||||
priv := new(ecdsa.PrivateKey)
|
||||
priv.PublicKey.Curve = p256
|
||||
priv.D = d
|
||||
priv.PublicKey.X, priv.PublicKey.Y = p256.ScalarBaseMult(d.Bytes())
|
||||
|
||||
return priv, nil
|
||||
}
|
||||
|
||||
type httpSigner struct {
|
||||
Request *http.Request
|
||||
ServiceName string
|
||||
RegionSet []string
|
||||
Time time.Time
|
||||
Credentials Credentials
|
||||
IsPreSign bool
|
||||
|
||||
Logger logging.Logger
|
||||
Debug bool
|
||||
|
||||
// PayloadHash is the hex encoded SHA-256 hash of the request payload
|
||||
// If len(PayloadHash) == 0 the signer will attempt to send the request
|
||||
// as an unsigned payload. Note: Unsigned payloads only work for a subset of services.
|
||||
PayloadHash string
|
||||
|
||||
DisableHeaderHoisting bool
|
||||
DisableURIPathEscaping bool
|
||||
}
|
||||
|
||||
// SignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and signs using SigV4a.
|
||||
// The passed in request will be modified in place.
|
||||
func (s *Signer) SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) error {
|
||||
options := s.options
|
||||
for _, fn := range optFns {
|
||||
fn(&options)
|
||||
}
|
||||
|
||||
signer := &httpSigner{
|
||||
Request: r,
|
||||
PayloadHash: payloadHash,
|
||||
ServiceName: service,
|
||||
RegionSet: regionSet,
|
||||
Credentials: credentials,
|
||||
Time: signingTime.UTC(),
|
||||
DisableHeaderHoisting: options.DisableHeaderHoisting,
|
||||
DisableURIPathEscaping: options.DisableURIPathEscaping,
|
||||
}
|
||||
|
||||
signedRequest, err := signer.Build()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
logHTTPSigningInfo(ctx, options, signedRequest)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// PresignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and presigns using SigV4a
|
||||
// Returns the presigned URL along with the headers that were signed with the request.
|
||||
//
|
||||
// PresignHTTP will not set the expires time of the presigned request
|
||||
// automatically. To specify the expire duration for a request add the
|
||||
// "X-Amz-Expires" query parameter on the request with the value as the
|
||||
// duration in seconds the presigned URL should be considered valid for. This
|
||||
// parameter is not used by all AWS services, and is most notable used by
|
||||
// Amazon S3 APIs.
|
||||
func (s *Signer) PresignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) (signedURI string, signedHeaders http.Header, err error) {
|
||||
options := s.options
|
||||
for _, fn := range optFns {
|
||||
fn(&options)
|
||||
}
|
||||
|
||||
signer := &httpSigner{
|
||||
Request: r,
|
||||
PayloadHash: payloadHash,
|
||||
ServiceName: service,
|
||||
RegionSet: regionSet,
|
||||
Credentials: credentials,
|
||||
Time: signingTime.UTC(),
|
||||
IsPreSign: true,
|
||||
DisableHeaderHoisting: options.DisableHeaderHoisting,
|
||||
DisableURIPathEscaping: options.DisableURIPathEscaping,
|
||||
}
|
||||
|
||||
signedRequest, err := signer.Build()
|
||||
if err != nil {
|
||||
return "", nil, err
|
||||
}
|
||||
|
||||
logHTTPSigningInfo(ctx, options, signedRequest)
|
||||
|
||||
signedHeaders = make(http.Header)
|
||||
|
||||
// For the signed headers we canonicalize the header keys in the returned map.
|
||||
// This avoids situations where can standard library double headers like host header. For example the standard
|
||||
// library will set the Host header, even if it is present in lower-case form.
|
||||
for k, v := range signedRequest.SignedHeaders {
|
||||
key := textproto.CanonicalMIMEHeaderKey(k)
|
||||
signedHeaders[key] = append(signedHeaders[key], v...)
|
||||
}
|
||||
|
||||
return signedRequest.Request.URL.String(), signedHeaders, nil
|
||||
}
|
||||
|
||||
func (s *httpSigner) setRequiredSigningFields(headers http.Header, query url.Values) {
|
||||
amzDate := s.Time.Format(timeFormat)
|
||||
|
||||
if s.IsPreSign {
|
||||
query.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
|
||||
query.Set(amzDateKey, amzDate)
|
||||
query.Set(amzAlgorithmKey, signingAlgorithm)
|
||||
if len(s.Credentials.SessionToken) > 0 {
|
||||
query.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
headers.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
|
||||
headers.Set(amzDateKey, amzDate)
|
||||
if len(s.Credentials.SessionToken) > 0 {
|
||||
headers.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *httpSigner) Build() (signedRequest, error) {
|
||||
req := s.Request
|
||||
|
||||
query := req.URL.Query()
|
||||
headers := req.Header
|
||||
|
||||
s.setRequiredSigningFields(headers, query)
|
||||
|
||||
// Sort Each Query Key's Values
|
||||
for key := range query {
|
||||
sort.Strings(query[key])
|
||||
}
|
||||
|
||||
v4Internal.SanitizeHostForHeader(req)
|
||||
|
||||
credentialScope := s.buildCredentialScope()
|
||||
credentialStr := s.Credentials.Context + "/" + credentialScope
|
||||
if s.IsPreSign {
|
||||
query.Set(amzCredentialKey, credentialStr)
|
||||
}
|
||||
|
||||
unsignedHeaders := headers
|
||||
if s.IsPreSign && !s.DisableHeaderHoisting {
|
||||
urlValues := url.Values{}
|
||||
urlValues, unsignedHeaders = buildQuery(v4Internal.AllowedQueryHoisting, unsignedHeaders)
|
||||
for k := range urlValues {
|
||||
query[k] = urlValues[k]
|
||||
}
|
||||
}
|
||||
|
||||
host := req.URL.Host
|
||||
if len(req.Host) > 0 {
|
||||
host = req.Host
|
||||
}
|
||||
|
||||
signedHeaders, signedHeadersStr, canonicalHeaderStr := s.buildCanonicalHeaders(host, v4Internal.IgnoredHeaders, unsignedHeaders, s.Request.ContentLength)
|
||||
|
||||
if s.IsPreSign {
|
||||
query.Set(amzSignedHeadersKey, signedHeadersStr)
|
||||
}
|
||||
|
||||
rawQuery := strings.Replace(query.Encode(), "+", "%20", -1)
|
||||
|
||||
canonicalURI := v4Internal.GetURIPath(req.URL)
|
||||
if !s.DisableURIPathEscaping {
|
||||
canonicalURI = httpbinding.EscapePath(canonicalURI, false)
|
||||
}
|
||||
|
||||
canonicalString := s.buildCanonicalString(
|
||||
req.Method,
|
||||
canonicalURI,
|
||||
rawQuery,
|
||||
signedHeadersStr,
|
||||
canonicalHeaderStr,
|
||||
)
|
||||
|
||||
strToSign := s.buildStringToSign(credentialScope, canonicalString)
|
||||
signingSignature, err := s.buildSignature(strToSign)
|
||||
if err != nil {
|
||||
return signedRequest{}, err
|
||||
}
|
||||
|
||||
if s.IsPreSign {
|
||||
rawQuery += "&X-Amz-Signature=" + signingSignature
|
||||
} else {
|
||||
headers[authorizationHeader] = append(headers[authorizationHeader][:0], buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature))
|
||||
}
|
||||
|
||||
req.URL.RawQuery = rawQuery
|
||||
|
||||
return signedRequest{
|
||||
Request: req,
|
||||
SignedHeaders: signedHeaders,
|
||||
CanonicalString: canonicalString,
|
||||
StringToSign: strToSign,
|
||||
PreSigned: s.IsPreSign,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature string) string {
|
||||
const credential = "Credential="
|
||||
const signedHeaders = "SignedHeaders="
|
||||
const signature = "Signature="
|
||||
const commaSpace = ", "
|
||||
|
||||
var parts strings.Builder
|
||||
parts.Grow(len(signingAlgorithm) + 1 +
|
||||
len(credential) + len(credentialStr) + len(commaSpace) +
|
||||
len(signedHeaders) + len(signedHeadersStr) + len(commaSpace) +
|
||||
len(signature) + len(signingSignature),
|
||||
)
|
||||
parts.WriteString(signingAlgorithm)
|
||||
parts.WriteRune(' ')
|
||||
parts.WriteString(credential)
|
||||
parts.WriteString(credentialStr)
|
||||
parts.WriteString(commaSpace)
|
||||
parts.WriteString(signedHeaders)
|
||||
parts.WriteString(signedHeadersStr)
|
||||
parts.WriteString(commaSpace)
|
||||
parts.WriteString(signature)
|
||||
parts.WriteString(signingSignature)
|
||||
return parts.String()
|
||||
}
|
||||
|
||||
func (s *httpSigner) buildCredentialScope() string {
|
||||
return strings.Join([]string{
|
||||
s.Time.Format(shortTimeFormat),
|
||||
s.ServiceName,
|
||||
"aws4_request",
|
||||
}, "/")
|
||||
|
||||
}
|
||||
|
||||
func buildQuery(r v4Internal.Rule, header http.Header) (url.Values, http.Header) {
|
||||
query := url.Values{}
|
||||
unsignedHeaders := http.Header{}
|
||||
for k, h := range header {
|
||||
if r.IsValid(k) {
|
||||
query[k] = h
|
||||
} else {
|
||||
unsignedHeaders[k] = h
|
||||
}
|
||||
}
|
||||
|
||||
return query, unsignedHeaders
|
||||
}
|
||||
|
||||
func (s *httpSigner) buildCanonicalHeaders(host string, rule v4Internal.Rule, header http.Header, length int64) (signed http.Header, signedHeaders, canonicalHeadersStr string) {
|
||||
signed = make(http.Header)
|
||||
|
||||
var headers []string
|
||||
const hostHeader = "host"
|
||||
headers = append(headers, hostHeader)
|
||||
signed[hostHeader] = append(signed[hostHeader], host)
|
||||
|
||||
if length > 0 {
|
||||
const contentLengthHeader = "content-length"
|
||||
headers = append(headers, contentLengthHeader)
|
||||
signed[contentLengthHeader] = append(signed[contentLengthHeader], strconv.FormatInt(length, 10))
|
||||
}
|
||||
|
||||
for k, v := range header {
|
||||
if !rule.IsValid(k) {
|
||||
continue // ignored header
|
||||
}
|
||||
|
||||
lowerCaseKey := strings.ToLower(k)
|
||||
if _, ok := signed[lowerCaseKey]; ok {
|
||||
// include additional values
|
||||
signed[lowerCaseKey] = append(signed[lowerCaseKey], v...)
|
||||
continue
|
||||
}
|
||||
|
||||
headers = append(headers, lowerCaseKey)
|
||||
signed[lowerCaseKey] = v
|
||||
}
|
||||
sort.Strings(headers)
|
||||
|
||||
signedHeaders = strings.Join(headers, ";")
|
||||
|
||||
var canonicalHeaders strings.Builder
|
||||
n := len(headers)
|
||||
const colon = ':'
|
||||
for i := range n {
|
||||
if headers[i] == hostHeader {
|
||||
canonicalHeaders.WriteString(hostHeader)
|
||||
canonicalHeaders.WriteRune(colon)
|
||||
canonicalHeaders.WriteString(v4Internal.StripExcessSpaces(host))
|
||||
} else {
|
||||
canonicalHeaders.WriteString(headers[i])
|
||||
canonicalHeaders.WriteRune(colon)
|
||||
// Trim out leading, trailing, and dedup inner spaces from signed header values.
|
||||
values := signed[headers[i]]
|
||||
for j, v := range values {
|
||||
cleanedValue := strings.TrimSpace(v4Internal.StripExcessSpaces(v))
|
||||
canonicalHeaders.WriteString(cleanedValue)
|
||||
if j < len(values)-1 {
|
||||
canonicalHeaders.WriteRune(',')
|
||||
}
|
||||
}
|
||||
}
|
||||
canonicalHeaders.WriteRune('\n')
|
||||
}
|
||||
canonicalHeadersStr = canonicalHeaders.String()
|
||||
|
||||
return signed, signedHeaders, canonicalHeadersStr
|
||||
}
|
||||
|
||||
func (s *httpSigner) buildCanonicalString(method, uri, query, signedHeaders, canonicalHeaders string) string {
|
||||
return strings.Join([]string{
|
||||
method,
|
||||
uri,
|
||||
query,
|
||||
canonicalHeaders,
|
||||
signedHeaders,
|
||||
s.PayloadHash,
|
||||
}, "\n")
|
||||
}
|
||||
|
||||
func (s *httpSigner) buildStringToSign(credentialScope, canonicalRequestString string) string {
|
||||
return strings.Join([]string{
|
||||
signingAlgorithm,
|
||||
s.Time.Format(timeFormat),
|
||||
credentialScope,
|
||||
hex.EncodeToString(makeHash(sha256.New(), []byte(canonicalRequestString))),
|
||||
}, "\n")
|
||||
}
|
||||
|
||||
func makeHash(hash hash.Hash, b []byte) []byte {
|
||||
hash.Reset()
|
||||
hash.Write(b)
|
||||
return hash.Sum(nil)
|
||||
}
|
||||
|
||||
func (s *httpSigner) buildSignature(strToSign string) (string, error) {
|
||||
sig, err := s.Credentials.PrivateKey.Sign(rand.Reader, makeHash(sha256.New(), []byte(strToSign)), crypto.SHA256)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return hex.EncodeToString(sig), nil
|
||||
}
|
||||
|
||||
const logSignInfoMsg = `Request Signature:
|
||||
---[ CANONICAL STRING ]-----------------------------
|
||||
%s
|
||||
---[ STRING TO SIGN ]--------------------------------
|
||||
%s%s
|
||||
-----------------------------------------------------`
|
||||
const logSignedURLMsg = `
|
||||
---[ SIGNED URL ]------------------------------------
|
||||
%s`
|
||||
|
||||
func logHTTPSigningInfo(ctx context.Context, options SignerOptions, r signedRequest) {
|
||||
if !options.LogSigning {
|
||||
return
|
||||
}
|
||||
signedURLMsg := ""
|
||||
if r.PreSigned {
|
||||
signedURLMsg = fmt.Sprintf(logSignedURLMsg, r.Request.URL.String())
|
||||
}
|
||||
logger := logging.WithContext(ctx, options.Logger)
|
||||
logger.Logf(logging.Debug, logSignInfoMsg, r.CanonicalString, r.StringToSign, signedURLMsg)
|
||||
}
|
||||
|
||||
type signedRequest struct {
|
||||
Request *http.Request
|
||||
SignedHeaders http.Header
|
||||
CanonicalString string
|
||||
StringToSign string
|
||||
PreSigned bool
|
||||
}
|
||||
Generated
Vendored
+8
@@ -1,3 +1,11 @@
|
||||
# v1.13.9 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
|
||||
# v1.13.8 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
|
||||
# v1.13.7 (2026-03-13)
|
||||
|
||||
* **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
|
||||
|
||||
Generated
Vendored
+1
-1
@@ -3,4 +3,4 @@
|
||||
package acceptencoding
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.13.7"
|
||||
const goModuleVersion = "1.13.9"
|
||||
|
||||
+14
@@ -1,3 +1,17 @@
|
||||
# v1.13.23 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.13.22 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.13.21 (2026-03-26)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.13.20 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
Generated
Vendored
+1
-1
@@ -3,4 +3,4 @@
|
||||
package presignedurl
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.13.20"
|
||||
const goModuleVersion = "1.13.23"
|
||||
|
||||
+15
@@ -1,3 +1,18 @@
|
||||
# v1.0.11 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.10 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.9 (2026-03-26)
|
||||
|
||||
* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.0.8 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+2
-22
@@ -15,9 +15,7 @@ import (
|
||||
internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
|
||||
internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
|
||||
internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
|
||||
internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
|
||||
smithy "github.com/aws/smithy-go"
|
||||
smithyauth "github.com/aws/smithy-go/auth"
|
||||
smithydocument "github.com/aws/smithy-go/document"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/aws/smithy-go/metrics"
|
||||
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
|
||||
})
|
||||
}
|
||||
|
||||
func addRetry(stack *middleware.Stack, o Options) error {
|
||||
func addRetry(stack *middleware.Stack, o Options, c *Client) error {
|
||||
attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
|
||||
m.LogAttempts = o.ClientLogMode.IsRetries()
|
||||
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/signin")
|
||||
m.ClientSkew = c.timeOffset
|
||||
})
|
||||
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
|
||||
return err
|
||||
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
|
||||
if mode == aws.AccountIDEndpointModeDisabled {
|
||||
return nil
|
||||
}
|
||||
|
||||
if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
|
||||
return aws.String(ca.Credentials.AccountID)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
|
||||
mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
|
||||
if err := stack.Build.Add(&mw, middleware.After); err != nil {
|
||||
return err
|
||||
}
|
||||
return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
|
||||
}
|
||||
func initializeTimeOffsetResolver(c *Client) {
|
||||
c.timeOffset = new(atomic.Int64)
|
||||
}
|
||||
|
||||
+1
-4
@@ -134,7 +134,7 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -158,9 +158,6 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package signin
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.0.8"
|
||||
const goModuleVersion = "1.0.11"
|
||||
|
||||
+19
@@ -1,3 +1,22 @@
|
||||
# v1.30.17 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.30.16 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.30.15 (2026-04-02)
|
||||
|
||||
* No change notes available for this release.
|
||||
|
||||
# v1.30.14 (2026-03-26)
|
||||
|
||||
* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.30.13 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+2
-22
@@ -15,9 +15,7 @@ import (
|
||||
internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
|
||||
internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
|
||||
internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
|
||||
internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
|
||||
smithy "github.com/aws/smithy-go"
|
||||
smithyauth "github.com/aws/smithy-go/auth"
|
||||
smithydocument "github.com/aws/smithy-go/document"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/aws/smithy-go/metrics"
|
||||
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
|
||||
})
|
||||
}
|
||||
|
||||
func addRetry(stack *middleware.Stack, o Options) error {
|
||||
func addRetry(stack *middleware.Stack, o Options, c *Client) error {
|
||||
attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
|
||||
m.LogAttempts = o.ClientLogMode.IsRetries()
|
||||
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sso")
|
||||
m.ClientSkew = c.timeOffset
|
||||
})
|
||||
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
|
||||
return err
|
||||
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
|
||||
if mode == aws.AccountIDEndpointModeDisabled {
|
||||
return nil
|
||||
}
|
||||
|
||||
if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
|
||||
return aws.String(ca.Credentials.AccountID)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
|
||||
mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
|
||||
if err := stack.Build.Add(&mw, middleware.After); err != nil {
|
||||
return err
|
||||
}
|
||||
return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
|
||||
}
|
||||
func initializeTimeOffsetResolver(c *Client) {
|
||||
c.timeOffset = new(atomic.Int64)
|
||||
}
|
||||
|
||||
+1
-4
@@ -93,7 +93,7 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -117,9 +117,6 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -98,7 +98,7 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -122,9 +122,6 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -97,7 +97,7 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -121,9 +121,6 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -92,7 +92,7 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -116,9 +116,6 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package sso
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.30.13"
|
||||
const goModuleVersion = "1.30.17"
|
||||
|
||||
+5
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
|
||||
},
|
||||
RegionRegex: partitionRegexp.AwsEusc,
|
||||
IsRegionalized: true,
|
||||
Endpoints: endpoints.Endpoints{
|
||||
endpoints.EndpointKey{
|
||||
Region: "eusc-de-east-1",
|
||||
}: endpoints.Endpoint{},
|
||||
},
|
||||
},
|
||||
{
|
||||
ID: "aws-iso",
|
||||
|
||||
+19
@@ -1,3 +1,22 @@
|
||||
# v1.35.21 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.35.20 (2026-04-17)
|
||||
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.35.19 (2026-04-02)
|
||||
|
||||
* No change notes available for this release.
|
||||
|
||||
# v1.35.18 (2026-03-26)
|
||||
|
||||
* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.35.17 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+2
-22
@@ -15,9 +15,7 @@ import (
|
||||
internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
|
||||
internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
|
||||
internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
|
||||
internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
|
||||
smithy "github.com/aws/smithy-go"
|
||||
smithyauth "github.com/aws/smithy-go/auth"
|
||||
smithydocument "github.com/aws/smithy-go/document"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/aws/smithy-go/metrics"
|
||||
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
|
||||
})
|
||||
}
|
||||
|
||||
func addRetry(stack *middleware.Stack, o Options) error {
|
||||
func addRetry(stack *middleware.Stack, o Options, c *Client) error {
|
||||
attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
|
||||
m.LogAttempts = o.ClientLogMode.IsRetries()
|
||||
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/ssooidc")
|
||||
m.ClientSkew = c.timeOffset
|
||||
})
|
||||
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
|
||||
return err
|
||||
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
|
||||
if mode == aws.AccountIDEndpointModeDisabled {
|
||||
return nil
|
||||
}
|
||||
|
||||
if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
|
||||
return aws.String(ca.Credentials.AccountID)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
|
||||
mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
|
||||
if err := stack.Build.Add(&mw, middleware.After); err != nil {
|
||||
return err
|
||||
}
|
||||
return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
|
||||
}
|
||||
func initializeTimeOffsetResolver(c *Client) {
|
||||
c.timeOffset = new(atomic.Int64)
|
||||
}
|
||||
|
||||
+1
-4
@@ -163,7 +163,7 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -187,9 +187,6 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -210,7 +210,7 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -234,9 +234,6 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -134,7 +134,7 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -158,9 +158,6 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
Generated
Vendored
+1
-4
@@ -116,7 +116,7 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -140,9 +140,6 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package ssooidc
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.35.17"
|
||||
const goModuleVersion = "1.35.21"
|
||||
|
||||
Generated
Vendored
+5
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
|
||||
},
|
||||
RegionRegex: partitionRegexp.AwsEusc,
|
||||
IsRegionalized: true,
|
||||
Endpoints: endpoints.Endpoints{
|
||||
endpoints.EndpointKey{
|
||||
Region: "eusc-de-east-1",
|
||||
}: endpoints.Endpoint{},
|
||||
},
|
||||
},
|
||||
{
|
||||
ID: "aws-iso",
|
||||
|
||||
+16
@@ -1,3 +1,19 @@
|
||||
# v1.42.1 (2026-04-29)
|
||||
|
||||
* **Dependency Update**: Update to smithy-go v1.25.1.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.42.0 (2026-04-17)
|
||||
|
||||
* **Feature**: The STS client now supports configuring SigV4a through the auth scheme preference setting. SigV4a uses asymmetric cryptography, enabling customers using long-term IAM credentials to continue making STS API calls even when a region is isolated from the partition leader.
|
||||
* **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.41.10 (2026-03-26)
|
||||
|
||||
* **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
# v1.41.9 (2026-03-13)
|
||||
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
+26
-18
@@ -16,11 +16,10 @@ import (
|
||||
internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
|
||||
internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
|
||||
internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
|
||||
internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/v4a"
|
||||
acceptencodingcust "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding"
|
||||
presignedurlcust "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url"
|
||||
smithy "github.com/aws/smithy-go"
|
||||
smithyauth "github.com/aws/smithy-go/auth"
|
||||
smithydocument "github.com/aws/smithy-go/document"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/aws/smithy-go/metrics"
|
||||
@@ -209,6 +208,8 @@ func New(options Options, optFns ...func(*Options)) *Client {
|
||||
|
||||
resolveEndpointResolverV2(&options)
|
||||
|
||||
resolveHTTPSignerV4a(&options)
|
||||
|
||||
resolveTracerProvider(&options)
|
||||
|
||||
resolveMeterProvider(&options)
|
||||
@@ -383,6 +384,11 @@ func resolveAuthSchemes(options *Options) {
|
||||
Logger: options.Logger,
|
||||
LogSigning: options.ClientLogMode.IsSigning(),
|
||||
}),
|
||||
internalauth.NewHTTPAuthScheme("aws.auth#sigv4a", &v4a.SignerAdapter{
|
||||
Signer: options.httpSignerV4a,
|
||||
Logger: options.Logger,
|
||||
LogSigning: options.ClientLogMode.IsSigning(),
|
||||
}),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -715,10 +721,11 @@ func addIsPaginatorUserAgent(o *Options) {
|
||||
})
|
||||
}
|
||||
|
||||
func addRetry(stack *middleware.Stack, o Options) error {
|
||||
func addRetry(stack *middleware.Stack, o Options, c *Client) error {
|
||||
attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
|
||||
m.LogAttempts = o.ClientLogMode.IsRetries()
|
||||
m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sts")
|
||||
m.ClientSkew = c.timeOffset
|
||||
})
|
||||
if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
|
||||
return err
|
||||
@@ -759,25 +766,26 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
|
||||
if mode == aws.AccountIDEndpointModeDisabled {
|
||||
return nil
|
||||
}
|
||||
|
||||
if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
|
||||
return aws.String(ca.Credentials.AccountID)
|
||||
}
|
||||
|
||||
return nil
|
||||
type httpSignerV4a interface {
|
||||
SignHTTP(ctx context.Context, credentials v4a.Credentials, r *http.Request, payloadHash,
|
||||
service string, regionSet []string, signingTime time.Time,
|
||||
optFns ...func(*v4a.SignerOptions)) error
|
||||
}
|
||||
|
||||
func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
|
||||
mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
|
||||
if err := stack.Build.Add(&mw, middleware.After); err != nil {
|
||||
return err
|
||||
func resolveHTTPSignerV4a(o *Options) {
|
||||
if o.httpSignerV4a != nil {
|
||||
return
|
||||
}
|
||||
return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
|
||||
o.httpSignerV4a = newDefaultV4aSigner(*o)
|
||||
}
|
||||
|
||||
func newDefaultV4aSigner(o Options) *v4a.Signer {
|
||||
return v4a.NewSigner(func(so *v4a.SignerOptions) {
|
||||
so.Logger = o.Logger
|
||||
so.LogSigning = o.ClientLogMode.IsSigning()
|
||||
})
|
||||
}
|
||||
|
||||
func initializeTimeOffsetResolver(c *Client) {
|
||||
c.timeOffset = new(atomic.Int64)
|
||||
}
|
||||
|
||||
+1
-4
@@ -448,7 +448,7 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -472,9 +472,6 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -383,7 +383,7 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -407,9 +407,6 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
Generated
Vendored
+1
-4
@@ -400,7 +400,7 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
|
||||
if err = addResolveEndpointMiddleware(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -424,9 +424,6 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -157,7 +157,7 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -181,9 +181,6 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
Generated
Vendored
+1
-4
@@ -117,7 +117,7 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -141,9 +141,6 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -108,7 +108,7 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -132,9 +132,6 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -99,7 +99,7 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -123,9 +123,6 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
Generated
Vendored
+1
-4
@@ -97,7 +97,7 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -121,9 +121,6 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -321,7 +321,7 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -345,9 +345,6 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -170,7 +170,7 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -194,9 +194,6 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+1
-4
@@ -120,7 +120,7 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
|
||||
if err = addComputePayloadSHA256(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRetry(stack, options); err != nil {
|
||||
if err = addRetry(stack, options, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addRawResponseToMetadata(stack); err != nil {
|
||||
@@ -144,9 +144,6 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
|
||||
if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addTimeOffsetBuild(stack, c); err != nil {
|
||||
return err
|
||||
}
|
||||
if err = addUserAgentRetryMode(stack, options); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+10
@@ -149,6 +149,16 @@ func serviceAuthOptions(params *AuthResolverParameters) []*smithyauth.Option {
|
||||
return props
|
||||
}(),
|
||||
},
|
||||
|
||||
{
|
||||
SchemeID: smithyauth.SchemeIDSigV4A,
|
||||
SignerProperties: func() smithy.Properties {
|
||||
var props smithy.Properties
|
||||
smithyhttp.SetSigV4ASigningName(&props, "sts")
|
||||
smithyhttp.SetSigV4ASigningRegions(&props, []string{params.Region})
|
||||
return props
|
||||
}(),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+1
@@ -3,6 +3,7 @@
|
||||
"github.com/aws/aws-sdk-go-v2": "v1.4.0",
|
||||
"github.com/aws/aws-sdk-go-v2/internal/configsources": "v0.0.0-00010101000000-000000000000",
|
||||
"github.com/aws/aws-sdk-go-v2/internal/endpoints/v2": "v2.0.0-00010101000000-000000000000",
|
||||
"github.com/aws/aws-sdk-go-v2/internal/v4a": "v0.0.0-00010101000000-000000000000",
|
||||
"github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding": "v1.0.5",
|
||||
"github.com/aws/aws-sdk-go-v2/service/internal/presigned-url": "v1.0.7",
|
||||
"github.com/aws/smithy-go": "v1.4.0"
|
||||
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package sts
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.41.9"
|
||||
const goModuleVersion = "1.42.1"
|
||||
|
||||
+48
@@ -4,9 +4,11 @@ package sts
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
|
||||
"github.com/aws/aws-sdk-go-v2/internal/v4a"
|
||||
smithyauth "github.com/aws/smithy-go/auth"
|
||||
"github.com/aws/smithy-go/logging"
|
||||
"github.com/aws/smithy-go/metrics"
|
||||
@@ -107,6 +109,9 @@ type Options struct {
|
||||
// The client tracer provider.
|
||||
TracerProvider tracing.TracerProvider
|
||||
|
||||
// Signature Version 4a (SigV4a) Signer
|
||||
httpSignerV4a httpSignerV4a
|
||||
|
||||
// The initial DefaultsMode used when the client options were constructed. If the
|
||||
// DefaultsMode was set to aws.DefaultsModeAuto this will store what the resolved
|
||||
// value was at that point in time.
|
||||
@@ -146,6 +151,9 @@ func (o Options) GetIdentityResolver(schemeID string) smithyauth.IdentityResolve
|
||||
if schemeID == "aws.auth#sigv4" {
|
||||
return getSigV4IdentityResolver(o)
|
||||
}
|
||||
if schemeID == "aws.auth#sigv4a" {
|
||||
return getSigV4AIdentityResolver(o)
|
||||
}
|
||||
if schemeID == "smithy.api#noAuth" {
|
||||
return &smithyauth.AnonymousIdentityResolver{}
|
||||
}
|
||||
@@ -231,6 +239,46 @@ func WithSigV4SigningRegion(region string) func(*Options) {
|
||||
}
|
||||
}
|
||||
|
||||
func getSigV4AIdentityResolver(o Options) smithyauth.IdentityResolver {
|
||||
if o.Credentials != nil {
|
||||
return &v4a.CredentialsProviderAdapter{
|
||||
Provider: &v4a.SymmetricCredentialAdaptor{
|
||||
SymmetricProvider: o.Credentials,
|
||||
},
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// WithSigV4ASigningRegions applies an override to the authentication workflow to
|
||||
// use the given signing region set for SigV4A-authenticated operations.
|
||||
//
|
||||
// This is an advanced setting. The value here is FINAL, taking precedence over
|
||||
// the resolved signing region set from both auth scheme resolution and endpoint
|
||||
// resolution.
|
||||
func WithSigV4ASigningRegions(regions []string) func(*Options) {
|
||||
fn := func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (
|
||||
out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
|
||||
) {
|
||||
rscheme := getResolvedAuthScheme(ctx)
|
||||
if rscheme == nil {
|
||||
return out, metadata, fmt.Errorf("no resolved auth scheme")
|
||||
}
|
||||
|
||||
smithyhttp.SetSigV4ASigningRegions(&rscheme.SignerProperties, regions)
|
||||
return next.HandleFinalize(ctx, in)
|
||||
}
|
||||
return func(o *Options) {
|
||||
o.APIOptions = append(o.APIOptions, func(s *middleware.Stack) error {
|
||||
return s.Finalize.Insert(
|
||||
middleware.FinalizeMiddlewareFunc("withSigV4ASigningRegions", fn),
|
||||
"Signing",
|
||||
middleware.Before,
|
||||
)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func ignoreAnonymousAuth(options *Options) {
|
||||
if aws.IsCredentialsProvider(options.Credentials, (*aws.AnonymousCredentials)(nil)) {
|
||||
options.Credentials = nil
|
||||
|
||||
+172
@@ -0,0 +1,172 @@
|
||||
# AGENTS.md
|
||||
|
||||
## Project overview
|
||||
|
||||
smithy-go is the Go code generator and runtime for [Smithy](https://smithy.io/).
|
||||
It has two major components:
|
||||
|
||||
1. **Codegen** (`codegen/`) — A Smithy build plugin written in Java that
|
||||
generates Go client/server/shape code from Smithy models.
|
||||
2. **Runtime** (`./`, top-level Go module) — The Go packages that generated
|
||||
code depends on at runtime.
|
||||
|
||||
The primary downstream consumer is
|
||||
[aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2).
|
||||
|
||||
## Repository layout
|
||||
|
||||
```
|
||||
. # Root Go module (github.com/aws/smithy-go)
|
||||
├── auth/ # Auth identity + scheme interfaces
|
||||
│ └── bearer/ # Bearer token auth
|
||||
├── aws-http-auth/ # Separate module: AWS SigV4/SigV4A HTTP signing
|
||||
├── codegen/ # Java/Gradle: Smithy code generator
|
||||
│ ├── smithy-go-codegen/ # Main codegen source (Java)
|
||||
│ └── smithy-go-codegen-test/ # Codegen integration tests
|
||||
├── container/ # Generic container types
|
||||
├── context/ # Context helpers
|
||||
├── document/ # Smithy document type abstraction
|
||||
│ └── json/ # JSON document codec
|
||||
├── encoding/ # Wire format encoders/decoders
|
||||
│ ├── cbor/ # CBOR (used by rpcv2Cbor)
|
||||
│ ├── httpbinding/ # HTTP binding serde helpers
|
||||
│ ├── json/ # JSON encoder/decoder
|
||||
│ └── xml/ # XML encoder/decoder
|
||||
├── endpoints/ # Endpoint resolution types
|
||||
├── internal/ # Internal utilities (singleflight, etc.)
|
||||
├── io/ # I/O helpers
|
||||
├── logging/ # Logging interfaces
|
||||
├── metrics/ # Metrics interfaces
|
||||
│ └── smithyotelmetrics/ # Separate module: OpenTelemetry metrics adapter
|
||||
├── middleware/ # Middleware stack (the core of the operation pipeline)
|
||||
├── ptr/ # Pointer-to/from-value helpers
|
||||
├── testing/ # Test assertion helpers for generated protocol tests
|
||||
│ └── xml/ # XML comparison utilities
|
||||
├── time/ # Smithy timestamp format helpers
|
||||
├── tracing/ # Tracing interfaces
|
||||
│ └── smithyoteltracing/ # Separate module: OpenTelemetry tracing adapter
|
||||
└── transport/
|
||||
└── http/ # HTTP request/response types and middleware
|
||||
```
|
||||
|
||||
## Building and testing
|
||||
|
||||
### Runtime (Go)
|
||||
|
||||
```bash
|
||||
# Run unit tests
|
||||
make unit
|
||||
```
|
||||
|
||||
### Codegen (Java)
|
||||
|
||||
```bash
|
||||
# Build and test codegen
|
||||
cd codegen && ./gradlew build
|
||||
|
||||
# Publish to local Maven for downstream use
|
||||
cd codegen && ./gradlew publishToMavenLocal
|
||||
```
|
||||
|
||||
The codegen artifact version is fixed at `0.1.0` and is not published to
|
||||
Maven Central — you **MUST** `publishToMavenLocal`.
|
||||
|
||||
## Runtime architecture
|
||||
|
||||
### Middleware stack
|
||||
|
||||
The operation pipeline is built on a middleware stack defined in `middleware/`.
|
||||
Steps execute in order: Initialize → Serialize → Build → Finalize →
|
||||
Deserialize. Each step is a `middleware.Step` that holds an ordered list of
|
||||
middleware. The codegen generates middleware registrations for each operation.
|
||||
|
||||
### Encoding packages
|
||||
|
||||
Each wire format has its own encoder/decoder under `encoding/`. These are
|
||||
low-level — they produce/consume raw tokens or values, not full Smithy shapes.
|
||||
Generated serde code calls into these packages.
|
||||
|
||||
## Codegen: GoWriter and template system
|
||||
|
||||
GoWriter extends Smithy's `SymbolWriter` and is the primary mechanism for
|
||||
generating Go source. It has **two distinct writing styles** that must not be
|
||||
confused.
|
||||
|
||||
### Style 1: Positional args (`writer.write` / `writer.openBlock`)
|
||||
|
||||
Inherited from `SymbolWriter`. Arguments are positional and referenced with
|
||||
`$`-prefixed format characters. Each `$X` consumes the next argument in order.
|
||||
|
||||
Format characters:
|
||||
- `$L` — Literal (toString). Strings, names, anything that should be inserted
|
||||
verbatim.
|
||||
- `$S` — String, quoted. Wraps the value in Go double-quotes.
|
||||
- `$T` — Type (Symbol). Inserts the symbol name and auto-adds its import.
|
||||
- `$P` — Pointable type (Symbol). Like `$T` but prepends `*` if the symbol is
|
||||
marked pointable.
|
||||
- `$W` — Writable. Evaluates a `Writable` (lambda/closure) inline.
|
||||
- `$D` — Dependency. Adds a `GoDependency` import, expands to empty string.
|
||||
|
||||
Numbered variants (`$1L`, `$2T`, etc.) allow reusing the same argument
|
||||
multiple times. The number is 1-indexed and refers to the position in the
|
||||
argument list:
|
||||
|
||||
```java
|
||||
// $1L is used twice, $2L once — only 2 args needed
|
||||
writer.write("type $1L struct{}\nvar _ $2L = (*$1L)(nil)",
|
||||
DEFAULT_NAME, INTERFACE_NAME);
|
||||
```
|
||||
|
||||
`openBlock`/`closeBlock` manage indentation for braced blocks. Arguments are
|
||||
positional:
|
||||
|
||||
```java
|
||||
writer.openBlock("func (c $P) $T(ctx $T) ($P, error) {", "}",
|
||||
serviceSymbol, operationSymbol, contextSymbol, outputSymbol,
|
||||
() -> {
|
||||
writer.write("return nil, nil");
|
||||
});
|
||||
```
|
||||
|
||||
### Style 2: Named template args (`goTemplate` / `writeGoTemplate`)
|
||||
|
||||
Uses `$name:X` syntax where `name` is a key in a `Map<String, Object>` and `X`
|
||||
is the format character. Arguments are passed as one or more maps. This is the
|
||||
**preferred style for new code** — it is more readable and less error-prone
|
||||
than positional args.
|
||||
|
||||
```java
|
||||
return goTemplate("""
|
||||
func $name:L(v $cborValue:T) ($type:T, error) {
|
||||
return $coercer:T(v)
|
||||
}
|
||||
""",
|
||||
Map.of(
|
||||
"name", getDeserializerName(shape),
|
||||
"cborValue", SmithyGoTypes.Encoding.Cbor.Value,
|
||||
"type", symbolProvider.toSymbol(shape),
|
||||
"coercer", coercer
|
||||
));
|
||||
```
|
||||
|
||||
Rules:
|
||||
- `goTemplate(String, Map...)` is a **static** method that returns a
|
||||
`Writable` (a `Consumer<GoWriter>` lambda). It does NOT write immediately.
|
||||
- `writeGoTemplate(String, Map...)` is an **instance** method that writes
|
||||
immediately to the writer.
|
||||
- Maps are merged into the writer's context scope for the duration of the
|
||||
template. Multiple maps can be passed and are applied in order.
|
||||
- The writer pre-populates common symbols in context: `fmt.Sprintf`,
|
||||
`fmt.Errorf`, `errors.As`, `context.Context`, `time.Now`.
|
||||
|
||||
### Composing writables
|
||||
|
||||
- `ChainWritable` — Collects multiple `Writable`s and composes them with
|
||||
newlines between each. Use `.compose()` (with newlines) or
|
||||
`.compose(false)` (without).
|
||||
|
||||
### Symbol constants
|
||||
|
||||
For symbols, use `SmithyGoDependency.*.valueSymbol("Name")` or
|
||||
`SmithyGoDependency.*.pointableSymbol("Name")`.
|
||||
|
||||
+30
-1
@@ -1,8 +1,37 @@
|
||||
# Release (2026-02-27)
|
||||
# Release (2026-04-23)
|
||||
|
||||
## General Highlights
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
## Module Highlights
|
||||
* `github.com/aws/smithy-go`: v1.25.1
|
||||
* **Bug Fix**: Fixed a memory leak in the LRU cache implementation used by some AWS services.
|
||||
|
||||
# Release (2026-04-15)
|
||||
|
||||
## General Highlights
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
## Module Highlights
|
||||
* `github.com/aws/smithy-go`: v1.25.0
|
||||
* **Feature**: Add support for endpointBdd trait
|
||||
|
||||
# Release (2026-04-02)
|
||||
|
||||
## General Highlights
|
||||
* **Dependency Update**: Updated to the latest SDK module versions
|
||||
|
||||
## Module Highlights
|
||||
* `github.com/aws/smithy-go`: v1.24.3
|
||||
* **Bug Fix**: Add additional sigv4 configuration.
|
||||
* `github.com/aws/smithy-go/aws-http-auth`: [v1.1.3](aws-http-auth/CHANGELOG.md#v113-2026-04-02)
|
||||
* **Bug Fix**: Add additional sigv4 configuration.
|
||||
|
||||
# Release (2026-02-27)
|
||||
|
||||
## General Highlights
|
||||
* **Dependency Update**: Bump minimum go version to 1.24.
|
||||
|
||||
# Release (2026-02-20)
|
||||
|
||||
## General Highlights
|
||||
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
package rulesfn
|
||||
|
||||
import "strings"
|
||||
|
||||
// Split splits the input string by the delimiter and returns the resulting
|
||||
// parts. If limit is > 0, at most limit substrings are returned.
|
||||
// Returns a slice with a single empty string if the input is empty.
|
||||
func Split(input, delimiter string, limit int) []string {
|
||||
if len(input) == 0 {
|
||||
return []string{""}
|
||||
}
|
||||
if limit > 0 {
|
||||
return strings.SplitN(input, delimiter, limit)
|
||||
}
|
||||
return strings.Split(input, delimiter)
|
||||
}
|
||||
+1
-1
@@ -3,4 +3,4 @@
|
||||
package smithy
|
||||
|
||||
// goModuleVersion is the tagged release for this module
|
||||
const goModuleVersion = "1.24.2"
|
||||
const goModuleVersion = "1.25.1"
|
||||
|
||||
+1
-1
@@ -24,7 +24,7 @@ var (
|
||||
Package = "github.com/containerd/containerd/v2"
|
||||
|
||||
// Version holds the complete version number. Filled in at linking time.
|
||||
Version = "2.2.2+unknown"
|
||||
Version = "2.2.3+unknown"
|
||||
|
||||
// Revision is filled with the VCS (e.g. git) revision being used to build
|
||||
// the program at linking time.
|
||||
|
||||
+6
-2
@@ -22,8 +22,12 @@ var errBadPattern = errors.New("syntax error in pattern")
|
||||
// term:
|
||||
// '*' matches any sequence of non-/ characters
|
||||
// '?' matches any single non-/ character
|
||||
// '[' [ '^' ] { character-range } ']'
|
||||
// '[' [ '!' ] { character-range } ']'
|
||||
// character class (must be non-empty)
|
||||
//
|
||||
// NOTE: Only '!' is supported for character class negation, not '^'. This is to
|
||||
// ensure compatibility with in-toto-python.
|
||||
//
|
||||
// c matches character c (c != '*', '?', '\\', '[')
|
||||
// '\\' c matches character c
|
||||
//
|
||||
@@ -141,7 +145,7 @@ func matchChunk(chunk, s string) (rest string, ok bool, err error) {
|
||||
chunk = chunk[1:]
|
||||
// possibly negated
|
||||
negated := false
|
||||
if len(chunk) > 0 && chunk[0] == '^' {
|
||||
if len(chunk) > 0 && chunk[0] == '!' {
|
||||
negated = true
|
||||
chunk = chunk[1:]
|
||||
}
|
||||
|
||||
@@ -1,2 +1,3 @@
|
||||
* -text
|
||||
*.bin -text -diff
|
||||
*.md text eol=lf
|
||||
|
||||
+700
-700
File diff suppressed because it is too large
Load Diff
+78
-78
@@ -1,79 +1,79 @@
|
||||
# Finite State Entropy
|
||||
|
||||
This package provides Finite State Entropy encoding and decoding.
|
||||
|
||||
Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS))
|
||||
encoding provides a fast near-optimal symbol encoding/decoding
|
||||
for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
|
||||
|
||||
This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
|
||||
This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
|
||||
but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding.
|
||||
|
||||
* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
|
||||
|
||||
## News
|
||||
|
||||
* Feb 2018: First implementation released. Consider this beta software for now.
|
||||
|
||||
# Usage
|
||||
|
||||
This package provides a low level interface that allows to compress single independent blocks.
|
||||
|
||||
Each block is separate, and there is no built in integrity checks.
|
||||
This means that the caller should keep track of block sizes and also do checksums if needed.
|
||||
|
||||
Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
|
||||
You must provide input and will receive the output and maybe an error.
|
||||
|
||||
These error values can be returned:
|
||||
|
||||
| Error | Description |
|
||||
|---------------------|-----------------------------------------------------------------------------|
|
||||
| `<nil>` | Everything ok, output is returned |
|
||||
| `ErrIncompressible` | Returned when input is judged to be too hard to compress |
|
||||
| `ErrUseRLE` | Returned from the compressor when the input is a single byte value repeated |
|
||||
| `(error)` | An internal error occurred. |
|
||||
|
||||
As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
|
||||
|
||||
To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object
|
||||
that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same
|
||||
object can be used for both.
|
||||
|
||||
Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
|
||||
you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
|
||||
|
||||
Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
|
||||
You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
|
||||
your input was likely corrupted.
|
||||
|
||||
It is important to note that a successful decoding does *not* mean your output matches your original input.
|
||||
There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
|
||||
|
||||
For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
|
||||
|
||||
# Performance
|
||||
|
||||
A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.
|
||||
All compression functions are currently only running on the calling goroutine so only one core will be used per block.
|
||||
|
||||
The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
|
||||
is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be
|
||||
beneficial to transpose all your input values down by 64.
|
||||
|
||||
With moderate block sizes around 64k speed are typically 200MB/s per core for compression and
|
||||
around 300MB/s decompression speed.
|
||||
|
||||
The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s.
|
||||
|
||||
# Plans
|
||||
|
||||
At one point, more internals will be exposed to facilitate more "expert" usage of the components.
|
||||
|
||||
A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).
|
||||
|
||||
# Contributing
|
||||
|
||||
Contributions are always welcome. Be aware that adding public functions will require good justification and breaking
|
||||
# Finite State Entropy
|
||||
|
||||
This package provides Finite State Entropy encoding and decoding.
|
||||
|
||||
Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS))
|
||||
encoding provides a fast near-optimal symbol encoding/decoding
|
||||
for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
|
||||
|
||||
This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
|
||||
This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
|
||||
but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding.
|
||||
|
||||
* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
|
||||
|
||||
## News
|
||||
|
||||
* Feb 2018: First implementation released. Consider this beta software for now.
|
||||
|
||||
# Usage
|
||||
|
||||
This package provides a low level interface that allows to compress single independent blocks.
|
||||
|
||||
Each block is separate, and there is no built in integrity checks.
|
||||
This means that the caller should keep track of block sizes and also do checksums if needed.
|
||||
|
||||
Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
|
||||
You must provide input and will receive the output and maybe an error.
|
||||
|
||||
These error values can be returned:
|
||||
|
||||
| Error | Description |
|
||||
|---------------------|-----------------------------------------------------------------------------|
|
||||
| `<nil>` | Everything ok, output is returned |
|
||||
| `ErrIncompressible` | Returned when input is judged to be too hard to compress |
|
||||
| `ErrUseRLE` | Returned from the compressor when the input is a single byte value repeated |
|
||||
| `(error)` | An internal error occurred. |
|
||||
|
||||
As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
|
||||
|
||||
To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object
|
||||
that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same
|
||||
object can be used for both.
|
||||
|
||||
Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
|
||||
you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
|
||||
|
||||
Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
|
||||
You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
|
||||
your input was likely corrupted.
|
||||
|
||||
It is important to note that a successful decoding does *not* mean your output matches your original input.
|
||||
There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
|
||||
|
||||
For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
|
||||
|
||||
# Performance
|
||||
|
||||
A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.
|
||||
All compression functions are currently only running on the calling goroutine so only one core will be used per block.
|
||||
|
||||
The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
|
||||
is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be
|
||||
beneficial to transpose all your input values down by 64.
|
||||
|
||||
With moderate block sizes around 64k speed are typically 200MB/s per core for compression and
|
||||
around 300MB/s decompression speed.
|
||||
|
||||
The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s.
|
||||
|
||||
# Plans
|
||||
|
||||
At one point, more internals will be exposed to facilitate more "expert" usage of the components.
|
||||
|
||||
A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).
|
||||
|
||||
# Contributing
|
||||
|
||||
Contributions are always welcome. Be aware that adding public functions will require good justification and breaking
|
||||
changes will likely not be accepted. If in doubt open an issue before writing the PR.
|
||||
+89
-89
@@ -1,89 +1,89 @@
|
||||
# Huff0 entropy compression
|
||||
|
||||
This package provides Huff0 encoding and decoding as used in zstd.
|
||||
|
||||
[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders),
|
||||
a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU
|
||||
(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
|
||||
|
||||
This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
|
||||
This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
|
||||
but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding.
|
||||
|
||||
* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
|
||||
|
||||
## News
|
||||
|
||||
This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
|
||||
|
||||
This ensures that most functionality is well tested.
|
||||
|
||||
# Usage
|
||||
|
||||
This package provides a low level interface that allows to compress single independent blocks.
|
||||
|
||||
Each block is separate, and there is no built in integrity checks.
|
||||
This means that the caller should keep track of block sizes and also do checksums if needed.
|
||||
|
||||
Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and
|
||||
[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
|
||||
You must provide input and will receive the output and maybe an error.
|
||||
|
||||
These error values can be returned:
|
||||
|
||||
| Error | Description |
|
||||
|---------------------|-----------------------------------------------------------------------------|
|
||||
| `<nil>` | Everything ok, output is returned |
|
||||
| `ErrIncompressible` | Returned when input is judged to be too hard to compress |
|
||||
| `ErrUseRLE` | Returned from the compressor when the input is a single byte value repeated |
|
||||
| `ErrTooBig` | Returned if the input block exceeds the maximum allowed size (128 Kib) |
|
||||
| `(error)` | An internal error occurred. |
|
||||
|
||||
|
||||
As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
|
||||
|
||||
To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object
|
||||
that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same
|
||||
object can be used for both.
|
||||
|
||||
Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
|
||||
you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
|
||||
|
||||
The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.
|
||||
|
||||
## Tables and re-use
|
||||
|
||||
Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results.
|
||||
|
||||
The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy)
|
||||
that controls this behaviour. See the documentation for details. This can be altered between each block.
|
||||
|
||||
Do however note that this information is *not* stored in the output block and it is up to the users of the package to
|
||||
record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
|
||||
based on the boolean reported back from the CompressXX call.
|
||||
|
||||
If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the
|
||||
[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
|
||||
|
||||
## Decompressing
|
||||
|
||||
The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
|
||||
This will initialize the decoding tables.
|
||||
You can supply the complete block to `ReadTable` and it will return the data part of the block
|
||||
which can be given to the decompressor.
|
||||
|
||||
Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X)
|
||||
or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
|
||||
|
||||
For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
|
||||
|
||||
You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
|
||||
your input was likely corrupted.
|
||||
|
||||
It is important to note that a successful decoding does *not* mean your output matches your original input.
|
||||
There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
|
||||
|
||||
# Contributing
|
||||
|
||||
Contributions are always welcome. Be aware that adding public functions will require good justification and breaking
|
||||
changes will likely not be accepted. If in doubt open an issue before writing the PR.
|
||||
# Huff0 entropy compression
|
||||
|
||||
This package provides Huff0 encoding and decoding as used in zstd.
|
||||
|
||||
[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders),
|
||||
a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU
|
||||
(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
|
||||
|
||||
This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
|
||||
This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
|
||||
but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding.
|
||||
|
||||
* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
|
||||
|
||||
## News
|
||||
|
||||
This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
|
||||
|
||||
This ensures that most functionality is well tested.
|
||||
|
||||
# Usage
|
||||
|
||||
This package provides a low level interface that allows to compress single independent blocks.
|
||||
|
||||
Each block is separate, and there is no built in integrity checks.
|
||||
This means that the caller should keep track of block sizes and also do checksums if needed.
|
||||
|
||||
Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and
|
||||
[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
|
||||
You must provide input and will receive the output and maybe an error.
|
||||
|
||||
These error values can be returned:
|
||||
|
||||
| Error | Description |
|
||||
|---------------------|-----------------------------------------------------------------------------|
|
||||
| `<nil>` | Everything ok, output is returned |
|
||||
| `ErrIncompressible` | Returned when input is judged to be too hard to compress |
|
||||
| `ErrUseRLE` | Returned from the compressor when the input is a single byte value repeated |
|
||||
| `ErrTooBig` | Returned if the input block exceeds the maximum allowed size (128 Kib) |
|
||||
| `(error)` | An internal error occurred. |
|
||||
|
||||
|
||||
As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
|
||||
|
||||
To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object
|
||||
that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same
|
||||
object can be used for both.
|
||||
|
||||
Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
|
||||
you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
|
||||
|
||||
The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.
|
||||
|
||||
## Tables and re-use
|
||||
|
||||
Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results.
|
||||
|
||||
The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy)
|
||||
that controls this behaviour. See the documentation for details. This can be altered between each block.
|
||||
|
||||
Do however note that this information is *not* stored in the output block and it is up to the users of the package to
|
||||
record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
|
||||
based on the boolean reported back from the CompressXX call.
|
||||
|
||||
If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the
|
||||
[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
|
||||
|
||||
## Decompressing
|
||||
|
||||
The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
|
||||
This will initialize the decoding tables.
|
||||
You can supply the complete block to `ReadTable` and it will return the data part of the block
|
||||
which can be given to the decompressor.
|
||||
|
||||
Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X)
|
||||
or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
|
||||
|
||||
For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
|
||||
|
||||
You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
|
||||
your input was likely corrupted.
|
||||
|
||||
It is important to note that a successful decoding does *not* mean your output matches your original input.
|
||||
There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
|
||||
|
||||
# Contributing
|
||||
|
||||
Contributions are always welcome. Be aware that adding public functions will require good justification and breaking
|
||||
changes will likely not be accepted. If in doubt open an issue before writing the PR.
|
||||
|
||||
+11
-2
@@ -409,6 +409,7 @@ type SolveRequest struct {
|
||||
Exporters []*Exporter `protobuf:"bytes,13,rep,name=Exporters,proto3" json:"Exporters,omitempty"`
|
||||
EnableSessionExporter bool `protobuf:"varint,14,opt,name=EnableSessionExporter,proto3" json:"EnableSessionExporter,omitempty"`
|
||||
SourcePolicySession string `protobuf:"bytes,15,opt,name=SourcePolicySession,proto3" json:"SourcePolicySession,omitempty"`
|
||||
CompatibilityVersion int64 `protobuf:"varint,16,opt,name=CompatibilityVersion,proto3" json:"CompatibilityVersion,omitempty"`
|
||||
unknownFields protoimpl.UnknownFields
|
||||
sizeCache protoimpl.SizeCache
|
||||
}
|
||||
@@ -548,6 +549,13 @@ func (x *SolveRequest) GetSourcePolicySession() string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *SolveRequest) GetCompatibilityVersion() int64 {
|
||||
if x != nil {
|
||||
return x.CompatibilityVersion
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
type CacheOptions struct {
|
||||
state protoimpl.MessageState `protogen:"open.v1"`
|
||||
// ExportRefDeprecated is deprecated in favor or the new Exports since BuildKit v0.4.0.
|
||||
@@ -2058,7 +2066,7 @@ const file_github_com_moby_buildkit_api_services_control_control_proto_rawDesc =
|
||||
" \x01(\tR\n" +
|
||||
"RecordType\x12\x16\n" +
|
||||
"\x06Shared\x18\v \x01(\bR\x06Shared\x12\x18\n" +
|
||||
"\aParents\x18\f \x03(\tR\aParents\"\xa6\b\n" +
|
||||
"\aParents\x18\f \x03(\tR\aParents\"\xda\b\n" +
|
||||
"\fSolveRequest\x12\x10\n" +
|
||||
"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12.\n" +
|
||||
"\n" +
|
||||
@@ -2077,7 +2085,8 @@ const file_github_com_moby_buildkit_api_services_control_control_proto_rawDesc =
|
||||
"\fSourcePolicy\x18\f \x01(\v2%.moby.buildkit.v1.sourcepolicy.PolicyR\fSourcePolicy\x128\n" +
|
||||
"\tExporters\x18\r \x03(\v2\x1a.moby.buildkit.v1.ExporterR\tExporters\x124\n" +
|
||||
"\x15EnableSessionExporter\x18\x0e \x01(\bR\x15EnableSessionExporter\x120\n" +
|
||||
"\x13SourcePolicySession\x18\x0f \x01(\tR\x13SourcePolicySession\x1aJ\n" +
|
||||
"\x13SourcePolicySession\x18\x0f \x01(\tR\x13SourcePolicySession\x122\n" +
|
||||
"\x14CompatibilityVersion\x18\x10 \x01(\x03R\x14CompatibilityVersion\x1aJ\n" +
|
||||
"\x1cExporterAttrsDeprecatedEntry\x12\x10\n" +
|
||||
"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
|
||||
"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a@\n" +
|
||||
|
||||
+1
@@ -77,6 +77,7 @@ message SolveRequest {
|
||||
repeated Exporter Exporters = 13;
|
||||
bool EnableSessionExporter = 14;
|
||||
string SourcePolicySession = 15;
|
||||
int64 CompatibilityVersion = 16;
|
||||
}
|
||||
|
||||
message CacheOptions {
|
||||
|
||||
+33
@@ -143,6 +143,7 @@ func (m *SolveRequest) CloneVT() *SolveRequest {
|
||||
r.SourcePolicy = m.SourcePolicy.CloneVT()
|
||||
r.EnableSessionExporter = m.EnableSessionExporter
|
||||
r.SourcePolicySession = m.SourcePolicySession
|
||||
r.CompatibilityVersion = m.CompatibilityVersion
|
||||
if rhs := m.ExporterAttrsDeprecated; rhs != nil {
|
||||
tmpContainer := make(map[string]string, len(rhs))
|
||||
for k, v := range rhs {
|
||||
@@ -1043,6 +1044,9 @@ func (this *SolveRequest) EqualVT(that *SolveRequest) bool {
|
||||
if this.SourcePolicySession != that.SourcePolicySession {
|
||||
return false
|
||||
}
|
||||
if this.CompatibilityVersion != that.CompatibilityVersion {
|
||||
return false
|
||||
}
|
||||
return string(this.unknownFields) == string(that.unknownFields)
|
||||
}
|
||||
|
||||
@@ -2249,6 +2253,13 @@ func (m *SolveRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
|
||||
i -= len(m.unknownFields)
|
||||
copy(dAtA[i:], m.unknownFields)
|
||||
}
|
||||
if m.CompatibilityVersion != 0 {
|
||||
i = protohelpers.EncodeVarint(dAtA, i, uint64(m.CompatibilityVersion))
|
||||
i--
|
||||
dAtA[i] = 0x1
|
||||
i--
|
||||
dAtA[i] = 0x80
|
||||
}
|
||||
if len(m.SourcePolicySession) > 0 {
|
||||
i -= len(m.SourcePolicySession)
|
||||
copy(dAtA[i:], m.SourcePolicySession)
|
||||
@@ -4174,6 +4185,9 @@ func (m *SolveRequest) SizeVT() (n int) {
|
||||
if l > 0 {
|
||||
n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
|
||||
}
|
||||
if m.CompatibilityVersion != 0 {
|
||||
n += 2 + protohelpers.SizeOfVarint(uint64(m.CompatibilityVersion))
|
||||
}
|
||||
n += len(m.unknownFields)
|
||||
return n
|
||||
}
|
||||
@@ -6326,6 +6340,25 @@ func (m *SolveRequest) UnmarshalVT(dAtA []byte) error {
|
||||
}
|
||||
m.SourcePolicySession = string(dAtA[iNdEx:postIndex])
|
||||
iNdEx = postIndex
|
||||
case 16:
|
||||
if wireType != 0 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field CompatibilityVersion", wireType)
|
||||
}
|
||||
m.CompatibilityVersion = 0
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return protohelpers.ErrIntOverflow
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
m.CompatibilityVersion |= int64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := protohelpers.Skip(dAtA[iNdEx:])
|
||||
|
||||
+129
-11
@@ -483,6 +483,26 @@ func Git(url, fragment string, opts ...GitOption) State {
|
||||
addCap(&gi.Constraints, pb.CapSourceGitMTime)
|
||||
}
|
||||
|
||||
if gi.FetchByCommit {
|
||||
attrs[pb.AttrGitFetchByCommit] = "true"
|
||||
addCap(&gi.Constraints, pb.CapSourceGitFetchByCommit)
|
||||
}
|
||||
if gi.Bundle != "" {
|
||||
attrs[pb.AttrGitBundle] = gi.Bundle
|
||||
addCap(&gi.Constraints, pb.CapSourceGitBundle)
|
||||
}
|
||||
if gi.BundleOCISessionID != "" {
|
||||
attrs[pb.AttrOCILayoutSessionID] = gi.BundleOCISessionID
|
||||
}
|
||||
if gi.BundleOCIStoreID != "" {
|
||||
attrs[pb.AttrOCILayoutStoreID] = gi.BundleOCIStoreID
|
||||
}
|
||||
|
||||
if gi.CheckoutBundle {
|
||||
attrs[pb.AttrGitCheckoutBundle] = "true"
|
||||
addCap(&gi.Constraints, pb.CapSourceGitCheckoutBundle)
|
||||
}
|
||||
|
||||
addCap(&gi.Constraints, pb.CapSourceGit)
|
||||
|
||||
source := NewSource("git://"+id, attrs, gi.Constraints)
|
||||
@@ -500,17 +520,22 @@ func (fn gitOptionFunc) SetGitOption(gi *GitInfo) {
|
||||
|
||||
type GitInfo struct {
|
||||
constraintsWrapper
|
||||
KeepGitDir bool
|
||||
AuthTokenSecret string
|
||||
AuthHeaderSecret string
|
||||
addAuthCap bool
|
||||
KnownSSHHosts string
|
||||
MountSSHSock string
|
||||
Checksum string
|
||||
Ref string
|
||||
SubDir string
|
||||
SkipSubmodules bool
|
||||
MTime string
|
||||
KeepGitDir bool
|
||||
AuthTokenSecret string
|
||||
AuthHeaderSecret string
|
||||
addAuthCap bool
|
||||
KnownSSHHosts string
|
||||
MountSSHSock string
|
||||
Checksum string
|
||||
Ref string
|
||||
SubDir string
|
||||
SkipSubmodules bool
|
||||
MTime string
|
||||
Bundle string
|
||||
BundleOCISessionID string
|
||||
BundleOCIStoreID string
|
||||
CheckoutBundle bool
|
||||
FetchByCommit bool
|
||||
}
|
||||
|
||||
func GitRef(v string) GitOption {
|
||||
@@ -577,6 +602,99 @@ func GitChecksum(v string) GitOption {
|
||||
})
|
||||
}
|
||||
|
||||
// GitFetchByCommit makes the git source trust the provided checksum as the
|
||||
// commit to fetch, without resolving the ref against the remote. The ref, if
|
||||
// set, is applied locally after the commit is fetched so that cache keys
|
||||
// still depend on it. This is useful when the remote ref may have moved
|
||||
// since the original resolution.
|
||||
//
|
||||
// Unqualified ref names are canonicalized to "refs/heads/<name>" to match
|
||||
// the normal path's cache keys for branches. Tags must be passed fully
|
||||
// qualified ("refs/tags/<name>").
|
||||
func GitFetchByCommit() GitOption {
|
||||
return gitOptionFunc(func(gi *GitInfo) {
|
||||
gi.FetchByCommit = true
|
||||
})
|
||||
}
|
||||
|
||||
// GitBundleInfo carries scheme-specific configuration for [GitBundleURL].
|
||||
// It is populated by [GitBundleOption] values and consumed by GitBundleURL.
|
||||
type GitBundleInfo struct {
|
||||
// OCISessionID pins the OCI-layout bundle fetch to a specific client
|
||||
// session. Only meaningful when the locator uses the
|
||||
// "oci-layout+blob://" scheme.
|
||||
OCISessionID string
|
||||
// OCIStoreID overrides the OCI-layout store name derived from the
|
||||
// bundle locator body. Only meaningful when the locator uses the
|
||||
// "oci-layout+blob://" scheme.
|
||||
OCIStoreID string
|
||||
}
|
||||
|
||||
// GitBundleOption configures bundle-specific behavior for [GitBundleURL].
|
||||
type GitBundleOption interface {
|
||||
SetGitBundleOption(*GitBundleInfo)
|
||||
}
|
||||
|
||||
type gitBundleOptionFunc func(*GitBundleInfo)
|
||||
|
||||
func (fn gitBundleOptionFunc) SetGitBundleOption(bi *GitBundleInfo) {
|
||||
fn(bi)
|
||||
}
|
||||
|
||||
// GitBundleURL configures the git source to import the commit history from a
|
||||
// pre-built git bundle instead of fetching from the upstream Git remote. The
|
||||
// locator must use one of the following schemes:
|
||||
//
|
||||
// docker-image+blob://<registry-ref>@sha256:<digest>
|
||||
// oci-layout+blob://<ref>@sha256:<digest>
|
||||
//
|
||||
// [GitChecksum] is required when GitBundleURL is used and the commit it
|
||||
// identifies must be reachable from a ref inside the bundle (i.e. the bundle
|
||||
// must contain that commit; BuildKit validates this after import). Auth and
|
||||
// SSH options are ignored in bundle mode. Submodules, if present, still fetch
|
||||
// from their own remotes. See [GitCheckoutBundle] for the checkout side; it
|
||||
// is mutually exclusive with [KeepGitDir] and [GitSubDir].
|
||||
//
|
||||
// Scheme-specific behavior can be tuned via [GitBundleOption] values, e.g.
|
||||
// [GitBundleOCIStore] for the "oci-layout+blob://" scheme.
|
||||
func GitBundleURL(locator string, opts ...GitBundleOption) GitOption {
|
||||
bi := &GitBundleInfo{}
|
||||
for _, o := range opts {
|
||||
o.SetGitBundleOption(bi)
|
||||
}
|
||||
return gitOptionFunc(func(gi *GitInfo) {
|
||||
gi.Bundle = locator
|
||||
gi.BundleOCISessionID = bi.OCISessionID
|
||||
gi.BundleOCIStoreID = bi.OCIStoreID
|
||||
})
|
||||
}
|
||||
|
||||
// GitBundleOCIStore configures the OCI-layout session and store id used to
|
||||
// resolve a bundle locator with the "oci-layout+blob://" scheme. When unset,
|
||||
// the locator body (the part before "@digest") is used as the store id and no
|
||||
// session is pinned. This mirrors [ImageBlobOCIStore] for regular OCI-layout
|
||||
// blobs.
|
||||
//
|
||||
// Only meaningful when passed to [GitBundleURL] together with a locator that
|
||||
// uses the "oci-layout+blob://" scheme.
|
||||
func GitBundleOCIStore(sessionID, storeID string) GitBundleOption {
|
||||
return gitBundleOptionFunc(func(bi *GitBundleInfo) {
|
||||
bi.OCISessionID = sessionID
|
||||
bi.OCIStoreID = storeID
|
||||
})
|
||||
}
|
||||
|
||||
// GitCheckoutBundle produces a single-file git bundle at the checkout mount
|
||||
// root (filename "bundle") containing the resolved commit, instead of a
|
||||
// worktree. Mutually exclusive with [KeepGitDir] and [GitSubDir]. Submodules
|
||||
// are not included in the bundle. Pair with [GitBundleURL] to re-import the
|
||||
// bundle back into a later build.
|
||||
func GitCheckoutBundle() GitOption {
|
||||
return gitOptionFunc(func(gi *GitInfo) {
|
||||
gi.CheckoutBundle = true
|
||||
})
|
||||
}
|
||||
|
||||
// AuthOption can be used with either HTTP or Git sources.
|
||||
type AuthOption interface {
|
||||
GitOption
|
||||
|
||||
+3
-23
@@ -36,8 +36,8 @@ import (
|
||||
|
||||
type SolveOpt struct {
|
||||
Exports []ExportEntry
|
||||
CompatibilityVersion int
|
||||
EnableSessionExporter bool
|
||||
LocalDirs map[string]string // Deprecated: use LocalMounts
|
||||
LocalMounts map[string]fsutil.FS
|
||||
OCIStores map[string]content.Store
|
||||
SharedKey string
|
||||
@@ -95,11 +95,7 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
|
||||
return nil, errors.New("invalid with def and cb")
|
||||
}
|
||||
|
||||
mounts, err := prepareMounts(&opt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
syncedDirs, err := prepareSyncedFiles(def, mounts)
|
||||
syncedDirs, err := prepareSyncedFiles(def, opt.LocalMounts)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -311,6 +307,7 @@ func (c *Client) solve(ctx context.Context, def *llb.Definition, runGateway runG
|
||||
Cache: &cacheOpt.options,
|
||||
Entitlements: slices.Clone(opt.AllowedEntitlements),
|
||||
Internal: opt.Internal,
|
||||
CompatibilityVersion: int64(opt.CompatibilityVersion),
|
||||
SourcePolicy: opt.SourcePolicy,
|
||||
}
|
||||
if opt.SourcePolicyProvider != nil {
|
||||
@@ -586,20 +583,3 @@ func parseCacheOptions(ctx context.Context, isGateway bool, opt SolveOpt) (*cach
|
||||
}
|
||||
return &res, nil
|
||||
}
|
||||
|
||||
func prepareMounts(opt *SolveOpt) (map[string]fsutil.FS, error) {
|
||||
// merge local mounts and fallback local directories together
|
||||
mounts := make(map[string]fsutil.FS)
|
||||
maps.Copy(mounts, opt.LocalMounts)
|
||||
for k, dir := range opt.LocalDirs {
|
||||
mount, err := fsutil.NewFS(dir)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if _, ok := mounts[k]; ok {
|
||||
return nil, errors.Errorf("local mount %s already exists", k)
|
||||
}
|
||||
mounts[k] = mount
|
||||
}
|
||||
return mounts, nil
|
||||
}
|
||||
|
||||
+4
@@ -7,7 +7,10 @@ import (
|
||||
|
||||
// Config provides containerd configuration data for the server
|
||||
type Config struct {
|
||||
// Deprecated: Use Log.Level with "debug" set instead.
|
||||
Debug bool `toml:"debug"`
|
||||
|
||||
// Deprecated: Use Log.Level with "trace" set instead.
|
||||
Trace bool `toml:"trace"`
|
||||
|
||||
// Root is the path to a directory where buildkit will store persistent data
|
||||
@@ -63,6 +66,7 @@ type SystemConfig struct {
|
||||
|
||||
type LogConfig struct {
|
||||
Format string `toml:"format"`
|
||||
Level string `toml:"level"`
|
||||
}
|
||||
|
||||
type GRPCConfig struct {
|
||||
|
||||
+29
-4
@@ -3,6 +3,7 @@ package dfgitutil
|
||||
|
||||
import (
|
||||
"net/url"
|
||||
"path"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
@@ -59,6 +60,11 @@ type GitRef struct {
|
||||
|
||||
// MTime controls file modification time policy: "checkout" (default) or "commit".
|
||||
MTime string
|
||||
|
||||
// FetchByCommit, when true, trusts Checksum as the commit and skips comparing
|
||||
// it against the remote ref. The commit is fetched directly and the ref name
|
||||
// (if any) is applied locally.
|
||||
FetchByCommit bool
|
||||
}
|
||||
|
||||
// ParseGitRef parses a git ref.
|
||||
@@ -134,7 +140,7 @@ func (gf *GitRef) loadQuery(query url.Values) error {
|
||||
case 0, 1:
|
||||
if len(v) == 0 || v[0] == "" {
|
||||
switch k {
|
||||
case "submodules", "keep-git-dir":
|
||||
case "submodules", "keep-git-dir", "fetch-by-commit":
|
||||
v = nil
|
||||
default:
|
||||
return errors.Errorf("query %q has no value", k)
|
||||
@@ -192,6 +198,18 @@ func (gf *GitRef) loadQuery(query url.Values) error {
|
||||
default:
|
||||
return errors.Errorf("invalid mtime value: %q (must be \"checkout\" or \"commit\")", v[0])
|
||||
}
|
||||
case "fetch-by-commit":
|
||||
var vv bool
|
||||
if len(v) == 0 {
|
||||
vv = true
|
||||
} else {
|
||||
var err error
|
||||
vv, err = strconv.ParseBool(v[0])
|
||||
if err != nil {
|
||||
return errors.Errorf("invalid fetch-by-commit value: %q", v[0])
|
||||
}
|
||||
}
|
||||
gf.FetchByCommit = vv
|
||||
default:
|
||||
return errors.Errorf("unexpected query %q", k)
|
||||
}
|
||||
@@ -223,16 +241,23 @@ func (gf *GitRef) loadQuery(query url.Values) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// FragmentFormat returns a simplified git URL in fragment format with only ref.
|
||||
// FragmentFormat returns a simplified git URL in fragment format.
|
||||
// If the URL cannot be parsed, the original string is returned with false.
|
||||
func FragmentFormat(remote string) (string, bool) {
|
||||
func FragmentFormat(remote string, withSubdir bool) (string, bool) {
|
||||
gitRef, _, err := ParseGitRef(remote)
|
||||
if err != nil || gitRef == nil {
|
||||
return remote, false
|
||||
}
|
||||
u := gitRef.Remote
|
||||
if gitRef.Ref != "" {
|
||||
subdir := ""
|
||||
if withSubdir {
|
||||
subdir = strings.TrimPrefix(path.Join("/", gitRef.SubDir), "/")
|
||||
}
|
||||
if gitRef.Ref != "" || subdir != "" {
|
||||
u += "#" + gitRef.Ref
|
||||
if subdir != "" {
|
||||
u += ":" + subdir
|
||||
}
|
||||
}
|
||||
return u, true
|
||||
}
|
||||
|
||||
-13
@@ -4,7 +4,6 @@ import (
|
||||
"net"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/containerd/platforms"
|
||||
"github.com/docker/go-units"
|
||||
@@ -113,18 +112,6 @@ func parseNetMode(v string) (pb.NetMode, error) {
|
||||
}
|
||||
}
|
||||
|
||||
func parseSourceDateEpoch(v string) (*time.Time, error) {
|
||||
if v == "" {
|
||||
return nil, nil
|
||||
}
|
||||
sde, err := strconv.ParseInt(v, 10, 64)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid SOURCE_DATE_EPOCH: %s", v)
|
||||
}
|
||||
tm := time.Unix(sde, 0).UTC()
|
||||
return &tm, nil
|
||||
}
|
||||
|
||||
func parseLocalSessionIDs(opt map[string]string) map[string]string {
|
||||
m := map[string]string{}
|
||||
for k, v := range opt {
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user