CodeArtifact .publishPackageVersion fails for large generic artifact with 'InvalidSignatureException' #1217
Comments
cloudshiftchris
added
bug
|
Full debug log |
|
AWS CLI debug logs |
|
In case this is a service issue, the AWS case # is 170802144901259 |
|
The signature algorithm appears to be incorrect for Kotlin SDK, when compared to the same request for Java SDK v2. Java SDK sends the payload as a single chunk, whereas Kotlin SDK uses From the documented signature algorithms (single chunks, multiple chunks) the value of x-amz-content-sha256 is different:
For the Java SDK call it correctly provides the ...this results in the CodeArtifact service calculating a different signature than what as incorrectly calculated by the Kotlin SDK client. Using a chunked transfer for this CodeArtifact call also raises the question of where does the asset-sha256 value go (it's part of the SDK parameters for this call)? Is it then unused, or ... ? Likely a better question for the service-side of this, what is expected/supported (i.e. is was-chunked even supported for this API call)? Answering my own question... from the API docs this call looks to require single-chunk transfer: The Kotlin SDK code is partially consistent with that API spec: ...however, manually setting the Omitting the So it appears the issue here is the Kotlin SDK, for this API call, is selecting multi-chunk encoding which isn't compatible with the spec for this call. Likely fixable in aws.smithy.kotlin.runtime.http.auth.AwsHttpSigner#sign - before checking for |
|
Hi, thanks for the detailed report, I've reproduced the issue and am working on a fix. In the meantime, here is a temporary workaround using an interceptor: class PrecomputedHashInterceptor(val hash: String): HttpInterceptor {
override suspend fun modifyBeforeRetryLoop(context: ProtocolRequestInterceptorContext<Any, HttpRequest>): HttpRequest {
context.executionContext[AwsSigningAttributes.HashSpecification] = HashSpecification.Precalculated(hash)
return context.protocolRequest
}
}
val testFile = File("build/sql-database-fingerprint-baseline.bak.zip")
val testFileSha256 = testFile.sha256()
val client = CodeartifactClient {
credentialsProvider = creds
region = "us-east-1"
logMode = LogMode.LogRequest + LogMode.LogResponse
}
client.withConfig {
interceptors += PrecomputedHashInterceptor(testFileSha256)
}.use { precomputedHashClient ->
precomputedHashClient.publishPackageVersion {
...
assetSha256 = testFileSha256
}
} |
|
|
Hi, I merged a fix for this. It should be available in tomorrow's release, v1.0.61. Thanks! Besides upgrading, there is no action needed from you to receive the fix. The change disables aws-chunked content encoding for all services except S3, since that's the only service that explicitly supports it. |
Describe the bug
Uploading a large (937MB) file to AWS CodeArtifact as a generic artifact fails with this exception:
The SHA256 has been validated as correctly calculated.
Uploading smaller files works (have not tested for size boundaries).
Forcing a SHA256 mismatch results in a different, specific exception.
Furthermore, perhaps related (or not), the same attempt using AWS CLI fails for different reasons (SSL/EOF errors - seems like CodeArtifact terminates the connection; there are no network proxies or otherwise involved).
937MB is within the 5GB limit for an individual CodeArtifact asset.
AWS Kotlin SDK 1.0.56
Expected behavior
When invoked with valid data AWS SDK correctly uploads large files into CodeArtifact.
Current behavior
Fails with this exception:
Steps to Reproduce
The code below can be used to reproduce the issue; in the comments are the command-line equivalents.
Possible Solution
Have not identified a working means to upload large assets to CodeArtifact.
Context
Blocked; unable to upload large assets to CodeArtifact
Originally discovered from this code in a CodeArtifact Gradle Plugin.
AWS Kotlin SDK version used
1.0.56
Platform (JVM/JS/Native)
JVM
Operating System and version
macOS Sonoma
The text was updated successfully, but these errors were encountered: