summaryrefslogtreecommitdiff
path: root/vendor/github.com/minio/minio-go/v7/pkg/signer
diff options
context:
space:
mode:
authorLibravatar Terin Stock <terinjokes@gmail.com>2025-03-09 17:47:56 +0100
committerLibravatar Terin Stock <terinjokes@gmail.com>2025-03-10 01:59:49 +0100
commit3ac1ee16f377d31a0fb80c8dae28b6239ac4229e (patch)
treef61faa581feaaeaba2542b9f2b8234a590684413 /vendor/github.com/minio/minio-go/v7/pkg/signer
parent[chore] update URLs to forked source (diff)
downloadgotosocial-3ac1ee16f377d31a0fb80c8dae28b6239ac4229e.tar.xz
[chore] remove vendor
Diffstat (limited to 'vendor/github.com/minio/minio-go/v7/pkg/signer')
-rw-r--r--vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming-unsigned-trailer.go224
-rw-r--r--vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming.go403
-rw-r--r--vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v2.go319
-rw-r--r--vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v4.go351
-rw-r--r--vendor/github.com/minio/minio-go/v7/pkg/signer/utils.go62
5 files changed, 0 insertions, 1359 deletions
diff --git a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming-unsigned-trailer.go b/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming-unsigned-trailer.go
deleted file mode 100644
index 77540e2d8..000000000
--- a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming-unsigned-trailer.go
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * MinIO Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2022 MinIO, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package signer
-
-import (
- "bytes"
- "fmt"
- "io"
- "net/http"
- "strconv"
- "strings"
- "time"
-)
-
-// getUnsignedChunkLength - calculates the length of chunk metadata
-func getUnsignedChunkLength(chunkDataSize int64) int64 {
- return int64(len(fmt.Sprintf("%x", chunkDataSize))) +
- crlfLen +
- chunkDataSize +
- crlfLen
-}
-
-// getUSStreamLength - calculates the length of the overall stream (data + metadata)
-func getUSStreamLength(dataLen, chunkSize int64, trailers http.Header) int64 {
- if dataLen <= 0 {
- return 0
- }
-
- chunksCount := int64(dataLen / chunkSize)
- remainingBytes := int64(dataLen % chunkSize)
- streamLen := int64(0)
- streamLen += chunksCount * getUnsignedChunkLength(chunkSize)
- if remainingBytes > 0 {
- streamLen += getUnsignedChunkLength(remainingBytes)
- }
- streamLen += getUnsignedChunkLength(0)
- if len(trailers) > 0 {
- for name, placeholder := range trailers {
- if len(placeholder) > 0 {
- streamLen += int64(len(name) + len(trailerKVSeparator) + len(placeholder[0]) + 1)
- }
- }
- streamLen += crlfLen
- }
-
- return streamLen
-}
-
-// prepareStreamingRequest - prepares a request with appropriate
-// headers before computing the seed signature.
-func prepareUSStreamingRequest(req *http.Request, sessionToken string, dataLen int64, timestamp time.Time) {
- req.TransferEncoding = []string{"aws-chunked"}
- if sessionToken != "" {
- req.Header.Set("X-Amz-Security-Token", sessionToken)
- }
-
- req.Header.Set("X-Amz-Date", timestamp.Format(iso8601DateFormat))
- // Set content length with streaming signature for each chunk included.
- req.ContentLength = getUSStreamLength(dataLen, int64(payloadChunkSize), req.Trailer)
-}
-
-// StreamingUSReader implements chunked upload signature as a reader on
-// top of req.Body's ReaderCloser chunk header;data;... repeat
-type StreamingUSReader struct {
- contentLen int64 // Content-Length from req header
- baseReadCloser io.ReadCloser // underlying io.Reader
- bytesRead int64 // bytes read from underlying io.Reader
- buf bytes.Buffer // holds signed chunk
- chunkBuf []byte // holds raw data read from req Body
- chunkBufLen int // no. of bytes read so far into chunkBuf
- done bool // done reading the underlying reader to EOF
- chunkNum int
- totalChunks int
- lastChunkSize int
- trailer http.Header
-}
-
-// writeChunk - signs a chunk read from s.baseReader of chunkLen size.
-func (s *StreamingUSReader) writeChunk(chunkLen int, addCrLf bool) {
- s.buf.WriteString(strconv.FormatInt(int64(chunkLen), 16) + "\r\n")
-
- // Write chunk data into streaming buffer
- s.buf.Write(s.chunkBuf[:chunkLen])
-
- // Write the chunk trailer.
- if addCrLf {
- s.buf.Write([]byte("\r\n"))
- }
-
- // Reset chunkBufLen for next chunk read.
- s.chunkBufLen = 0
- s.chunkNum++
-}
-
-// addSignedTrailer - adds a trailer with the provided headers,
-// then signs a chunk and adds it to output.
-func (s *StreamingUSReader) addTrailer(h http.Header) {
- olen := len(s.chunkBuf)
- s.chunkBuf = s.chunkBuf[:0]
- for k, v := range h {
- s.chunkBuf = append(s.chunkBuf, []byte(strings.ToLower(k)+trailerKVSeparator+v[0]+"\n")...)
- }
-
- s.buf.Write(s.chunkBuf)
- s.buf.WriteString("\r\n\r\n")
-
- // Reset chunkBufLen for next chunk read.
- s.chunkBuf = s.chunkBuf[:olen]
- s.chunkBufLen = 0
- s.chunkNum++
-}
-
-// StreamingUnsignedV4 - provides chunked upload
-func StreamingUnsignedV4(req *http.Request, sessionToken string, dataLen int64, reqTime time.Time) *http.Request {
- // Set headers needed for streaming signature.
- prepareUSStreamingRequest(req, sessionToken, dataLen, reqTime)
-
- if req.Body == nil {
- req.Body = io.NopCloser(bytes.NewReader([]byte("")))
- }
-
- stReader := &StreamingUSReader{
- baseReadCloser: req.Body,
- chunkBuf: make([]byte, payloadChunkSize),
- contentLen: dataLen,
- chunkNum: 1,
- totalChunks: int((dataLen+payloadChunkSize-1)/payloadChunkSize) + 1,
- lastChunkSize: int(dataLen % payloadChunkSize),
- }
- if len(req.Trailer) > 0 {
- stReader.trailer = req.Trailer
- // Remove...
- req.Trailer = nil
- }
-
- req.Body = stReader
-
- return req
-}
-
-// Read - this method performs chunk upload signature providing a
-// io.Reader interface.
-func (s *StreamingUSReader) Read(buf []byte) (int, error) {
- switch {
- // After the last chunk is read from underlying reader, we
- // never re-fill s.buf.
- case s.done:
-
- // s.buf will be (re-)filled with next chunk when has lesser
- // bytes than asked for.
- case s.buf.Len() < len(buf):
- s.chunkBufLen = 0
- for {
- n1, err := s.baseReadCloser.Read(s.chunkBuf[s.chunkBufLen:])
- // Usually we validate `err` first, but in this case
- // we are validating n > 0 for the following reasons.
- //
- // 1. n > 0, err is one of io.EOF, nil (near end of stream)
- // A Reader returning a non-zero number of bytes at the end
- // of the input stream may return either err == EOF or err == nil
- //
- // 2. n == 0, err is io.EOF (actual end of stream)
- //
- // Callers should always process the n > 0 bytes returned
- // before considering the error err.
- if n1 > 0 {
- s.chunkBufLen += n1
- s.bytesRead += int64(n1)
-
- if s.chunkBufLen == payloadChunkSize ||
- (s.chunkNum == s.totalChunks-1 &&
- s.chunkBufLen == s.lastChunkSize) {
- // Sign the chunk and write it to s.buf.
- s.writeChunk(s.chunkBufLen, true)
- break
- }
- }
- if err != nil {
- if err == io.EOF {
- // No more data left in baseReader - last chunk.
- // Done reading the last chunk from baseReader.
- s.done = true
-
- // bytes read from baseReader different than
- // content length provided.
- if s.bytesRead != s.contentLen {
- return 0, fmt.Errorf("http: ContentLength=%d with Body length %d", s.contentLen, s.bytesRead)
- }
-
- // Sign the chunk and write it to s.buf.
- s.writeChunk(0, len(s.trailer) == 0)
- if len(s.trailer) > 0 {
- // Trailer must be set now.
- s.addTrailer(s.trailer)
- }
- break
- }
- return 0, err
- }
-
- }
- }
- return s.buf.Read(buf)
-}
-
-// Close - this method makes underlying io.ReadCloser's Close method available.
-func (s *StreamingUSReader) Close() error {
- return s.baseReadCloser.Close()
-}
diff --git a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming.go b/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming.go
deleted file mode 100644
index 1c2f1dc9d..000000000
--- a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-streaming.go
+++ /dev/null
@@ -1,403 +0,0 @@
-/*
- * MinIO Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2017 MinIO, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package signer
-
-import (
- "bytes"
- "encoding/hex"
- "fmt"
- "io"
- "net/http"
- "strconv"
- "strings"
- "time"
-
- md5simd "github.com/minio/md5-simd"
-)
-
-// Reference for constants used below -
-// http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html#example-signature-calculations-streaming
-const (
- streamingSignAlgorithm = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
- streamingSignTrailerAlgorithm = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"
- streamingPayloadHdr = "AWS4-HMAC-SHA256-PAYLOAD"
- streamingTrailerHdr = "AWS4-HMAC-SHA256-TRAILER"
- emptySHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
- payloadChunkSize = 64 * 1024
- chunkSigConstLen = 17 // ";chunk-signature="
- signatureStrLen = 64 // e.g. "f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2"
- crlfLen = 2 // CRLF
- trailerKVSeparator = ":"
- trailerSignature = "x-amz-trailer-signature"
-)
-
-// Request headers to be ignored while calculating seed signature for
-// a request.
-var ignoredStreamingHeaders = map[string]bool{
- "Authorization": true,
- "User-Agent": true,
- "Content-Type": true,
-}
-
-// getSignedChunkLength - calculates the length of chunk metadata
-func getSignedChunkLength(chunkDataSize int64) int64 {
- return int64(len(fmt.Sprintf("%x", chunkDataSize))) +
- chunkSigConstLen +
- signatureStrLen +
- crlfLen +
- chunkDataSize +
- crlfLen
-}
-
-// getStreamLength - calculates the length of the overall stream (data + metadata)
-func getStreamLength(dataLen, chunkSize int64, trailers http.Header) int64 {
- if dataLen <= 0 {
- return 0
- }
-
- chunksCount := int64(dataLen / chunkSize)
- remainingBytes := int64(dataLen % chunkSize)
- streamLen := int64(0)
- streamLen += chunksCount * getSignedChunkLength(chunkSize)
- if remainingBytes > 0 {
- streamLen += getSignedChunkLength(remainingBytes)
- }
- streamLen += getSignedChunkLength(0)
- if len(trailers) > 0 {
- for name, placeholder := range trailers {
- if len(placeholder) > 0 {
- streamLen += int64(len(name) + len(trailerKVSeparator) + len(placeholder[0]) + 1)
- }
- }
- streamLen += int64(len(trailerSignature)+len(trailerKVSeparator)) + signatureStrLen + crlfLen + crlfLen
- }
-
- return streamLen
-}
-
-// buildChunkStringToSign - returns the string to sign given chunk data
-// and previous signature.
-func buildChunkStringToSign(t time.Time, region, previousSig, chunkChecksum string) string {
- stringToSignParts := []string{
- streamingPayloadHdr,
- t.Format(iso8601DateFormat),
- getScope(region, t, ServiceTypeS3),
- previousSig,
- emptySHA256,
- chunkChecksum,
- }
-
- return strings.Join(stringToSignParts, "\n")
-}
-
-// buildTrailerChunkStringToSign - returns the string to sign given chunk data
-// and previous signature.
-func buildTrailerChunkStringToSign(t time.Time, region, previousSig, chunkChecksum string) string {
- stringToSignParts := []string{
- streamingTrailerHdr,
- t.Format(iso8601DateFormat),
- getScope(region, t, ServiceTypeS3),
- previousSig,
- chunkChecksum,
- }
-
- return strings.Join(stringToSignParts, "\n")
-}
-
-// prepareStreamingRequest - prepares a request with appropriate
-// headers before computing the seed signature.
-func prepareStreamingRequest(req *http.Request, sessionToken string, dataLen int64, timestamp time.Time) {
- // Set x-amz-content-sha256 header.
- if len(req.Trailer) == 0 {
- req.Header.Set("X-Amz-Content-Sha256", streamingSignAlgorithm)
- } else {
- req.Header.Set("X-Amz-Content-Sha256", streamingSignTrailerAlgorithm)
- for k := range req.Trailer {
- req.Header.Add("X-Amz-Trailer", strings.ToLower(k))
- }
- req.TransferEncoding = []string{"aws-chunked"}
- }
-
- if sessionToken != "" {
- req.Header.Set("X-Amz-Security-Token", sessionToken)
- }
-
- req.Header.Set("X-Amz-Date", timestamp.Format(iso8601DateFormat))
- // Set content length with streaming signature for each chunk included.
- req.ContentLength = getStreamLength(dataLen, int64(payloadChunkSize), req.Trailer)
- req.Header.Set("x-amz-decoded-content-length", strconv.FormatInt(dataLen, 10))
-}
-
-// buildChunkHeader - returns the chunk header.
-// e.g string(IntHexBase(chunk-size)) + ";chunk-signature=" + signature + \r\n + chunk-data + \r\n
-func buildChunkHeader(chunkLen int64, signature string) []byte {
- return []byte(strconv.FormatInt(chunkLen, 16) + ";chunk-signature=" + signature + "\r\n")
-}
-
-// buildChunkSignature - returns chunk signature for a given chunk and previous signature.
-func buildChunkSignature(chunkCheckSum string, reqTime time.Time, region,
- previousSignature, secretAccessKey string,
-) string {
- chunkStringToSign := buildChunkStringToSign(reqTime, region,
- previousSignature, chunkCheckSum)
- signingKey := getSigningKey(secretAccessKey, region, reqTime, ServiceTypeS3)
- return getSignature(signingKey, chunkStringToSign)
-}
-
-// buildChunkSignature - returns chunk signature for a given chunk and previous signature.
-func buildTrailerChunkSignature(chunkChecksum string, reqTime time.Time, region,
- previousSignature, secretAccessKey string,
-) string {
- chunkStringToSign := buildTrailerChunkStringToSign(reqTime, region,
- previousSignature, chunkChecksum)
- signingKey := getSigningKey(secretAccessKey, region, reqTime, ServiceTypeS3)
- return getSignature(signingKey, chunkStringToSign)
-}
-
-// getSeedSignature - returns the seed signature for a given request.
-func (s *StreamingReader) setSeedSignature(req *http.Request) {
- // Get canonical request
- canonicalRequest := getCanonicalRequest(*req, ignoredStreamingHeaders, getHashedPayload(*req))
-
- // Get string to sign from canonical request.
- stringToSign := getStringToSignV4(s.reqTime, s.region, canonicalRequest, ServiceTypeS3)
-
- signingKey := getSigningKey(s.secretAccessKey, s.region, s.reqTime, ServiceTypeS3)
-
- // Calculate signature.
- s.seedSignature = getSignature(signingKey, stringToSign)
-}
-
-// StreamingReader implements chunked upload signature as a reader on
-// top of req.Body's ReaderCloser chunk header;data;... repeat
-type StreamingReader struct {
- accessKeyID string
- secretAccessKey string
- sessionToken string
- region string
- prevSignature string
- seedSignature string
- contentLen int64 // Content-Length from req header
- baseReadCloser io.ReadCloser // underlying io.Reader
- bytesRead int64 // bytes read from underlying io.Reader
- buf bytes.Buffer // holds signed chunk
- chunkBuf []byte // holds raw data read from req Body
- chunkBufLen int // no. of bytes read so far into chunkBuf
- done bool // done reading the underlying reader to EOF
- reqTime time.Time
- chunkNum int
- totalChunks int
- lastChunkSize int
- trailer http.Header
- sh256 md5simd.Hasher
-}
-
-// signChunk - signs a chunk read from s.baseReader of chunkLen size.
-func (s *StreamingReader) signChunk(chunkLen int, addCrLf bool) {
- // Compute chunk signature for next header
- s.sh256.Reset()
- s.sh256.Write(s.chunkBuf[:chunkLen])
- chunckChecksum := hex.EncodeToString(s.sh256.Sum(nil))
-
- signature := buildChunkSignature(chunckChecksum, s.reqTime,
- s.region, s.prevSignature, s.secretAccessKey)
-
- // For next chunk signature computation
- s.prevSignature = signature
-
- // Write chunk header into streaming buffer
- chunkHdr := buildChunkHeader(int64(chunkLen), signature)
- s.buf.Write(chunkHdr)
-
- // Write chunk data into streaming buffer
- s.buf.Write(s.chunkBuf[:chunkLen])
-
- // Write the chunk trailer.
- if addCrLf {
- s.buf.Write([]byte("\r\n"))
- }
-
- // Reset chunkBufLen for next chunk read.
- s.chunkBufLen = 0
- s.chunkNum++
-}
-
-// addSignedTrailer - adds a trailer with the provided headers,
-// then signs a chunk and adds it to output.
-func (s *StreamingReader) addSignedTrailer(h http.Header) {
- olen := len(s.chunkBuf)
- s.chunkBuf = s.chunkBuf[:0]
- for k, v := range h {
- s.chunkBuf = append(s.chunkBuf, []byte(strings.ToLower(k)+trailerKVSeparator+v[0]+"\n")...)
- }
-
- s.sh256.Reset()
- s.sh256.Write(s.chunkBuf)
- chunkChecksum := hex.EncodeToString(s.sh256.Sum(nil))
- // Compute chunk signature
- signature := buildTrailerChunkSignature(chunkChecksum, s.reqTime,
- s.region, s.prevSignature, s.secretAccessKey)
-
- // For next chunk signature computation
- s.prevSignature = signature
-
- s.buf.Write(s.chunkBuf)
- s.buf.WriteString("\r\n" + trailerSignature + trailerKVSeparator + signature + "\r\n\r\n")
-
- // Reset chunkBufLen for next chunk read.
- s.chunkBuf = s.chunkBuf[:olen]
- s.chunkBufLen = 0
- s.chunkNum++
-}
-
-// setStreamingAuthHeader - builds and sets authorization header value
-// for streaming signature.
-func (s *StreamingReader) setStreamingAuthHeader(req *http.Request) {
- credential := GetCredential(s.accessKeyID, s.region, s.reqTime, ServiceTypeS3)
- authParts := []string{
- signV4Algorithm + " Credential=" + credential,
- "SignedHeaders=" + getSignedHeaders(*req, ignoredStreamingHeaders),
- "Signature=" + s.seedSignature,
- }
-
- // Set authorization header.
- auth := strings.Join(authParts, ",")
- req.Header.Set("Authorization", auth)
-}
-
-// StreamingSignV4 - provides chunked upload signatureV4 support by
-// implementing io.Reader.
-func StreamingSignV4(req *http.Request, accessKeyID, secretAccessKey, sessionToken,
- region string, dataLen int64, reqTime time.Time, sh256 md5simd.Hasher,
-) *http.Request {
- // Set headers needed for streaming signature.
- prepareStreamingRequest(req, sessionToken, dataLen, reqTime)
-
- if req.Body == nil {
- req.Body = io.NopCloser(bytes.NewReader([]byte("")))
- }
-
- stReader := &StreamingReader{
- baseReadCloser: req.Body,
- accessKeyID: accessKeyID,
- secretAccessKey: secretAccessKey,
- sessionToken: sessionToken,
- region: region,
- reqTime: reqTime,
- chunkBuf: make([]byte, payloadChunkSize),
- contentLen: dataLen,
- chunkNum: 1,
- totalChunks: int((dataLen+payloadChunkSize-1)/payloadChunkSize) + 1,
- lastChunkSize: int(dataLen % payloadChunkSize),
- sh256: sh256,
- }
- if len(req.Trailer) > 0 {
- stReader.trailer = req.Trailer
- // Remove...
- req.Trailer = nil
- }
-
- // Add the request headers required for chunk upload signing.
-
- // Compute the seed signature.
- stReader.setSeedSignature(req)
-
- // Set the authorization header with the seed signature.
- stReader.setStreamingAuthHeader(req)
-
- // Set seed signature as prevSignature for subsequent
- // streaming signing process.
- stReader.prevSignature = stReader.seedSignature
- req.Body = stReader
-
- return req
-}
-
-// Read - this method performs chunk upload signature providing a
-// io.Reader interface.
-func (s *StreamingReader) Read(buf []byte) (int, error) {
- switch {
- // After the last chunk is read from underlying reader, we
- // never re-fill s.buf.
- case s.done:
-
- // s.buf will be (re-)filled with next chunk when has lesser
- // bytes than asked for.
- case s.buf.Len() < len(buf):
- s.chunkBufLen = 0
- for {
- n1, err := s.baseReadCloser.Read(s.chunkBuf[s.chunkBufLen:])
- // Usually we validate `err` first, but in this case
- // we are validating n > 0 for the following reasons.
- //
- // 1. n > 0, err is one of io.EOF, nil (near end of stream)
- // A Reader returning a non-zero number of bytes at the end
- // of the input stream may return either err == EOF or err == nil
- //
- // 2. n == 0, err is io.EOF (actual end of stream)
- //
- // Callers should always process the n > 0 bytes returned
- // before considering the error err.
- if n1 > 0 {
- s.chunkBufLen += n1
- s.bytesRead += int64(n1)
-
- if s.chunkBufLen == payloadChunkSize ||
- (s.chunkNum == s.totalChunks-1 &&
- s.chunkBufLen == s.lastChunkSize) {
- // Sign the chunk and write it to s.buf.
- s.signChunk(s.chunkBufLen, true)
- break
- }
- }
- if err != nil {
- if err == io.EOF {
- // No more data left in baseReader - last chunk.
- // Done reading the last chunk from baseReader.
- s.done = true
-
- // bytes read from baseReader different than
- // content length provided.
- if s.bytesRead != s.contentLen {
- return 0, fmt.Errorf("http: ContentLength=%d with Body length %d", s.contentLen, s.bytesRead)
- }
-
- // Sign the chunk and write it to s.buf.
- s.signChunk(0, len(s.trailer) == 0)
- if len(s.trailer) > 0 {
- // Trailer must be set now.
- s.addSignedTrailer(s.trailer)
- }
- break
- }
- return 0, err
- }
-
- }
- }
- return s.buf.Read(buf)
-}
-
-// Close - this method makes underlying io.ReadCloser's Close method available.
-func (s *StreamingReader) Close() error {
- if s.sh256 != nil {
- s.sh256.Close()
- s.sh256 = nil
- }
- return s.baseReadCloser.Close()
-}
diff --git a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v2.go b/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v2.go
deleted file mode 100644
index fa4f8c91e..000000000
--- a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v2.go
+++ /dev/null
@@ -1,319 +0,0 @@
-/*
- * MinIO Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2015-2017 MinIO, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package signer
-
-import (
- "bytes"
- "crypto/hmac"
- "crypto/sha1"
- "encoding/base64"
- "fmt"
- "net/http"
- "net/url"
- "sort"
- "strconv"
- "strings"
- "time"
-
- "github.com/minio/minio-go/v7/pkg/s3utils"
-)
-
-// Signature and API related constants.
-const (
- signV2Algorithm = "AWS"
-)
-
-// Encode input URL path to URL encoded path.
-func encodeURL2Path(req *http.Request, virtualHost bool) (path string) {
- if virtualHost {
- reqHost := getHostAddr(req)
- dotPos := strings.Index(reqHost, ".")
- if dotPos > -1 {
- bucketName := reqHost[:dotPos]
- path = "/" + bucketName
- path += req.URL.Path
- path = s3utils.EncodePath(path)
- return
- }
- }
- path = s3utils.EncodePath(req.URL.Path)
- return
-}
-
-// PreSignV2 - presign the request in following style.
-// https://${S3_BUCKET}.s3.amazonaws.com/${S3_OBJECT}?AWSAccessKeyId=${S3_ACCESS_KEY}&Expires=${TIMESTAMP}&Signature=${SIGNATURE}.
-func PreSignV2(req http.Request, accessKeyID, secretAccessKey string, expires int64, virtualHost bool) *http.Request {
- // Presign is not needed for anonymous credentials.
- if accessKeyID == "" || secretAccessKey == "" {
- return &req
- }
-
- d := time.Now().UTC()
- // Find epoch expires when the request will expire.
- epochExpires := d.Unix() + expires
-
- // Add expires header if not present.
- if expiresStr := req.Header.Get("Expires"); expiresStr == "" {
- req.Header.Set("Expires", strconv.FormatInt(epochExpires, 10))
- }
-
- // Get presigned string to sign.
- stringToSign := preStringToSignV2(req, virtualHost)
- hm := hmac.New(sha1.New, []byte(secretAccessKey))
- hm.Write([]byte(stringToSign))
-
- // Calculate signature.
- signature := base64.StdEncoding.EncodeToString(hm.Sum(nil))
-
- query := req.URL.Query()
- // Handle specially for Google Cloud Storage.
- if strings.Contains(getHostAddr(&req), ".storage.googleapis.com") {
- query.Set("GoogleAccessId", accessKeyID)
- } else {
- query.Set("AWSAccessKeyId", accessKeyID)
- }
-
- // Fill in Expires for presigned query.
- query.Set("Expires", strconv.FormatInt(epochExpires, 10))
-
- // Encode query and save.
- req.URL.RawQuery = s3utils.QueryEncode(query)
-
- // Save signature finally.
- req.URL.RawQuery += "&Signature=" + s3utils.EncodePath(signature)
-
- // Return.
- return &req
-}
-
-// PostPresignSignatureV2 - presigned signature for PostPolicy
-// request.
-func PostPresignSignatureV2(policyBase64, secretAccessKey string) string {
- hm := hmac.New(sha1.New, []byte(secretAccessKey))
- hm.Write([]byte(policyBase64))
- signature := base64.StdEncoding.EncodeToString(hm.Sum(nil))
- return signature
-}
-
-// Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature;
-// Signature = Base64( HMAC-SHA1( YourSecretAccessKeyID, UTF-8-Encoding-Of( StringToSign ) ) );
-//
-// StringToSign = HTTP-Verb + "\n" +
-// Content-Md5 + "\n" +
-// Content-Type + "\n" +
-// Date + "\n" +
-// CanonicalizedProtocolHeaders +
-// CanonicalizedResource;
-//
-// CanonicalizedResource = [ "/" + Bucket ] +
-// <HTTP-Request-URI, from the protocol name up to the query string> +
-// [ subresource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
-//
-// CanonicalizedProtocolHeaders = <described below>
-
-// SignV2 sign the request before Do() (AWS Signature Version 2).
-func SignV2(req http.Request, accessKeyID, secretAccessKey string, virtualHost bool) *http.Request {
- // Signature calculation is not needed for anonymous credentials.
- if accessKeyID == "" || secretAccessKey == "" {
- return &req
- }
-
- // Initial time.
- d := time.Now().UTC()
-
- // Add date if not present.
- if date := req.Header.Get("Date"); date == "" {
- req.Header.Set("Date", d.Format(http.TimeFormat))
- }
-
- // Calculate HMAC for secretAccessKey.
- stringToSign := stringToSignV2(req, virtualHost)
- hm := hmac.New(sha1.New, []byte(secretAccessKey))
- hm.Write([]byte(stringToSign))
-
- // Prepare auth header.
- authHeader := new(bytes.Buffer)
- authHeader.WriteString(fmt.Sprintf("%s %s:", signV2Algorithm, accessKeyID))
- encoder := base64.NewEncoder(base64.StdEncoding, authHeader)
- encoder.Write(hm.Sum(nil))
- encoder.Close()
-
- // Set Authorization header.
- req.Header.Set("Authorization", authHeader.String())
-
- return &req
-}
-
-// From the Amazon docs:
-//
-// StringToSign = HTTP-Verb + "\n" +
-//
-// Content-Md5 + "\n" +
-// Content-Type + "\n" +
-// Expires + "\n" +
-// CanonicalizedProtocolHeaders +
-// CanonicalizedResource;
-func preStringToSignV2(req http.Request, virtualHost bool) string {
- buf := new(bytes.Buffer)
- // Write standard headers.
- writePreSignV2Headers(buf, req)
- // Write canonicalized protocol headers if any.
- writeCanonicalizedHeaders(buf, req)
- // Write canonicalized Query resources if any.
- writeCanonicalizedResource(buf, req, virtualHost)
- return buf.String()
-}
-
-// writePreSignV2Headers - write preSign v2 required headers.
-func writePreSignV2Headers(buf *bytes.Buffer, req http.Request) {
- buf.WriteString(req.Method + "\n")
- buf.WriteString(req.Header.Get("Content-Md5") + "\n")
- buf.WriteString(req.Header.Get("Content-Type") + "\n")
- buf.WriteString(req.Header.Get("Expires") + "\n")
-}
-
-// From the Amazon docs:
-//
-// StringToSign = HTTP-Verb + "\n" +
-//
-// Content-Md5 + "\n" +
-// Content-Type + "\n" +
-// Date + "\n" +
-// CanonicalizedProtocolHeaders +
-// CanonicalizedResource;
-func stringToSignV2(req http.Request, virtualHost bool) string {
- buf := new(bytes.Buffer)
- // Write standard headers.
- writeSignV2Headers(buf, req)
- // Write canonicalized protocol headers if any.
- writeCanonicalizedHeaders(buf, req)
- // Write canonicalized Query resources if any.
- writeCanonicalizedResource(buf, req, virtualHost)
- return buf.String()
-}
-
-// writeSignV2Headers - write signV2 required headers.
-func writeSignV2Headers(buf *bytes.Buffer, req http.Request) {
- buf.WriteString(req.Method + "\n")
- buf.WriteString(req.Header.Get("Content-Md5") + "\n")
- buf.WriteString(req.Header.Get("Content-Type") + "\n")
- buf.WriteString(req.Header.Get("Date") + "\n")
-}
-
-// writeCanonicalizedHeaders - write canonicalized headers.
-func writeCanonicalizedHeaders(buf *bytes.Buffer, req http.Request) {
- var protoHeaders []string
- vals := make(map[string][]string)
- for k, vv := range req.Header {
- // All the AMZ headers should be lowercase
- lk := strings.ToLower(k)
- if strings.HasPrefix(lk, "x-amz") {
- protoHeaders = append(protoHeaders, lk)
- vals[lk] = vv
- }
- }
- sort.Strings(protoHeaders)
- for _, k := range protoHeaders {
- buf.WriteString(k)
- buf.WriteByte(':')
- for idx, v := range vals[k] {
- if idx > 0 {
- buf.WriteByte(',')
- }
- buf.WriteString(v)
- }
- buf.WriteByte('\n')
- }
-}
-
-// AWS S3 Signature V2 calculation rule is give here:
-// http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationStringToSign
-
-// Whitelist resource list that will be used in query string for signature-V2 calculation.
-//
-// This list should be kept alphabetically sorted, do not hastily edit.
-var resourceList = []string{
- "acl",
- "cors",
- "delete",
- "encryption",
- "legal-hold",
- "lifecycle",
- "location",
- "logging",
- "notification",
- "partNumber",
- "policy",
- "replication",
- "requestPayment",
- "response-cache-control",
- "response-content-disposition",
- "response-content-encoding",
- "response-content-language",
- "response-content-type",
- "response-expires",
- "retention",
- "select",
- "select-type",
- "tagging",
- "torrent",
- "uploadId",
- "uploads",
- "versionId",
- "versioning",
- "versions",
- "website",
-}
-
-// From the Amazon docs:
-//
-// CanonicalizedResource = [ "/" + Bucket ] +
-//
-// <HTTP-Request-URI, from the protocol name up to the query string> +
-// [ sub-resource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
-func writeCanonicalizedResource(buf *bytes.Buffer, req http.Request, virtualHost bool) {
- // Save request URL.
- requestURL := req.URL
- // Get encoded URL path.
- buf.WriteString(encodeURL2Path(&req, virtualHost))
- if requestURL.RawQuery != "" {
- var n int
- vals, _ := url.ParseQuery(requestURL.RawQuery)
- // Verify if any sub resource queries are present, if yes
- // canonicallize them.
- for _, resource := range resourceList {
- if vv, ok := vals[resource]; ok && len(vv) > 0 {
- n++
- // First element
- switch n {
- case 1:
- buf.WriteByte('?')
- // The rest
- default:
- buf.WriteByte('&')
- }
- buf.WriteString(resource)
- // Request parameters
- if len(vv[0]) > 0 {
- buf.WriteByte('=')
- buf.WriteString(vv[0])
- }
- }
- }
- }
-}
diff --git a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v4.go b/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v4.go
deleted file mode 100644
index ffd251451..000000000
--- a/vendor/github.com/minio/minio-go/v7/pkg/signer/request-signature-v4.go
+++ /dev/null
@@ -1,351 +0,0 @@
-/*
- * MinIO Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2015-2017 MinIO, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package signer
-
-import (
- "bytes"
- "encoding/hex"
- "net/http"
- "sort"
- "strconv"
- "strings"
- "time"
-
- "github.com/minio/minio-go/v7/pkg/s3utils"
-)
-
-// Signature and API related constants.
-const (
- signV4Algorithm = "AWS4-HMAC-SHA256"
- iso8601DateFormat = "20060102T150405Z"
- yyyymmdd = "20060102"
-)
-
-// Different service types
-const (
- ServiceTypeS3 = "s3"
- ServiceTypeSTS = "sts"
-)
-
-// Excerpts from @lsegal -
-// https:/github.com/aws/aws-sdk-js/issues/659#issuecomment-120477258.
-//
-// * User-Agent
-// This is ignored from signing because signing this causes problems with generating pre-signed
-// URLs (that are executed by other agents) or when customers pass requests through proxies, which
-// may modify the user-agent.
-//
-// * Authorization
-// Is skipped for obvious reasons.
-//
-// * Accept-Encoding
-// Some S3 servers like Hitachi Content Platform do not honor this header for signature
-// calculation.
-var v4IgnoredHeaders = map[string]bool{
- "Accept-Encoding": true,
- "Authorization": true,
- "User-Agent": true,
-}
-
-// getSigningKey hmac seed to calculate final signature.
-func getSigningKey(secret, loc string, t time.Time, serviceType string) []byte {
- date := sumHMAC([]byte("AWS4"+secret), []byte(t.Format(yyyymmdd)))
- location := sumHMAC(date, []byte(loc))
- service := sumHMAC(location, []byte(serviceType))
- signingKey := sumHMAC(service, []byte("aws4_request"))
- return signingKey
-}
-
-// getSignature final signature in hexadecimal form.
-func getSignature(signingKey []byte, stringToSign string) string {
- return hex.EncodeToString(sumHMAC(signingKey, []byte(stringToSign)))
-}
-
-// getScope generate a string of a specific date, an AWS region, and a
-// service.
-func getScope(location string, t time.Time, serviceType string) string {
- scope := strings.Join([]string{
- t.Format(yyyymmdd),
- location,
- serviceType,
- "aws4_request",
- }, "/")
- return scope
-}
-
-// GetCredential generate a credential string.
-func GetCredential(accessKeyID, location string, t time.Time, serviceType string) string {
- scope := getScope(location, t, serviceType)
- return accessKeyID + "/" + scope
-}
-
-// getHashedPayload get the hexadecimal value of the SHA256 hash of
-// the request payload.
-func getHashedPayload(req http.Request) string {
- hashedPayload := req.Header.Get("X-Amz-Content-Sha256")
- if hashedPayload == "" {
- // Presign does not have a payload, use S3 recommended value.
- hashedPayload = unsignedPayload
- }
- return hashedPayload
-}
-
-// getCanonicalHeaders generate a list of request headers for
-// signature.
-func getCanonicalHeaders(req http.Request, ignoredHeaders map[string]bool) string {
- var headers []string
- vals := make(map[string][]string)
- for k, vv := range req.Header {
- if _, ok := ignoredHeaders[http.CanonicalHeaderKey(k)]; ok {
- continue // ignored header
- }
- headers = append(headers, strings.ToLower(k))
- vals[strings.ToLower(k)] = vv
- }
- if !headerExists("host", headers) {
- headers = append(headers, "host")
- }
- sort.Strings(headers)
-
- var buf bytes.Buffer
- // Save all the headers in canonical form <header>:<value> newline
- // separated for each header.
- for _, k := range headers {
- buf.WriteString(k)
- buf.WriteByte(':')
- switch {
- case k == "host":
- buf.WriteString(getHostAddr(&req))
- buf.WriteByte('\n')
- default:
- for idx, v := range vals[k] {
- if idx > 0 {
- buf.WriteByte(',')
- }
- buf.WriteString(signV4TrimAll(v))
- }
- buf.WriteByte('\n')
- }
- }
- return buf.String()
-}
-
-func headerExists(key string, headers []string) bool {
- for _, k := range headers {
- if k == key {
- return true
- }
- }
- return false
-}
-
-// getSignedHeaders generate all signed request headers.
-// i.e lexically sorted, semicolon-separated list of lowercase
-// request header names.
-func getSignedHeaders(req http.Request, ignoredHeaders map[string]bool) string {
- var headers []string
- for k := range req.Header {
- if _, ok := ignoredHeaders[http.CanonicalHeaderKey(k)]; ok {
- continue // Ignored header found continue.
- }
- headers = append(headers, strings.ToLower(k))
- }
- if !headerExists("host", headers) {
- headers = append(headers, "host")
- }
- sort.Strings(headers)
- return strings.Join(headers, ";")
-}
-
-// getCanonicalRequest generate a canonical request of style.
-//
-// canonicalRequest =
-//
-// <HTTPMethod>\n
-// <CanonicalURI>\n
-// <CanonicalQueryString>\n
-// <CanonicalHeaders>\n
-// <SignedHeaders>\n
-// <HashedPayload>
-func getCanonicalRequest(req http.Request, ignoredHeaders map[string]bool, hashedPayload string) string {
- req.URL.RawQuery = strings.ReplaceAll(req.URL.Query().Encode(), "+", "%20")
- canonicalRequest := strings.Join([]string{
- req.Method,
- s3utils.EncodePath(req.URL.Path),
- req.URL.RawQuery,
- getCanonicalHeaders(req, ignoredHeaders),
- getSignedHeaders(req, ignoredHeaders),
- hashedPayload,
- }, "\n")
- return canonicalRequest
-}
-
-// getStringToSign a string based on selected query values.
-func getStringToSignV4(t time.Time, location, canonicalRequest, serviceType string) string {
- stringToSign := signV4Algorithm + "\n" + t.Format(iso8601DateFormat) + "\n"
- stringToSign = stringToSign + getScope(location, t, serviceType) + "\n"
- stringToSign += hex.EncodeToString(sum256([]byte(canonicalRequest)))
- return stringToSign
-}
-
-// PreSignV4 presign the request, in accordance with
-// http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html.
-func PreSignV4(req http.Request, accessKeyID, secretAccessKey, sessionToken, location string, expires int64) *http.Request {
- // Presign is not needed for anonymous credentials.
- if accessKeyID == "" || secretAccessKey == "" {
- return &req
- }
-
- // Initial time.
- t := time.Now().UTC()
-
- // Get credential string.
- credential := GetCredential(accessKeyID, location, t, ServiceTypeS3)
-
- // Get all signed headers.
- signedHeaders := getSignedHeaders(req, v4IgnoredHeaders)
-
- // Set URL query.
- query := req.URL.Query()
- query.Set("X-Amz-Algorithm", signV4Algorithm)
- query.Set("X-Amz-Date", t.Format(iso8601DateFormat))
- query.Set("X-Amz-Expires", strconv.FormatInt(expires, 10))
- query.Set("X-Amz-SignedHeaders", signedHeaders)
- query.Set("X-Amz-Credential", credential)
- // Set session token if available.
- if sessionToken != "" {
- query.Set("X-Amz-Security-Token", sessionToken)
- }
- req.URL.RawQuery = query.Encode()
-
- // Get canonical request.
- canonicalRequest := getCanonicalRequest(req, v4IgnoredHeaders, getHashedPayload(req))
-
- // Get string to sign from canonical request.
- stringToSign := getStringToSignV4(t, location, canonicalRequest, ServiceTypeS3)
-
- // Gext hmac signing key.
- signingKey := getSigningKey(secretAccessKey, location, t, ServiceTypeS3)
-
- // Calculate signature.
- signature := getSignature(signingKey, stringToSign)
-
- // Add signature header to RawQuery.
- req.URL.RawQuery += "&X-Amz-Signature=" + signature
-
- return &req
-}
-
-// PostPresignSignatureV4 - presigned signature for PostPolicy
-// requests.
-func PostPresignSignatureV4(policyBase64 string, t time.Time, secretAccessKey, location string) string {
- // Get signining key.
- signingkey := getSigningKey(secretAccessKey, location, t, ServiceTypeS3)
- // Calculate signature.
- signature := getSignature(signingkey, policyBase64)
- return signature
-}
-
-// SignV4STS - signature v4 for STS request.
-func SignV4STS(req http.Request, accessKeyID, secretAccessKey, location string) *http.Request {
- return signV4(req, accessKeyID, secretAccessKey, "", location, ServiceTypeSTS, nil)
-}
-
-// Internal function called for different service types.
-func signV4(req http.Request, accessKeyID, secretAccessKey, sessionToken, location, serviceType string, trailer http.Header) *http.Request {
- // Signature calculation is not needed for anonymous credentials.
- if accessKeyID == "" || secretAccessKey == "" {
- return &req
- }
-
- // Initial time.
- t := time.Now().UTC()
-
- // Set x-amz-date.
- req.Header.Set("X-Amz-Date", t.Format(iso8601DateFormat))
-
- // Set session token if available.
- if sessionToken != "" {
- req.Header.Set("X-Amz-Security-Token", sessionToken)
- }
-
- if len(trailer) > 0 {
- for k := range trailer {
- req.Header.Add("X-Amz-Trailer", strings.ToLower(k))
- }
-
- req.Header.Set("Content-Encoding", "aws-chunked")
- req.Header.Set("x-amz-decoded-content-length", strconv.FormatInt(req.ContentLength, 10))
- }
-
- hashedPayload := getHashedPayload(req)
- if serviceType == ServiceTypeSTS {
- // Content sha256 header is not sent with the request
- // but it is expected to have sha256 of payload for signature
- // in STS service type request.
- req.Header.Del("X-Amz-Content-Sha256")
- }
-
- // Get canonical request.
- canonicalRequest := getCanonicalRequest(req, v4IgnoredHeaders, hashedPayload)
-
- // Get string to sign from canonical request.
- stringToSign := getStringToSignV4(t, location, canonicalRequest, serviceType)
-
- // Get hmac signing key.
- signingKey := getSigningKey(secretAccessKey, location, t, serviceType)
-
- // Get credential string.
- credential := GetCredential(accessKeyID, location, t, serviceType)
-
- // Get all signed headers.
- signedHeaders := getSignedHeaders(req, v4IgnoredHeaders)
-
- // Calculate signature.
- signature := getSignature(signingKey, stringToSign)
-
- // If regular request, construct the final authorization header.
- parts := []string{
- signV4Algorithm + " Credential=" + credential,
- "SignedHeaders=" + signedHeaders,
- "Signature=" + signature,
- }
-
- // Set authorization header.
- auth := strings.Join(parts, ", ")
- req.Header.Set("Authorization", auth)
-
- if len(trailer) > 0 {
- // Use custom chunked encoding.
- req.Trailer = trailer
- return StreamingUnsignedV4(&req, sessionToken, req.ContentLength, time.Now().UTC())
- }
- return &req
-}
-
-// SignV4 sign the request before Do(), in accordance with
-// http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html.
-func SignV4(req http.Request, accessKeyID, secretAccessKey, sessionToken, location string) *http.Request {
- return signV4(req, accessKeyID, secretAccessKey, sessionToken, location, ServiceTypeS3, nil)
-}
-
-// SignV4Trailer sign the request before Do(), in accordance with
-// http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
-func SignV4Trailer(req http.Request, accessKeyID, secretAccessKey, sessionToken, location string, trailer http.Header) *http.Request {
- return signV4(req, accessKeyID, secretAccessKey, sessionToken, location, ServiceTypeS3, trailer)
-}
diff --git a/vendor/github.com/minio/minio-go/v7/pkg/signer/utils.go b/vendor/github.com/minio/minio-go/v7/pkg/signer/utils.go
deleted file mode 100644
index 87c993989..000000000
--- a/vendor/github.com/minio/minio-go/v7/pkg/signer/utils.go
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * MinIO Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2015-2017 MinIO, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package signer
-
-import (
- "crypto/hmac"
- "crypto/sha256"
- "net/http"
- "strings"
-)
-
-// unsignedPayload - value to be set to X-Amz-Content-Sha256 header when
-const unsignedPayload = "UNSIGNED-PAYLOAD"
-
-// sum256 calculate sha256 sum for an input byte array.
-func sum256(data []byte) []byte {
- hash := sha256.New()
- hash.Write(data)
- return hash.Sum(nil)
-}
-
-// sumHMAC calculate hmac between two input byte array.
-func sumHMAC(key, data []byte) []byte {
- hash := hmac.New(sha256.New, key)
- hash.Write(data)
- return hash.Sum(nil)
-}
-
-// getHostAddr returns host header if available, otherwise returns host from URL
-func getHostAddr(req *http.Request) string {
- host := req.Header.Get("host")
- if host != "" && req.Host != host {
- return host
- }
- if req.Host != "" {
- return req.Host
- }
- return req.URL.Host
-}
-
-// Trim leading and trailing spaces and replace sequential spaces with one space, following Trimall()
-// in http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
-func signV4TrimAll(input string) string {
- // Compress adjacent spaces (a space is determined by
- // unicode.IsSpace() internally here) to one space and return
- return strings.Join(strings.Fields(input), " ")
-}