Python 为 S3 Post 生成的签名

Question

我想我已经阅读了几乎所有关于浏览器内签名的 base-64 编码、基于表单的 S3 帖子的所有内容:旧文档和新文档。例如:

http://doc.s3.amazonaws.com/proposals/post.html

甚至发现了这个:

http://s3.amazonaws.com/doc/s3-example-code/post/post_sample.html

我没有使用上面的或亚马逊更新的策略生成器，也没有摆弄 Boto，而是尝试起草一个更简单的 .py 脚本，从纯文本文件 (policy.txt) 中提取策略 JSON，然后生成必要的 base-64 编码签名来帮助我起草 HTML 表单。

签名本身(依赖于编码策略)未正确编码...可能是由于某种 utf-8 与 ascii 或\n(换行符)问题？

我正在使用的脚本如下，策略和 AWS key private_key 来 self 用来查看此脚本是否有效的 AWS 测试用例。正确编码的签名(如 Amazon 所引用)包含在下面的脚本中以供引用。

谁能告诉我为什么下面计算的签名与亚马逊提供的引用签名不匹配？

换句话说:

为什么编码正确:

policy_encoded = base64.b64encode(policy)

但这一个不是:

signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())

PYTHON 签名计算器...

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha
from sys import argv

script, policy = argv

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("..Desktop/policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

JSON 策略 (policy.txt--UTF-8)

{ "expiration": "2007-12-01T12:00:00.000Z",
"conditions": [
{"bucket": "johnsmith"},
["starts-with", "$key", "user/eric/"],
{"acl": "public-read"},
{"success_action_redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html"},
["starts-with", "$Content-Type", "image/"],
{"x-amz-meta-uuid": "14365123651274"},
["starts-with", "$x-amz-meta-tag", ""]
]
}

Answer 1

我认为这取决于您的 policy.txt 文件的内容。

我从引用的链接 ( http://doc.s3.amazonaws.com/proposals/post.html ) 中获取了策略并将其保存为 policy.txt

{ "expiration": "2007-12-01T12:00:00.000Z",
  "conditions": [
    {"bucket": "johnsmith" },
    ["starts-with", "$key", "user/eric/"],
    {"acl": "public-read" },
    {"redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html" },
    ["starts-with", "$Content-Type", "image/"],
    {"x-amz-meta-uuid": "14365123651274"},
    ["starts-with", "$x-amz-meta-tag", ""],
  ]
}

为了获得完全相同的签名，此文件必须具有完全相同的内容。

供引用，当我复制和粘贴时:MD5(policy.txt) = 5bce89d9ff799e2064c136d76bc7fc7a

如果我使用下面的脚本(和你的一样，只是调整文件名并删除args)

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

我得到的输出:

Your policy base-64 encoded iseyAiZXhwaXJhdGlvbiI6ICIyMDA3LTEyLTAxVDEyOjAwOjAwLjAwMFoiLAogICJjb25kaXRpb25zIjogWwogICAgeyJidWNrZXQiOiAiam9obnNtaXRoIiB9LAogICAgWyJzdGFydHMtd2l0aCIsICIka2V5IiwgInVzZXIvZXJpYy8iXSwKICAgIHsiYWNsIjogInB1YmxpYy1yZWFkIiB9LAogICAgeyJyZWRpcmVjdCI6ICJodHRwOi8vam9obnNtaXRoLnMzLmFtYXpvbmF3cy5jb20vc3VjY2Vzc2Z1bF91cGxvYWQuaHRtbCIgfSwKICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICJpbWFnZS8iXSwKICAgIHsieC1hbXotbWV0YS11dWlkIjogIjE0MzY1MTIzNjUxMjc0In0sCiAgICBbInN0YXJ0cy13aXRoIiwgIiR4LWFtei1tZXRhLXRhZyIsICIiXSwKICBdCn0KYour signature base-64 encoded is 2qCp0odXe7A9IYyUVqn0w2adtCA=Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA=

所以，您的代码有效，我只是认为您签署的政策略有不同(空格差异)