用于S3 Post的Python生成签名

Question

我想我已经阅读了几乎所有关于签名的base-64编码的内容,用于浏览器内,基于表单的帖子到S3:旧文档和新文档.例如:

http://doc.s3.amazonaws.com/proposals/post.html

甚至发现了这个:

http://s3.amazonaws.com/doc/s3-example-code/post/post_sample.html

我没有使用上面或亚马逊的新策略生成器,也没有使用Boto,我试图草拟一个更简单的.py脚本,它从明文文件(policy.txt)中提取策略JSON,然后生成必要的基础 - 64位编码签名,帮助我起草HTML表单.

签名本身(依赖于编码策略)未被正确编码...可能是由于某种utf-8与ascii或\n(换行)问题？

我正在使用的脚本如下,策略和AWS Secret Key private_key来自我正在使用的AWS测试用例,以查看此脚本是否有效.正确编码的签名 - 由亚马逊引用 - 包含在下面的脚本中以供参考.

谁能告诉我为什么下面计算的签名与亚马逊提供的参考签名不符？

换一种说法:

为什么这是正确编码的:

policy_encoded = base64.b64encode(policy)

但这个不是:

signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())

PYTHON签名计算器......

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha
from sys import argv

script, policy = argv

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("..Desktop/policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

JSON策略(policy.txt - UTF-8)

{ "expiration": "2007-12-01T12:00:00.000Z",
"conditions": [
{"bucket": "johnsmith"},
["starts-with", "$key", "user/eric/"],
{"acl": "public-read"},
{"success_action_redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html"},
["starts-with", "$Content-Type", "image/"],
{"x-amz-meta-uuid": "14365123651274"},
["starts-with", "$x-amz-meta-tag", ""]
]
}

Answer 1

我认为这取决于policy.txt文件的内容.

我从引用的链接(http://doc.s3.amazonaws.com/proposals/post.html)中获取了该策略并将其保存为policy.txt

{ "expiration": "2007-12-01T12:00:00.000Z",
  "conditions": [
    {"bucket": "johnsmith" },
    ["starts-with", "$key", "user/eric/"],
    {"acl": "public-read" },
    {"redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html" },
    ["starts-with", "$Content-Type", "image/"],
    {"x-amz-meta-uuid": "14365123651274"},
    ["starts-with", "$x-amz-meta-tag", ""],
  ]
}

为了获得完全相同的签名,此文件必须具有完全相同的内容.

作为参考,当我复制并粘贴时:MD5(policy.txt)= 5bce89d9ff799e2064c136d76bc7fc7a

如果我使用以下脚本(与您的相同,只需调整文件名并删除args)

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

输出我得到:

Your policy base-64 encoded is
eyAiZXhwaXJhdGlvbiI6ICIyMDA3LTEyLTAxVDEyOjAwOjAwLjAwMFoiLAogICJjb25kaXRpb25zIjo
gWwogICAgeyJidWNrZXQiOiAiam9obnNtaXRoIiB9LAogICAgWyJzdGFydHMtd2l0aCIsICIka2V5Ii
wgInVzZXIvZXJpYy8iXSwKICAgIHsiYWNsIjogInB1YmxpYy1yZWFkIiB9LAogICAgeyJyZWRpcmVjd
CI6ICJodHRwOi8vam9obnNtaXRoLnMzLmFtYXpvbmF3cy5jb20vc3VjY2Vzc2Z1bF91cGxvYWQuaHRt
bCIgfSwKICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICJpbWFnZS8iXSwKICAgIHs
ieC1hbXotbWV0YS11dWlkIjogIjE0MzY1MTIzNjUxMjc0In0sCiAgICBbInN0YXJ0cy13aXRoIiwgIi
R4LWFtei1tZXRhLXRhZyIsICIiXSwKICBdCn0K
Your signature base-64 encoded is 2qCp0odXe7A9IYyUVqn0w2adtCA=
Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA=

所以,你的代码有效,我只是认为你签署了一个略有不同的政策(空白差异)