From 394ec50ae5f82ee1da7cf8d45adfc63b09a7b7d8 Mon Sep 17 00:00:00 2001 From: Octoturge Date: Mon, 10 Aug 2026 08:39:43 +0200 Subject: [PATCH] Fix worker MinIO endpoint to omit default port from signed Host header s3.octoturge.com normalizes an explicit :443/:80 out of the Host header before validating SigV4, so including it caused SignatureDoesNotMatch even with correct credentials. --- worker/src/main.rs | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/worker/src/main.rs b/worker/src/main.rs index 0482dd2..bca929d 100644 --- a/worker/src/main.rs +++ b/worker/src/main.rs @@ -24,11 +24,19 @@ async fn main() -> anyhow::Result<()> { } else { "http" }; - let minio_endpoint = format!( - "{minio_scheme}://{}:{}", - std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into()), - std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into()), - ); + let minio_host = std::env::var("MINIO_ENDPOINT").unwrap_or_else(|_| "minio".into()); + let minio_port = std::env::var("MINIO_PORT").unwrap_or_else(|_| "9000".into()); + // Omit the port when it's the scheme's default — an explicit ":443"/":80" in the endpoint + // gets baked into the SigV4-signed Host header, and some S3-compatible gateways (confirmed + // against s3.octoturge.com) normalize the port away before validating the signature, + // producing SignatureDoesNotMatch even with a correct access/secret key. + let is_default_port = (minio_scheme == "https" && minio_port == "443") + || (minio_scheme == "http" && minio_port == "80"); + let minio_endpoint = if is_default_port { + format!("{minio_scheme}://{minio_host}") + } else { + format!("{minio_scheme}://{minio_host}:{minio_port}") + }; let minio_access_key = std::env::var("MINIO_ACCESS_KEY").unwrap_or_else(|_| "mcmapper".into()); let minio_secret_key = std::env::var("MINIO_SECRET_KEY").unwrap_or_else(|_| "mcmapper-dev-only".into());