Skip to content

Conversation

@gregnr
Copy link
Contributor

@gregnr gregnr commented Dec 9, 2025

When the s3_endpoint URL contains a path (e.g. https://s3.example.com/some/path) and S3 path-style access is used, s3 requests fail with a 403 Forbidden due to an incorrect AWS AWS4-HMAC-SHA256 signature.

With the above example endpoint, the current logic will:

  1. set host to s3.example.com/some/path
  2. set path /<bucket-name>/<requested-path>

This PR corrects this to:

  1. set host to s3.example.com
  2. set path /some/path/<bucket-name>/<requested-path>

Which fixes the downstream signature that is generated from those values.


An example of an S3-compatible endpoint that does this in practice is Supabase's Storage API, which serves the s3 endpoint from:

https://<project-ref>.storage.supabase.co/storage/v1/s3

@gregnr
Copy link
Contributor Author

gregnr commented Dec 17, 2025

@carlopi just a friendly ping on this. Anything I can do to help move it forward?

Side note: I attempted to add unit tests for the S3 path logic but struggled to fit it into the existing test frameworks (most other tests seemed to be full integration vs unit). Let me know if you'd like this in there though!

@carlopi
Copy link
Collaborator

carlopi commented Dec 17, 2025

Thanks for the PR, LGTM!

@carlopi carlopi merged commit fa229d0 into duckdb:main Dec 17, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants