iremcaginyurtturk opened a new pull request, #1559: URL: https://github.com/apache/iceberg-go/pull/1559
## Problem The `strip-gcs-incompatible-signed-headers` compat-mode middleware (added in #1423) removes `Amz-Sdk-Invocation-Id`, `Amz-Sdk-Request`, and `Accept-Encoding` from the SigV4 signed set only for **write** operations (`PutObject`/`UploadPart`/`CreateMultipartUpload`). **Read** operations still send those headers signed. Against Google Cloud Storage's S3-interop endpoint (`storage.googleapis.com` + HMAC keys), a `GetObject`/`HeadObject` — e.g. loading a table's `metadata.json` during a table-exists check — is rejected with: ``` operation error S3: GetObject, StatusCode: 403 ... SignatureDoesNotMatch ``` So writes succeed but any subsequent read fails, making GCS S3-interop unusable end to end. ## Fix - Strip `Amz-Sdk-Invocation-Id` / `Amz-Sdk-Request` / `Accept-Encoding` before signing on **every** operation (reads included), so none of them are in the SigV4 signed set. - Re-add `Accept-Encoding: identity` in a middleware inserted **after** the Signing step, so it is present on the wire but **not** part of the signature. This keeps GCS happy while still suppressing the HTTP transport's transparent gzip, so read responses aren't silently decompressed (which would drop `Content-Length`). Only affects the S3-compat path (`s3.compat-mode=true`); the normal AWS S3 path is unchanged. ## Testing - New `TestCompatModeGetObjectStripsSignedHeaders` asserts the `Amz-Sdk-*` headers are absent from wire and signature, `Accept-Encoding` is absent from the signature but present on the wire as `identity`. - Existing write/compat tests unchanged and passing. - `go test ./io/gocloud/` passes. - Verified end-to-end against a real GCS bucket via the S3-interop endpoint: a full write + read (table create followed by metadata reload) now succeeds. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
