From f17e38488e89922f4255682010cdfd0dfc4b436b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 09:25:12 +0000 Subject: [PATCH] build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.42.1 to 1.43.0 Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.42.1 to 1.43.0. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.42.1...v1.43.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 +- .../aws/aws-sdk-go-v2/aws/config.go | 8 ++ .../aws-sdk-go-v2/aws/go_module_metadata.go | 2 +- .../aws/middleware/middleware.go | 47 +++++++++++- .../aws/aws-sdk-go-v2/aws/retry/middleware.go | 76 ++++++++++++++----- vendor/modules.txt | 2 +- 7 files changed, 113 insertions(+), 28 deletions(-) diff --git a/go.mod b/go.mod index c96bf170..56fb71db 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/KimMachineGun/automemlimit v0.7.5 - github.com/aws/aws-sdk-go-v2 v1.42.1 + github.com/aws/aws-sdk-go-v2 v1.43.0 github.com/aws/aws-sdk-go-v2/config v1.32.30 github.com/aws/aws-sdk-go-v2/credentials v1.19.29 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34 diff --git a/go.sum b/go.sum index 3c7502d1..ceb70ec7 100644 --- a/go.sum +++ b/go.sum @@ -51,8 +51,8 @@ github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7X github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek= -github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= +github.com/aws/aws-sdk-go-v2 v1.43.0 h1:fharf/WhbRAVZ1du0QL7roNFxZ6T/sWr+4Ni617bwSI= +github.com/aws/aws-sdk-go-v2 v1.43.0/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 h1:3IZY0XAJquT3aHzbkHfPzy4ACPcEjVG0x87KOwtpqGY= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14/go.mod h1:zwM6veDkhGgQFqkBy+uT28AAYpLu+uFMlPl+rCg/73E= github.com/aws/aws-sdk-go-v2/config v1.32.30 h1:XwsEzpTJfQYJbFicz/QMLwAZdyeNVVoOEkbF7R3gPJk= diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/config.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/config.go index 372b1512..0183a122 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/config.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/config.go @@ -164,6 +164,14 @@ type Config struct { // the shared config profile attribute request_min_compression_size_bytes RequestMinCompressSizeBytes int64 + // DisableClockSkewCorrection turns off SDK clock skew correction. When set + // the SDK will not adjust request signing timestamps to compensate for + // drift between the client and service clocks. Set to false (enabled) by + // default. This variable is sourced from the environment variable + // AWS_DISABLE_CLOCK_SKEW_CORRECTION or the shared config profile attribute + // disable_clock_skew_correction. + DisableClockSkewCorrection bool + // Controls how a resolved AWS account ID is handled for endpoint routing. AccountIDEndpointMode AccountIDEndpointMode diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go index 92732c3d..ba7e7270 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go @@ -3,4 +3,4 @@ package aws // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.42.1" +const goModuleVersion = "1.43.0" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go index 6d5f0079..3c4f2cae 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go @@ -43,7 +43,12 @@ func (r ClientRequestID) HandleBuild(ctx context.Context, in middleware.BuildInp } // RecordResponseTiming records the response timing for the SDK client requests. -type RecordResponseTiming struct{} +type RecordResponseTiming struct { + // DisableClockSkewCorrection suppresses recording of clock skew observed + // from the response, per the Clock Skew Correction SEP. Response timing is + // still recorded. + DisableClockSkewCorrection bool +} // ID is the middleware identifier func (a *RecordResponseTiming) ID() string { @@ -54,14 +59,17 @@ func (a *RecordResponseTiming) ID() string { func (a RecordResponseTiming) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) ( out middleware.DeserializeOutput, metadata middleware.Metadata, err error, ) { + requestAt := sdk.NowTime() out, metadata, err = next.HandleDeserialize(ctx, in) responseAt := sdk.NowTime() setResponseAt(&metadata, responseAt) var serverTime time.Time + var hasAgeHeader bool switch resp := out.RawResponse.(type) { case *smithyhttp.Response: + hasAgeHeader = len(resp.Header.Get("Age")) > 0 respDateHeader := resp.Header.Get("Date") if len(respDateHeader) == 0 { break @@ -77,14 +85,45 @@ func (a RecordResponseTiming) HandleDeserialize(ctx context.Context, in middlewa setServerTime(&metadata, serverTime) } - if !serverTime.IsZero() { - attemptSkew := serverTime.Sub(responseAt) - setAttemptSkew(&metadata, attemptSkew) + if !a.DisableClockSkewCorrection { + if skew, ok := computeClockSkew(serverTime, requestAt, responseAt, hasAgeHeader); ok { + setAttemptSkew(&metadata, skew) + } } return out, metadata, err } +// maxTrustedRequestDuration bounds how long a request may take before the SDK +// discards the skew measurement derived from its response. A slower round trip +// could only produce a signing failure if it pushed the timestamp outside the +// SigV4 validity window. See the Clock Skew Correction SEP. +const maxTrustedRequestDuration = 15 * time.Minute + +// computeClockSkew derives a clock skew candidate from a response per the Clock +// Skew Correction SEP. It returns ok=false (no candidate) when the Date header +// was absent/unparseable (serverTime zero), the round trip exceeded the maximum +// trusted request duration, or the response was served from a cache (Age +// header present). Otherwise the skew is the difference between the server's +// Date and the midpoint of the request round trip. +func computeClockSkew(serverTime, requestAt, responseAt time.Time, hasAgeHeader bool) (time.Duration, bool) { + if serverTime.IsZero() { + return 0, false + } + + if hasAgeHeader { + return 0, false + } + + elapsed := responseAt.Sub(requestAt) + if elapsed > maxTrustedRequestDuration { + return 0, false + } + + midpoint := requestAt.Add(elapsed / 2) + return serverTime.Sub(midpoint), true +} + type responseAtKey struct{} // GetResponseAt returns the time response was received at. diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go index ab024de0..126dcf47 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go @@ -48,6 +48,12 @@ type Attempt struct { // call. ClientSkew *atomic.Int64 + // DisableClockSkewCorrection disables clock skew correction per the Clock + // Skew Correction SEP: observed skew is not applied to the signing + // timestamp, not recorded into ClientSkew, and clock skew error codes are + // not treated as retry candidates. + DisableClockSkewCorrection bool + retryer aws.RetryerV2 requestCloner RequestCloner } @@ -88,7 +94,7 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error, ) { var attemptClockSkew time.Duration - if r.ClientSkew != nil { + if !r.DisableClockSkewCorrection && r.ClientSkew != nil { attemptClockSkew = time.Duration(r.ClientSkew.Load()) } @@ -159,7 +165,7 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn // this guarantees we are staying on top of the persistent skew value // (either to apply it or to heal it back if the clocks realign) - if r.ClientSkew != nil { + if !r.DisableClockSkewCorrection && r.ClientSkew != nil { if resultSkew, ok := awsmiddle.GetAttemptSkew(metadata); ok { r.ClientSkew.Store(resultSkew.Nanoseconds()) } @@ -245,7 +251,10 @@ func (r *Attempt) handleAttempt( return out, attemptResult, nopRelease, err } - err = wrapAsClockSkew(ctx, err) + if !r.DisableClockSkewCorrection { + candidateSkew, hasCandidateSkew := awsmiddle.GetAttemptSkew(metadata) + err = wrapAsClockSkew(err, candidateSkew, hasCandidateSkew, retryMetadata.AttemptClockSkew) + } //------------------------------ // Is Retryable and Should Retry @@ -316,37 +325,66 @@ func (r *Attempt) handleAttempt( return out, attemptResult, releaseRetryToken, err } -// errors that, if detected when we know there's a clock skew, -// can be retried and have a high chance of success -var possibleSkewCodes = map[string]struct{}{ +// clockSkewCodes are the error codes that may indicate a clock skew problem. +// Per the Clock Skew Correction SEP these are retryable only when the absolute +// skew observed from the response Date header exceeds the detection threshold. +// The SEP does not distinguish "definite" from "possible" skew errors: modern +// services overload a single code (e.g. InvalidSignatureException) for both +// skewed and genuinely malformed signatures, so every code is gated on the +// observed skew. +var clockSkewCodes = map[string]struct{}{ "InvalidSignatureException": {}, "SignatureDoesNotMatch": {}, "AuthFailure": {}, + "RequestTimeTooSkewed": {}, + "AccessDeniedException": {}, } -var definiteSkewCodes = map[string]struct{}{ - "RequestExpired": {}, - "RequestInTheFuture": {}, - "RequestTimeTooSkewed": {}, -} - -// wrapAsClockSkew checks if this error could be related to a clock skew -// error and if so, wrap the error. -func wrapAsClockSkew(ctx context.Context, err error) error { +// wrapAsClockSkew classifies err as a retryable clock skew error when its code +// is a known clock skew code and the signing time diverges from the server +// time by more than the detection threshold. +// +// The signing time is now() + attemptSkew. The server time is now() + +// candidateSkew (derived from the response Date header). The signing error is: +// +// |attemptSkew - candidateSkew| > skewThreshold +// +// This single check covers both fresh skew detection (attemptSkew is zero on +// first attempt, so the error equals |candidateSkew|) and stale offset healing +// (attemptSkew is large but the server and client clocks have realigned, so +// candidateSkew is near zero). +// +// If no candidate was observed (the Date header was absent, unparseable, or +// discarded as untrusted), the error is not treated as clock skew. +func wrapAsClockSkew(err error, candidateSkew time.Duration, hasCandidateSkew bool, attemptSkew time.Duration) error { var v interface{ ErrorCode() string } if !errors.As(err, &v) { return err } - if _, ok := definiteSkewCodes[v.ErrorCode()]; ok { - return &retryableClockSkewError{Err: err} + + if _, ok := clockSkewCodes[v.ErrorCode()]; !ok { + return err } - _, isPossibleSkewCode := possibleSkewCodes[v.ErrorCode()] - if skew := internalcontext.GetAttemptSkewContext(ctx); skew > skewThreshold && isPossibleSkewCode { + + if !hasCandidateSkew { + return err + } + + if absDuration(attemptSkew-candidateSkew) > skewThreshold { return &retryableClockSkewError{Err: err} } + return err } +func absDuration(d time.Duration) time.Duration { + if d < 0 { + return -d + } + + return d +} + // MetricsHeader attaches SDK request metric header for retries to the transport type MetricsHeader struct{} diff --git a/vendor/modules.txt b/vendor/modules.txt index 6beffaba..65821d79 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -15,7 +15,7 @@ github.com/STARRY-S/zip ## explicit; go 1.13 github.com/andybalholm/brotli github.com/andybalholm/brotli/matchfinder -# github.com/aws/aws-sdk-go-v2 v1.42.1 +# github.com/aws/aws-sdk-go-v2 v1.43.0 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/aws github.com/aws/aws-sdk-go-v2/aws/arn