#172 Signature Error in case of special character in secret key
The S3Cmd Tool fails to create a valid signature for communication with amazon, if the password contains a special character (not sure what characters are affected, but it fails with a secret key that contains a '+' sign)
This was experienced on a mac os x, version 1.6.0 of s3cmd installed via homebrew. I was accessing an amazon S3 bucket in Frankfurt. Signature v2 setting was set on False.
The bucket could be accessed via aws cmd line tool. After creating a different secret that contains no special character, the access of the bucket now works.
Here is debug output (all credentials invalid now):
DEBUG: Canonical Request:
GET
/
delimiter=%2F
host:dilab-trailblazr-maven-repository.s3.amazonaws.com
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date:20160209T141342Z
host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
DEBUG: signature-v4 headers: {'x-amz-content-sha256': 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', 'Authorization': 'AWS4-HMAC-SHA256 Credential=AKIAJDSGFXXF4TL3MQIA/20160209/eu-central-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=95ed51c0ef93c54d47fc3684f35b0955b8e5fe88f8dbfbe7e896b739f3145c35', 'x-amz-date': '20160209T141342Z'}
DEBUG: Processing request, please wait...
DEBUG: get_hostname(dilab-trailblazr-maven-repository): dilab-trailblazr-maven-repository.s3.amazonaws.com
DEBUG: ConnMan.get(): creating new connection: https://dilab-trailblazr-maven-repository.s3.amazonaws.com
DEBUG: Using ca_certs_file None
DEBUG: non-proxied HTTPSConnection(dilab-trailblazr-maven-repository.s3.amazonaws.com)
DEBUG: format_uri(): /?delimiter=/
DEBUG: Sending request method_string='GET', uri='/?delimiter=/', headers={'x-amz-content-sha256': 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', 'Authorization': 'AWS4-HMAC-SHA256 Credential=AKIAJDSGFXXF4TL3MQIA/20160209/eu-central-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=95ed51c0ef93c54d47fc3684f35b0955b8e5fe88f8dbfbe7e896b739f3145c35', 'x-amz-date': '20160209T141342Z'}, body=(0 bytes)
DEBUG: Response: {'status': 403, 'headers': {'x-amz-bucket-region': 'eu-central-1', 'x-amz-id-2': '3PWZC63NM9i5tdM1EonLaNB3RCTkHn3ZSidDLjiEKtFSAvlkmQwY9L3u99KGYpp8eUdpxwyEpRk=', 'server': 'AmazonS3', 'transfer-encoding': 'chunked', 'x-amz-request-id': '25005C80DBEF6EFC', 'date': 'Tue, 09 Feb 2016 14:13:41 GMT', 'content-type': 'application/xml'}, 'reason': 'Forbidden', 'data': '\n<error>SignatureDoesNotMatch<message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</message><awsaccesskeyid>AKIAJDSGFXXF4TL3MQIA</awsaccesskeyid><stringtosign>AWS4-HMAC-SHA256\n20160209T141342Z\n20160209/eu-central-1/s3/aws4_request\n695afea48e858f04246e4550d9a1b50d76128b28e6a28673cac308e15e72c684</stringtosign><signatureprovided>95ed51c0ef93c54d47fc3684f35b0955b8e5fe88f8dbfbe7e896b739f3145c35</signatureprovided><stringtosignbytes>41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 0a 32 30 31 36 30 32 30 39 54 31 34 31 33 34 32 5a 0a 32 30 31 36 30 32 30 39 2f 65 75 2d 63 65 6e 74 72 61 6c 2d 31 2f 73 33 2f 61 77 73 34 5f 72 65 71 75 65 73 74 0a 36 39 35 61 66 65 61 34 38 65 38 35 38 66 30 34 32 34 36 65 34 35 35 30 64 39 61 31 62 35 30 64 37 36 31 32 38 62 32 38 65 36 61 32 38 36 37 33 63 61 63 33 30 38 65 31 35 65 37 32 63 36 38 34</stringtosignbytes><canonicalrequest>GET\n/\ndelimiter=%2F\nhost:dilab-trailblazr-maven-repository.s3.amazonaws.com\nx-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\nx-amz-date:20160209T141342Z\n\nhost;x-amz-content-sha256;x-amz-date\ne3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</canonicalrequest><canonicalrequestbytes>47 45 54 0a 2f 0a 64 65 6c 69 6d 69 74 65 72 3d 25 32 46 0a 68 6f 73 74 3a 64 69 6c 61 62 2d 74 72 61 69 6c 62 6c 61 7a 72 2d 6d 61 76 65 6e 2d 72 65 70 6f 73 69 74 6f 72 79 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 0a 78 2d 61 6d 7a 2d 63 6f 6e 74 65 6e 74 2d 73 68 61 32 35 36 3a 65 33 62 30 63 34 34 32 39 38 66 63 31 63 31 34 39 61 66 62 66 34 63 38 39 39 36 66 62 39 32 34 32 37 61 65 34 31 65 34 36 34 39 62 39 33 34 63 61 34 39 35 39 39 31 62 37 38 35 32 62 38 35 35 0a 78 2d 61 6d 7a 2d 64 61 74 65 3a 32 30 31 36 30 32 30 39 54 31 34 31 33 34 32 5a 0a 0a 68 6f 73 74 3b 78 2d 61 6d 7a 2d 63 6f 6e 74 65 6e 74 2d 73 68 61 32 35 36 3b 78 2d 61 6d 7a 2d 64 61 74 65 0a 65 33 62 30 63 34 34 32 39 38 66 63 31 63 31 34 39 61 66 62 66 34 63 38 39 39 36 66 62 39 32 34 32 37 61 65 34 31 65 34 36 34 39 62 39 33 34 63 61 34 39 35 39 39 31 62 37 38 35 32 62 38 35 35</canonicalrequestbytes><requestid>25005C80DBEF6EFC</requestid><hostid>3PWZC63NM9i5tdM1EonLaNB3RCTkHn3ZSidDLjiEKtFSAvlkmQwY9L3u99KGYpp8eUdpxwyEpRk=</hostid></error>'}
DEBUG: ConnMan.put(): connection put back to pool (https://dilab-trailblazr-maven-repository.s3.amazonaws.com#1)
DEBUG: S3Error: 403 (Forbidden)
DEBUG: HttpHeader: x-amz-bucket-region: eu-central-1
DEBUG: HttpHeader: x-amz-id-2: 3PWZC63NM9i5tdM1EonLaNB3RCTkHn3ZSidDLjiEKtFSAvlkmQwY9L3u99KGYpp8eUdpxwyEpRk=
DEBUG: HttpHeader: server: AmazonS3
DEBUG: HttpHeader: transfer-encoding: chunked
DEBUG: HttpHeader: x-amz-request-id: 25005C80DBEF6EFC
DEBUG: HttpHeader: date: Tue, 09 Feb 2016 14:13:41 GMT
DEBUG: HttpHeader: content-type: application/xml
DEBUG: ErrorXML: Code: 'SignatureDoesNotMatch'
DEBUG: ErrorXML: Message: 'The request signature we calculated does not match the signature you provided. Check your key and signing method.'
DEBUG: ErrorXML: AWSAccessKeyId: 'AKIAJDSGFXXF4TL3MQIA'
DEBUG: ErrorXML: StringToSign: 'AWS4-HMAC-SHA256\n20160209T141342Z\n20160209/eu-central-1/s3/aws4_request\n695afea48e858f04246e4550d9a1b50d76128b28e6a28673cac308e15e72c684'
DEBUG: ErrorXML: SignatureProvided: '95ed51c0ef93c54d47fc3684f35b0955b8e5fe88f8dbfbe7e896b739f3145c35'
DEBUG: ErrorXML: StringToSignBytes: '41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 0a 32 30 31 36 30 32 30 39 54 31 34 31 33 34 32 5a 0a 32 30 31 36 30 32 30 39 2f 65 75 2d 63 65 6e 74 72 61 6c 2d 31 2f 73 33 2f 61 77 73 34 5f 72 65 71 75 65 73 74 0a 36 39 35 61 66 65 61 34 38 65 38 35 38 66 30 34 32 34 36 65 34 35 35 30 64 39 61 31 62 35 30 64 37 36 31 32 38 62 32 38 65 36 61 32 38 36 37 33 63 61 63 33 30 38 65 31 35 65 37 32 63 36 38 34'
DEBUG: ErrorXML: CanonicalRequest: 'GET\n/\ndelimiter=%2F\nhost:dilab-trailblazr-maven-repository.s3.amazonaws.com\nx-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\nx-amz-date:20160209T141342Z\n\nhost;x-amz-content-sha256;x-amz-date\ne3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
DEBUG: ErrorXML: CanonicalRequestBytes: '47 45 54 0a 2f 0a 64 65 6c 69 6d 69 74 65 72 3d 25 32 46 0a 68 6f 73 74 3a 64 69 6c 61 62 2d 74 72 61 69 6c 62 6c 61 7a 72 2d 6d 61 76 65 6e 2d 72 65 70 6f 73 69 74 6f 72 79 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 0a 78 2d 61 6d 7a 2d 63 6f 6e 74 65 6e 74 2d 73 68 61 32 35 36 3a 65 33 62 30 63 34 34 32 39 38 66 63 31 63 31 34 39 61 66 62 66 34 63 38 39 39 36 66 62 39 32 34 32 37 61 65 34 31 65 34 36 34 39 62 39 33 34 63 61 34 39 35 39 39 31 62 37 38 35 32 62 38 35 35 0a 78 2d 61 6d 7a 2d 64 61 74 65 3a 32 30 31 36 30 32 30 39 54 31 34 31 33 34 32 5a 0a 0a 68 6f 73 74 3b 78 2d 61 6d 7a 2d 63 6f 6e 74 65 6e 74 2d 73 68 61 32 35 36 3b 78 2d 61 6d 7a 2d 64 61 74 65 0a 65 33 62 30 63 34 34 32 39 38 66 63 31 63 31 34 39 61 66 62 66 34 63 38 39 39 36 66 62 39 32 34 32 37 61 65 34 31 65 34 36 34 39 62 39 33 34 63 61 34 39 35 39 39 31 62 37 38 35 32 62 38 35 35'
DEBUG: ErrorXML: RequestId: '25005C80DBEF6EFC'
DEBUG: ErrorXML: HostId: '3PWZC63NM9i5tdM1EonLaNB3RCTkHn3ZSidDLjiEKtFSAvlkmQwY9L3u99KGYpp8eUdpxwyEpRk='
ERROR: S3 error: 403 (SignatureDoesNotMatch): The request signature we calculated does not match the signature you provided. Check your key and signing method.