Skip to content

fix: resolve GCS S3-compatible API SignatureDoesNotMatch on put_object#634

Merged
yaojin3616 merged 1 commit into
mainfrom
fix/gcs-s3-signature
May 29, 2026
Merged

fix: resolve GCS S3-compatible API SignatureDoesNotMatch on put_object#634
yaojin3616 merged 1 commit into
mainfrom
fix/gcs-s3-signature

Conversation

@yaojin3616
Copy link
Copy Markdown
Collaborator

Problem

Using Google Cloud Storage (GCS) with the S3-compatible API causes SignatureDoesNotMatch error on put_object:

botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: Invalid argument.

Root Cause

GCS S3-compatible API computes the V4 signature body-hash differently when ContentType is not explicitly set. Boto3 signs with an empty content-type, but GCS applies a different default, causing a signature mismatch.

Fix

  • write_bytes(): Always set ContentType explicitly (default application/octet-stream) to prevent GCS signature mismatch
  • presign_download_url(): Add comment clarifying GCS needs no path rewrite (unlike MinIO)
  • .env.example: Add GCS configuration examples with S3_REGION=auto

GCS Configuration

STORAGE_BACKEND=s3
S3_BUCKET=your-gcs-bucket-name
S3_REGION=auto
S3_ENDPOINT_URL=https://storage.googleapis.com
S3_ACCESS_KEY_ID=your-hmac-access-key
S3_SECRET_ACCESS_KEY=your-hmac-secret
S3_PREFIX=agents

- Always set ContentType in write_bytes() to prevent GCS signature mismatch
  (GCS applies a different default content-type than boto3's empty value)
- Add GCS configuration examples to .env.example files
- Clarify presigned URL logic (GCS needs no path rewrite unlike MinIO)
@yaojin3616 yaojin3616 merged commit d079056 into main May 29, 2026
1 check was pending
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant