Python 为 S3 Post 生成签名

我想我已经阅读了几乎所有有关浏览器内基于表单的 S3 签名的 Base-64 编码的内容：旧文档和新文档。例如：

http://doc.s3.amazonaws.com/proposals/post.html http://doc.s3.amazonaws.com/proposals/post.html

甚至发现了这个：

http://s3.amazonaws.com/doc/s3-example-code/post/post_sample.html http://s3.amazonaws.com/doc/s3-example-code/post/post_sample.html

我没有使用上面的或亚马逊更新的策略生成器，也没有摆弄 Boto，而是尝试起草一个更简单的 .py 脚本，从纯文本文件 (policy.txt) 中提取策略 JSON，然后生成必要的基本 - 64 编码签名来帮助我起草 HTML 表单。

签名本身（依赖于编码策略）未正确编码...可能是由于某种 utf-8 与 ascii 或 \n （换行符）问题？

我正在使用的脚本如下，策略和AWS密钥private_key来自我用来查看此脚本是否有效的 AWS 测试用例。亚马逊引用的正确编码的签名包含在下面的脚本中以供参考。

谁能告诉我为什么下面计算的签名与亚马逊提供的参考签名不匹配？：

换句话说：

为什么这是正确编码的：

policy_encoded = base64.b64encode(policy)

但这不是：

signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())

PYTHON签名计算器...

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha
from sys import argv

script, policy = argv

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("..Desktop/policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

JSON 策略（policy.txt--UTF-8）

{ "expiration": "2007-12-01T12:00:00.000Z",
"conditions": [
{"bucket": "johnsmith"},
["starts-with", "$key", "user/eric/"],
{"acl": "public-read"},
{"success_action_redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html"},
["starts-with", "$Content-Type", "image/"],
{"x-amz-meta-uuid": "14365123651274"},
["starts-with", "$x-amz-meta-tag", ""]
]
}

我认为这取决于您的policy.txt 文件的内容。

我从引用的链接中获取了该政策（http://doc.s3.amazonaws.com/proposals/post.html http://doc.s3.amazonaws.com/proposals/post.html）并将其保存为policy.txt

{ "expiration": "2007-12-01T12:00:00.000Z",
  "conditions": [
    {"bucket": "johnsmith" },
    ["starts-with", "$key", "user/eric/"],
    {"acl": "public-read" },
    {"redirect": "http://johnsmith.s3.amazonaws.com/successful_upload.html" },
    ["starts-with", "$Content-Type", "image/"],
    {"x-amz-meta-uuid": "14365123651274"},
    ["starts-with", "$x-amz-meta-tag", ""],
  ]
}

为了获得完全相同的签名，该文件必须具有完全相同的内容。

作为参考，当我复制并粘贴时： MD5（策略.txt）= 5bce89d9ff799e2064c136d76bc7fc7a

如果我使用以下脚本（与您的相同，只需调整文件名并删除args)

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import base64, hmac, sha

private_key = 'uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o'
input = open("policy.txt", "rb")
policy = input.read()
policy_encoded = base64.b64encode(policy)
signature = base64.b64encode(hmac.new(private_key, policy_encoded, sha).digest())
print "Your policy base-64 encoded is %s." % (policy_encoded)
print "Your signature base-64 encoded is %s." % (signature)
print "Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA="

我得到的输出：

Your policy base-64 encoded is
eyAiZXhwaXJhdGlvbiI6ICIyMDA3LTEyLTAxVDEyOjAwOjAwLjAwMFoiLAogICJjb25kaXRpb25zIjo
gWwogICAgeyJidWNrZXQiOiAiam9obnNtaXRoIiB9LAogICAgWyJzdGFydHMtd2l0aCIsICIka2V5Ii
wgInVzZXIvZXJpYy8iXSwKICAgIHsiYWNsIjogInB1YmxpYy1yZWFkIiB9LAogICAgeyJyZWRpcmVjd
CI6ICJodHRwOi8vam9obnNtaXRoLnMzLmFtYXpvbmF3cy5jb20vc3VjY2Vzc2Z1bF91cGxvYWQuaHRt
bCIgfSwKICAgIFsic3RhcnRzLXdpdGgiLCAiJENvbnRlbnQtVHlwZSIsICJpbWFnZS8iXSwKICAgIHs
ieC1hbXotbWV0YS11dWlkIjogIjE0MzY1MTIzNjUxMjc0In0sCiAgICBbInN0YXJ0cy13aXRoIiwgIi
R4LWFtei1tZXRhLXRhZyIsICIiXSwKICBdCn0K
Your signature base-64 encoded is 2qCp0odXe7A9IYyUVqn0w2adtCA=
Your signature encoded should be 2qCp0odXe7A9IYyUVqn0w2adtCA=
  

所以，你的代码有效，我只是认为你签署了一个稍微不同的策略（空格差异）