vendor: github.com/aws/aws-sdk-go-v2 v1.43.0

full diff: https://github.com/aws/aws-sdk-go-v2/compare/v1.42.0...v1.43.0

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // see https://github.com/microsoft/hcsshim/pull/2545
 	github.com/Microsoft/hcsshim v0.15.0-rc.1
 	github.com/RackSec/srslog v0.0.0-20180709174129-a4725f04ec91
-	github.com/aws/aws-sdk-go-v2 v1.42.0
+	github.com/aws/aws-sdk-go-v2 v1.43.0
 	github.com/aws/aws-sdk-go-v2/config v1.32.25
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29

go.sum

@@ -82,8 +82,8 @@ github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJ
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
-github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
+github.com/aws/aws-sdk-go-v2 v1.43.0 h1:fharf/WhbRAVZ1du0QL7roNFxZ6T/sWr+4Ni617bwSI=
+github.com/aws/aws-sdk-go-v2 v1.43.0/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13 h1:p1BBrg/Hhp6uK7zpejeI8QFXHJeC/mynzi04Sl03k9g=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.13/go.mod h1:8cIfkE9MDhkRZGpQ22aV6/lkYeYSozpz16Smrs5x4Ls=
 github.com/aws/aws-sdk-go-v2/config v1.32.25 h1:ACCejvStYoilgwrfegSt5ZntCbPrk52qfwyNcnl3omM=

vendor/github.com/aws/aws-sdk-go-v2/aws/config.go

@@ -164,6 +164,14 @@ type Config struct {
 	// the shared config profile attribute request_min_compression_size_bytes
 	RequestMinCompressSizeBytes int64
 
+	// DisableClockSkewCorrection turns off SDK clock skew correction. When set
+	// the SDK will not adjust request signing timestamps to compensate for
+	// drift between the client and service clocks. Set to false (enabled) by
+	// default. This variable is sourced from the environment variable
+	// AWS_DISABLE_CLOCK_SKEW_CORRECTION or the shared config profile attribute
+	// disable_clock_skew_correction.
+	DisableClockSkewCorrection bool
+
 	// Controls how a resolved AWS account ID is handled for endpoint routing.
 	AccountIDEndpointMode AccountIDEndpointMode
 

vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go

@@ -3,4 +3,4 @@
 package aws
 
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.42.0"
+const goModuleVersion = "1.43.0"

vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.go

@@ -43,7 +43,12 @@ func (r ClientRequestID) HandleBuild(ctx context.Context, in middleware.BuildInp
 }
 
 // RecordResponseTiming records the response timing for the SDK client requests.
-type RecordResponseTiming struct{}
+type RecordResponseTiming struct {
+	// DisableClockSkewCorrection suppresses recording of clock skew observed
+	// from the response, per the Clock Skew Correction SEP. Response timing is
+	// still recorded.
+	DisableClockSkewCorrection bool
+}
 
 // ID is the middleware identifier
 func (a *RecordResponseTiming) ID() string {
@@ -54,14 +59,17 @@ func (a *RecordResponseTiming) ID() string {
 func (a RecordResponseTiming) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
 	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
 ) {
+	requestAt := sdk.NowTime()
 	out, metadata, err = next.HandleDeserialize(ctx, in)
 	responseAt := sdk.NowTime()
 	setResponseAt(&metadata, responseAt)
 
 	var serverTime time.Time
+	var hasAgeHeader bool
 
 	switch resp := out.RawResponse.(type) {
 	case *smithyhttp.Response:
+		hasAgeHeader = len(resp.Header.Get("Age")) > 0
 		respDateHeader := resp.Header.Get("Date")
 		if len(respDateHeader) == 0 {
 			break
@@ -77,14 +85,45 @@ func (a RecordResponseTiming) HandleDeserialize(ctx context.Context, in middlewa
 		setServerTime(&metadata, serverTime)
 	}
 
-	if !serverTime.IsZero() {
-		attemptSkew := serverTime.Sub(responseAt)
-		setAttemptSkew(&metadata, attemptSkew)
+	if !a.DisableClockSkewCorrection {
+		if skew, ok := computeClockSkew(serverTime, requestAt, responseAt, hasAgeHeader); ok {
+			setAttemptSkew(&metadata, skew)
+		}
 	}
 
 	return out, metadata, err
 }
 
+// maxTrustedRequestDuration bounds how long a request may take before the SDK
+// discards the skew measurement derived from its response. A slower round trip
+// could only produce a signing failure if it pushed the timestamp outside the
+// SigV4 validity window. See the Clock Skew Correction SEP.
+const maxTrustedRequestDuration = 15 * time.Minute
+
+// computeClockSkew derives a clock skew candidate from a response per the Clock
+// Skew Correction SEP. It returns ok=false (no candidate) when the Date header
+// was absent/unparseable (serverTime zero), the round trip exceeded the maximum
+// trusted request duration, or the response was served from a cache (Age
+// header present). Otherwise the skew is the difference between the server's
+// Date and the midpoint of the request round trip.
+func computeClockSkew(serverTime, requestAt, responseAt time.Time, hasAgeHeader bool) (time.Duration, bool) {
+	if serverTime.IsZero() {
+		return 0, false
+	}
+
+	if hasAgeHeader {
+		return 0, false
+	}
+
+	elapsed := responseAt.Sub(requestAt)
+	if elapsed > maxTrustedRequestDuration {
+		return 0, false
+	}
+
+	midpoint := requestAt.Add(elapsed / 2)
+	return serverTime.Sub(midpoint), true
+}
+
 type responseAtKey struct{}
 
 // GetResponseAt returns the time response was received at.

vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.go

@@ -48,6 +48,12 @@ type Attempt struct {
 	// call.
 	ClientSkew *atomic.Int64
 
+	// DisableClockSkewCorrection disables clock skew correction per the Clock
+	// Skew Correction SEP: observed skew is not applied to the signing
+	// timestamp, not recorded into ClientSkew, and clock skew error codes are
+	// not treated as retry candidates.
+	DisableClockSkewCorrection bool
+
 	retryer       aws.RetryerV2
 	requestCloner RequestCloner
 }
@@ -88,7 +94,7 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 	out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error,
 ) {
 	var attemptClockSkew time.Duration
-	if r.ClientSkew != nil {
+	if !r.DisableClockSkewCorrection && r.ClientSkew != nil {
 		attemptClockSkew = time.Duration(r.ClientSkew.Load())
 	}
 
@@ -159,7 +165,7 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 
 	// this guarantees we are staying on top of the persistent skew value
 	// (either to apply it or to heal it back if the clocks realign)
-	if r.ClientSkew != nil {
+	if !r.DisableClockSkewCorrection && r.ClientSkew != nil {
 		if resultSkew, ok := awsmiddle.GetAttemptSkew(metadata); ok {
 			r.ClientSkew.Store(resultSkew.Nanoseconds())
 		}
@@ -245,7 +251,10 @@ func (r *Attempt) handleAttempt(
 		return out, attemptResult, nopRelease, err
 	}
 
-	err = wrapAsClockSkew(ctx, err)
+	if !r.DisableClockSkewCorrection {
+		candidateSkew, hasCandidateSkew := awsmiddle.GetAttemptSkew(metadata)
+		err = wrapAsClockSkew(err, candidateSkew, hasCandidateSkew, retryMetadata.AttemptClockSkew)
+	}
 
 	//------------------------------
 	// Is Retryable and Should Retry
@@ -316,37 +325,66 @@ func (r *Attempt) handleAttempt(
 	return out, attemptResult, releaseRetryToken, err
 }
 
-// errors that, if detected when we know there's a clock skew,
-// can be retried and have a high chance of success
-var possibleSkewCodes = map[string]struct{}{
+// clockSkewCodes are the error codes that may indicate a clock skew problem.
+// Per the Clock Skew Correction SEP these are retryable only when the absolute
+// skew observed from the response Date header exceeds the detection threshold.
+// The SEP does not distinguish "definite" from "possible" skew errors: modern
+// services overload a single code (e.g. InvalidSignatureException) for both
+// skewed and genuinely malformed signatures, so every code is gated on the
+// observed skew.
+var clockSkewCodes = map[string]struct{}{
 	"InvalidSignatureException": {},
 	"SignatureDoesNotMatch":     {},
 	"AuthFailure":               {},
+	"RequestTimeTooSkewed":      {},
+	"AccessDeniedException":     {},
 }
 
-var definiteSkewCodes = map[string]struct{}{
-	"RequestExpired":       {},
-	"RequestInTheFuture":   {},
-	"RequestTimeTooSkewed": {},
-}
-
-// wrapAsClockSkew checks if this error could be related to a clock skew
-// error and if so, wrap the error.
-func wrapAsClockSkew(ctx context.Context, err error) error {
+// wrapAsClockSkew classifies err as a retryable clock skew error when its code
+// is a known clock skew code and the signing time diverges from the server
+// time by more than the detection threshold.
+//
+// The signing time is now() + attemptSkew. The server time is now() +
+// candidateSkew (derived from the response Date header). The signing error is:
+//
+//	|attemptSkew - candidateSkew| > skewThreshold
+//
+// This single check covers both fresh skew detection (attemptSkew is zero on
+// first attempt, so the error equals |candidateSkew|) and stale offset healing
+// (attemptSkew is large but the server and client clocks have realigned, so
+// candidateSkew is near zero).
+//
+// If no candidate was observed (the Date header was absent, unparseable, or
+// discarded as untrusted), the error is not treated as clock skew.
+func wrapAsClockSkew(err error, candidateSkew time.Duration, hasCandidateSkew bool, attemptSkew time.Duration) error {
 	var v interface{ ErrorCode() string }
 	if !errors.As(err, &v) {
 		return err
 	}
-	if _, ok := definiteSkewCodes[v.ErrorCode()]; ok {
-		return &retryableClockSkewError{Err: err}
-	}
-	_, isPossibleSkewCode := possibleSkewCodes[v.ErrorCode()]
-	if skew := internalcontext.GetAttemptSkewContext(ctx); skew > skewThreshold && isPossibleSkewCode {
+
+	if _, ok := clockSkewCodes[v.ErrorCode()]; !ok {
+		return err
+	}
+
+	if !hasCandidateSkew {
+		return err
+	}
+
+	if absDuration(attemptSkew-candidateSkew) > skewThreshold {
 		return &retryableClockSkewError{Err: err}
 	}
+
 	return err
 }
 
+func absDuration(d time.Duration) time.Duration {
+	if d < 0 {
+		return -d
+	}
+
+	return d
+}
+
 // MetricsHeader attaches SDK request metric header for retries to the transport
 type MetricsHeader struct{}
 

vendor/modules.txt

@@ -188,7 +188,7 @@ github.com/armon/go-metrics
 # github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 ## explicit; go 1.13
 github.com/asaskevich/govalidator
-# github.com/aws/aws-sdk-go-v2 v1.42.0
+# github.com/aws/aws-sdk-go-v2 v1.43.0
 ## explicit; go 1.24
 github.com/aws/aws-sdk-go-v2/aws
 github.com/aws/aws-sdk-go-v2/aws/defaults