Upload image failed with SignatureDoesNotMatch error

[ngoc-minh-do]

Bug Report

Problematic behavior
Upload image failed with SignatureDoesNotMatch error

Expected behavior/code
Upload image success without error

Steps to Reproduce

1. Upload image to a doc
2. Then it show Error: Upload failed
3. Then docker log show An error occurred (SignatureDoesNotMatch)

Environment

• Docs version: latest
• Instance URL: doc.example.com

Additional context/Screenshots

192.168.128.3 - - [16/Jul/2025:13:58:41 +0000] "GET /api/v1.0/documents/4717d569-3b7a-4bcf-a5ba-bdddbd4bf7cc/ HTTP/1.1" 200 15499 "-" "axios/1.10.0"
2025-07-16 13:58:42,023 request.summary INFO 
192.168.128.3 - - [16/Jul/2025:13:58:42 +0000] "GET /api/v1.0/users/me/ HTTP/1.1" 200 130 "-" "axios/1.10.0"
2025-07-16 13:58:57,546 core.malware_detection INFO File 4717d569-3b7a-4bcf-a5ba-bdddbd4bf7cc/attachments/c397c779-7795-46d1-8aeb-04672af57e32.jpeg is safe
2025-07-16 13:58:57,561 request.summary ERROR An error occurred (SignatureDoesNotMatch) when calling the CopyObject operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2025-07-16 13:58:57,561 django.request ERROR Internal Server Error: /api/v1.0/documents/4717d569-3b7a-4bcf-a5ba-bdddbd4bf7cc/attachment-upload/
Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
      response = get_response(request)
      File "/usr/local/lib/python3.13/site-packages/django/core/handlers/base.py", line 197, in _get_response
      response = wrapped_callback(request, *callback_args, **callback_kwargs)
      File "/usr/local/lib/python3.13/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
      return view_func(request, *args, **kwargs)
      File "/usr/local/lib/python3.13/site-packages/rest_framework/viewsets.py", line 125, in view
      return self.dispatch(request, *args, **kwargs)
               ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
             File "/usr/local/lib/python3.13/site-packages/rest_framework/views.py", line 515, in dispatch
      response = self.handle_exception(exc)
      File "/usr/local/lib/python3.13/site-packages/rest_framework/views.py", line 475, in handle_exception
      self.raise_uncaught_exception(exc)
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^
      File "/usr/local/lib/python3.13/site-packages/rest_framework/views.py", line 486, in raise_uncaught_exception
      raise exc
      File "/usr/local/lib/python3.13/site-packages/rest_framework/views.py", line 512, in dispatch
      response = handler(request, *args, **kwargs)
      File "/app/core/api/viewsets.py", line 1172, in attachment_upload
      malware_detection.analyse_file(key, document_id=document.id)
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/usr/local/lib/python3.13/site-packages/lasuite/malware_detection/backends/dummy.py", line 12, in analyse_file
      self.callback(file_path, ReportStatus.SAFE, error_info={}, **kwargs)
        ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/app/core/malware_detection.py", line 28, in malware_detection_callback
      s3_client.copy_object(
          ~~~~~~~~~~~~~~~~~~~~~^
            Bucket=bucket_name,
                ^^^^^^^^^^^^^^^^^^^
            ...<4 lines>...
            MetadataDirective="REPLACE",
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            )
        ^
      File "/usr/local/lib/python3.13/site-packages/botocore/client.py", line 601, in _api_call
      return self._make_api_call(operation_name, kwargs)
               ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
             File "/usr/local/lib/python3.13/site-packages/botocore/context.py", line 123, in wrapper
      return func(*args, **kwargs)
      File "/usr/local/lib/python3.13/site-packages/botocore/client.py", line 1074, in _make_api_call
      raise error_class(parsed_response, operation_name)
    botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the CopyObject operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.
192.168.128.3 - - [16/Jul/2025:13:58:57 +0000] "POST /api/v1.0/documents/4717d569-3b7a-4bcf-a5ba-bdddbd4bf7cc/attachment-upload/ HTTP/1.1" 500 145 "https://docs.ngoclab.com/docs/4717d569-3b7a-4bcf-a5ba-bdddbd4bf7cc/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0"

[jco-c]

Question from my side, as I had a similar issue: Are you using an s3 backend other than the recommended minio instance? If yes, maybe check if your s3 provider is compatible with boto3 version 1.36.0 (or later). A breaking change was introduced in that version, which not all s3 backends are compatible to yet. Also see my issue here for a fix: #1202

[classabbyamp]

that linked issue appears to be slightly different (PutObject vs CopyObject). I'm also seeing this backtrace when using garage 2.0.0 as my s3 provider. The fix you suggested did not work for me.