{"record":{"id":"621c30eac78ddcb7","repo":"JuliusBrussee/caveman","slug":"bedrock-request-signing-failed","errorCode":null,"errorMessage":"bedrock: request signing failed","messagePattern":"bedrock: request signing failed","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/signing.go","lineNumber":101,"sourceCode":"\ttoSign, err := http.NewRequestWithContext(ctx, req.Method, upstream.String(), nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"bedrock: could not build signing request: %w\", err)\n\t}\n\ttoSign.Header = out.Clone()\n\n\tsigningService := runtimeService\n\tif mantle {\n\t\tsigningService = mantleService\n\t}\n\tpayloadHash, err := requestPayloadHash(ctx, req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tsigner := awssig.Signer{Region: signingRegion(req, upstream), Service: signingService}\n\tif err := signer.Sign(toSign, creds, payloadHash, time.Now()); err != nil {\n\t\t// The error from Sign never contains the secret (see awssig docs); still,\n\t\t// return a generic mapping error rather than the raw text.\n\t\treturn nil, fmt.Errorf(\"bedrock: request signing failed\")\n\t}\n\n\tfor _, name := range []string{\"Authorization\", \"Host\", \"X-Amz-Date\", \"X-Amz-Content-Sha256\", \"X-Amz-Security-Token\"} {\n\t\tif v := toSign.Header.Get(name); v != \"\" {\n\t\t\tout.Set(name, v)\n\t\t}\n\t}\n\treturn out, nil\n}\n\n// requestPayloadHash returns the hash of the exact post-transform wire body.\n// Gateways install it in context after transforming. Direct adapter callers and\n// verification probes can fall back to net/http's replayable GetBody contract.\n// A non-replayable body without a bound hash fails closed instead of emitting a\n// signature over bytes that may differ from the request on the wire.\nfunc requestPayloadHash(ctx context.Context, req *http.Request) (string, error) {\n\tif hash, ok := providers.RequestPayloadHash(ctx); ok {\n\t\treturn hash, nil","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/proxy/providers/bedrock/signing.go#L83-L119","documentation":"Error \"bedrock: request signing failed\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at proxy/providers/bedrock/signing.go:101 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Bedrock request signing failed; verify credentials and retry."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}