[Bug] - SignatureDoesNotMatch with aws s3 cp on small files

[lfstuttgart]

Describe the bug Upload results in error with small files (below the multipart threshold). botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. For more information, see REST Authentication and SOAP Authentication for details.

The same happens with aws s3 cp: aws s3 cp hello.txt s3://data-amt41-lesesaal-test/cp.txt --profile s3proxy-myuser-data-amt41-lesesaal-test upload failed: ./hello.txt to s3://data-amt41-lesesaal-test/cp.txt An error occurred (SignatureDoesNotMatch) when calling the PutObject operation: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. For more information, see REST Authentication and SOAP Authentication for details. Maybe it is the same as #1517 - in that case feel free to merge the issues.

This happens only with small files. As soon as file size is above the multipart threshold it works fine.

To Reproduce

1. Configure Versity GW as an s3proxy to an S3 storage (backend)
2. Create a small file locally.
3. Upload the file with either boto3 or aws s3 cp command.

Expected behavior The file is uploaded to the backend S3 storage

Server Version Version : 1.0.18 Build : c2c359e9f0d9ae20d142d1736d9ed4e120482972 BuildTime: 2025-09-17T15:36:49Z Linux x17-s3proxy1 6.1.0-41-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.158-1 (2025-11-09) x86_64 GNU/Linux

Happens also with Versity GW 1.0.16.

Additional context Our focus is on getting it to work with boto3. AWS CLI is just for testing. The same requests sent directly to our S3 storage (Netapp) works just fine. Since the S3 client is a third party application we have we are not able to enforce the use of multipart uploads (which work fine) instead of put object. So this would not be a viable workaround

Server journal with aws s3 cp command: Nov 17 12:31:25 x17-s3proxy1 versitygw-s3proxy-central[1086]: SDK 2025/11/17 12:31:25 WARN Response has no supported checksum. Not validating response payload. Nov 17 12:31:25 x17-s3proxy1 versitygw-s3proxy-central[1086]: 12:31:24 | 403 | 225.63102ms | 10.164.145.2 | PUT | /data-amt41-lesesaal-test/cp.txt | - |

with boto3 (more or less the same): Nov 17 12:32:43 x17-s3proxy1 versitygw-s3proxy-central[1086]: SDK 2025/11/17 12:32:43 WARN Response has no supported checksum. Not validating response payload. Nov 17 12:32:43 x17-s3proxy1 versitygw-s3proxy-central[1086]: 12:32:43 | 403 | 235.637585ms | 10.164.145.2 | PUT | /data-amt41-lesesaal-test/hello.txt | - |

Ballpark estimate Would it be possible to get an estimate for a fix - if you see this as a bug, too? I am fully aware we use VGW for free. And we appreciate that very much. So this question is really not to put pressure on you. It is just for us to asses if we need to look for a different solution.

Thank you Thanks in advance for looking into this!