okigan/awscurl v0.45

on GitHub

Fixes since v0.44 — all user-facing, no new dependencies, no CLI flags added.

Signing / encoding

• Query parameters with = in the value now sign correctly (issue #169, PR #225).
  aws_url_encode percent-encodes = as %3D instead of doubling it, each pair is split on
  the first =, and existing percent escapes are preserved (including non-UTF-8 ones), so a
  pre-encoded value keeps its meaning instead of being escaped again.
• --data-binary no longer raises inside hashlib when the payload came from -d/@file as
  text: a str payload is hashed as its UTF-8 encoding.

CLI

• -H is parsed on the first colon, so curl-style -H 'Name:value' works and values that
  contain colons survive; a malformed fragment exits 2 with a one-line message instead of a
  traceback (PR #253).
• --data-binary @- reads stdin as raw bytes, so binary payloads survive the pipe (PR #253).
• --profile is handed to botocore, so profiles defined in ~/.aws/config (SSO, role assume)
  are honoured as well as ~/.aws/credentials (PR #250). A missing profile or unresolvable
  credentials now print awscurl: error: ... instead of dumping a traceback (PR #254).
• Verbose (-v) output masks credentials: access key, secret key, session/security token,
  Authorization and x-amz-security-token. Beyond PR #254, this release also masks the session
  token inside the canonical-request dump and credential headers supplied via -H. Only the
  printed copies are masked — the canonical request that is actually signed is unchanged, and a
  test asserts that.

Tests / tooling

• Live TLS tests hardened against transient network failures (PR #251).
• Signing timestamp uses a timezone-aware UTC clock; datetime.utcnow() is deprecated and was
  emitting a DeprecationWarning on every request under Python 3.13. amzdate/datestamp and
  every signature are unchanged.
• Dependabot: actions/checkout 7, actions/setup-python 7, github/codeql-action 4.39.1.

Verification (Python 3.13.17, Linux)

• pycodestyle awscurl tests clean — including tests/, which scripts/ci.sh lints but the
  GitHub workflow does not; a missing blank line introduced by PR #254 was failing that local flow.
• mypy awscurl/ tests/ — no issues in 12 files.
• pytest --cov=awscurl --cov-fail-under=77 — 63 passed, 81.94% coverage, run with
  -W error::DeprecationWarning so no deprecated API remains.
• End-to-end sign-and-send against a local HTTP server: Authorization: AWS4-HMAC-SHA256 ... and
  x-amz-date arrive as expected, and x-amz-content-sha256 equals sha256 of the body for both
  binary stdin and UTF-8 text payloads.
• Canonical query strings compared against botocore's own SigV4Auth canonicalization for tricky
  inputs (=, +, /, %, *, ', UTF-8, repeated keys): 6/6 identical.

Known gaps (not fixed in this release)

• --data-binary is a flag, not a value-taking option, so awscurl --data-binary @- URL puts @-
  in the positional URI slot. Use awscurl -X POST -d @- --data-binary URL.
• -v still echoes --uri verbatim, so a presigned URL (whose query carries
  X-Amz-Credential/X-Amz-Signature) is printed as-is.