From ea589de9415703d63a956d7059848cc377fcdeb6 Mon Sep 17 00:00:00 2001 From: Aditya Date: Tue, 8 Sep 2026 21:21:05 +0530 Subject: [PATCH] s3: disable signing Accept-Encoding for Ceph and Linode - fixes #8206 Ceph RGW (and Linode Object Storage, which is Ceph-backed) can break SigV4 when Accept-Encoding is included in the signature, especially when a reverse proxy rewrites that header. GCS already sets this quirk; apply the same default for Ceph and Linode as suggested in #8206. --- backend/s3/provider/Ceph.yaml | 4 ++++ backend/s3/provider/Linode.yaml | 5 +++++ docs/content/s3.md | 10 ++++++++++ 3 files changed, 19 insertions(+) diff --git a/backend/s3/provider/Ceph.yaml b/backend/s3/provider/Ceph.yaml index 32285726d..17aa311ff 100644 --- a/backend/s3/provider/Ceph.yaml +++ b/backend/s3/provider/Ceph.yaml @@ -19,3 +19,7 @@ quirks: force_path_style: true list_url_encode: false use_already_exists: false + # Ceph RGW (and reverse proxies such as Cloudflare in front of it) can + # mutate Accept-Encoding and break SigV4 when that header is signed. + # See: https://github.com/rclone/rclone/issues/8206 + sign_accept_encoding: false diff --git a/backend/s3/provider/Linode.yaml b/backend/s3/provider/Linode.yaml index 2e6054174..77b39d1aa 100644 --- a/backend/s3/provider/Linode.yaml +++ b/backend/s3/provider/Linode.yaml @@ -24,3 +24,8 @@ endpoint: us-iad-10.linodeobjects.com: Washington, DC, US (us-iad-10) acl: {} bucket_acl: true +quirks: + # Linode Object Storage is Ceph-backed; signing Accept-Encoding causes + # SignatureDoesNotMatch with rclone 1.68+. Match the Ceph quirk. + # See: https://github.com/rclone/rclone/issues/8206 + sign_accept_encoding: false diff --git a/docs/content/s3.md b/docs/content/s3.md index 98962229d..9fdf5d864 100644 --- a/docs/content/s3.md +++ b/docs/content/s3.md @@ -5159,6 +5159,12 @@ parameter `--s3-upload-cutoff 0` or put this in the config file as `upload_cutoff 0` to work around a bug which causes uploading of small files to fail. +Rclone defaults `sign_accept_encoding` to false for the Ceph provider. +That avoids `SignatureDoesNotMatch` errors when a reverse proxy (for +example Cloudflare) rewrites the `Accept-Encoding` request header. You +can override this with `--s3-sign-accept-encoding` / `sign_accept_encoding` +if needed. + Note also that Ceph sometimes puts `/` in the passwords it gives users. If you read the secret access key using the command line tools you will get a JSON blob with the `/` escaped as `\/`. Make sure you @@ -7477,6 +7483,10 @@ secret_access_key = SECRET_ACCESS_KEY endpoint = eu-central-1.linodeobjects.com ``` +Linode Object Storage is Ceph-backed. Rclone defaults +`sign_accept_encoding` to false for this provider so SigV4 requests do +not fail with `SignatureDoesNotMatch` (see the [Ceph](#ceph) section). + ### Magalu {#magalu} Here is an example of making a [Magalu Object Storage](https://magalu.cloud/object-storage/)