`Aws::CloudFront::Signer` SHA1 digest is not supported on Fedora Linux
- Dominant language
- Ruby
- Stars
- 3.7k
- Forks
- 1.2k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 5
Description
### Describe the bug
The `Aws::CloudFront::Signer` class always uses the digest algorithm "SHA1",
https://github.com/aws/aws-sdk-ruby/blob/3919bccc5a0087a59a28c8f7ab19e5e267e21f26/gems/aws-sdk-cloudfront/lib/aws-sdk-cloudfront/signer.rb#L16
But this digest algorithm is unsupported since Fedora 41:
https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer
When using `Aws::CloudFront::Signer` on Fedora, it results in:
```
OpenSSL::PKey::PKeyError (EVP_DigestSignInit: invalid digest):
```
Changing the digest to SHA256 works for me, either by patching the aws-sdk-cloudfront gem or by overriding the class.
```rb
@cipher = OpenSSL::Digest.new('SHA256')
```
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Expected Behavior
`Aws::CloudFront::Signer` is compatible with a default Fedora installation without any monkey patching.
### Current Behavior
Results in the error:
```
OpenSSL::PKey::PKeyError (EVP_DigestSignInit: invalid digest):
```
### Reproduction Steps
Using Fedora Linux:
```rb
require 'aws-sdk-cloudfront'
signer = Aws::CloudFront::UrlSigner.new(key_pair_id: 'MY_KEY_PAIR_ID', private_key_path: '/home/jon/private.pem')
signed_url = signer.signed_url('https://mydistribution.cloudfront.net/myvideo.mp4', expires: Time.now.to_i + 3600)
puts signed_url
```
```
.../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:98:in 'OpenSSL::PKey::PKey#sign': EVP_DigestSignInit: invalid digest (OpenSSL::PKey::PKeyError)
from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:98:in 'Aws::CloudFront::Signer#sign_policy'
from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:91:in 'Aws::CloudFront::Signer#signature'
from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/url_signer.rb:30:in 'Aws::CloudFront::UrlSigner#signed_url'
from test.rb:4:in ''
```
### Possible Solution
```rb
require 'aws-sdk-cloudfront'
class MyUrlSigner < Aws::CloudFront::UrlSigner
def initialize(...)
super
@cipher = OpenSSL::Digest.new('SHA256')
end
end
signer = MyUrlSigner.new(key_pair_id: 'MY_KEY_PAIR_ID', private_key_path: '/home/jon/private.pem')
signed_url = signer.signed_url('https://mydistribution.cloudfront.net/myvideo.mp4', expires: Time.now.to_i + 3600)
puts signed_url
```
### Additional Information/Context
_No response_
### Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version
aws-sdk-cloudfront
### Environment details (Version of Ruby, OS environment)
Fedora Linux, ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [x86_64-linux]
Contributor guide
Assessment
This issue has not been assessed yet.