{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/925","repository_url":"https://api.github.com/repos/docker/distribution","labels_url":"https://api.github.com/repos/docker/distribution/issues/925/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/925/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/925/events","html_url":"https://github.com/docker/distribution/issues/925","id":103194804,"number":925,"title":"CloudFront creating invalid Signed URL's","user":{"login":"benbarclay","id":413810,"avatar_url":"https://avatars.githubusercontent.com/u/413810?v=3","gravatar_id":"","url":"https://api.github.com/users/benbarclay","html_url":"https://github.com/benbarclay","followers_url":"https://api.github.com/users/benbarclay/followers","following_url":"https://api.github.com/users/benbarclay/following{/other_user}","gists_url":"https://api.github.com/users/benbarclay/gists{/gist_id}","starred_url":"https://api.github.com/users/benbarclay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benbarclay/subscriptions","organizations_url":"https://api.github.com/users/benbarclay/orgs","repos_url":"https://api.github.com/users/benbarclay/repos","events_url":"https://api.github.com/users/benbarclay/events{/privacy}","received_events_url":"https://api.github.com/users/benbarclay/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"RichardScothern","id":922018,"avatar_url":"https://avatars.githubusercontent.com/u/922018?v=3","gravatar_id":"","url":"https://api.github.com/users/RichardScothern","html_url":"https://github.com/RichardScothern","followers_url":"https://api.github.com/users/RichardScothern/followers","following_url":"https://api.github.com/users/RichardScothern/following{/other_user}","gists_url":"https://api.github.com/users/RichardScothern/gists{/gist_id}","starred_url":"https://api.github.com/users/RichardScothern/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RichardScothern/subscriptions","organizations_url":"https://api.github.com/users/RichardScothern/orgs","repos_url":"https://api.github.com/users/RichardScothern/repos","events_url":"https://api.github.com/users/RichardScothern/events{/privacy}","received_events_url":"https://api.github.com/users/RichardScothern/received_events","type":"User","site_admin":false},"milestone":null,"comments":27,"created_at":"2015-08-26T07:11:30Z","updated_at":"2016-03-24T18:44:27Z","closed_at":null,"body":"I am trying to get the CloudFront middleware layer working on version 2.1.1\r\n\r\nAs far as I can tell, the signed url's being generated by the registry are invalid.\r\n\r\nBoth pushing and pulling images from the registry throw errors. \r\n- Pushing image logs: https://gist.github.com/benbarclay/e4c14e6fa3473af4e2a5\r\n- Pulling image logs: https://gist.github.com/benbarclay/cf1f2d87bd882b8d17b8\r\n\r\nI grabbed a HEAD request in the registry logs from one of the pull's and tested it out in Postman, including the Authorization and User-Agent headers. I successfully receive the 307 redirect to a cloudfront signed url. The cloudfront url then gives me a 403 Forbidden.\r\n\r\nPlaying around with a [CloudFront URL Tool](https://aws.amazon.com/code/CloudFront/3052) I am able to decode the URL successfully\r\n```\r\nBase URL: \r\nhttps://d287onwoug4r78.cloudfront.net/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data\r\nPolicy: \r\n{\"Statement\":[{\"Resource\":\"https://d287onwoug4r78.cloudfront.net/docker/registry/v2/blobs/sha256/a3/a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4/data\",\"Condition\":{\"DateLessThan\":{\"AWS:EpochTime\":1440572954}}}]}\r\nKey: \r\nKEYHERE\r\n```\r\n\r\nIf I then use that tool to create a new signed url, with the same Key ID and Key that the registry is using, along with the base url decoded above, I get a URL that lets me download the manually.\r\n\r\nI'm not really sure how to debug this much further, but it's looking like the registry might be at fault here."},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/200965473","html_url":"https://github.com/docker/distribution/issues/925#issuecomment-200965473","issue_url":"https://api.github.com/repos/docker/distribution/issues/925","id":200965473,"user":{"login":"moxiegirl","id":1347209,"avatar_url":"https://avatars.githubusercontent.com/u/1347209?v=3","gravatar_id":"","url":"https://api.github.com/users/moxiegirl","html_url":"https://github.com/moxiegirl","followers_url":"https://api.github.com/users/moxiegirl/followers","following_url":"https://api.github.com/users/moxiegirl/following{/other_user}","gists_url":"https://api.github.com/users/moxiegirl/gists{/gist_id}","starred_url":"https://api.github.com/users/moxiegirl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moxiegirl/subscriptions","organizations_url":"https://api.github.com/users/moxiegirl/orgs","repos_url":"https://api.github.com/users/moxiegirl/repos","events_url":"https://api.github.com/users/moxiegirl/events{/privacy}","received_events_url":"https://api.github.com/users/moxiegirl/received_events","type":"User","site_admin":false},"created_at":"2016-03-24T18:44:26Z","updated_at":"2016-03-24T18:44:26Z","body":"@dmp42 The way I'm reading this thread, the next release on 4/7 will solve this issue. After that release, the product will work for Cloudfront as documented.  If you agree, then I would recommend that we work with Support to maintain an FAQ perhaps in the forums and leave the docs unchanged. WDYT?"}}