feat(sandbox): proxy-side AWS SigV4 credential signing for CONNECT tunnels - #1638

Merged

pimlock merged 13 commits into

NVIDIA:mainfrom

jhjaggars:sigv4-credential-signing

Jun 26, 2026

Commits on Jun 22, 2026

feat(sandbox): proxy-side AWS SigV4 credential signing for CONNECT tunnels
jhjaggars
committed
fix(policy): validate signing_service at policy load time
jhjaggars
committed
feat(sandbox): support unsigned payload and streaming SigV4 signing
jhjaggars
committed
fix(sandbox): address SigV4 PR review feedback
jhjaggars
committed
fix(sandbox): address second review — FIPS+dualstack, missing tests, OCSF nit
jhjaggars
committed
fix(sandbox): address third review — chunked SignBody gap, provider DTO, startup validation
jhjaggars
committed
fix(sandbox): reject service names as regions in extract_aws_region

russellb
authored and
jhjaggars
committed
fix(sandbox): handle streaming SigV4 payload modes from boto3

russellb
authored and
jhjaggars
committed
test(sandbox): remove sigv4 integration test that uses real AWS credentials
jhjaggars
committed
fix: rustfmt and mise.lock sync
jhjaggars
committed
fix(sandbox): address SigV4 review findings — security, correctness, docs
jhjaggars
committed

Commits on Jun 23, 2026

fix: harden SigV4 signing path and fix CI lint failures
jhjaggars
committed

Commits on Jun 25, 2026

fix(sandbox): address PR review feedback for SigV4 signing
jhjaggars
committed