GHAC cannot communicate with GHES using AWS backed storage. Requires AWS Signature Version 4.

[DLukeNelson]

I have a project that is trying to communicate with GHAC in a Github enterprise server. I'm in a big company, so I don't have a lot of details about how exactly our enterprise server and its cache is configured, but the error that I see on write is:

Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.

My code looks like:

let mut builder = opendal::services::Ghac::default()
    .version(GITHUB_ACTIONS_CACHE_VERSION)
    .endpoint(url);

I'm not really doing anything to let opendal know that the backing server for the GHAC is AWS, or that it ought to use an AWSV4Signer. From a glance at the docs, I didn't really see how I could possibly configure something like this.

Has anyone done something like this before? Any tips on how I might configure this? (I do see that the AWSV4Signer exists in the S3 service, but I'm not sure how I might make it useful in GHAC as well.)

[Xuanwo]

Hi, I suggest you submit a ticket to GitHub for further troubleshooting.

The GHAC service is provided by GitHub and utilizes the presigned URL feature offered by the underlying storage services. It can be tricky if the underlying storage service is configured with SSE, but GitHub still uses outdated signing methods (v2 here) to generate the presigned URL.

There is no method on our end to tweak this.

---

By the way, do other tools that rely on GHAC work, such as GitHub's own cache actions? Maybe you can try enable debug logging for those actions and paste the log files here.