signature-process-demo/signature-v3/bash/signv3.sh at main · TencentCloud/signature-process-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/bin/bash

# 密钥参数
# 需要设置环境变量 TENCENTCLOUD_SECRET_ID，值为示例的 AKIDz8krbsJ5yKBZQpn74WFkmLPx3*******
#secret_id=AKIDz8krbsJ5yKBZQpn74WFkmLPx3*******
secret_id=$TENCENTCLOUD_SECRET_ID
# 需要设置环境变量 TENCENTCLOUD_SECRET_KEY，值为示例的 Gu5t9xGARNpq86cd98joQYCN3*******
#secret_key=Gu5t9xGARNpq86cd98joQYCN3*******
secret_key=$TENCENTCLOUD_SECRET_KEY

service="cvm"
host="cvm.tencentcloudapi.com"
region="ap-guangzhou"
action="DescribeInstances"
version="2017-03-12"
algorithm="TC3-HMAC-SHA256"
timestamp=1551113065
# 获取真实当前时间戳
timestamp=$(date +%s)
date=$(date -u -d @$timestamp +"%Y-%m-%d")
# utf8编码请求体
payload=$(echo '{"Limit": 1, "Filters": [{"Values": ["未命名"], "Name": "instance-name"}]}' | iconv -t utf-8)


# ************* 步骤 1：拼接规范请求串 *************
http_request_method="POST"
canonical_uri="/"
canonical_querystring=""
canonical_headers="content-type:application/json; charset=utf-8\nhost:$host\nx-tc-action:$(echo $action | awk '{print tolower($0)}')\n"
signed_headers="content-type;host;x-tc-action"
hashed_request_payload=$(echo -n "$payload" | openssl sha256 -hex | awk '{print $2}')
canonical_request="$http_request_method\n$canonical_uri\n$canonical_querystring\n$canonical_headers\n$signed_headers\n$hashed_request_payload"
echo "$canonical_request"

# ************* 步骤 2：拼接待签名字符串 *************
credential_scope="$date/$service/tc3_request"
hashed_canonical_request=$(printf "$canonical_request" | openssl sha256 -hex | awk '{print $2}')
string_to_sign="$algorithm\n$timestamp\n$credential_scope\n$hashed_canonical_request"
echo "$string_to_sign"

# ************* 步骤 3：计算签名 *************
# 计算签名摘要函数
sign() {
    printf "$2" | openssl sha256 -hmac "$1" | awk '{print $2}'
}
secret_date=$(sign "TC3$secret_key" "$date")
echo $secret_date
# 转二进制
secret_date=$(printf $secret_date | xxd -r -p)
secret_service=$(sign "$secret_date" "$service")
echo $secret_service
secret_service=$(printf $secret_service | xxd -r -p)
secret_signing=$(sign "$secret_service" "tc3_request")
echo $secret_signing
secret_signing=$(printf $secret_signing | xxd -r -p)
signature=$(printf "$string_to_sign" | openssl sha256 -hmac "$secret_signing" | awk '{print $2}')
echo "$signature"

# ************* 步骤 4：拼接 Authorization *************
authorization="$algorithm Credential=$secret_id/$credential_scope, SignedHeaders=$signed_headers, Signature=$signature"
echo $authorization

# 使用文档中的例子则必定会失败，因为时间戳离当前时间太大
# 根据注释将密钥和时间戳timestamp调整为当前的实际值则可以调用成功
curl -XPOST "https://$host" -d "$payload" -H "Authorization: $authorization" -H "Content-Type: application/json; charset=utf-8" -H "Host: $host" -H "X-TC-Action: $action" -H "X-TC-Timestamp: $timestamp" -H "X-TC-Version: $version" -H "X-TC-Region: $region"