Skip to content

fix: don't set global credential system properties for third-party S3 targets #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheMeinerLP merged 2 commits into from
Jul 19, 2026
Merged

fix: don't set global credential system properties for third-party S3 targets #83

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6529a23
fix: don't set global credential system properties for third-party S3…
TheMeinerLP Jul 19, 2026
fa927c5
docs: trim inline comment, keep full reasoning in the PR description
TheMeinerLP Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions src/main/java/dev/themeinerlp/bluemap/s3/storage/S3FileSystemFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,6 @@ public static S3Fs build(S3Configuration cfg) {
final URI uri;
String region = resolved.region() != null && !resolved.region().isBlank() ? resolved.region() : DEFAULT_AWS_REGION;
System.setProperty(AWS_REGION_KEY, region);
System.setProperty("aws.accessKeyId", cfg.getAccessKeyId());
System.setProperty("aws.secretAccessKey", cfg.getSecretAccessKey());
// AWS SDK for Java 2.30.0+ defaults to attaching a flexible checksum (e.g. a CRC32
// trailer) to every PutObject and validating one on every GetObject. Many
// third-party S3-compatible stores (Ceph RGW included) don't handle that request
Expand All @@ -64,10 +62,14 @@ public static S3Fs build(S3Configuration cfg) {
System.setProperty("s3.spi.force-path-style", "true");
}
PROVIDER = new S3XFileSystemProvider();
// Credentials go through the URI userInfo instead of the global
// aws.accessKeyId/aws.secretAccessKey properties - see PR #83.
String userInfo = buildUserInfo(cfg);
uri = new URI("s3x", userInfo, url.getHost(), url.getPort(), "/" + cfg.getBucketName(), null, null);
} else {
// AWS S3 – the provider uses the default region/credentials chain
// AWS S3: no URI-embedded credentials, so these are the only way to set them.
System.setProperty("aws.accessKeyId", cfg.getAccessKeyId());
System.setProperty("aws.secretAccessKey", cfg.getSecretAccessKey());
PROVIDER = new S3FileSystemProvider();

uri = new URI("s3","/" + cfg.getBucketName(), null, null);
Expand Down