feat(libstore): add AWS SSO support for S3 authentication#14645
Merged
Mic92 merged 8 commits intoNixOS:masterfrom Dec 15, 2025
Merged
feat(libstore): add AWS SSO support for S3 authentication#14645Mic92 merged 8 commits intoNixOS:masterfrom
Mic92 merged 8 commits intoNixOS:masterfrom
Conversation
xokdvium
reviewed
Nov 25, 2025
Mic92
reviewed
Dec 1, 2025
xokdvium
reviewed
Dec 1, 2025
lovesegfault
force-pushed
the
s3-sts
branch
2 times, most recently
from
0d6ee1d to
294d846
Compare
This enables seamless AWS SSO authentication for S3 binary caches without requiring users to manually export credentials. This adds SSO support by calling aws_credentials_provider_new_sso() from the C library directly. It builds a custom credential chain: Env → SSO → Profile → IMDS The SSO provider requires a TLS context for HTTPS connections to SSO endpoints, which is created once and shared across all providers.
Add validation for TLS context and client bootstrap initialization, with appropriate error messages when these fail. The TLS context failure is now a warning that gracefully disables SSO, while bootstrap failure throws since it's required for all providers.
The default (empty) profile case was using CreateCredentialsProviderChainDefault which didn't properly support role_arn/source_profile based role assumption via STS because TLS context wasn't being passed to the Profile provider. This change unifies the credential chain for all profiles (default and named), ensuring: - Consistent behavior between default and named profiles - Proper TLS context is passed for STS operations - SSO support works for both cases
The SSO provider was unconditionally setting profile_name_override to the (potentially empty) profile string from the S3 URL. When profile was empty, this prevented the AWS CRT SDK from falling back to the AWS_PROFILE environment variable. Only set profile_name_override when a profile is explicitly specified in the URL, allowing the SDK's built-in AWS_PROFILE handling to work.
Mic92
approved these changes
Dec 15, 2025
lovesegfault
added
the
backport 2.33-maintenance
|
Successfully created backport PR for |
jfroche
added a commit
to supabase/postgres
that referenced
this pull request
Feb 6, 2026
2.33 introduced a regression in the s3 upload, which causes the build to fail with "Access Denied". Downgrading to 2.32.5 should fix the issue. Waiting for NixOS/nix#14645 to be released in 2.33.3 which should be soon (tm).
philiptaron
added a commit
to philiptaron/nixpkgs
that referenced
this pull request
Feb 7, 2026
## Bug fixes - Fix destruction of DerivationBuilder implementations (NixOS/nix#15072) - Don't report cancelled goals as failures (NixOS/nix#14972) - Fix `linux` build on fresh `glibc` and `gcc` (NixOS/nix#15011) ## S3 binary cache improvements - Add AWS SSO support for S3 authentication (NixOS/nix#14645) - Respect `AWS_PROFILE` environment variable (NixOS/nix#14645) - Add STS support for default profile (NixOS/nix#14645) - Skip `Accept-Encoding` header for S3 SigV4 requests (NixOS/nix#15048) - Restart source before upload retries (NixOS/nix#15047) - Route AWS CRT logs through Nix logger (NixOS/nix#15059) The glibc 2.42 build fix patch is dropped as it is now included upstream. https://github.com/NixOS/nix/releases/tag/2.33.2
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Context
Fixes: #14476
Add 👍 to pull requests you find important.
The Nix maintainer team uses a GitHub project board to schedule and track reviews.