From c7e6fe14d21d9bf831f485888132291b0027ad54 Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Mon, 20 Jul 2026 13:46:30 -0700 Subject: [PATCH] Clarify Bedrock credential change detection --- src/openai/lib/bedrock.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/openai/lib/bedrock.py b/src/openai/lib/bedrock.py index 466e8ed75e..71d617840e 100644 --- a/src/openai/lib/bedrock.py +++ b/src/openai/lib/bedrock.py @@ -2,7 +2,7 @@ import os import re -import hashlib +import hmac import inspect from typing import Any, Literal, Mapping, Callable, Optional, Awaitable, cast from dataclasses import field, replace, dataclass @@ -24,7 +24,7 @@ AsyncBedrockTokenProvider = Callable[[], "str | Awaitable[str]"] _LegacyAuthMode = Literal["bearer", "token_provider", "aws"] _LegacyAuthConfiguration = tuple[_LegacyAuthMode, Optional[object]] -_LEGACY_SIGNATURE_KEY = os.urandom(32) +_LEGACY_SIGNATURE_NONCE = os.urandom(32) @dataclass(frozen=True) @@ -299,8 +299,9 @@ def _legacy_runtime_signature( configuration: _LegacyAuthConfiguration, ) -> _LegacyRuntimeSignature: mode, credential = configuration + # This is an opaque, process-local change detector, not a password hash. credential_identity: object = ( - hashlib.blake2s(credential.encode(), key=_LEGACY_SIGNATURE_KEY).digest() + hmac.digest(credential.encode(), _LEGACY_SIGNATURE_NONCE, "sha256") if isinstance(credential, str) else id(credential) )