Regression in 1.1.0

[martinamps]

Authentication has begun failing for us with multiple query strings because the 1.1.0 release (which is not tagged in GitHub) has introduced this commit from 5 years ago which appears to be a regression. The 1.0.1 branch did not include it

Any ideas how this happened / how it can be prevented moving forward?

Simple repro test:

qs_items = {'foo': ['bar', 'baz'], 'qux': ['3','2','1']}
qs_strings = []
for name in sorted(qs_items):
    vals = qs_items[name]
    for val in vals:
        qs_strings.append('='.join([name, val]))
    qs1 = '&'.join(qs_strings)

qs_strings = []
for name, vals in qs_items.items():
    for val in vals:
        qs_strings.append('='.join([name, val]))
    qs2 = '&'.join(sorted(qs_strings))

print(qs1)
print(qs2)

assert qs1 == qs2

foo=bar&foo=baz&qux=3&qux=2&qux=1
foo=bar&foo=baz&qux=1&qux=2&qux=3
Traceback (most recent call last):
  File "main.py", line 19, in <module>
    assert qs1 == qs2
AssertionError

EDIT: Ah I see though the commit is 5 years old, the merge just landed more recently.

[tedder]

Martin- thanks for teasing out the root cause of the problem. I've been too casual with the release process, so I just cut it from main.

I want to compare the pip version against my local server that I uploaded from and see why there's a difference. I'll definitely add a unit test, thank you very much for giving breadcrumbs on that.

(feel free to PR some of it if you want)

[martinamps]

Apologies I think I was mistaken about the release process bug - the git blame showing me the commit was 5 years old was misleading given it was merged in March. I think this will do it #50

[tedder]

Gotcha, I need to sort out how that affects #21, I think.

[tedder]

I'm thinking it isn't about reverting #21 (in PR #23), it's about the need to sort the inner loop too, so "for val in vals:" needs sorting.

[tedder]

Okay. I closed #50, which traded one bug for another. I also added unit tests for both- and in fact, you can see that the unit test for your problem isn't fixed until 1d01f46.

Do you have an environment where you can test this before I release it as v1.1.1? I mean, something like this:

pip install git+git://github.com/tedder/requests-aws4auth.git@1d01f46950d9290773939bf17ff73d67f8cfa308

[martinamps]

@tedder thanks for the quick turnaround, can confirm this works :)

[tedder]

great! I just uploaded it to pypi.