Merge lp:~cox-katherine-e/goamz/lp1319475.v4.signature.support into lp:goamz

[Katherine Cox-Buday]

In order to keep the change as least impactful as possible, all regions will continue utilizing the v2 signing process except for China. China will utilize the new v4 signing methodology. Attaching the signature to the region also keeps the public APIs the same.

Although not tested on a live China instance, tests were performed on the sample requests provided by Amazon, of which the significant ones are passing (significant being the tests which test the signing process and not whether we can parse an HTTP request). The new version was also tested on a live EC2 instance with the v2 signing process to ensure there were no regressions. This gives us a high degree of confidence that the v4 signatures are passing.

Note many files have changes simply from switching over to gpkg.in for gocheck.

Also note that the v2 signature has been moved to aws/sign.go which accounts for a large amount of the diff.

[lp:~cox-katherine-e/goamz/lp1319475.v4.signature.support]

50. By Katherine Cox-Buday <kate@washu> on 2014-08-12

Added documentation to the public methods.

51. By Katherine Cox-Buday <kate@washu> on 2014-08-12

Corrected bug when path-segment was empty. Added test for this.

[Martin Packman (gz)]

Looks good to me.

review: Approve

=== modified file 'aws/attempt_test.go'
--- aws/attempt_test.go	2013-02-01 19:38:47 +0000
+++ aws/attempt_test.go	2014-08-12 16:51:05 +0000
@@ -2,7 +2,7 @@
 
 import (
 	"launchpad.net/goamz/aws"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"time"
 )
 

=== modified file 'aws/aws.go'
--- aws/aws.go	2014-07-08 15:42:26 +0000
+++ aws/aws.go	2014-08-12 16:51:05 +0000
@@ -27,6 +27,7 @@
 	SNSEndpoint          string
 	SQSEndpoint          string
 	IAMEndpoint          string
+	Sign                 Signer // Method which will be used to sign requests.
 }
 
 var USEast = Region{
@@ -40,6 +41,7 @@
 	"https://sns.us-east-1.amazonaws.com",
 	"https://sqs.us-east-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var USWest = Region{
@@ -53,6 +55,7 @@
 	"https://sns.us-west-1.amazonaws.com",
 	"https://sqs.us-west-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var USWest2 = Region{
@@ -66,6 +69,7 @@
 	"https://sns.us-west-2.amazonaws.com",
 	"https://sqs.us-west-2.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var EUWest = Region{
@@ -79,6 +83,7 @@
 	"https://sns.eu-west-1.amazonaws.com",
 	"https://sqs.eu-west-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var APSoutheast = Region{
@@ -92,6 +97,7 @@
 	"https://sns.ap-southeast-1.amazonaws.com",
 	"https://sqs.ap-southeast-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var APSoutheast2 = Region{
@@ -105,6 +111,7 @@
 	"https://sns.ap-southeast-2.amazonaws.com",
 	"https://sqs.ap-southeast-2.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var APNortheast = Region{
@@ -118,6 +125,7 @@
 	"https://sns.ap-northeast-1.amazonaws.com",
 	"https://sqs.ap-northeast-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var SAEast = Region{
@@ -131,6 +139,7 @@
 	"https://sns.sa-east-1.amazonaws.com",
 	"https://sqs.sa-east-1.amazonaws.com",
 	"https://iam.amazonaws.com",
+	SignV2,
 }
 
 var CNNorth = Region{
@@ -144,6 +153,7 @@
 	"https://sns.cn-north-1.amazonaws.com.cn",
 	"https://sqs.cn-north-1.amazonaws.com.cn",
 	"https://iam.amazonaws.com.cn",
+	SignV4Factory("cn-north-1"),
 }
 
 var Regions = map[string]Region{

=== modified file 'aws/aws_test.go'
--- aws/aws_test.go	2013-05-23 01:06:45 +0000
+++ aws/aws_test.go	2014-08-12 16:51:05 +0000
@@ -2,7 +2,7 @@
 
 import (
 	"launchpad.net/goamz/aws"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"os"
 	"strings"
 	"testing"

=== added file 'aws/sign.go'
--- aws/sign.go	1970-01-01 00:00:00 +0000
+++ aws/sign.go	2014-08-12 16:51:05 +0000
@@ -0,0 +1,366 @@
+package aws
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+type Signer func(*http.Request, Auth) error
+
+// Ensure our signers meet the interface
+var _ Signer = SignV2
+var _ Signer = SignV4Factory("")
+
+type hasher func([]byte) string
+
+const (
+	ISO8601BasicFormat      = "20060102T150405Z"
+	ISO8601BasicFormatShort = "20060102"
+)
+
+// SignV2 signs an HTTP request utilizing version 2 of the AWS
+// signature, and the given credentials.
+func SignV2(req *http.Request, auth Auth) (err error) {
+
+	queryVals := req.URL.Query()
+	queryVals.Set("AWSAccessKeyId", auth.AccessKey)
+	queryVals.Set("SignatureVersion", "2")
+	queryVals.Set("SignatureMethod", "HmacSHA256")
+
+	queryStr, err := canonicalQueryString(queryVals)
+	if err != nil {
+		return err
+	}
+
+	// The algorithm states that if the path is empty, to just use a "/".
+	path := req.URL.Path
+	if path == "" {
+		path = "/"
+	}
+
+	payload := new(bytes.Buffer)
+	if err := errorCollector(
+		fprintfWrapper(payload, "%s\n", requestMethodVerb(req.Method)),
+		fprintfWrapper(payload, "%s\n", req.Host),
+		fprintfWrapper(payload, "%s\n", path),
+		fprintfWrapper(payload, "%s", queryStr),
+	); err != nil {
+		return err
+	}
+
+	hash := hmac.New(sha256.New, []byte(auth.SecretKey))
+	hash.Write(payload.Bytes())
+	signature := make([]byte, base64.StdEncoding.EncodedLen(hash.Size()))
+	base64.StdEncoding.Encode(signature, hash.Sum(nil))
+
+	queryVals.Set("Signature", string(signature))
+	req.URL.RawQuery = queryVals.Encode()
+
+	return nil
+}
+
+// SignV4Factory returns a version 4 Signer which will utilize the
+// given region name.
+func SignV4Factory(regionName string) Signer {
+	return func(req *http.Request, auth Auth) error {
+		return SignV4(req, auth, regionName)
+	}
+}
+
+// SignV4 signs an HTTP request utilizing version 4 of the AWS
+// signature, and the given credentials.
+func SignV4(req *http.Request, auth Auth, regionName string) (err error) {
+
+	var reqTime time.Time
+	if reqTime, err = requestTime(req); err != nil {
+		return err
+	}
+
+	svcName := inferServiceName(req.URL)
+	credScope := credentialScope(reqTime, regionName, svcName)
+
+	// There are several places in the algorithm that call for
+	// processing the headers sorted by name.
+	sortedHdrNames := sortHeaderNames(req.Header)
+
+	var canonReqHash string
+	if _, canonReqHash, err = canonicalRequest(req, sortedHdrNames, sha256Hasher); err != nil {
+		return err
+	}
+
+	var strToSign string
+	if strToSign, err = stringToSign(reqTime, canonReqHash, credScope); err != nil {
+		return err
+	}
+
+	key := signingKey(reqTime, auth.SecretKey, regionName, svcName)
+	signature := fmt.Sprintf("%x", hmacHasher(key, strToSign))
+
+	var authHdrVal string
+	if authHdrVal, err = authHeaderString(
+		req.Header,
+		auth.AccessKey,
+		signature,
+		credScope,
+		sortedHdrNames,
+	); err != nil {
+		return err
+	}
+
+	req.Header.Set("Authorization", authHdrVal)
+
+	return nil
+}
+
+// Task 1: Create a Canonical Request.
+// Returns the canonical request, and its hash.
+func canonicalRequest(
+	req *http.Request,
+	sortedHdrNames []string,
+	hasher hasher,
+) (canReq, canReqHash string, err error) {
+
+	var canHdr string
+	if canHdr, err = canonicalHeaders(sortedHdrNames, req.Header); err != nil {
+		return
+	}
+
+	var payHash string
+	if payHash, err = payloadHash(req, hasher); err != nil {
+		return
+	}
+
+	var queryStr string
+	if queryStr, err = canonicalQueryString(req.URL.Query()); err != nil {
+		return
+	}
+
+	c := new(bytes.Buffer)
+	if err := errorCollector(
+		fprintfWrapper(c, "%s\n", requestMethodVerb(req.Method)),
+		fprintfWrapper(c, "%s\n", req.URL.RequestURI()),
+		fprintfWrapper(c, "%s\n", queryStr),
+		fprintfWrapper(c, "%s\n", canHdr),
+		fprintfWrapper(c, "%s\n", strings.Join(sortedHdrNames, ";")),
+		fprintfWrapper(c, "%s", payHash),
+	); err != nil {
+		return "", "", err
+	}
+
+	canReq = c.String()
+	return canReq, hasher([]byte(canReq)), nil
+}
+
+// Task 2: Create a string to Sign
+// Returns a string in the defined format to sign for the authorization header.
+func stringToSign(
+	t time.Time,
+	canonReqHash string,
+	credScope string,
+) (string, error) {
+	w := new(bytes.Buffer)
+	if err := errorCollector(
+		fprintfWrapper(w, "AWS4-HMAC-SHA256\n"),
+		fprintfWrapper(w, "%s\n", t.Format(ISO8601BasicFormat)),
+		fprintfWrapper(w, "%s\n", credScope),
+		fprintfWrapper(w, "%s", canonReqHash),
+	); err != nil {
+		return "", err
+	}
+
+	return w.String(), nil
+}
+
+// Task 3: Calculate the Signature
+// Returns a derived signing key.
+func signingKey(t time.Time, secretKey, regionName, svcName string) []byte {
+
+	kSecret := secretKey
+	kDate := hmacHasher([]byte("AWS4"+kSecret), t.Format(ISO8601BasicFormatShort))
+	kRegion := hmacHasher(kDate, regionName)
+	kService := hmacHasher(kRegion, svcName)
+	kSigning := hmacHasher(kService, "aws4_request")
+
+	return kSigning
+}
+
+// Task 4: Add the Signing Information to the Request
+// Returns a string to be placed in the Authorization header for the request.
+func authHeaderString(
+	header http.Header,
+	accessKey,
+	signature string,
+	credScope string,
+	sortedHeaderNames []string,
+) (string, error) {
+	w := new(bytes.Buffer)
+	if err := errorCollector(
+		fprintfWrapper(w, "AWS4-HMAC-SHA256 "),
+		fprintfWrapper(w, "Credential=%s/%s, ", accessKey, credScope),
+		fprintfWrapper(w, "SignedHeaders=%s, ", strings.Join(sortedHeaderNames, ";")),
+		fprintfWrapper(w, "Signature=%s", signature),
+	); err != nil {
+		return "", err
+	}
+
+	return w.String(), nil
+}
+
+func canonicalQueryString(queryVals url.Values) (string, error) {
+
+	// AWS dictates that we use %20 for encoding spaces rather than +.
+	// All significant +s should already be encoded into their
+	// hexadecimal equivalents before doing the string replace.
+	return strings.Replace(queryVals.Encode(), "+", "%20", -1), nil
+}
+
+func canonicalHeaders(sortedHeaderNames []string, hdr http.Header) (string, error) {
+	buffer := new(bytes.Buffer)
+
+	for _, hName := range sortedHeaderNames {
+		canonHdrKey := http.CanonicalHeaderKey(hName)
+		sortedHdrVals := hdr[canonHdrKey]
+		sort.Strings(sortedHdrVals)
+		hdrVals := strings.Join(sortedHdrVals, ",")
+		if _, err := fmt.Fprintf(buffer, "%s:%s\n", hName, hdrVals); err != nil {
+			return "", err
+		}
+	}
+
+	return buffer.String(), nil
+}
+
+// Returns a SHA256 checksum of the request body. Represented as a
+// lowercase hexadecimal string.
+func payloadHash(req *http.Request, hasher hasher) (string, error) {
+	if b, err := ioutil.ReadAll(req.Body); err != nil {
+		return "", err
+	} else {
+		req.Body = ioutil.NopCloser(bytes.NewBuffer(b))
+		return hasher(b), nil
+	}
+}
+
+// Retrieve the header names, lower-case them, and sort them.
+func sortHeaderNames(header http.Header) []string {
+
+	var sortedNames []string
+	for hName, _ := range header {
+		sortedNames = append(sortedNames, strings.ToLower(hName))
+	}
+
+	sort.Strings(sortedNames)
+
+	return sortedNames
+}
+
+func hmacHasher(key []byte, value string) []byte {
+	h := hmac.New(sha256.New, key)
+	h.Write([]byte(value))
+	return h.Sum(nil)
+}
+
+func inferServiceName(url *url.URL) string {
+	return strings.Split(url.Host, ".")[0]
+}
+
+func sha256Hasher(payload []byte) string {
+	return fmt.Sprintf("%x", sha256.Sum256(payload))
+}
+
+func credentialScope(t time.Time, regionName, svcName string) string {
+	return fmt.Sprintf(
+		"%s/%s/%s/aws4_request",
+		t.Format(ISO8601BasicFormatShort),
+		regionName,
+		svcName,
+	)
+}
+
+// We do a lot of fmt.Fprintfs in this package. Create a higher-order
+// function to elide the bytes written return value so we can submit
+// these calls to an error collector.
+func fprintfWrapper(w io.Writer, format string, vals ...interface{}) func() error {
+	return func() error {
+		_, err := fmt.Fprintf(w, format, vals...)
+		return err
+	}
+}
+
+// Poor man's maybe monad.
+func errorCollector(writers ...func() error) error {
+	for _, writer := range writers {
+		if err := writer(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Time formats to try. We want to do everything we can to accept all
+// time formats, but ultimately we may fail. In the package scope so
+// it doesn't get initialized for every request.
+var timeFormats = []string{
+	time.RFC822,
+	ISO8601BasicFormat,
+	time.RFC1123,
+	time.ANSIC,
+	time.UnixDate,
+	time.RubyDate,
+	time.RFC822Z,
+	time.RFC850,
+	time.RFC1123Z,
+	time.RFC3339,
+	time.RFC3339Nano,
+	time.Kitchen,
+}
+
+// Retrieve the request time from the request. We will attempt to
+// parse whatever we find, but we will not make up a request date for
+// the user (i.e.: Magic!).
+func requestTime(req *http.Request) (time.Time, error) {
+
+	// Get a date header.
+	var date string
+	if date = req.Header.Get("x-amz-date"); date == "" {
+		if date = req.Header.Get("date"); date == "" {
+			return time.Time{}, fmt.Errorf(`Could not retrieve a request date. Please provide one in either "x-amz-date", or "date".`)
+		}
+	}
+
+	// Start attempting to parse
+	for _, format := range timeFormats {
+		if parsedTime, err := time.Parse(format, date); err == nil {
+			return parsedTime, nil
+		}
+	}
+
+	return time.Time{}, fmt.Errorf(
+		"Could not parse the given date. Please utilize on of the following formats: %s",
+		strings.Join(timeFormats, ","),
+	)
+}
+
+// http.Request's Method member returns the entire method. Derive the
+// verb.
+func requestMethodVerb(rawMethod string) (verb string) {
+	verbPlus := strings.SplitN(rawMethod, " ", 2)
+	switch {
+	case len(verbPlus) == 0: // Per docs, Method will be empty if it's GET.
+		verb = "GET"
+	default:
+		verb = verbPlus[0]
+	}
+	return verb
+}

=== added file 'aws/sign_test.go'
--- aws/sign_test.go	1970-01-01 00:00:00 +0000
+++ aws/sign_test.go	2014-08-12 16:51:05 +0000
@@ -0,0 +1,227 @@
+package aws
+
+import (
+	"bytes"
+	"fmt"
+	. "gopkg.in/check.v1"
+	"net/http"
+	"time"
+)
+
+var _ = Suite(&SigningSuite{})
+
+type SigningSuite struct{}
+
+// EC2 ReST authentication docs: http://goo.gl/fQmAN
+var testAuth = Auth{"user", "secret"}
+
+func (s *SigningSuite) TestV4StringToSign(c *C) {
+
+	mockTime, err := time.Parse(time.RFC3339, "2011-09-09T23:36:00Z")
+	c.Assert(err, IsNil)
+	stringToSign, err := stringToSign(
+		mockTime,
+		"3511de7e95d28ecd39e9513b642aee07e54f4941150d8df8bf94b328ef7e55e2",
+		"20110909/us-east-1/iam/aws4_request",
+	)
+	c.Assert(err, IsNil)
+
+	const expected = `AWS4-HMAC-SHA256
[phone]T233600Z
[phone]/us-east-1/iam/aws4_request
+3511de7e95d28ecd39e9513b642aee07e54f4941150d8df8bf94b328ef7e55e2`
+	c.Assert(stringToSign, Equals, expected)
+}
+
+func (s *SigningSuite) TestV4CanonicalRequest(c *C) {
+
+	body := new(bytes.Buffer)
+	_, err := fmt.Fprint(body, "Action=ListUsers&Version=2010-05-08")
+	c.Assert(err, IsNil)
+
+	req, err := http.NewRequest("POST", "https://iam.amazonaws.com", body)
+	c.Assert(err, IsNil)
+
+	req.Header.Add("content-type", "application/x-www-form-urlencoded; charset=utf-8")
+	req.Header.Add("host", req.URL.Host)
+	req.Header.Add("x-amz-date", "20110909T233600Z")
+
+	canonReq, canonReqHash, err := canonicalRequest(
+		req,
+		[]string{"content-type", "host", "x-amz-date"},
+		sha256Hasher,
+	)
+	c.Assert(err, IsNil)
+
+	const expected = `POST
+/
+
+content-type:application/x-www-form-urlencoded; charset=utf-8
+host:iam.amazonaws.com
+x-amz-date:20110909T233600Z
+
+content-type;host;x-amz-date
+b6359072c78d70ebee1e81adcbab4f01bf2c23245fa365ef83fe8f1f955085e2`
+
+	c.Assert(canonReq, Equals, expected)
+	c.Assert(canonReqHash, Equals, "3511de7e95d28ecd39e9513b642aee07e54f4941150d8df8bf94b328ef7e55e2")
+}
+
+func (s *SigningSuite) TestV4SigningKey(c *C) {
+	mockTime, err := time.Parse(time.RFC3339, "2011-09-09T23:36:00Z")
+	c.Assert(err, IsNil)
+	c.Assert(
+		fmt.Sprintf("%v", signingKey(mockTime, testAuth.SecretKey, USEast.Name, "iam")),
+		Equals,
+		"[152 241 216 137 254 196 244 66 26 220 82 43 171 12 225 248 46 105 41 194 98 237 21 229 169 76 144 239 209 227 176 231]")
+}
+
+func (s *SigningSuite) TestV4BasicSignatureV4(c *C) {
+
+	body := new(bytes.Buffer)
+
+	req, err := http.NewRequest("POST / http/1.1", "https://host.foo.com", body)
+	c.Assert(err, IsNil)
+
+	req.Header.Add("Host", req.URL.Host)
+	req.Header.Add("Date", "Mon, 09 Sep 2011 23:36:00 GMT")
+
+	testAuth = Auth{
+		AccessKey: "AKIDEXAMPLE",
+		SecretKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+	}
+	err = SignV4(req, testAuth, USEast.Name)
+	c.Assert(err, IsNil)
+
+	c.Assert(req.Header.Get("Authorization"), Equals, `AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=22902d79e148b64e7571c3565769328423fe276eae4b26f83afceda9e767f726`)
+}
+
+//
+// v2 Tests
+//
+
+func (s *SigningSuite) TestV2BasicSignature(c *C) {
+	req, err := http.NewRequest("GET", "http://localhost/path", nil)
+	c.Assert(err, IsNil)
+
+	SignV2(req, testAuth)
+
+	query := req.URL.Query()
+
+	c.Assert(query.Get("SignatureVersion"), Equals, "2")
+	c.Assert(query.Get("SignatureMethod"), Equals, "HmacSHA256")
+	expected := "6lSe5QyXum0jMVc7cOUz32/52ZnL7N5RyKRk/09yiK4="
+	c.Assert(query.Get("Signature"), Equals, expected)
+}
+
+func (s *SigningSuite) TestV2ParamSignature(c *C) {
+
+	req, err := http.NewRequest("GET", "http://localhost/path", nil)
+	c.Assert(err, IsNil)
+
+	query := req.URL.Query()
+	for i := 1; i <= 3; i++ {
+		query.Add(fmt.Sprintf("param%d", i), fmt.Sprintf("value%d", i))
+	}
+	req.URL.RawQuery = query.Encode()
+
+	SignV2(req, testAuth)
+
+	expected := "XWOR4+0lmK8bD8CGDGZ4kfuSPbb2JibLJiCl/OPu1oU="
+	c.Assert(req.URL.Query().Get("Signature"), Equals, expected)
+}
+
+func (s *SigningSuite) TestV2ManyParams(c *C) {
+
+	req, err := http.NewRequest("GET", "http://localhost/path", nil)
+	c.Assert(err, IsNil)
+
+	query := req.URL.Query()
+	orderedVals := []int{10, 2, 3, 4, 5, 6, 7, 8, 9, 1}
+	for i, val := range orderedVals {
+		query.Add(fmt.Sprintf("param%d", i+1), fmt.Sprintf("value%d", val))
+	}
+	req.URL.RawQuery = query.Encode()
+
+	SignV2(req, testAuth)
+
+	expected := "di0sjxIvezUgQ1SIL6i+C/H8lL+U0CQ9frLIak8jkVg="
+	c.Assert(req.URL.Query().Get("Signature"), Equals, expected)
+}
+
+func (s *SigningSuite) TestV2Escaping(c *C) {
+
+	req, err := http.NewRequest("GET", "http://localhost/path", nil)
+	c.Assert(err, IsNil)
+
+	query := req.URL.Query()
+	query.Add("Nonce", "+ +")
+	req.URL.RawQuery = query.Encode()
+
+	err = SignV2(req, testAuth)
+	c.Assert(err, IsNil)
+
+	query = req.URL.Query()
+	c.Assert(query.Get("Nonce"), Equals, "+ +")
+
+	expected := "bqffDELReIqwjg/W0DnsnVUmfLK4wXVLO4/LuG+1VFA="
+	c.Assert(query.Get("Signature"), Equals, expected)
+}
+
+func (s *SigningSuite) TestV2SignatureExample1(c *C) {
+
+	req, err := http.NewRequest("GET", "http://sdb.amazonaws.com/", nil)
+	c.Assert(err, IsNil)
+
+	query := req.URL.Query()
+	query.Add("Timestamp", "2009-02-01T12:53:20+00:00")
+	query.Add("Version", "2007-11-07")
+	query.Add("Action", "ListDomains")
+	req.URL.RawQuery = query.Encode()
+
+	SignV2(req, Auth{"access", "secret"})
+
+	expected := "okj96/5ucWBSc1uR2zXVfm6mDHtgfNv657rRtt/aunQ="
+	c.Assert(req.URL.Query().Get("Signature"), Equals, expected)
+}
+
+// Tests example from:
+// http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
+// Specifically, good for testing case when URL does not contain a /
+func (s *SigningSuite) TestV2SignatureTutorialExample(c *C) {
+
+	req, err := http.NewRequest("GET", "https://elasticmapreduce.amazonaws.com/", nil)
+	c.Assert(err, IsNil)
+
+	query := req.URL.Query()
+	query.Add("Timestamp", "2011-10-03T15:19:30")
+	query.Add("Version", "2009-03-31")
+	query.Add("Action", "DescribeJobFlows")
+	req.URL.RawQuery = query.Encode()
+
+	testAuth := Auth{"AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"}
+	err = SignV2(req, testAuth)
+	c.Assert(err, IsNil)
+	c.Assert(req.URL.Query().Get("Signature"), Equals, "i91nKc4PWAt0JJIdXwz9HxZCJDdiy6cf/Mj6vPxyYIs=")
+}
+
+// https://bugs.launchpad.net/goamz/+bug/1022749
+func (s *SigningSuite) TestSignatureWithEndpointPath(c *C) {
+
+	req, err := http.NewRequest("GET", "http://localhost:4444/services/Cloud", nil)
+	c.Assert(err, IsNil)
+
+	queryStr := req.URL.Query()
+	queryStr.Add("Action", "RebootInstances")
+	queryStr.Add("Version", "2011-12-15")
+	queryStr.Add("InstanceId.1", "i-10a64379")
+	queryStr.Add("Timestamp", time.Date(2012, 1, 1, 0, 0, 0, 0, time.UTC).In(time.UTC).Format(time.RFC3339))
+	req.URL.RawQuery = queryStr.Encode()
+
+	err = SignV2(req, Auth{"abc", "123"})
+	c.Assert(err, IsNil)
+	c.Assert(req.URL.Query().Get("Signature"), Equals, "gdG/vEm+c6ehhhfkrJy3+wuVzw/rzKR42TYelMwti7M=")
+	err = req.ParseForm()
+	c.Assert(err, IsNil)
+	c.Assert(req.Form["Signature"], DeepEquals, []string{"gdG/vEm+c6ehhhfkrJy3+wuVzw/rzKR42TYelMwti7M="})
+}

=== modified file 'ec2/ec2.go'
--- ec2/ec2.go	2014-05-30 09:43:41 +0000
+++ ec2/ec2.go	2014-08-12 16:51:05 +0000
@@ -21,6 +21,7 @@
 	"strconv"
 	"time"
 
+	"encoding/base64"
 	"launchpad.net/goamz/aws"
 )
 
@@ -126,21 +127,25 @@
 
 var timeNow = time.Now
 
+// resp = response structure that will get inflated by XML unmarshaling.
 func (ec2 *EC2) query(params map[string]string, resp interface{}) error {
-	params["Timestamp"] = timeNow().In(time.UTC).Format(time.RFC3339)
-	endpoint, err := url.Parse(ec2.Region.EC2Endpoint)
+
+	req, err := http.NewRequest("GET", ec2.Region.EC2Endpoint, nil)
 	if err != nil {
 		return err
 	}
-	if endpoint.Path == "" {
-		endpoint.Path = "/"
-	}
-	sign(ec2.Auth, "GET", endpoint.Path, params, endpoint.Host)
-	endpoint.RawQuery = multimap(params).Encode()
-	if debug {
-		log.Printf("get { %v } -> {\n", endpoint.String())
-	}
-	r, err := http.Get(endpoint.String())
+
+	// Add the params passed in to the query string
+	query := req.URL.Query()
+	for varName, varVal := range params {
+		query.Add(varName, varVal)
+	}
+	query.Add("Timestamp", timeNow().In(time.UTC).Format(time.RFC3339))
+	req.URL.RawQuery = query.Encode()
+
+	ec2.Region.Sign(req, ec2.Auth)
+
+	r, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return err
 	}
@@ -154,8 +159,7 @@
 	if r.StatusCode != 200 {
 		return buildError(r)
 	}
-	err = xml.NewDecoder(r.Body).Decode(resp)
-	return err
+	return xml.NewDecoder(r.Body).Decode(resp)
 }
 
 func multimap(p map[string]string) url.Values {
@@ -349,8 +353,8 @@
 		params["RamdiskId"] = options.RamdiskId
 	}
 	if options.UserData != nil {
-		userData := make([]byte, b64.EncodedLen(len(options.UserData)))
-		b64.Encode(userData, options.UserData)
+		userData := make([]byte, base64.StdEncoding.EncodedLen(len(options.UserData)))
+		base64.StdEncoding.Encode(userData, options.UserData)
 		params["UserData"] = string(userData)
 	}
 	if options.AvailZone != "" {

=== modified file 'ec2/ec2_test.go'
--- ec2/ec2_test.go	2014-05-30 09:43:41 +0000
+++ ec2/ec2_test.go	2014-08-12 16:51:05 +0000
@@ -6,7 +6,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 func Test(t *testing.T) {
@@ -24,7 +24,7 @@
 func (s *S) SetUpSuite(c *C) {
 	testServer.Start()
 	auth := aws.Auth{"abc", "123"}
-	s.ec2 = ec2.New(auth, aws.Region{EC2Endpoint: testServer.URL})
+	s.ec2 = ec2.New(auth, aws.Region{EC2Endpoint: testServer.URL, Sign: aws.SignV2})
 }
 
 func (s *S) TearDownSuite(c *C) {
@@ -791,22 +791,6 @@
 	c.Assert(resp.RequestId, Equals, "59dbff89-35bd-4eac-99ed-be587EXAMPLE")
 }
 
-func (s *S) TestSignatureWithEndpointPath(c *C) {
-	ec2.FakeTime(true)
-	defer ec2.FakeTime(false)
-
-	testServer.Response(200, nil, RebootInstancesExample)
-
-	// https://bugs.launchpad.net/goamz/+bug/1022749
-	ec2 := ec2.New(s.ec2.Auth, aws.Region{EC2Endpoint: testServer.URL + "/services/Cloud"})
-
-	_, err := ec2.RebootInstances("i-10a64379")
-	c.Assert(err, IsNil)
-
-	req := testServer.WaitRequest()
-	c.Assert(req.Form["Signature"], DeepEquals, []string{"gdG/vEm+c6ehhhfkrJy3+wuVzw/rzKR42TYelMwti7M="})
-}
-
 func (s *S) TestAvailabilityZonesExample1(c *C) {
 	testServer.Response(200, nil, DescribeAvailabilityZonesExample1)
 

=== modified file 'ec2/ec2i_test.go'
--- ec2/ec2i_test.go	2014-05-21 13:52:28 +0000
+++ ec2/ec2i_test.go	2014-08-12 16:51:05 +0000
@@ -7,7 +7,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // AmazonServer represents an Amazon EC2 server.

=== modified file 'ec2/ec2t_test.go'
--- ec2/ec2t_test.go	2014-05-30 09:43:41 +0000
+++ ec2/ec2t_test.go	2014-08-12 16:51:05 +0000
@@ -11,7 +11,7 @@
 	"launchpad.net/goamz/ec2"
 	"launchpad.net/goamz/ec2/ec2test"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // LocalServer represents a local ec2test fake server.
@@ -33,7 +33,7 @@
 	})
 
 	s.srv = srv
-	s.region = aws.Region{EC2Endpoint: srv.URL()}
+	s.region = aws.Region{EC2Endpoint: srv.URL(), Sign: aws.SignV2}
 }
 
 // LocalServerSuite defines tests that will run

=== modified file 'ec2/export_test.go'
--- ec2/export_test.go	2014-02-12 17:04:23 +0000
+++ ec2/export_test.go	2014-08-12 16:51:05 +0000
@@ -1,14 +1,9 @@
 package ec2
 
 import (
-	"launchpad.net/goamz/aws"
 	"time"
 )
 
-func Sign(auth aws.Auth, method, path string, params map[string]string, host string) {
-	sign(auth, method, path, params, host)
-}
-
 func fixedTime() time.Time {
 	return time.Date(2012, 1, 1, 0, 0, 0, 0, time.UTC)
 }

=== modified file 'ec2/networkinterfaces_test.go'
--- ec2/networkinterfaces_test.go	2014-02-12 17:29:13 +0000
+++ ec2/networkinterfaces_test.go	2014-08-12 16:51:05 +0000
@@ -11,7 +11,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"time"
 )
 

=== modified file 'ec2/privateips_test.go'
--- ec2/privateips_test.go	2014-05-27 11:43:56 +0000
+++ ec2/privateips_test.go	2014-08-12 16:51:05 +0000
@@ -14,7 +14,7 @@
 
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // Private IP tests with example responses

=== removed file 'ec2/sign.go'
--- ec2/sign.go	2013-05-23 01:06:45 +0000
+++ ec2/sign.go	1970-01-01 00:00:00 +0000
@@ -1,42 +0,0 @@
-package ec2
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"launchpad.net/goamz/aws"
-	"sort"
-	"strings"
-)
-
-// ----------------------------------------------------------------------------
-// EC2 signing (http://goo.gl/fQmAN)
-
-var b64 = base64.StdEncoding
-
-func sign(auth aws.Auth, method, path string, params map[string]string, host string) {
-	params["AWSAccessKeyId"] = auth.AccessKey
-	params["SignatureVersion"] = "2"
-	params["SignatureMethod"] = "HmacSHA256"
-
-	// AWS specifies that the parameters in a signed request must
-	// be provided in the natural order of the keys. This is distinct
-	// from the natural order of the encoded value of key=value.
-	// Percent and equals affect the sorting order.
-	var keys, sarray []string
-	for k, _ := range params {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		sarray = append(sarray, aws.Encode(k)+"="+aws.Encode(params[k]))
-	}
-	joined := strings.Join(sarray, "&")
-	payload := method + "\n" + host + "\n" + path + "\n" + joined
-	hash := hmac.New(sha256.New, []byte(auth.SecretKey))
-	hash.Write([]byte(payload))
-	signature := make([]byte, b64.EncodedLen(hash.Size()))
-	b64.Encode(signature, hash.Sum(nil))
-
-	params["Signature"] = string(signature)
-}

=== removed file 'ec2/sign_test.go'
--- ec2/sign_test.go	2012-10-18 01:02:48 +0000
+++ ec2/sign_test.go	1970-01-01 00:00:00 +0000
@@ -1,68 +0,0 @@
-package ec2_test
-
-import (
-	"launchpad.net/goamz/aws"
-	"launchpad.net/goamz/ec2"
-	. "launchpad.net/gocheck"
-)
-
-// EC2 ReST authentication docs: http://goo.gl/fQmAN
-
-var testAuth = aws.Auth{"user", "secret"}
-
-func (s *S) TestBasicSignature(c *C) {
-	params := map[string]string{}
-	ec2.Sign(testAuth, "GET", "/path", params, "localhost")
-	c.Assert(params["SignatureVersion"], Equals, "2")
-	c.Assert(params["SignatureMethod"], Equals, "HmacSHA256")
-	expected := "6lSe5QyXum0jMVc7cOUz32/52ZnL7N5RyKRk/09yiK4="
-	c.Assert(params["Signature"], Equals, expected)
-}
-
-func (s *S) TestParamSignature(c *C) {
-	params := map[string]string{
-		"param1": "value1",
-		"param2": "value2",
-		"param3": "value3",
-	}
-	ec2.Sign(testAuth, "GET", "/path", params, "localhost")
-	expected := "XWOR4+0lmK8bD8CGDGZ4kfuSPbb2JibLJiCl/OPu1oU="
-	c.Assert(params["Signature"], Equals, expected)
-}
-
-func (s *S) TestManyParams(c *C) {
-	params := map[string]string{
-		"param1":  "value10",
-		"param2":  "value2",
-		"param3":  "value3",
-		"param4":  "value4",
-		"param5":  "value5",
-		"param6":  "value6",
-		"param7":  "value7",
-		"param8":  "value8",
-		"param9":  "value9",
-		"param10": "value1",
-	}
-	ec2.Sign(testAuth, "GET", "/path", params, "localhost")
-	expected := "di0sjxIvezUgQ1SIL6i+C/H8lL+U0CQ9frLIak8jkVg="
-	c.Assert(params["Signature"], Equals, expected)
-}
-
-func (s *S) TestEscaping(c *C) {
-	params := map[string]string{"Nonce": "+ +"}
-	ec2.Sign(testAuth, "GET", "/path", params, "localhost")
-	c.Assert(params["Nonce"], Equals, "+ +")
-	expected := "bqffDELReIqwjg/W0DnsnVUmfLK4wXVLO4/LuG+1VFA="
-	c.Assert(params["Signature"], Equals, expected)
-}
-
-func (s *S) TestSignatureExample1(c *C) {
-	params := map[string]string{
-		"Timestamp": "2009-02-01T12:53:20+00:00",
-		"Version":   "2007-11-07",
-		"Action":    "ListDomains",
-	}
-	ec2.Sign(aws.Auth{"access", "secret"}, "GET", "/", params, "sdb.amazonaws.com")
-	expected := "okj96/5ucWBSc1uR2zXVfm6mDHtgfNv657rRtt/aunQ="
-	c.Assert(params["Signature"], Equals, expected)
-}

=== modified file 'ec2/subnets_test.go'
--- ec2/subnets_test.go	2014-02-12 16:38:47 +0000
+++ ec2/subnets_test.go	2014-08-12 16:51:05 +0000
@@ -11,7 +11,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"time"
 )
 

=== modified file 'ec2/vpc_test.go'
--- ec2/vpc_test.go	2014-02-12 13:58:45 +0000
+++ ec2/vpc_test.go	2014-08-12 16:51:05 +0000
@@ -11,7 +11,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/ec2"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"time"
 )
 

=== modified file 'exp/mturk/mturk_test.go'
--- exp/mturk/mturk_test.go	2013-05-23 02:56:41 +0000
+++ exp/mturk/mturk_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/exp/mturk"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"net/url"
 	"testing"
 )

=== modified file 'exp/mturk/sign_test.go'
--- exp/mturk/sign_test.go	2012-05-03 17:12:28 +0000
+++ exp/mturk/sign_test.go	2014-08-12 16:51:05 +0000
@@ -3,7 +3,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/exp/mturk"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // Mechanical Turk REST authentication docs: http://goo.gl/wrzfn

=== modified file 'exp/sdb/sdb_test.go'
--- exp/sdb/sdb_test.go	2013-05-23 02:56:41 +0000
+++ exp/sdb/sdb_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/exp/sdb"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"testing"
 )
 
@@ -23,7 +23,7 @@
 func (s *S) SetUpSuite(c *C) {
 	testServer.Start()
 	auth := aws.Auth{"abc", "123"}
-	s.sdb = sdb.New(auth, aws.Region{SDBEndpoint: testServer.URL})
+	s.sdb = sdb.New(auth, aws.Region{SDBEndpoint: testServer.URL, Sign: aws.SignV2})
 }
 
 func (s *S) TearDownSuite(c *C) {

=== modified file 'exp/sdb/sign_test.go'
--- exp/sdb/sign_test.go	2012-03-09 15:34:56 +0000
+++ exp/sdb/sign_test.go	2014-08-12 16:51:05 +0000
@@ -3,7 +3,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/exp/sdb"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // SimpleDB ReST authentication docs: http://goo.gl/CaY81

=== modified file 'exp/sns/sns_test.go'
--- exp/sns/sns_test.go	2013-05-23 02:56:41 +0000
+++ exp/sns/sns_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/exp/sns"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"testing"
 )
 
@@ -23,7 +23,7 @@
 func (s *S) SetUpSuite(c *C) {
 	testServer.Start()
 	auth := aws.Auth{"abc", "123"}
-	s.sns = sns.New(auth, aws.Region{SNSEndpoint: testServer.URL})
+	s.sns = sns.New(auth, aws.Region{SNSEndpoint: testServer.URL, Sign: aws.SignV2})
 }
 
 func (s *S) TearDownSuite(c *C) {

=== modified file 'iam/iam_test.go'
--- iam/iam_test.go	2013-05-23 02:56:41 +0000
+++ iam/iam_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/iam"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"strings"
 	"testing"
 )
@@ -24,7 +24,7 @@
 func (s *S) SetUpSuite(c *C) {
 	testServer.Start()
 	auth := aws.Auth{"abc", "123"}
-	s.iam = iam.New(auth, aws.Region{IAMEndpoint: testServer.URL})
+	s.iam = iam.New(auth, aws.Region{IAMEndpoint: testServer.URL, Sign: aws.SignV2})
 }
 
 func (s *S) TearDownSuite(c *C) {

=== modified file 'iam/iami_test.go'
--- iam/iami_test.go	2013-03-02 02:11:38 +0000
+++ iam/iami_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/iam"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"net/url"
 )
 

=== modified file 'iam/iamt_test.go'
--- iam/iamt_test.go	2012-10-10 21:18:36 +0000
+++ iam/iamt_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/iam"
 	"launchpad.net/goamz/iam/iamtest"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // LocalServer represents a local ec2test fake server.
@@ -20,7 +20,7 @@
 	c.Assert(srv, NotNil)
 
 	s.srv = srv
-	s.region = aws.Region{IAMEndpoint: srv.URL()}
+	s.region = aws.Region{IAMEndpoint: srv.URL(), Sign: aws.SignV2}
 }
 
 // LocalServerSuite defines tests that will run

=== modified file 's3/multi_test.go'
--- s3/multi_test.go	2013-08-15 13:18:02 +0000
+++ s3/multi_test.go	2014-08-12 16:51:05 +0000
@@ -5,7 +5,7 @@
 	"io"
 	"io/ioutil"
 	"launchpad.net/goamz/s3"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"strings"
 )
 

=== modified file 's3/s3_test.go'
--- s3/s3_test.go	2013-08-15 13:18:02 +0000
+++ s3/s3_test.go	2014-08-12 16:51:05 +0000
@@ -9,7 +9,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/s3"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"time"
 )
 
@@ -28,7 +28,7 @@
 func (s *S) SetUpSuite(c *C) {
 	testServer.Start()
 	auth := aws.Auth{"abc", "123"}
-	s.s3 = s3.New(auth, aws.Region{Name: "faux-region-1", S3Endpoint: testServer.URL})
+	s.s3 = s3.New(auth, aws.Region{Name: "faux-region-1", S3Endpoint: testServer.URL, Sign: aws.SignV2})
 }
 
 func (s *S) TearDownSuite(c *C) {

=== modified file 's3/s3i_test.go'
--- s3/s3i_test.go	2013-02-13 12:20:38 +0000
+++ s3/s3i_test.go	2014-08-12 16:51:05 +0000
@@ -11,7 +11,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/s3"
 	"launchpad.net/goamz/testutil"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 	"net"
 	"sort"
 	"time"

=== modified file 's3/s3t_test.go'
--- s3/s3t_test.go	2013-02-01 05:55:19 +0000
+++ s3/s3t_test.go	2014-08-12 16:51:05 +0000
@@ -4,7 +4,7 @@
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/s3"
 	"launchpad.net/goamz/s3/s3test"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 type LocalServer struct {
@@ -24,6 +24,7 @@
 		Name:                 "faux-region-1",
 		S3Endpoint:           srv.URL(),
 		S3LocationConstraint: true, // s3test server requires a LocationConstraint
+		Sign:                 aws.SignV2,
 	}
 }
 

=== modified file 's3/sign_test.go'
--- s3/sign_test.go	2012-07-16 00:36:17 +0000
+++ s3/sign_test.go	2014-08-12 16:51:05 +0000
@@ -3,7 +3,7 @@
 import (
 	"launchpad.net/goamz/aws"
 	"launchpad.net/goamz/s3"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // S3 ReST authentication docs: http://goo.gl/G1LrK

=== modified file 'testutil/http.go'
--- testutil/http.go	2013-05-23 03:13:02 +0000
+++ testutil/http.go	2014-08-12 16:51:05 +0000
@@ -4,6 +4,7 @@
 	"bytes"
 	"fmt"
 	"io/ioutil"
+	"log"
 	"net"
 	"net/http"
 	"net/url"
@@ -27,7 +28,12 @@
 }
 
 func NewHTTPServer() *HTTPServer {
-	return &HTTPServer{URL: "http://localhost:4444", Timeout: 5 * time.Second}
+	s := &HTTPServer{
+		URL:     "http://localhost:0",
+		Timeout: 5 * time.Second,
+	}
+
+	return s
 }
 
 type ResponseFunc func(path string) Response
@@ -43,10 +49,16 @@
 	if err != nil {
 		panic(err)
 	}
+
 	s.listener, err = net.Listen("tcp", u.Host)
 	if err != nil {
 		panic(err)
 	}
+
+	// The OS has found an open port; reset the URL to reflect the
+	// actual port.
+	s.URL = fmt.Sprintf("http://%s", s.listener.Addr().String())
+	log.Printf("Listening on %v\n", s.URL)
 	go http.Serve(s.listener, s)
 
 	s.Response(203, nil, "")
@@ -56,6 +68,7 @@
 		if err == nil && resp.StatusCode == 203 {
 			break
 		}
+		log.Printf("Waiting on addr: %s\n", s.URL)
 		time.Sleep(1e8)
 	}
 	s.WaitRequest() // Consume dummy request.
@@ -70,6 +83,7 @@
 		panic(err)
 	}
 	s.listener = nil
+	s.started = false
 }
 
 // Flush discards all pending requests and responses.

=== modified file 'testutil/suite.go'
--- testutil/suite.go	2013-01-31 14:52:05 +0000
+++ testutil/suite.go	2014-08-12 16:51:05 +0000
@@ -3,7 +3,7 @@
 import (
 	"flag"
 	"launchpad.net/goamz/aws"
-	. "launchpad.net/gocheck"
+	. "gopkg.in/check.v1"
 )
 
 // Amazon must be used by all tested packages to determine whether to