Rclone v1.74.4 cannot access Alibaba OSS endpoint with OSS4-HMAC-SHA256 only

Suspected Bug
1

What is the problem you are having with rclone?

I am trying to use rclone to access Alibaba Cloud OSS.

The OSS endpoint only supports OSS4-HMAC-SHA256 authentication.

The same AK/SK and endpoint work correctly with Alibaba ossutil, but rclone returns:

"Only support authorization for OSS4-HMAC-SHA256"

I have tried both:

  • provider = Alibaba
  • provider = Other

but the error remains.

My purpose is to migrate data between Alibaba OSS and Huawei OBS, and I need rclone to access the Alibaba OSS bucket for data verification.

Run the command 'rclone version' and share the full output of the command.

rclone v1.74.4

  • os/version: ubuntu 20.04 (64 bit)
  • os/kernel: 5.4.0-216-generic (x86_64)
  • os/type: linux
  • os/arch: amd64
  • go/version: go1.26.5
  • go/linking: static
  • go/tags: none

Which cloud storage system are you using? (eg Google Drive)

Alibaba Cloud OSS (S3 compatible API) Endpoint: http://oss-cn-jinan-acdr-ut-1-internal.aliyuncs.com

The command you were trying to run:

rclone lsd aliyun:

Output:

2026/07/30 15:47:08 ERROR : error listing:operation error S3: ListBuckets, https response error StatusCode: 400,RequestID: 6A6B017CF88AD832395C968F,HostID: http://oss-cn-jinan-acdr-ut-1-internal.aliyuncs.com,api error InvalidArgument:Only support authorization for OSS4-HMAC-SHA256

The rclone config contents with secrets removed.

[aliyun] type = s3
provider = Alibaba
env_auth = false
access_key_id = REDACTED
secret_access_key = REDACTED
region = cn-jinan-acdr-ut-1
endpoint = http://oss-cn-jinan-acdr-ut-1-internal.aliyuncs.com
force_path_style = false
v2_auth = false

A log from the command with the -vv flag：

rclone -vv lsd aliyun:

Additional information:

2026/07/30 15:47:08 ERROR : error listing:operation error S3: ListBuckets,https response error StatusCode: 400,RequestID: 6A6B017CF88AD832395C968F,HostID: http://oss-cn-jinan-acdr-ut-1-internal.aliyuncs.com,api error InvalidArgument:Only support authorization for OSS4-HMAC-SHA256
2

http: is odd for an endpoint.

Try removing the http:// from the endpoint and see if that helps.

If it doesn't, post the result of a simple test command with -vv --dump bodies, eg something like

rclone lsf -vv --dump bodies aliyun:your bucket

Thanks

3

OSS4-HMAC-SHA256 related support sdk has been added in rclone source code to solve this problem. Thank you

4

@lizhaoyang017 are you saying this is fixed in 1.75.0 ?

5

I modified the source code of rclone locally, recompiled it using the latest aliyun sdk, and the problem was solved

6

Thanks for clarifying. So this is not fixed in the official rclone release yet, but only in your local build with the latest Aliyun SDK.

Could you share the patch or open a PR, so the OSS4-HMAC-SHA256 support can be reviewed and added upstream?

7

@TimTom420 @lizhaoyang017

I have looked into this a bit.

We can't use the alibaba sdk instead of the s3 sdk, but what we can do is implement a custom signer. I had a go at this. I tested it against oss-eu-central-1.aliyuncs.com but I need help testing against the ACDR endpoint, ideally including uploads with modtimes, server-side copy, and rclone check.

v1.76.0-beta.10113.d07036b92.fix-s3-alibaba on branch fix-s3-alibaba (uploaded in 15-30 mins)

Let me know what you think