Ceph » rgw

bucket full sync uses RGWListRemoteBucketCR to send a bucket listing request with a query param key-marker as the position to resume listing

the client-side v4 signing logic appears to be calculating a signature based on un-encoded query parameters, but gen_v4_canonical_qs() relies on aws4_uri_recode() when expects them to be url-encoded already. aws4_uri_recode() first calls uri_decode() on the input, which returns an empty string if the input isn't a valid url-encoding (such as normal object names that contain a % character)

when that happens, the client would calculate a signature based on an empty value for key-marker, while the server would handle it correctly