test: separate canonical trailer text (\n) from on-wire format (\r\n)

weed/s3api/chunked_reader_v4_test.go

@@ -292,17 +292,20 @@ func TestSignedStreamingUploadWithTrailer(t *testing.T) {
 	base64EncodedChecksum := base64.StdEncoding.EncodeToString(checksum)
 
 	// Calculate trailer signature
-	// The trailer content is: "x-amz-checksum-crc32:{checksum}\n"
-	trailerContent := "x-amz-checksum-crc32:" + base64EncodedChecksum + "\n"
-	trailerHash := getSHA256Hash([]byte(trailerContent))
+	// The canonical trailer content uses \n for signing (per AWS SigV4 spec)
+	trailerCanonical := "x-amz-checksum-crc32:" + base64EncodedChecksum + "\n"
+	trailerHash := getSHA256Hash([]byte(trailerCanonical))
 	trailerStringToSign := "AWS4-HMAC-SHA256-TRAILER\n" + amzDate + "\n" + scope + "\n" +
 		finalSignature + "\n" + trailerHash
 	trailerSignature := getSignature(signingKey, trailerStringToSign)
 
+	// The on-wire trailer format uses \r\n (HTTP/aws-chunked convention)
+	trailerOnWire := "x-amz-checksum-crc32:" + base64EncodedChecksum + "\r\n"
+
 	// Build the chunked payload with trailer and trailer signature
 	payload := fmt.Sprintf("c;chunk-signature=%s\r\n%s\r\n", chunk1Signature, chunk1Data) +
 		fmt.Sprintf("0;chunk-signature=%s\r\n", finalSignature) +
-		trailerContent +
+		trailerOnWire +
 		"x-amz-trailer-signature:" + trailerSignature + "\r\n" +
 		"\r\n"