Signature validation failed

Getting Help
1

I have a problem with initializing and backing up to a Backblaze B2 bucket using S3-compatible API. Restic version is restic 0.19.1 compiled with go1.26.4 on linux/amd64.

Previously, I had a restic repository in the same bucket which was initialized and had already some snapshots on it (i.e. backup command executed normally without errors). Yesterday, I tried to run the backup command as usual, and I got instead an error “config” something and then “Signature validation failed” (unfortunately, I did not save the full output at that point).

Thinking the config was corrupted somehow, I decided to purge the B2 bucket and start over with a new restic repository. The problem is now that “Signature validation failed” error appears when trying to init the repository:

export RESTIC_REPOSITORY=s3:s3.eu-central-003.backblazeb2.com/<bucket_name> && export AWS_ACCESS_KEY_ID="<snip>" && export AWS_SECRET_ACCESS_KEY="<snip>"

restic -v init
enter password for new repository: 
enter password again: 
Fatal: Fatal: create repository at s3:s3.eu-central-003.backblazeb2.com/<bucket_name> failed: client.BucketExists: Signature validation failed

What could be the reason for this error, and what are the ways to fix this?

2

As it was working before, start by checking your computer’s time/date. If you are not yet syncing your time with time servers, make sure you do so. Incorrect time can lead to many “weird” problems when using online services.

3

Could it be that this is the same as discussed in Will existing restic repos break after BackBlaze turns on default encryption on 14th September - #4 by alexweiss ?

At least for me it seems this is a backend problem and not a restic problem…

4

Thanks for your reply. The system clock is synchronized and I don’t see anything odd looking at the output of timedatectl. Could there be something else at play than time/date?

5

OK. So troubleshooting should continue:)

B2 endpoints are region specific. The region that restic uses for signing must match the endpoint. I see that you are using EU endpoint and maybe restic is using US region as default creating mismatch when signing signature?

Try:

export AWS_DEFAULT_REGION=eu-central-003
# or
restic -o s3.region=eu-central-003 -r s3:s3.eu-central-003.backblazeb2.com/<bucket_name> init

If it fails start from the beginning…

Use some other app and the same credentials to see if it works - can be aws cli or rclone. Run it from the same machine you use to run restic.

BTW.

Error you are getting indicates problem with restic talking to B2 API - not that something was wrong with your repository. As you say that it worked before it means that something changed… Either on B2 or your end.

6

Setting the AWS_DEFAULT_REGION env. variable and trying to init repository gave the following output:

Stat(<config/>) failed: Stat: Access Denied. 
Fatal: Fatal: create key in repository at s3:s3.eu-central-003.backblazeb2.com/<bucket_name> failed: Stat: Access Denied.

Color me confused, but this error got me into creating a new application key… and it worked with the new application key (even if I don’t set AWS_DEFAULT_REGION to point to the EU endpoint).
Then I switched back to the old application key which worked before this problem occurred, and… it works. Looking into .bash_history file I couldn’t really see that there was some mistyping of the application key or anything… yet it is clear something was off here, there is probably a logical explanation in somewhere between a faulty copy paste or a mistype. I guess this was another example of PEBKAS. :slight_smile:

Thanks so much for your help!