[itsrayeedscodespace]

Description

This change sorts canonical signing headers by character code.

Impact

Signed URLs use matching canonical and signed header orders across locales.

Changes

• Replace locale-dependent localeCompare with direct string comparison after lowercasing header names in URLSigner.getCanonicalHeaders.
• Match the native string ordering already used by V4 signedHeaders, as required by the GCS canonical request specification. Valid HTTP header names are ASCII, so JavaScript code-unit ordering agrees with code-point ordering here.
• Preserve value normalization and public APIs. V2 shares this method and also requires code-point ordering.

Testing

• Add eight V4 cases covering hyphens versus underscores, reverse insertion order, mixed-case names, normalized values, and Lithuanian-sensitive letters under default and explicit Lithuanian collation (when supported).
• Verify the canonical headers block, canonical request signed header list, returned URL's X-Goog-SignedHeaders, and exact string passed to mocked signing credentials, including the canonical request SHA-256 digest.
• Add a V2 regression checking the complete signing input with punctuation, mixed case, and normalized values.
• Red: unmodified implementation plus regression tests: 74 passing, 8 failing. The default punctuation cases fail without requiring a particular process locale.
• Green: node ../../bin/run-test.cjs --no-c8 --no-parallel build/cjs/test/signer.js: 82 passing; also 82 passing with LANG=lt_LT.UTF-8.
• pnpm install --frozen-lockfile --filter @google-cloud/storage..., pnpm run compile (CJS and ESM), and pnpm test: 1,112 passing.
• pnpm run check, pnpm exec prettier --check src/signer.ts test/signer.ts, and git diff --check: passed.
• Verified with Node.js v26.13.0 and pnpm 10.0.0; no live GCS access or credentials required.

Alternatives

Keeping localeCompare produces signatures inconsistent with the advertised signed header list for valid header names. Locale-specific collation options still do not express the protocol's character-code ordering. Direct comparison of the already-lowercased names is sufficient, requires no helper or API changes, and compares names independently of header values.

• Existing issue and approved coordination comment precede submission.
• Tests and linter pass.
• Regression tests exercise the changed comparison.
• No public documentation changes are needed.

Fixes #9840

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the header sorting logic in URLSigner to use code-point order instead of localeCompare for canonical headers, and adds corresponding test cases for V2 and V4 header ordering. The feedback suggests using a regular expression like /\r?\n/ instead of a literal newline character when splitting strings in tests to ensure cross-platform compatibility with Windows line endings.

[gemini-code-assist]

When splitting string content by lines, use a regular expression like /\r?\n/ instead of '\n' to ensure cross-platform compatibility with Windows line endings (\r\n), and include test cases with \r\n line endings to verify this behavior.

                .split(/\r?\n/)

References

1. When splitting string content by lines, use a regular expression like /\r?\n/ instead of '\n' to ensure cross-platform compatibility with Windows line endings (\r\n), and include test cases with \r\n line endings to verify this behavior.