Fix ranged GET signing failure with Cloudflare R2

GetObjectRange (and other body-less commands like DeleteObject,
AbortMultipartUpload, etc.) were getting content-length and content-type
headers included in the signed request. For commands with no body these
headers are empty/meaningless, but they still end up in the canonical
request signature. Cloudflare R2 rejects the resulting signature
(SignatureDoesNotMatch), while AWS S3 happens to tolerate it.

Added a `has_body()` helper on Command that returns true only for
commands that actually serialize request content (PutObject, UploadPart,
CompleteMultipartUpload, etc.). The header insertion in request_trait.rs
now checks `has_body()` instead of matching on the HTTP verb, which
avoids signing empty headers for any current or future body-less command.

Author: w4nderlust

s3/src/command.rs

@@ -211,6 +211,21 @@ impl<'a> Command<'a> {
         }
     }
 
+    /// Whether this command carries a request body that should be reflected
+    /// in `Content-Length` and `Content-Type` headers during signing.
+    pub fn has_body(&self) -> bool {
+        matches!(
+            self,
+            Command::PutObject { .. }
+                | Command::PutObjectTagging { .. }
+                | Command::UploadPart { .. }
+                | Command::CompleteMultipartUpload { .. }
+                | Command::CreateBucket { .. }
+                | Command::PutBucketLifecycle { .. }
+                | Command::PutBucketCors { .. }
+        )
+    }
+
     pub fn content_length(&self) -> Result<usize, S3Error> {
         let result = match &self {
             Command::CopyObject { from: _ } => 0,

s3/src/request/request_trait.rs

@@ -700,23 +700,22 @@ pub trait Request {
 
         headers.insert(HOST, host_header.parse()?);
 
-        match self.command() {
-            Command::CopyObject { from } => {
-                headers.insert(HeaderName::from_static("x-amz-copy-source"), from.parse()?);
-            }
-            Command::ListObjects { .. } => {}
-            Command::ListObjectsV2 { .. } => {}
-            Command::GetObject => {}
-            Command::GetObjectTagging => {}
-            Command::GetBucketLocation => {}
-            Command::ListBuckets => {}
-            _ => {
-                headers.insert(
-                    CONTENT_LENGTH,
-                    self.command().content_length()?.to_string().parse()?,
-                );
-                headers.insert(CONTENT_TYPE, self.command().content_type().parse()?);
-            }
+        if let Command::CopyObject { from } = self.command() {
+            headers.insert(HeaderName::from_static("x-amz-copy-source"), from.parse()?);
+        }
+
+        // Only include content-length and content-type for commands that
+        // actually carry a request body. Body-less commands (GET, HEAD,
+        // DELETE, CopyObject, AbortMultipartUpload, etc.) must not have
+        // these headers in the signed request, otherwise providers like
+        // Cloudflare R2 reject the signature because the empty
+        // content-length value corrupts the canonical request.
+        if self.command().has_body() {
+            headers.insert(
+                CONTENT_LENGTH,
+                self.command().content_length()?.to_string().parse()?,
+            );
+            headers.insert(CONTENT_TYPE, self.command().content_type().parse()?);
         }
         headers.insert(
             HeaderName::from_static("x-amz-content-sha256"),