feat(x-optee): better error messages for aws signing

Cargo.toml

@@ -89,6 +89,7 @@ async-stream = "0.3.6"
 async-tempfile = "0.7.0"
 async-trait = "0.1.88"
 aws-config = "=1.5.5"
+aws-credential-types = "1.2.14"
 aws-sdk-s3 = "=1.46.0"
 axum = "0.8.3"
 base64 = "0.22.1"
@@ -111,10 +112,6 @@ console-subscriber = "0.4"
 dashmap = "5.5.3"
 data-encoding = "2.3"
 dbus-launch = "0.2.0"
-derive_more = { version = "2.1.0", default-features = false, features = [
-	"display",
-	"from",
-] }
 ed25519-dalek = { version = "2.1.1", default-features = false, features = ["std"] }
 escargot = "0.5.15"
 eyre = "0.6.12"
@@ -147,10 +144,6 @@ pkg-config = "0.3.32"
 proptest = "1.10.0"
 rand = "0.8"
 regex = "1.11.2"
-reqwest = { version = "0.12.24", default-features = false, features = [
-	"rustls-tls",
-	"stream",
-] }
 ring = "0.17.2"
 rkyv = "0.7.46"
 rustix = "0.38.37"
@@ -229,10 +222,20 @@ seek-camera.path = "seek-camera/wrapper"
 test-utils.path = "test-utils"
 zenorb.path = "zenorb"
 
+[workspace.dependencies.derive_more]
+default-features = false
+features = ["display", "from"]
+version = "2.1.0"
+
 [workspace.dependencies.orb-messages]
 git = "https://github.com/worldcoin/orb-messages"
 rev = "af472fadb57ce55ac63f8f94bd2a0608e62405c7"
 
+[workspace.dependencies.reqwest]
+default-features = false
+features = ["rustls-tls", "stream"]
+version = "0.12.24"
+
 [patch.crates-io.optee-teec-sys]
 branch = "tfh"
 git = "https://github.com/TheButlah/teaclave-trustzone-sdk"

s3-helpers/src/client.rs

@@ -44,7 +44,7 @@ pub async fn client() -> Result<aws_sdk_s3::Client> {
     let retry_config =
         RetryConfig::standard().with_max_attempts(TIMEOUT_RETRY_ATTEMPTS);
 
-    let config = aws_config::defaults(BehaviorVersion::v2025_08_07())
+    let config = aws_config::defaults(BehaviorVersion::v2026_01_12())
         .region(region_provider)
         .credentials_provider(credentials_provider)
         .retry_config(retry_config)

s3-helpers/tests/common/mod.rs

@@ -44,7 +44,7 @@ impl TestCtx {
                     .operation_timeout(Duration::from_secs(5))
                     .build(),
             )
-            .behavior_version(BehaviorVersion::v2025_08_07())
+            .behavior_version(BehaviorVersion::v2026_01_12())
             .region(Region::new("us-east-1"))
             .credentials_provider(creds)
             .endpoint_url(endpoint_url)

xtask/optee/Cargo.toml

@@ -13,6 +13,8 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+aws-config.workspace = true
+aws-credential-types.workspace = true
 cargo_metadata = "0.22.0"
 clap = { workspace = true, features = ["derive"] }
 cmd_lib.workspace = true
@@ -21,4 +23,5 @@ derive_more = { workspace = true, features = ["display"] }
 object = "0.38.1"
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
+tokio.workspace = true
 uuid.workspace = true

xtask/optee/src/lib.rs

@@ -5,11 +5,13 @@ use std::{
     sync::LazyLock,
 };
 
+use aws_config::default_provider::credentials::DefaultCredentialsChain;
+use aws_credential_types::provider::ProvideCredentials as _;
 use clap::ValueEnum;
 use cmd_lib::run_cmd;
 use color_eyre::{
-    eyre::{ensure, Context as _, ContextCompat, OptionExt},
-    Result,
+    eyre::{ensure, Context as _, ContextCompat, OptionExt as _},
+    Result, Section as _,
 };
 use derive_more::Display;
 use uuid::Uuid;
@@ -113,6 +115,31 @@ impl SignArgs {
             format!("failed to read requried arg: {ENV_OPTEE_OS_PATH}")
         })?;
 
+        let creds_fut = async {
+            let credentials_provider = DefaultCredentialsChain::builder().build().await;
+            credentials_provider
+            .provide_credentials()
+            .await
+            .wrap_err("failed to get aws credentials")
+            .with_note(|| {
+                format!("AWS_PROFILE env var was {:?}", std::env::var("AWS_PROFILE"))
+            })
+            .with_suggestion(|| {
+                "make sure that your aws credentials are set. Follow the instructions at
+            https://worldcoin.github.io/orb-software/aws-creds"
+            })
+            .with_suggestion(|| {
+                "try running `AWS_PROFILE=<profile> aws sso login --use-device-code` to refresh your \
+            credentials"
+            })
+        };
+        let _creds = tokio::runtime::Builder::new_current_thread()
+            .enable_time()
+            .enable_io()
+            .build()
+            .wrap_err("failed to make tokio runtime")?
+            .block_on(creds_fut)?;
+
         run_cmd!(uv run --all-packages $optee_os_path/scripts/sign_encrypt.py sign-enc --uuid $inspected_uuid --in $file_to_sign --out $out_dir/$inspected_uuid.ta --key $key_id)?;
 
         Ok(())