This is somewhat annoying — the site’s original design has it communicating independently with Amazon (using Amazon’s XSLT API feature to transform their XML data into JSON), and that’s no longer possible with the use of a private key. But it’s not unfixable. The site now sends its API call first to my server, which returns a signed version, and then forwards the signed call on to Amazon.

I found most of what I needed for this on Chris Roos’ blog, but his version still wasn’t quite working for me (the two problems I recall are that Ruby’s CGI.escape doesn’t quite follow Amazon’s requirements, and that times need converting to GMT).

Anyway, in case you’re looking to do the same, here’s what I ended up with:

#!/usr/bin/env ruby
 
# Note: You need hmac.rb and hmac-sha2.rb from http://deisui.org/~ueno/ruby/hmac.html 
# somewhere in your require paths. ruby-hmac is currently broken under Ruby 1.9.
 
%w(rubygems cgi time hmac-sha2 base64).each { |lib| require lib }
 
ACCESS_IDENTIFIER = 'YOUR_PUBLIC_ID'
SECRET_IDENTIFIER = 'YOUR_PRIVATE_ID'
 
def aws_escape(s)
  s.gsub(/[^A-Za-z0-9_.~-]/) { |c| '%' + c[0].to_s(16).upcase }  
  # for 1.9, you'd replace [0] with .ord -- but ruby-hmac seems broken under 1.9
end
 
cgi = CGI.new
params = cgi.params.dup
 
amazon_endpoint = params.delete('amazon_endpoint')
amazon_path = params.delete('amazon_path')
js_callback = params.delete('js_callback')
 
signing_params = {
  'AWSAccessKeyId' => ACCESS_IDENTIFIER,
  'Timestamp' => Time.now.gmtime.iso8601
}
 
params.merge!(signing_params)
 
canonical_querystring = params.sort.collect do |key, value| 
  [aws_escape(key.to_s), aws_escape(value.to_s)].join('=') 
end.join('&')
 
string_to_sign = "GET\n#{amazon_endpoint}\n#{amazon_path}\n#{canonical_querystring}"
 
hmac = HMAC::SHA256.new(SECRET_IDENTIFIER)
hmac.update(string_to_sign)
signature = Base64.encode64(hmac.digest).chomp
 
params['Signature'] = signature
querystring = params.sort.collect do |key, value| 
  [aws_escape(key.to_s), aws_escape(value.to_s)].join('=') 
end.join('&')
 
signed_url = "http://#{amazon_endpoint}#{amazon_path}?#{querystring}"
 
cgi.out('type' => 'text/javascript') { "#{js_callback}('#{signed_url}');" }

You can test this locally by feeding key/value parameters to CGI, followed by Ctrl-D. These, for example:

amazon_endpoint=ecs.amazonaws.com
amazon_path=/onca/xml
js_callback=do_stuff
Service=AWSECommerceService
Version=2009-03-31
Operation=ItemSearch
SearchIndex=Books
Keywords=george+monbiot

These include:

• Caslon Pro
• Chaparral Pro
• Garamond Pro
• Minion Pro
• Myriad Pro

If you don’t want to actually install InDesign, you can get to the fonts like so (if you’re a Mac user):

• Mount (double-click) the downloaded disk image
• Mount another disk image found on the newly mounted disk, at Adobe InDesign CS4/payloads/AdobeFontsAll/AdobeFontsAll.dmg
• The fonts are inside /Assets/contents on this second disk

Note that these fonts may well be covered by a very restrictive licence: I haven’t checked.

This is brilliant for Mac users who need to test websites in IE, because you get a real installation of each browser in its home environment, with the right JavaScript engine and working conditional comments, plug-ins, Windows Media Player, and so on. With the alternatives, such as running under Wine or using Multiple IEs in a single Windows virtual machine, one or more of these things tends to be missing.

Unfortunately, the images are supplied as self-extracting .exe files, which of course are Windows programs. But happily, the Mac ports of Wine, the open-source Windows emulation software, can run them.

• Get hold of the self-extracting archives from Microsoft. I find XP+IE6 and XP+IE8 a useful combination.
• Install Darwine.
• Open /Applications/Darwine/WineHelper, choose File > Open… and pick one of the .exe files you downloaded in the last step.
• Ignore any Darwine messages about needing to install Mozilla, and click Next/Agree/etc. as necessary in the installer to extract the .vhd file. (I understand the free VirtualBox will take such a .vhd directly, but I’ve not tried this myself).
• Download Q. This is a largely useless program for Intel Mac users, since its purpose is to emulate the CPU you already have. But bear with me: it includes a very handy utility.
• Open /Applications/Utilities/Terminal, and paste in the following command, substituting in the correct path to your .vhd file and a path of your choice for the .vmdk file it will be converted to:

/Applications/Q.app/Contents/MacOS/qemu-img convert \
  -f vpc -O vmdk path_to_old.vhd path_to_new.vmdk

• Nothing will appear to be happening for a few minutes, but don’t worry. Wait for the prompt to reappear.
• Create a new Virtual Machine in Fusion, based on the new .vmdk you just created. Agree to Fusion’s request to convert the format of the disk.
• Before starting up the new machine, remove its USB controller, sound card and serial port, and disable 3D graphics (this is all optional, but it reduces the number of requests for drivers you’ll have to deny later).
• Start the virtual machine, canceling any requests for driver disks or Windows Update attempts.
• Install VMWare Tools. I find everything works except the mouse, so at this point I choose the custom installation and deselect the mouse driver.
• Reboot and you’re done.
• Don’t forget to move the original .exe and .vhd files to the Trash: they’re big and completely useless now.