fix(boto3): Fix botocore SigV4 failures caused by post-sign trace propagation

[pabloDeputter]

Description

Summary of issue

• pre-4.12.0 ddtrace basically behaved like Sentry before: propagation headers were added by the HTTP client after botocore already had calculated the SigV4 signature. So baggage was not included in SignedHeaders. Any later modifications to the value did not invalidate the request.
• 4.12.0 moves the header injection to botocore's before-sign event. It adds baggage, ... and x-datadog-* before signing. Any later modifications to the value DO invalidate the request, thus later HTTP-client injection is suppressed to avoid duplicate headers.
• How failure happens:
  1. incoming FastAPI request contains Sentry or other W3C baggage
  2. datadog extracts that baggage into its active context
  3. boto3 request is created
  4. datadog’s before-sign handler writes the baggage to the AWS request
  5. botocore includes baggage in the SigV4 signature
  6. sentry’s httplib runs afterwards and updates or adds another baggage value
  7. AWS receives a different baggage value from the one that was signed. Because request was "tampered" with after signing, AWS rejects the request with 403 Forbidden or SignatureDoesNotMatch.

Changes

• inject sentry propagation through before-sign handler, so final baggage and sentry-trace values are created before SigV4 signing.
• existing third-party baggage is merged into one header.
• http.client propagation is delayed until endheaders(), when the complete request headers and SigV4 SignedHeaders are available. Existing baggage header is never mutated after it already was signed.
• propagation is skipped for presigned requests, since adding headers could require a future caller to reproduce these exact headers.

Issues

Resolves: #7031 & PY-2667
Related issues in dd-trace-py: #19477 & #19358

Reminders

• Please add tests to validate your changes, and lint your code using uv run ruff.
• Add GH Issue ID & Linear ID (if applicable)
• PR title should use conventional commit style (feat:, fix:, ref:, meta:)
• For external contributors: CONTRIBUTING.md, Sentry SDK development docs, Discord community

[github-actions]

Codecov Results 📊

✅ 111606 passed | ⏭️ 6764 skipped | Total: 118370 | Pass Rate: 94.29% | Execution Time: 412m 40s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +266
Passed Tests	📈 +251
Failed Tests	—
Skipped Tests	📈 +15

All tests are passing successfully.

✅ Patch coverage is 97.14%. Project has 2483 uncovered lines.
✅ Project coverage is 90.23%. Comparing base (base) to head (head).

Files with missing lines (3)

File	Patch %	Lines
sentry_sdk/integrations/stdlib.py	96.36%	⚠️ 2 Missing and 3 partials
sentry_sdk/integrations/boto3.py	96.15%	⚠️ 1 Missing and 1 partials
sentry_sdk/utils.py	100.00%	⚠️ 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    90.17%    90.23%    +0.06%
==========================================
  Files          193       193         —
  Lines        25317     25413       +96
  Branches      9280      9322       +42
==========================================
+ Hits         22827     22930      +103
- Misses        2490      2483        -7
- Partials      1427      1429        +2

---

Generated by Codecov Action

[alexander-alderman-webb]

Does calling sentry_sdk.get_current_scope().iter_trace_propagation_headers() here instead of in putrequest() work?
It would be best to avoid stashing stuff on the HTTPConnection instance if we can help it.

[pabloDeputter]

Good suggestion :) header generation is moved into endheaders() instead of being stored on the connection.

[alexander-alderman-webb]

I haven't forgot about this, it's just complex so I'll likely only re-review fully at the start of next week.

[alexander-alderman-webb]

This looks really good broadly as fixes the issue without disrupting existing users (including those that not using boto3).

My comments are mainly concerned with the patching approach. It looks more complex than needed to achieve the result.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 484a941. Configure here.}