fix(boto3): Fix botocore SigV4 failures caused by post-sign trace propagation

[pabloDeputter]

Description

Summary of issue

• pre-4.12.0 ddtrace basically behaved like Sentry before: propagation headers were added by the HTTP client after botocore already had calculate the SigV4 signature. So baggage was not included in SignedHeaders. Any later modifications to the value did not invalidate the request.
• 4.12.0 moves the header injection to botocore's before-sign event. It adds baggage, ... and x-datadog-* before signing. Any later modifications to the value DO invalidate the request, thus later HTTP-client injection is suppressed to avoid duplicate headers.
• How failure happens:
  1. incoming FastAPI request contains Sentry or other W3C baggage
  2. datadog extracts that baggage into its active context
  3. boto3 request is created
  4. datadog’s before-sign handler writes the baggage to the AWS request
  5. botocore includes baggage in the SigV4 signature
  6. sentry’s httplib runs afterwards and updates or adds another baggage value
  7. AWS receives a different baggage value from the one that was signed. Because request was "tampered" with after signing, AWS rejects the request with 403 Forbidden or SignatureDoesNotMatch.

Changes

• inject sentry propagation through before-sign handler, so final baggage and sentry-trace values are created before SigV4 signing.
• existing third-party baggage is merged into one header.
• http.client propagation is delayed until endheaders(), when the complete request headers and SigV4 SignedHeaders are available. Existing baggage header is never mutated after it already was signed.
• propagation is skipped for presigned requests, since adding headers could require a future caller to reproduce these exact headers.

Issues

Resolves: #7031 & PY-2667

Reminders

• Please add tests to validate your changes, and lint your code using uv run ruff.
• Add GH Issue ID & Linear ID (if applicable)
• PR title should use conventional commit style (feat:, fix:, ref:, meta:)
• For external contributors: CONTRIBUTING.md, Sentry SDK development docs, Discord community

[github-actions]

Codecov Results 📊

✅ 99287 passed | ⏭️ 6494 skipped | Total: 105781 | Pass Rate: 93.86% | Execution Time: 354m 38s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +140
Passed Tests	📈 +126
Failed Tests	📉 -1
Skipped Tests	📈 +15

➖ Removed Tests (1)

View removed tests

• test_continuous_profiler_auto_start_and_stop_sampled[experiment-gevent]
  • File: tests.profiler.test_continuous_profiler

All tests are passing successfully.

✅ Patch coverage is 95.06%. Project has 2508 uncovered lines.
✅ Project coverage is 89.98%. Comparing base (base) to head (head).

Files with missing lines (2)

File	Patch %	Lines
sentry_sdk/integrations/stdlib.py	94.55%	⚠️ 3 Missing and 4 partials
sentry_sdk/integrations/boto3.py	96.15%	⚠️ 1 Missing and 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    89.95%    89.98%    +0.03%
==========================================
  Files          193       193         —
  Lines        24955     25029       +74
  Branches      9004      9038       +34
==========================================
+ Hits         22448     22521       +73
- Misses        2507      2508        +1
- Partials      1437      1440        +3

---

Generated by Codecov Action

[sentry]

Bug: The logic to avoid overwriting signed headers is too broad. It skips injecting sentry-trace if it already exists, even if it's unsigned, causing stale traces to be propagated.
_{Severity: LOW}

Suggested Fix

The condition should be simplified to only skip headers that are present in signed_headers. The fix is to change the conditional to if normalized_header in signed_headers: continue. This ensures Sentry only avoids mutating headers that are actually part of a SigV4 signature, and will correctly overwrite any stale, unsigned headers.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: sentry_sdk/integrations/stdlib.py#L228-L233

Potential issue: The conditional logic in the patched `endheaders` method incorrectly
skips injecting the `sentry-trace` header if any pre-existing, unsigned `sentry-trace`
header is found. The logic was intended to avoid overwriting SigV4-signed headers, but
the condition `normalized_header != BAGGAGE_HEADER_NAME` causes it to always skip any
pre-existing `sentry-trace` header, regardless of whether it is signed. This can lead to
stale trace information being propagated if user code or middleware adds a
`sentry-trace` header before `endheaders` is called in a non-boto3 context.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[alexander-alderman-webb]

Does calling sentry_sdk.get_current_scope().iter_trace_propagation_headers() here instead of in putrequest() work?
It would be best to avoid stashing stuff on the HTTPConnection instance if we can help it.