fix(storage): suppress SDK checksum WARN for S3-compatible backends (MinIO/Ceph)#3284
fix(storage): suppress SDK checksum WARN for S3-compatible backends (MinIO/Ceph)#3284AdaAibaby wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures the AWS S3 client to only validate response checksums when explicitly required, aiming to prevent warning logs when using S3-compatible backends like MinIO or Ceph. The reviewer noted that applying this setting unconditionally weakens data integrity guarantees for standard AWS S3 clients. They suggested conditionally applying this configuration only when targeting S3-compatible backends, such as when S3_USE_PATH_STYLE is enabled.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ebd7c9ae8
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
AWS SDK Go v2 logs a WARN on every GetObject response when the server does not return x-amz-checksum-* headers, which MinIO and other S3-compatible backends do not include by default. Setting ResponseChecksumValidation to WhenRequired tells the SDK to only validate payload checksums when the caller explicitly requests one, eliminating the noise without compromising integrity guarantees for callers that do use checksums.
AdaAibaby
force-pushed
the
fix/s3-response-checksum-validation-warn
branch
from
8ebd7c9 to
2a7545b
Compare
2 participants
Problem
When using an S3-compatible backend (MinIO, Ceph, etc.), the orchestrator logs a flood of WARN messages:
This fires on every
GetObjectresponse because MinIO does not returnx-amz-checksum-*response headers, and AWS SDK Go v2 defaults toResponseChecksumValidationWhenSupported— logging a WARN whenever it cannot find a checksum to validate.Root Cause
newAWSStorageinpackages/shared/pkg/storage/storage_aws.gocreates the S3 client without settingResponseChecksumValidation. The SDK default (WhenSupported) attempts checksum validation on every response and emits a WARN when no checksum header is present.Fix
Set
o.ResponseChecksumValidation = aws.ResponseChecksumValidationWhenRequiredin thes3.NewFromConfigoptions func. This tells the SDK to only validate checksums when the caller explicitly requests one — which is the correct contract for S3-compatible backends that don't implement the checksum extension.This does not weaken integrity guarantees for callers that do pass
WithChecksumoptions; it only stops the SDK from logging warnings for responses where no checksum was requested.Testing
go build ./packages/shared/pkg/storage/✅