From 48a834f0930eab21b5c7a48da5914d98a95851f3 Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Sun, 21 Jun 2026 23:18:10 +0800
Subject: [PATCH] Disable optional S3 checksum headers

---
 .../run/halo/s3os/S3OsAttachmentHandler.java  |  2 +
 .../halo/s3os/S3OsAttachmentHandlerTest.java  | 51 +++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/src/main/java/run/halo/s3os/S3OsAttachmentHandler.java b/src/main/java/run/halo/s3os/S3OsAttachmentHandler.java
index 34b1178..530f06f 100644
--- a/src/main/java/run/halo/s3os/S3OsAttachmentHandler.java
+++ b/src/main/java/run/halo/s3os/S3OsAttachmentHandler.java
@@ -32,6 +32,7 @@
 import run.halo.app.extension.MetadataUtil;
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.awscore.presigner.SdkPresigner;
+import software.amazon.awssdk.core.checksums.RequestChecksumCalculation;
 import software.amazon.awssdk.core.SdkResponse;
 import software.amazon.awssdk.core.sync.RequestBody;
 import software.amazon.awssdk.http.SdkHttpResponse;
@@ -309,6 +310,7 @@ Attachment buildAttachment(S3OsProperties properties, ObjectDetail objectDetail)
     S3Client buildS3Client(S3OsProperties properties) {
         var builder = S3Client.builder()
             .region(Region.of(properties.getRegion()))
+            .requestChecksumCalculation(RequestChecksumCalculation.WHEN_REQUIRED)
             .endpointOverride(
                 URI.create(properties.getEndpointProtocol() + "://" + properties.getEndpoint()))
             .credentialsProvider(() -> AwsBasicCredentials.create(properties.getAccessKey(),
diff --git a/src/test/java/run/halo/s3os/S3OsAttachmentHandlerTest.java b/src/test/java/run/halo/s3os/S3OsAttachmentHandlerTest.java
index cc22319..fd50cd0 100644
--- a/src/test/java/run/halo/s3os/S3OsAttachmentHandlerTest.java
+++ b/src/test/java/run/halo/s3os/S3OsAttachmentHandlerTest.java
@@ -1,5 +1,7 @@
 package run.halo.s3os;
 
+import com.sun.net.httpserver.Headers;
+import com.sun.net.httpserver.HttpServer;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.core.io.buffer.DataBuffer;
@@ -11,11 +13,15 @@
 import run.halo.app.core.extension.attachment.Policy;
 import run.halo.app.extension.ConfigMap;
 import run.halo.app.extension.Metadata;
+import software.amazon.awssdk.core.sync.RequestBody;
+import software.amazon.awssdk.services.s3.model.UploadPartRequest;
 
+import java.net.InetSocketAddress;
 import java.net.URI;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -49,6 +55,47 @@ void acceptHandlingWhenPolicyTemplateIsExpected() {
         assertFalse(handler.shouldHandle(null));
     }
 
+    @Test
+    void buildS3ClientShouldNotSendOptionalChecksumHeadersForUploadPart() throws Exception {
+        var headersRef = new AtomicReference<Headers>();
+        var server = HttpServer.create(new InetSocketAddress("localhost", 0), 0);
+        server.createContext("/", exchange -> {
+            headersRef.set(exchange.getRequestHeaders());
+            exchange.getRequestBody().transferTo(java.io.OutputStream.nullOutputStream());
+            exchange.getResponseHeaders().add("ETag", "\"etag\"");
+            exchange.sendResponseHeaders(200, -1);
+            exchange.close();
+        });
+        server.start();
+        try {
+            var properties = new S3OsProperties();
+            properties.setBucket("bucket");
+            properties.setEndpointProtocol(S3OsProperties.Protocol.http);
+            properties.setEndpoint("localhost:" + server.getAddress().getPort());
+            properties.setAccessKey("access-key");
+            properties.setAccessSecret("secret-key");
+            properties.setRegion("us-east-1");
+            properties.setEnablePathStyleAccess(true);
+
+            try (var client = handler.buildS3Client(properties)) {
+                client.uploadPart(UploadPartRequest.builder()
+                        .bucket(properties.getBucket())
+                        .key("halo.txt")
+                        .uploadId("upload-id")
+                        .partNumber(1)
+                        .contentLength(5L)
+                        .build(),
+                    RequestBody.fromString("hello"));
+            }
+
+            var headers = headersRef.get();
+            assertFalse(hasHeader(headers, "x-amz-sdk-checksum-algorithm"));
+            assertFalse(hasHeader(headers, "x-amz-checksum-crc32"));
+        } finally {
+            server.stop(0);
+        }
+    }
+
     @Test
     void reshapeDataBufferWithSmallerBufferSize() {
         var handler = new S3OsAttachmentHandler();
@@ -209,4 +256,8 @@ static Attachment createAttachment(String mediaType, String permalink) {
         return attachment;
     }
 
+    private static boolean hasHeader(Headers headers, String name) {
+        return headers.keySet().stream().anyMatch(name::equalsIgnoreCase);
+    }
+
 }