feat(s3): CopyObject checksum propagation and replacement

A copy without a checksum request carries the source's checksum triple
(algorithm/value/type) to the destination; a request naming a different
x-amz-checksum-algorithm replaces it, streaming the shared body through the
new algorithm once for a full-object value. The CopyObjectResult now
reports the destination checksum fields. Promotes the four checksum rows of
the CopyObject XFail table.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: frrist

itest/versity_object_test.go

@@ -173,10 +173,14 @@ var copyObjectPass = []forgeCase{
 	{name: "invalid_legal_hold", fn: integration.CopyObject_invalid_legal_hold},
 	{name: "invalid_object_lock_mode", fn: integration.CopyObject_invalid_object_lock_mode},
 	{name: "invalid_website_redirect_location", fn: integration.CopyObject_invalid_website_redirect_location},
+	{name: "create_checksum_on_copy", fn: integration.CopyObject_create_checksum_on_copy},
+	{name: "should_copy_the_existing_checksum", fn: integration.CopyObject_should_copy_the_existing_checksum},
+	{name: "should_replace_the_existing_checksum", fn: integration.CopyObject_should_replace_the_existing_checksum},
+	{name: "to_itself_by_replacing_the_checksum", fn: integration.CopyObject_to_itself_by_replacing_the_checksum},
 }
 
 // Observed failing against the forge stack: multi-account semantics, tagging,
-// object-lock, and checksum-on-copy are unimplemented surface.
+// and object-lock are unimplemented surface.
 var copyObjectXFail = []forgeCase{
 	{name: "not_owned_source_bucket", fn: integration.CopyObject_not_owned_source_bucket},
 	{name: "should_replace_tagging", fn: integration.CopyObject_should_replace_tagging},
@@ -185,10 +189,6 @@ var copyObjectXFail = []forgeCase{
 	{name: "with_legal_hold", fn: integration.CopyObject_with_legal_hold},
 	{name: "with_retention_lock", fn: integration.CopyObject_with_retention_lock},
 	{name: "object_acl_not_supported", fn: integration.CopyObject_object_acl_not_supported},
-	{name: "create_checksum_on_copy", fn: integration.CopyObject_create_checksum_on_copy},
-	{name: "should_copy_the_existing_checksum", fn: integration.CopyObject_should_copy_the_existing_checksum},
-	{name: "should_replace_the_existing_checksum", fn: integration.CopyObject_should_replace_the_existing_checksum},
-	{name: "to_itself_by_replacing_the_checksum", fn: integration.CopyObject_to_itself_by_replacing_the_checksum},
 	{name: "incorrect_source_bucket_expected_owner", fn: integration.CopyObject_incorrect_source_bucket_expected_owner},
 }
 

s3frontend/copy.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/fil-forge/versitygw/backend"
+	"github.com/fil-forge/versitygw/s3api/utils"
 	"github.com/fil-forge/versitygw/s3err"
 	"github.com/fil-forge/versitygw/s3response"
 
@@ -83,16 +85,42 @@ func (b *Backend) CopyObject(ctx context.Context, input s3response.CopyObjectInp
 		return s3response.CopyObjectOutput{}, err
 	}
 
+	// Destination checksum: same bytes → the source's checksum (and type)
+	// carries over. A request naming a DIFFERENT x-amz-checksum-algorithm
+	// replaces it: the shared body streams through the new algorithm once and
+	// the result is a full-object value — the sole per-object checksum, never
+	// accumulated alongside the source's.
+	ckAlgo, ckVal, ckType := srcMf.ChecksumAlgorithm, srcMf.Checksum, srcMf.ChecksumType
+	if ckVal != "" && ckType == "" {
+		ckType = string(types.ChecksumTypeFullObject)
+	}
+	if reqAlgo := input.ChecksumAlgorithm; reqAlgo != "" && string(reqAlgo) != srcMf.ChecksumAlgorithm {
+		ht, err := hashTypeForAlgo(reqAlgo)
+		if err != nil {
+			return s3response.CopyObjectOutput{}, err
+		}
+		rc := msbucket.OpenBody(ctx, b.read, srcRv.st.Space, srcMf.Body)
+		defer rc.Close()
+		hr, err := utils.NewHashReader(rc, "", ht)
+		if err != nil {
+			return s3response.CopyObjectOutput{}, fmt.Errorf("s3frontend: copy checksum reader: %w", err)
+		}
+		if _, err := io.Copy(io.Discard, hr); err != nil {
+			return s3response.CopyObjectOutput{}, fmt.Errorf("s3frontend: copy checksum: %w", err)
+		}
+		ckAlgo, ckVal, ckType = string(reqAlgo), hr.Sum(), string(types.ChecksumTypeFullObject)
+	}
+
 	// Destination manifest: the SAME body (size/sha/md5/blobs) and ETag, since
 	// the content is identical. Metadata per the directive.
 	dstMf := &msbucket.ObjectManifest{
-		Key:     dstKey,
-		Created: time.Now().Unix(),
-		Body:    srcMf.Body,
-		ETag:    srcMf.ETag,
-		// Same content → same additional checksum, regardless of directive.
-		ChecksumAlgorithm: srcMf.ChecksumAlgorithm,
-		Checksum:          srcMf.Checksum,
+		Key:               dstKey,
+		Created:           time.Now().Unix(),
+		Body:              srcMf.Body,
+		ETag:              srcMf.ETag,
+		ChecksumAlgorithm: ckAlgo,
+		Checksum:          ckVal,
+		ChecksumType:      ckType,
 	}
 	if replace {
 		ct := backend.GetStringFromPtr(input.ContentType)
@@ -130,11 +158,13 @@ func (b *Backend) CopyObject(ctx context.Context, input s3response.CopyObjectInp
 
 	lastMod := time.Unix(dstMf.Created, 0)
 	etag := etagOf(dstMf)
+	result := &s3response.CopyObjectResult{
+		ETag:         &etag,
+		LastModified: &lastMod,
+	}
+	result.ChecksumCRC32, result.ChecksumCRC32C, result.ChecksumSHA1, result.ChecksumSHA256, result.ChecksumCRC64NVME, result.ChecksumSHA512, result.ChecksumMD5, result.ChecksumXXHASH64, result.ChecksumXXHASH3, result.ChecksumXXHASH128, result.ChecksumType = checksumFields(dstMf.ChecksumAlgorithm, dstMf.Checksum, dstMf.ChecksumType)
 	out := s3response.CopyObjectOutput{
-		CopyObjectResult: &s3response.CopyObjectResult{
-			ETag:         &etag,
-			LastModified: &lastMod,
-		},
+		CopyObjectResult: result,
 	}
 	// Version ids in the response, per each side's bucket state (§4.3).
 	if srcRv.versioned() {

s3frontend/multipart_checksum_test.go

@@ -430,3 +430,81 @@ func TestListParts_Checksums(t *testing.T) {
 		t.Fatalf("internal CRC64NVME leaked into ListParts: %s", *res.Parts[0].ChecksumCRC64NVME)
 	}
 }
+
+// TestCopyObject_Checksums: a copy without a checksum request propagates the
+// source's checksum verbatim; a copy naming a different algorithm replaces it
+// with a recomputed full-object value (the old algorithm's field goes nil),
+// and the result agrees with a subsequent HEAD.
+func TestCopyObject_Checksums(t *testing.T) {
+	b, _, _ := newRefTestBackend(t)
+	bucket := "bk"
+	data := []byte("copy-source-bytes")
+	crcSum := crc32cB64(data)
+
+	srcKey := "cp-src"
+	if _, err := b.PutObject(context.Background(), s3response.PutObjectInput{
+		Bucket:         &bucket,
+		Key:            &srcKey,
+		Body:           bytes.NewReader(data),
+		ChecksumCRC32C: &crcSum,
+	}); err != nil {
+		t.Fatalf("PutObject: %v", err)
+	}
+
+	// No checksum request → the source's CRC32C carries over.
+	dstKey, src := "cp-propagate", bucket+"/"+srcKey
+	out, err := b.CopyObject(context.Background(), s3response.CopyObjectInput{
+		Bucket: &bucket, Key: &dstKey, CopySource: &src,
+	})
+	if err != nil {
+		t.Fatalf("CopyObject: %v", err)
+	}
+	if out.CopyObjectResult.ChecksumCRC32C == nil || *out.CopyObjectResult.ChecksumCRC32C != crcSum {
+		t.Fatalf("propagate: result CRC32C = %v, want %s", out.CopyObjectResult.ChecksumCRC32C, crcSum)
+	}
+	if out.CopyObjectResult.ChecksumType != types.ChecksumTypeFullObject {
+		t.Fatalf("propagate: type = %v, want FULL_OBJECT", out.CopyObjectResult.ChecksumType)
+	}
+	hCrc32c, _, _, _ := headChecksum(t, b, dstKey)
+	if hCrc32c == nil || *hCrc32c != crcSum {
+		t.Fatalf("propagate: HEAD CRC32C = %v, want %s", hCrc32c, crcSum)
+	}
+
+	// A different requested algorithm replaces the checksum: SHA256 set to the
+	// recomputed body digest, the source's CRC32C dropped.
+	dstKey = "cp-replace"
+	out, err = b.CopyObject(context.Background(), s3response.CopyObjectInput{
+		Bucket: &bucket, Key: &dstKey, CopySource: &src,
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+	})
+	if err != nil {
+		t.Fatalf("CopyObject: %v", err)
+	}
+	if out.CopyObjectResult.ChecksumSHA256 == nil || *out.CopyObjectResult.ChecksumSHA256 != sha256B64(data) {
+		t.Fatalf("replace: result SHA256 = %v, want %s", out.CopyObjectResult.ChecksumSHA256, sha256B64(data))
+	}
+	if out.CopyObjectResult.ChecksumCRC32C != nil {
+		t.Fatalf("replace: source CRC32C survived: %s", *out.CopyObjectResult.ChecksumCRC32C)
+	}
+	_, _, hSha, hType := headChecksum(t, b, dstKey)
+	if hSha == nil || *hSha != sha256B64(data) || hType != types.ChecksumTypeFullObject {
+		t.Fatalf("replace: HEAD = %v/%v, want %s/FULL_OBJECT", hSha, hType, sha256B64(data))
+	}
+
+	// Self-copy with REPLACE swapping the algorithm again.
+	selfSrc := bucket + "/" + dstKey
+	out, err = b.CopyObject(context.Background(), s3response.CopyObjectInput{
+		Bucket: &bucket, Key: &dstKey, CopySource: &selfSrc,
+		MetadataDirective: types.MetadataDirectiveReplace,
+		ChecksumAlgorithm: types.ChecksumAlgorithmCrc32c,
+	})
+	if err != nil {
+		t.Fatalf("self-copy: %v", err)
+	}
+	if out.CopyObjectResult.ChecksumCRC32C == nil || *out.CopyObjectResult.ChecksumCRC32C != crcSum {
+		t.Fatalf("self-copy: result CRC32C = %v, want %s", out.CopyObjectResult.ChecksumCRC32C, crcSum)
+	}
+	if out.CopyObjectResult.ChecksumSHA256 != nil {
+		t.Fatalf("self-copy: SHA256 survived: %s", *out.CopyObjectResult.ChecksumSHA256)
+	}
+}