rich7420 opened a new pull request, #11589: URL: https://github.com/apache/ozone/pull/11589
## What changes were proposed in this pull request? A valid trailer signature authenticates the checksum header but does not establish that the checksum matches the uploaded data. Calculate CRC32, CRC32C, CRC64NVME, SHA1, or SHA256 over the decoded payload in both chunk streams, and compare it with the declared trailer before commit. Reject mismatches with `BadDigest`, preserving HMAC error precedence and bounded memory use. Depends on #11586 (HDDS-16661). This draft includes that prerequisite; the [checksum-only diff](https://github.com/rich7420/ozone/compare/ca00873f1f1a0c22f57f4928859e04728120f37c...40aa638486afb7a708f0aa4a8942c6a7851d561e) shows this issue's changes. Checksum persistence and multipart aggregate checksums are outside this patch. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-16660 ## How was this patch tested? - Final-source targeted local suites: 363 cases, no failures or errors; checkstyle passed. - Independent checksum comparisons: 5,000 random cases and 3,885 byte/update-mode cases passed. A 128 MiB payload was processed with a 32 MiB heap. - Temporary HTTP probes through the existing normal and Ratis streaming SDK fixtures: 8 cases passed, checking valid uploads, checksum/framing rejection, and retention of prior objects and multipart parts after rejected replacements. These used nonsecure presigned CRC32 requests; signed-format dummy signatures do not establish HMAC verification. HMAC is covered separately by unit and endpoint tests. - [Latest fork CI](https://github.com/rich7420/ozone/actions/runs/39010096822) at `40aa638486`: in progress. Final-head 10×10 is pending. Generated-by: Codex (GPT-6) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
