fix: reject composite CRC64NVME checksums

Return InvalidArgument for CRC64NVME with COMPOSITE at multipart initiation and PutObject instead of silently canonicalizing the request to FULL_OBJECT.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/hash/checksum.go

@@ -157,7 +157,6 @@ func ChecksumStringToType(alg string) ChecksumType {
 	case "SHA256":
 		return ChecksumSHA256
 	case "CRC64NVME":
-		// AWS seems to ignore full value, and just assume it.
 		return ChecksumCRC64NVME
 	case "":
 		return ChecksumNone
@@ -192,7 +191,9 @@ func NewChecksumType(alg, objType string) ChecksumType {
 		}
 		return ChecksumSHA256
 	case "CRC64NVME":
-		// AWS seems to ignore full value, and just assume it.
+		if objType == xhttp.AmzChecksumTypeComposite {
+			return ChecksumInvalid
+		}
 		return ChecksumCRC64NVME
 	case "":
 		if full != 0 {
@@ -781,5 +782,8 @@ func getContentChecksum(h http.Header) (t ChecksumType, s string) {
 	for _, t := range BaseChecksumTypes {
 		checkType(t)
 	}
+	if t.Base().Is(ChecksumCRC64NVME) && h.Get(xhttp.AmzChecksumType) == xhttp.AmzChecksumTypeComposite {
+		return ChecksumInvalid, ""
+	}
 	return t, s
 }

internal/hash/checksum_test.go

@@ -67,6 +67,9 @@ func TestGetContentChecksumRejectsUnsupportedHeaders(t *testing.T) {
 
 // TestChecksumAddToHeader tests that adding and retrieving a checksum on a header works
 func TestChecksumAddToHeader(t *testing.T) {
+	if got := NewChecksumType("CRC64NVME", xhttp.AmzChecksumTypeComposite); !got.Is(ChecksumInvalid) {
+		t.Fatalf("CRC64NVME/COMPOSITE = %s, want invalid", got.StringFull())
+	}
 	tests := []struct {
 		name     string
 		checksum ChecksumType