CLDSRV-872: store checksum in object metadata by leif-scality · Pull Request #6114 · scality/cloudserver

leif-scality · 2026-03-17T15:49:59Z

No description provided.

bert-e · 2026-03-17T15:50:04Z

Hello leif-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-03-17T15:50:11Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-872 contains:

None

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

9.4.0

Please check the Fix Version/s of CLDSRV-872, or the target
branch of this pull request.

codecov · 2026-03-17T15:54:30Z

Codecov Report

❌ Patch coverage is 88.46154% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.69%. Comparing base (888ea43) to head (180d940).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
lib/api/apiUtils/object/createAndStoreObject.js	82.35%	3 Missing ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
lib/api/apiUtils/object/storeObject.js	`100.00% <100.00%> (ø)`
lib/api/objectPut.js	`94.95% <100.00%> (+0.13%)`	⬆️
lib/routes/routeBackbeat.js	`76.86% <ø> (+0.54%)`	⬆️
lib/services.js	`87.07% <100.00%> (+0.10%)`	⬆️
lib/api/apiUtils/object/createAndStoreObject.js	`85.52% <82.35%> (+0.12%)`	⬆️

... and 1 file with indirect coverage changes

@@                                 Coverage Diff                                  @@
##           improvement/CLDSRV-863-checksums-put-object-part    #6114      +/-   ##
====================================================================================
+ Coverage                                             84.66%   84.69%   +0.03%     
====================================================================================
  Files                                                   207      207              
  Lines                                                 13518    13540      +22     
====================================================================================
+ Hits                                                  11445    11468      +23     
+ Misses                                                 2073     2072       -1

Flag	Coverage Δ
file-ft-tests	`68.55% <88.46%> (+0.03%)`	⬆️
kmip-ft-tests	`28.10% <42.30%> (+0.02%)`	⬆️
mongo-v0-ft-tests	`69.73% <88.46%> (+0.03%)`	⬆️
mongo-v1-ft-tests	`69.76% <88.46%> (-0.05%)`	⬇️
multiple-backend	`35.28% <50.00%> (+0.13%)`	⬆️
sur-tests	`36.39% <42.30%> (+0.82%)`	⬆️
sur-tests-inflights	`37.40% <42.30%> (+<0.01%)`	⬆️
unit	`70.62% <84.61%> (+0.02%)`	⬆️
utapi-v2-tests	`34.54% <50.00%> (+0.11%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

package.json

lib/api/apiUtils/object/storeObject.js

claude · 2026-03-17T16:01:31Z

Arsenal dependency is pinned to a branch instead of a tag. Must be pinned to a release tag before merging.
- Change arsenal in package.json to point to a tagged version.
Verify ObjectMDChecksum constructor argument names match the field names used in storeObject.js checkHashMatchMD5 (algorithm, value, type). The unit tests assert checksumAlgorithm, checksumValue, checksumType on the stored metadata. If ObjectMDChecksum maps these internally it is fine, but worth confirming.
In storeObject.js dataStore, the onStreamError handler (line 91) and doValidate via once('finish', ...) (line 125) can both fire if the stream emits both error and finish. jsutil.once(cb) prevents a double callback, but both paths would call batchDelete independently. Consider removing the opposing listener when one fires to avoid a redundant delete call.

Review by Claude Code

package.json

lib/api/apiUtils/object/storeObject.js

claude · 2026-03-17T16:50:33Z

Review summary: (1) Arsenal dependency pinned to a branch instead of a tag - must update to a released tag. (2) checkHashMatchMD5 JSDoc missing the new checksumStream parameter. (3) dataStore callback returns a 4th checksum arg but objectPutPart and routeBackbeat callers ignore it. -- Review by Claude Code

…bject

package.json

claude · 2026-03-17T17:26:40Z

Arsenal dependency is pinned to a branch instead of a tag, which makes builds non-reproducible. Pin to a released tag before merging.

Review by Claude Code

package.json

claude · 2026-03-17T19:07:51Z

Arsenal dependency is pinned to a feature branch instead of a release tag. Pin to a tag before merging.

Review by Claude Code

package.json

claude · 2026-03-17T19:41:05Z

Arsenal is pinned to a feature branch instead of a release tag. This must be updated to a tagged version before merging to ensure reproducible builds.

Review by Claude Code

claude · 2026-03-18T12:00:24Z

package.json

    "@hapi/joi": "^17.1.1",
    "@smithy/node-http-handler": "^3.0.0",
-    "arsenal": "git+https://github.com/scality/Arsenal#8.3.6",
+    "arsenal": "git+https://github.com/scality/Arsenal#improvement/ARSN-557-add-checksum-to-object-metadata",


Arsenal dependency is pinned to a branch (improvement/ARSN-557-add-checksum-to-object-metadata) instead of a tag. Git-based deps must pin to a tag for reproducible builds. Update this to a released tag before merging.

— Claude Code

claude · 2026-03-18T12:00:32Z

lib/routes/routeBackbeat.js

+            // ChecksumTransform. The computed value is not stored here because
+            // this is a data-only write — metadata is written separately by
+            // Backbeat, which should propagate the source object's checksum.
            backendInfo, log, (err, retrievalInfo, md5) => {


The comment says "checksum (4th arg)" but it is positioned between dataStore positional arguments, not next to the callback. This reads as if it refers to the 4th positional arg of dataStore (which is payloadLen). Move it above the callback to clarify it refers to the callback's 4th parameter.

— Claude Code

claude · 2026-03-18T12:01:21Z

Arsenal dependency is pinned to a branch instead of a tag. Must be updated to a released tag before merge.
Misleading comment placement in routeBackbeat.js (two places): the checksum 4th-arg comment sits between dataStore positional args. Move it above the callback.

Review by Claude Code

claude · 2026-03-18T12:12:03Z

package.json

    "@hapi/joi": "^17.1.1",
    "@smithy/node-http-handler": "^3.0.0",
-    "arsenal": "git+https://github.com/scality/Arsenal#8.3.6",
+    "arsenal": "git+https://github.com/scality/Arsenal#improvement/ARSN-557-add-checksum-to-object-metadata",


Arsenal is pinned to a feature branch (improvement/ARSN-557-add-checksum-to-object-metadata) instead of a release tag. This will break reproducible builds and must be updated to a tag before merging.

— Claude Code

claude · 2026-03-18T12:12:13Z

lib/api/apiUtils/object/createAndStoreObject.js

+            metadataStoreParams.checksum = { algorithm, value, type: 'FULL_OBJECT' };
+            return callback(null);
+        })
+        .catch(err => callback(err));


Double-callback risk: if callback throws inside .then(), the .catch() handler will call callback(err) again. This is the classic try/catch + callback anti-pattern but in promise form. Wrap the callback call in a process.nextTick or use a flag to guard against re-entry, or restructure to avoid mixing promises and callbacks.

— Claude Code

claude · 2026-03-18T12:12:49Z

Arsenal dependency is pinned to a feature branch instead of a release tag. Must be updated to a tagged version before merging.
- Pin to the release tag that includes the ObjectMDChecksum changes.
zeroSizeBodyChecksumCheck mixes callbacks with Promises, creating a double-callback risk: if callback throws inside .then(), the .catch() will invoke callback(err) a second time.
- Use process.nextTick inside the .then() and .catch() to break out of the promise chain, or convert to async/await with try/catch.

Review by Claude Code

claude · 2026-03-18T12:21:00Z

package.json

    "@hapi/joi": "^17.1.1",
    "@smithy/node-http-handler": "^3.0.0",
-    "arsenal": "git+https://github.com/scality/Arsenal#8.3.6",
+    "arsenal": "git+https://github.com/scality/Arsenal#improvement/ARSN-557-add-checksum-to-object-metadata",


Arsenal is pinned to a branch (improvement/ARSN-557-add-checksum-to-object-metadata) instead of a tag. Git-based deps must pin to a tag for reproducible builds — a branch ref can resolve to different commits over time.

— Claude Code

claude · 2026-03-18T12:21:25Z

Arsenal dependency is pinned to a branch instead of a tag. This must be updated to a release tag before merging for reproducible builds.

Review by Claude Code

leif-scality changed the base branch from development/9.4 to improvement/CLDSRV-863-checksums-put-object-part March 17, 2026 15:51

claude bot reviewed Mar 17, 2026

View reviewed changes

package.json Show resolved Hide resolved

claude bot reviewed Mar 17, 2026

View reviewed changes

lib/api/apiUtils/object/storeObject.js Show resolved Hide resolved

leif-scality force-pushed the improvement/CLDSRV-872-store-checksum-in-object-metadata branch from 5d6c434 to 1b5a063 Compare March 17, 2026 16:48

claude bot reviewed Mar 17, 2026

View reviewed changes

package.json Show resolved Hide resolved

claude bot reviewed Mar 17, 2026

View reviewed changes

lib/api/apiUtils/object/storeObject.js Show resolved Hide resolved

claude bot reviewed Mar 17, 2026

View reviewed changes

lib/api/apiUtils/object/storeObject.js Show resolved Hide resolved

leif-scality added 3 commits March 17, 2026 18:24

CLDSRV-872: store checksum in metadata for objects uploaded with PutO…

661e8d9

…bject

tmp bump arsenal

e0566e0

CLDSRV-872: return stored checksum in PutObject response

b80b2ad

leif-scality force-pushed the improvement/CLDSRV-872-store-checksum-in-object-metadata branch from 1b5a063 to b80b2ad Compare March 17, 2026 17:24

claude bot reviewed Mar 17, 2026

View reviewed changes

package.json Show resolved Hide resolved

CLDSRV-872: handle empty object checksum

20da702

claude bot reviewed Mar 17, 2026

View reviewed changes

package.json Show resolved Hide resolved

CLDSRV-872: fix failing test, checksum lost when restoring object

3ad3daf

claude bot reviewed Mar 17, 2026

View reviewed changes

package.json Show resolved Hide resolved

leif-scality added 2 commits March 18, 2026 12:52

CLDSRV-872: test checksums are respected in backbeat routes

a3d952d

CLDSRV-872: add missing jsdoc

e2419b7

claude bot reviewed Mar 18, 2026

View reviewed changes

fixup! CLDSRV-872: test checksums are respected in backbeat routes

3d60da3

claude bot reviewed Mar 18, 2026

View reviewed changes

fixup! CLDSRV-872: handle empty object checksum

180d940

claude bot reviewed Mar 18, 2026

View reviewed changes

Conversation

leif-scality commented Mar 17, 2026

Uh oh!

bert-e commented Mar 17, 2026

Hello leif-scality,

Uh oh!

bert-e commented Mar 17, 2026

Incorrect fix version

Uh oh!

codecov bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

claude bot commented Mar 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude bot commented Mar 17, 2026

Uh oh!

Uh oh!

claude bot commented Mar 17, 2026

Uh oh!

Uh oh!

claude bot commented Mar 17, 2026

Uh oh!

Uh oh!

claude bot commented Mar 17, 2026

Uh oh!

claude bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot commented Mar 18, 2026

Uh oh!

claude bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot commented Mar 18, 2026

Uh oh!

claude bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Mar 17, 2026 •

edited

Loading