Fix when_required mode for request_checksum_calculation (#3307)

Author: jterapin

gems/aws-sdk-core/CHANGELOG.md

@@ -1,6 +1,8 @@
 Unreleased Changes
 ------------------
 
+* Issue - Fix `request_checksum_calculation` `when_required` mode to only calculate checksums when explicitly provided by user.
+
 * Issue - Add `CREDENTIALS_CODE` metric for `static_profile_` prefixed methods in default credential chain.
 
 3.233.0 (2025-09-23)

gems/aws-sdk-core/lib/aws-sdk-core/plugins/checksum_algorithm.rb

@@ -190,7 +190,6 @@ def call(context)
               name: "x-amz-checksum-#{algorithm.downcase}",
               request_algorithm_header: request_algorithm_header(context)
             }
-
             context[:http_checksum][:request_algorithm] = request_algorithm
             calculate_request_checksum(context, request_algorithm)
           end
@@ -249,6 +248,7 @@ def request_algorithm_selection(context)
           return unless context.operation.http_checksum
 
           input_member = context.operation.http_checksum['requestAlgorithmMember']
+
           context.params[input_member.to_sym] ||= DEFAULT_CHECKSUM if input_member
         end
 
@@ -271,25 +271,39 @@ def operation_response_algorithms(context)
           context.operation.http_checksum['responseAlgorithms']
         end
 
-        def checksum_required?(context)
-          (http_checksum = context.operation.http_checksum) &&
-            (checksum_required = http_checksum['requestChecksumRequired']) &&
-            (checksum_required && context.config.request_checksum_calculation == 'when_required')
-        end
-
-        def checksum_optional?(context)
-          context.operation.http_checksum &&
-            context.config.request_checksum_calculation != 'when_required'
-        end
-
         def checksum_provided_as_header?(headers)
           headers.any? { |k, _| k.start_with?('x-amz-checksum-') }
         end
 
+        # Determines whether a request checksum should be calculated.
+        # 1. **No existing checksum in header**: Skips if checksum header already present
+        # 2. **Operation support**: Considers model, client configuration and user input.
         def should_calculate_request_checksum?(context)
           !checksum_provided_as_header?(context.http_request.headers) &&
-            request_algorithm_selection(context) &&
-            (checksum_required?(context) || checksum_optional?(context))
+            checksum_applicable?(context)
+        end
+
+        # Checks if checksum calculation should proceed based on operation requirements and client settings.
+        # Returns true when any of these conditions are met:
+        # 1. http checksum's requestChecksumRequired is true
+        # 2. Config for request_checksum_calculation is "when_supported"
+        # 3. Config for request_checksum_calculation is "when_required" AND user provided checksum algorithm
+        def checksum_applicable?(context)
+          http_checksum = context.operation.http_checksum
+          return false unless http_checksum
+
+          return true if http_checksum['requestChecksumRequired']
+
+          return false unless (algorithm_member = http_checksum['requestAlgorithmMember'])
+
+          case context.config.request_checksum_calculation
+          when 'when_supported'
+            true
+          when 'when_required'
+            !context.params[algorithm_member.to_sym].nil?
+          else
+            false
+          end
         end
 
         def choose_request_algorithm!(context)

gems/aws-sdk-core/spec/aws/plugins/checksum_algorithm_spec.rb

@@ -47,7 +47,7 @@ module Plugins
             'String' => { 'type' => 'string' },
             'ChecksumAlgorithm' => {
               'type' => 'string',
-              'enum' => ['CRC32', 'CRC32C', 'CRC64NVME', 'SHA1', 'SHA256']
+              'enum' => %w[CRC32 CRC32C CRC64NVME SHA1 SHA256]
             },
             'SomeInput' => {
               'type' => 'structure',
@@ -405,6 +405,16 @@ module Plugins
           expect(resp.context.http_request.headers['x-amz-checksum-crc32'])
             .to be_nil
         end
+
+        it 'when_required; given algorithm; include a checksum' do
+          client = checksum_client.new(
+            stub_responses: true,
+            request_checksum_calculation: 'when_required'
+          )
+          resp = client.http_checksum_operation(checksum_algorithm: 'CRC32')
+          expect(resp.context.http_request.headers['x-amz-checksum-crc32'])
+            .to eq('AAAAAA==')
+        end
       end
 
       context 'when checksums are required' do

gems/aws-sdk-s3/CHANGELOG.md

@@ -1,6 +1,8 @@
 Unreleased Changes
 ------------------
 
+* Issue - Fix multipart upload to respect `request_checksum_calculation` `when_required` mode.
+
 1.200.0 (2025-10-15)
 ------------------
 

gems/aws-sdk-s3/lib/aws-sdk-s3/multipart_file_uploader.rb

@@ -51,11 +51,10 @@ def initiate_upload(options)
 
       def complete_upload(upload_id, parts, file_size, options)
         @client.complete_multipart_upload(
-          **complete_opts(options).merge(
-            upload_id: upload_id,
-            multipart_upload: { parts: parts },
-            mpu_object_size: file_size
-          )
+          **complete_opts(options),
+          upload_id: upload_id,
+          multipart_upload: { parts: parts },
+          mpu_object_size: file_size
         )
       rescue StandardError => e
         abort_upload(upload_id, options, [e])
@@ -79,8 +78,8 @@ def abort_upload(upload_id, options, errors)
       rescue MultipartUploadError => e
         raise e
       rescue StandardError => e
-        msg = "failed to abort multipart upload: #{e.message}. "\
-          "Multipart upload failed: #{errors.map(&:message).join('; ')}"
+        msg = "failed to abort multipart upload: #{e.message}. " \
+              "Multipart upload failed: #{errors.map(&:message).join('; ')}"
         raise MultipartUploadError.new(msg, errors + [e])
       end
 
@@ -113,8 +112,15 @@ def has_checksum_key?(keys)
         keys.any? { |key| checksum_key?(key) }
       end
 
+      def checksum_not_required?(options)
+        @client.config.request_checksum_calculation == 'when_required' && !options[:checksum_algorithm]
+      end
+
       def create_opts(options)
-        opts = { checksum_algorithm: Aws::Plugins::ChecksumAlgorithm::DEFAULT_CHECKSUM }
+        opts = {}
+        unless checksum_not_required?(options)
+          opts[:checksum_algorithm] = Aws::Plugins::ChecksumAlgorithm::DEFAULT_CHECKSUM
+        end
         opts[:checksum_type] = 'FULL_OBJECT' if has_checksum_key?(options.keys)
         CREATE_OPTIONS.each_with_object(opts) { |k, h| h[k] = options[k] if options.key?(k) }
       end
@@ -148,9 +154,7 @@ def upload_with_executor(pending, completed, options)
             resp = @client.upload_part(p)
             p[:body].close
             completed_part = { etag: resp.etag, part_number: p[:part_number] }
-            algorithm = resp.context.params[:checksum_algorithm].downcase
-            k = "checksum_#{algorithm}".to_sym
-            completed_part[k] = resp.send(k)
+            apply_part_checksum(resp, completed_part)
             completed.push(completed_part)
           rescue StandardError => e
             abort_upload = true
@@ -164,6 +168,13 @@ def upload_with_executor(pending, completed, options)
         errors
       end
 
+      def apply_part_checksum(resp, part)
+        return unless (checksum = resp.context.params[:checksum_algorithm])
+
+        k = :"checksum_#{checksum.downcase}"
+        part[k] = resp.send(k)
+      end
+
       def compute_default_part_size(file_size)
         [(file_size.to_f / MAX_PARTS).ceil, MIN_PART_SIZE].max.to_i
       end