From 341591a10b91361da221ca09a15eab7f25977cbf Mon Sep 17 00:00:00 2001 From: jedarden Date: Thu, 30 Apr 2026 10:35:00 -0400 Subject: [PATCH] fix(worker): disable SDK checksum trailer for R2 uploads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AWS SDK Go v2 s3 v1.100.0 defaults to RequestChecksumCalculationWhenSupported, which causes PutObject to send STREAMING-UNSIGNED-PAYLOAD-TRAILER — a chunked transfer mode R2 doesn't support. Setting WhenRequired makes the SDK send a standard signed payload instead, resolving the 403 SignatureDoesNotMatch. Co-Authored-By: Claude Sonnet 4.6 --- cmd/acb-worker/b2.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cmd/acb-worker/b2.go b/cmd/acb-worker/b2.go index 8445405..807b7b5 100644 --- a/cmd/acb-worker/b2.go +++ b/cmd/acb-worker/b2.go @@ -36,6 +36,11 @@ func NewR2Client(cfg *Config) *B2Client { client := s3.NewFromConfig(awsCfg, func(o *s3.Options) { o.BaseEndpoint = aws.String(cfg.R2Endpoint) o.UsePathStyle = true + // R2 rejects STREAMING-UNSIGNED-PAYLOAD-TRAILER (SDK default for PutObject). + // WhenRequired disables automatic checksum calculation so the SDK sends a + // standard signed payload instead. + o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired + o.ResponseChecksumValidation = aws.ResponseChecksumValidationWhenRequired }) return &B2Client{