fix(aws): silence aws-sdk-go-v2 "no supported checksum" warnings on s…#343
Open
universe-ops wants to merge 1 commit into
Open
fix(aws): silence aws-sdk-go-v2 "no supported checksum" warnings on s…#343universe-ops wants to merge 1 commit into
universe-ops wants to merge 1 commit into
Conversation
…tate reads aws-sdk-go-v2 (v1.42.0) defaults ResponseChecksumValidation to "when_supported", so the DIY backend's in-process s3blob client tries to validate a checksum on every S3 GET. Pulumi state objects stored without a checksum (all pre-existing state) make the SDK emit a noisy "Response has no supported checksum. Not validating response payload" WARN per object. Force "when_required" for both request calculation and response validation in the AWS state-store init (alongside the creds we already inject there, before diy.Login opens the bucket). config.LoadDefaultConfig honors these env vars, so checksums are only touched when an operation requires them — no behavior change, just silence. Mirrors the GCS compatibility settings in gcp/bucket.go. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
universe-ops
requested review from
Cre-eD,
Laboratory and
smecsia
as code owners
Security Scan ResultsRepository:
Scanned at 2026-06-25 10:22 UTC |
📊 Statement coverageMeasured on the documented included set (see
Baseline: |
Semgrep Scan ResultsRepository:
Scanned at 2026-06-25 10:23 UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
aws-sdk-go-v2 (v1.42.0) defaults ResponseChecksumValidation to "when_supported", so the DIY backend's in-process s3blob client tries to validate a checksum on every S3 GET. Pulumi state objects stored without a checksum (all pre-existing state) make the SDK emit a noisy "Response has no supported checksum. Not validating response payload" WARN per object.
Force "when_required" for both request calculation and response validation in the AWS state-store init (alongside the creds we already inject there, before diy.Login opens the bucket). config.LoadDefaultConfig honors these env vars, so checksums are only touched when an operation requires them — no behavior change, just silence. Mirrors the GCS compatibility settings in gcp/bucket.go.