snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

test/s3/checksum/.gitignore

@@ -0,0 +1,3 @@
+test-volume-data/
+weed-test.log
+weed-server.pid

test/s3/checksum/Makefile

@@ -0,0 +1,100 @@
+# S3 Checksum Integration Tests
+# Covers flexible-checksum behavior on presigned uploads and multipart copy.
+
+.PHONY: help build-weed check-deps start-server stop-server test test-with-server logs clean health-check
+
+WEED_BINARY := ../../../weed/weed_binary
+S3_PORT := 8333
+ACCESS_KEY ?= some_access_key1
+SECRET_KEY ?= some_secret_key1
+TEST_TIMEOUT := 10m
+TEST_PATTERN ?= .
+SERVER_DIR := ./test-volume-data/server-data
+
+help:
+	@echo "S3 Checksum Integration Tests"
+	@echo ""
+	@echo "Targets:"
+	@echo "  build-weed         Build the SeaweedFS binary"
+	@echo "  start-server       Start a local SeaweedFS S3 server for testing"
+	@echo "  stop-server        Stop the local SeaweedFS server"
+	@echo "  test               Run checksum tests (server must already be running)"
+	@echo "  test-with-server   Start server, run tests, stop server"
+	@echo "  logs               Tail server log"
+	@echo "  clean              Remove test artifacts"
+
+build-weed:
+	@echo "Building SeaweedFS binary..."
+	@cd ../../../weed && go build -o weed_binary .
+	@chmod +x $(WEED_BINARY)
+
+check-deps: build-weed
+	@command -v go >/dev/null 2>&1 || (echo "Go is required but not installed" && exit 1)
+	@test -f $(WEED_BINARY) || (echo "SeaweedFS binary not found at $(WEED_BINARY)" && exit 1)
+	@go list -m github.com/aws/aws-sdk-go-v2 >/dev/null 2>&1 || (echo "AWS SDK Go v2 not found. Run 'go mod tidy'." && exit 1)
+	@go list -m github.com/stretchr/testify >/dev/null 2>&1 || (echo "Testify not found. Run 'go mod tidy'." && exit 1)
+
+start-server: check-deps
+	@echo "Starting SeaweedFS server..."
+	@rm -f weed-server.pid
+	@mkdir -p $(SERVER_DIR)
+	@AWS_ACCESS_KEY_ID=$(ACCESS_KEY) AWS_SECRET_ACCESS_KEY=$(SECRET_KEY) $(WEED_BINARY) mini \
+		-dir=$(SERVER_DIR) \
+		-s3.port=$(S3_PORT) \
+		> weed-test.log 2>&1 & \
+		echo $$! > weed-server.pid
+	@for i in $$(seq 1 90); do \
+		if curl -s http://localhost:$(S3_PORT) >/dev/null 2>&1; then \
+			echo "✅ SeaweedFS server started on port $(S3_PORT) after $$i seconds"; \
+			exit 0; \
+		fi; \
+		sleep 1; \
+	done; \
+	echo "❌ Server failed to start within 90 seconds"; \
+	if [ -f weed-server.pid ]; then \
+		PID=$$(cat weed-server.pid); \
+		if ps -p $$PID >/dev/null 2>&1; then \
+			kill -TERM $$PID 2>/dev/null || true; \
+			sleep 1; \
+			ps -p $$PID >/dev/null 2>&1 && kill -KILL $$PID 2>/dev/null || true; \
+		fi; \
+		rm -f weed-server.pid; \
+	fi; \
+	if [ -f weed-test.log ]; then tail -100 weed-test.log; fi; \
+	exit 1
+
+stop-server:
+	@if [ -f weed-server.pid ]; then \
+		PID=$$(cat weed-server.pid); \
+		if ps -p $$PID >/dev/null 2>&1; then \
+			kill -TERM $$PID 2>/dev/null || true; \
+			sleep 2; \
+			ps -p $$PID >/dev/null 2>&1 && kill -KILL $$PID 2>/dev/null || true; \
+		fi; \
+		rm -f weed-server.pid; \
+	fi
+	@echo "✅ SeaweedFS server stopped"
+
+test: check-deps
+	@echo "Running checksum tests (pattern: $(TEST_PATTERN))..."
+	@S3_ENDPOINT=http://localhost:$(S3_PORT) \
+		S3_ACCESS_KEY=$(ACCESS_KEY) \
+		S3_SECRET_KEY=$(SECRET_KEY) \
+		go test -v -timeout=$(TEST_TIMEOUT) -run "$(TEST_PATTERN)" .
+
+test-with-server: start-server
+	@sleep 3
+	@$(MAKE) test || (echo "Tests failed, stopping server..." && $(MAKE) stop-server && exit 1)
+	@$(MAKE) stop-server
+	@echo "✅ Checksum tests completed"
+
+logs:
+	@if [ -f weed-test.log ]; then tail -f weed-test.log; else echo "No log file"; fi
+
+health-check:
+	@curl -s http://localhost:$(S3_PORT) >/dev/null 2>&1 && echo "✅ S3 on $(S3_PORT)" || (echo "❌ S3 not up" && exit 1)
+
+clean:
+	@$(MAKE) stop-server
+	@rm -f weed-test.log weed-server.pid
+	@rm -rf ./test-volume-data

test/s3/checksum/s3_checksum_multipart_test.go

@@ -0,0 +1,249 @@
+package checksum_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/stretchr/testify/require"
+)
+
+// newTrailerChecksumClient returns a client that can send flexible checksums.
+// aws-sdk-go-v2 sends them as unsigned streaming trailers, which it refuses over
+// plain HTTP, so front the HTTP endpoint with a TLS proxy.
+func newTrailerChecksumClient(t *testing.T) *s3.Client {
+	t.Helper()
+
+	target, err := url.Parse(defaultConfig.Endpoint)
+	require.NoError(t, err)
+
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	server := httptest.NewTLSServer(proxy)
+	t.Cleanup(server.Close)
+
+	cfg, err := config.LoadDefaultConfig(context.Background(),
+		config.WithRegion(defaultConfig.Region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			defaultConfig.AccessKey, defaultConfig.SecretKey, "")),
+		config.WithHTTPClient(server.Client()),
+	)
+	require.NoError(t, err)
+	return s3.NewFromConfig(cfg, func(o *s3.Options) {
+		o.BaseEndpoint = aws.String(server.URL)
+		o.UsePathStyle = true
+	})
+}
+
+func TestMultipartCopyPreservesChecksum(t *testing.T) {
+	client := newTrailerChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	cases := []struct {
+		algorithm types.ChecksumAlgorithm
+		srcSum    func(*s3.PutObjectOutput) *string
+		partSum   func(*types.CopyPartResult) *string
+		setPart   func(*types.CompletedPart, *string)
+	}{
+		{
+			algorithm: types.ChecksumAlgorithmCrc32,
+			srcSum:    func(o *s3.PutObjectOutput) *string { return o.ChecksumCRC32 },
+			partSum:   func(r *types.CopyPartResult) *string { return r.ChecksumCRC32 },
+			setPart:   func(p *types.CompletedPart, v *string) { p.ChecksumCRC32 = v },
+		},
+		{
+			algorithm: types.ChecksumAlgorithmCrc32c,
+			srcSum:    func(o *s3.PutObjectOutput) *string { return o.ChecksumCRC32C },
+			partSum:   func(r *types.CopyPartResult) *string { return r.ChecksumCRC32C },
+			setPart:   func(p *types.CompletedPart, v *string) { p.ChecksumCRC32C = v },
+		},
+		{
+			algorithm: types.ChecksumAlgorithmCrc64nvme,
+			srcSum:    func(o *s3.PutObjectOutput) *string { return o.ChecksumCRC64NVME },
+			partSum:   func(r *types.CopyPartResult) *string { return r.ChecksumCRC64NVME },
+			setPart:   func(p *types.CompletedPart, v *string) { p.ChecksumCRC64NVME = v },
+		},
+		{
+			algorithm: types.ChecksumAlgorithmSha1,
+			srcSum:    func(o *s3.PutObjectOutput) *string { return o.ChecksumSHA1 },
+			partSum:   func(r *types.CopyPartResult) *string { return r.ChecksumSHA1 },
+			setPart:   func(p *types.CompletedPart, v *string) { p.ChecksumSHA1 = v },
+		},
+		{
+			algorithm: types.ChecksumAlgorithmSha256,
+			srcSum:    func(o *s3.PutObjectOutput) *string { return o.ChecksumSHA256 },
+			partSum:   func(r *types.CopyPartResult) *string { return r.ChecksumSHA256 },
+			setPart:   func(p *types.CompletedPart, v *string) { p.ChecksumSHA256 = v },
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(string(tc.algorithm), func(t *testing.T) {
+			sourceKey := "source-" + string(tc.algorithm)
+			source, err := client.PutObject(context.Background(), &s3.PutObjectInput{
+				Bucket:            aws.String(bucket),
+				Key:               aws.String(sourceKey),
+				Body:              bytes.NewBufferString("trailing checksum"),
+				ChecksumAlgorithm: tc.algorithm,
+			})
+			require.NoError(t, err)
+
+			key := "multipart-copy-" + string(tc.algorithm)
+			create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+				Bucket:            aws.String(bucket),
+				Key:               aws.String(key),
+				ChecksumAlgorithm: tc.algorithm,
+			})
+			require.NoError(t, err)
+
+			part, err := client.UploadPartCopy(context.Background(), &s3.UploadPartCopyInput{
+				Bucket:     aws.String(bucket),
+				CopySource: aws.String(fmt.Sprintf("%s/%s", bucket, sourceKey)),
+				Key:        aws.String(key),
+				UploadId:   create.UploadId,
+				PartNumber: aws.Int32(1),
+			})
+			require.NoError(t, err)
+			require.Equal(t, aws.ToString(tc.srcSum(source)), aws.ToString(tc.partSum(part.CopyPartResult)))
+
+			completed := types.CompletedPart{ETag: part.CopyPartResult.ETag, PartNumber: aws.Int32(1)}
+			tc.setPart(&completed, tc.partSum(part.CopyPartResult))
+			_, err = client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+				Bucket:          aws.String(bucket),
+				Key:             aws.String(key),
+				UploadId:        create.UploadId,
+				MultipartUpload: &types.CompletedMultipartUpload{Parts: []types.CompletedPart{completed}},
+			})
+			require.NoError(t, err)
+		})
+	}
+}
+
+// A multipart upload that asked for a checksum must report it in the
+// CompleteMultipartUpload response, alongside the algorithm and type that
+// CreateMultipartUpload echoed back.
+func TestMultipartUploadReturnsObjectChecksum(t *testing.T) {
+	client := newTrailerChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	cases := []struct {
+		algorithm    types.ChecksumAlgorithm
+		expectedType types.ChecksumType
+		completeSum  func(*s3.CompleteMultipartUploadOutput) *string
+		headSum      func(*s3.HeadObjectOutput) *string
+		partSum      func(*s3.UploadPartOutput) *string
+		setPart      func(*types.CompletedPart, *string)
+	}{
+		{
+			algorithm:    types.ChecksumAlgorithmCrc32,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC32 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC32 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC32 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC32 = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmCrc32c,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC32C },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC32C },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC32C },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC32C = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmCrc64nvme,
+			expectedType: types.ChecksumTypeFullObject,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC64NVME },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC64NVME },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC64NVME },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC64NVME = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmSha1,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumSHA1 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumSHA1 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumSHA1 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumSHA1 = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmSha256,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumSHA256 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumSHA256 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumSHA256 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumSHA256 = v },
+		},
+	}
+
+	// Every part but the last has to reach the 5MB multipart minimum.
+	parts := [][]byte{bytes.Repeat([]byte("a"), 5*1024*1024), []byte("tail")}
+
+	for _, tc := range cases {
+		t.Run(string(tc.algorithm), func(t *testing.T) {
+			key := "multipart-" + string(tc.algorithm)
+			create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+				Bucket:            aws.String(bucket),
+				Key:               aws.String(key),
+				ChecksumAlgorithm: tc.algorithm,
+			})
+			require.NoError(t, err)
+			require.Equal(t, tc.algorithm, create.ChecksumAlgorithm)
+			require.Equal(t, tc.expectedType, create.ChecksumType)
+
+			var completed []types.CompletedPart
+			for i, data := range parts {
+				part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+					Bucket:            aws.String(bucket),
+					Key:               aws.String(key),
+					UploadId:          create.UploadId,
+					PartNumber:        aws.Int32(int32(i + 1)),
+					Body:              bytes.NewReader(data),
+					ChecksumAlgorithm: tc.algorithm,
+				})
+				require.NoError(t, err)
+				require.NotEmpty(t, aws.ToString(tc.partSum(part)))
+
+				entry := types.CompletedPart{ETag: part.ETag, PartNumber: aws.Int32(int32(i + 1))}
+				tc.setPart(&entry, tc.partSum(part))
+				completed = append(completed, entry)
+			}
+
+			done, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+				Bucket:          aws.String(bucket),
+				Key:             aws.String(key),
+				UploadId:        create.UploadId,
+				MultipartUpload: &types.CompletedMultipartUpload{Parts: completed},
+			})
+			require.NoError(t, err)
+			require.NotEmpty(t, aws.ToString(tc.completeSum(done)))
+			require.Equal(t, tc.expectedType, done.ChecksumType)
+			if tc.expectedType == types.ChecksumTypeComposite {
+				require.True(t, strings.HasSuffix(aws.ToString(tc.completeSum(done)), fmt.Sprintf("-%d", len(parts))))
+			}
+
+			head, err := client.HeadObject(context.Background(), &s3.HeadObjectInput{
+				Bucket:       aws.String(bucket),
+				Key:          aws.String(key),
+				ChecksumMode: types.ChecksumModeEnabled,
+			})
+			require.NoError(t, err)
+			require.Equal(t, aws.ToString(tc.completeSum(done)), aws.ToString(tc.headSum(head)))
+		})
+	}
+}

test/s3/checksum/s3_checksum_presigned_test.go

@@ -0,0 +1,256 @@
+package checksum_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Integration test for https://github.com/seaweedfs/seaweedfs/issues/9075:
+// presigned PUT URLs that request a flexible-checksum algorithm (SHA256, SHA1, ...)
+// must cause the server to compute and persist that checksum, and HEAD/GET must
+// return the x-amz-checksum-* header when the caller asks for it.
+//
+// AWS SDK presigners hoist headers like x-amz-sdk-checksum-algorithm into the
+// signed URL's query string, so we deliberately upload the body with a plain
+// http.Client to ensure the server sees the checksum algorithm via the query
+// string — which is exactly what a browser / curl / non-SDK client does.
+
+type s3TestConfig struct {
+	Endpoint     string
+	AccessKey    string
+	SecretKey    string
+	Region       string
+	BucketPrefix string
+}
+
+var defaultConfig = &s3TestConfig{
+	Endpoint:     "http://localhost:8333",
+	AccessKey:    "some_access_key1",
+	SecretKey:    "some_secret_key1",
+	Region:       "us-east-1",
+	BucketPrefix: "test-checksum-",
+}
+
+func getenvAny(keys ...string) string {
+	for _, k := range keys {
+		if v := os.Getenv(k); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func init() {
+	if v := getenvAny("S3_ENDPOINT"); v != "" {
+		defaultConfig.Endpoint = v
+	}
+	if v := getenvAny("S3_ACCESS_KEY", "AWS_ACCESS_KEY_ID"); v != "" {
+		defaultConfig.AccessKey = v
+	}
+	if v := getenvAny("S3_SECRET_KEY", "AWS_SECRET_ACCESS_KEY"); v != "" {
+		defaultConfig.SecretKey = v
+	}
+	if v := getenvAny("AWS_REGION", "AWS_DEFAULT_REGION"); v != "" {
+		defaultConfig.Region = v
+	}
+}
+
+// presignedHTTPClient is used for non-SDK PUTs to a presigned URL. A fixed
+// timeout keeps tests from hanging forever if the server stalls.
+var presignedHTTPClient = &http.Client{Timeout: 30 * time.Second}
+
+func getS3Client(t *testing.T) *s3.Client {
+	cfg, err := config.LoadDefaultConfig(context.TODO(),
+		config.WithRegion(defaultConfig.Region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			defaultConfig.AccessKey, defaultConfig.SecretKey, "")),
+		config.WithEndpointResolverWithOptions(aws.EndpointResolverWithOptionsFunc(
+			func(service, region string, _ ...interface{}) (aws.Endpoint, error) {
+				return aws.Endpoint{
+					URL:               defaultConfig.Endpoint,
+					SigningRegion:     defaultConfig.Region,
+					HostnameImmutable: true,
+				}, nil
+			})),
+	)
+	require.NoError(t, err)
+	return s3.NewFromConfig(cfg, func(o *s3.Options) { o.UsePathStyle = true })
+}
+
+func uniqueBucket() string {
+	return fmt.Sprintf("%s%d", defaultConfig.BucketPrefix, time.Now().UnixNano())
+}
+
+func createBucket(t *testing.T, client *s3.Client, name string) {
+	_, err := client.CreateBucket(context.TODO(), &s3.CreateBucketInput{Bucket: aws.String(name)})
+	require.NoError(t, err)
+}
+
+func cleanupBucket(t *testing.T, client *s3.Client, name string) {
+	t.Helper()
+	objs, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{Bucket: aws.String(name)})
+	if err == nil {
+		for _, o := range objs.Contents {
+			_, _ = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+				Bucket: aws.String(name), Key: o.Key,
+			})
+		}
+	}
+	_, _ = client.DeleteBucket(context.TODO(), &s3.DeleteBucketInput{Bucket: aws.String(name)})
+}
+
+// uploadViaPresignedURL PUTs body to the given presigned URL using a plain
+// http.Client, mirroring what a browser / curl / non-SDK client would do.
+// Crucially this path does NOT run any AWS SDK middleware, so the server must
+// compute and store the checksum based on the algorithm parameter that was
+// hoisted into the query string by the presigner.
+//
+// extraHeaders are additional HTTP headers the presigner signed (e.g.
+// Content-MD5). Their values must exactly match what was signed or SigV4
+// verification will return SignatureDoesNotMatch.
+func uploadViaPresignedURL(t *testing.T, url string, body []byte, extraHeaders map[string]string) {
+	t.Helper()
+	req, err := http.NewRequest(http.MethodPut, url, bytes.NewReader(body))
+	require.NoError(t, err)
+	req.ContentLength = int64(len(body))
+	for k, v := range extraHeaders {
+		req.Header.Set(k, v)
+	}
+	resp, err := presignedHTTPClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	respBody, err := io.ReadAll(resp.Body)
+	require.NoError(t, err, "read presigned PUT response body")
+	require.Equalf(t, http.StatusOK, resp.StatusCode,
+		"presigned PUT failed: %d %s", resp.StatusCode, string(respBody))
+}
+
+// presignPutURL builds a presigned S3 PutObject URL using the low-level
+// SigV4 presigner, with an optional x-amz-sdk-checksum-algorithm query
+// parameter baked into the signed canonical query string.
+//
+// We use the raw signer instead of s3.PresignClient because the SDK's
+// flexible-checksum middleware tries to inject a Content-MD5 header for
+// flexible-checksum PutObject calls, and at presign time (no body) it seeds
+// MD5-of-empty, which then mismatches any real body uploaded through a plain
+// http.Client. The raw signer has no such middleware and produces exactly
+// the kind of URL a browser, curl caller, or custom client would receive.
+func presignPutURL(t *testing.T, bucket, key, checksumAlgorithm string) string {
+	t.Helper()
+	putURL, err := url.Parse(fmt.Sprintf("%s/%s/%s", strings.TrimRight(defaultConfig.Endpoint, "/"), bucket, key))
+	require.NoError(t, err)
+	q := putURL.Query()
+	// PresignHTTP does not add X-Amz-Expires on its own; the caller must
+	// seed it so the signer picks it up into the canonical query string.
+	q.Set("X-Amz-Expires", "600")
+	if checksumAlgorithm != "" {
+		q.Set("x-amz-sdk-checksum-algorithm", checksumAlgorithm)
+	}
+	putURL.RawQuery = q.Encode()
+
+	req, err := http.NewRequest(http.MethodPut, putURL.String(), nil)
+	require.NoError(t, err)
+
+	signer := v4.NewSigner()
+	creds := aws.Credentials{
+		AccessKeyID:     defaultConfig.AccessKey,
+		SecretAccessKey: defaultConfig.SecretKey,
+	}
+	// For presigned URLs the AWS convention is UNSIGNED-PAYLOAD so the
+	// signer doesn't require a body-hash up front.
+	signedURL, _, err := signer.PresignHTTP(context.TODO(), creds, req,
+		"UNSIGNED-PAYLOAD", "s3", defaultConfig.Region, time.Now(),
+		func(o *v4.SignerOptions) {
+			o.DisableURIPathEscaping = true
+		})
+	require.NoError(t, err)
+	return signedURL
+}
+
+// TestPresignedPutWithChecksumSHA256 reproduces issue #9075: a presigned PUT
+// URL that carries x-amz-sdk-checksum-algorithm=SHA256 in its query string
+// must cause the object to be stored with an x-amz-checksum-sha256 attribute,
+// visible via HEAD when the caller requests ChecksumMode=ENABLED.
+func TestPresignedPutWithChecksumSHA256(t *testing.T) {
+	client := getS3Client(t)
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	key := "presigned-sha256.txt"
+	body := []byte("hello seaweedfs checksum")
+	sha256Sum := sha256.Sum256(body)
+	expected := base64.StdEncoding.EncodeToString(sha256Sum[:])
+
+	signedURL := presignPutURL(t, bucket, key, "SHA256")
+	uploadViaPresignedURL(t, signedURL, body, nil)
+
+	head, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+		Bucket:       aws.String(bucket),
+		Key:          aws.String(key),
+		ChecksumMode: types.ChecksumModeEnabled,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, head.ChecksumSHA256, "x-amz-checksum-sha256 missing from HEAD response")
+	assert.Equal(t, expected, aws.ToString(head.ChecksumSHA256),
+		"stored SHA256 does not match body")
+
+	// GET with ChecksumMode=ENABLED should also return the header and the body should match.
+	getOut, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+		Bucket:       aws.String(bucket),
+		Key:          aws.String(key),
+		ChecksumMode: types.ChecksumModeEnabled,
+	})
+	require.NoError(t, err)
+	defer getOut.Body.Close()
+	require.NotNil(t, getOut.ChecksumSHA256, "x-amz-checksum-sha256 missing from GET response")
+	assert.Equal(t, expected, aws.ToString(getOut.ChecksumSHA256))
+	got, err := io.ReadAll(getOut.Body)
+	require.NoError(t, err)
+	assert.Equal(t, body, got)
+}
+
+// TestPresignedPutWithoutChecksumAlgorithm is a negative control: when the
+// caller doesn't request a checksum algorithm, HEAD should not return one.
+func TestPresignedPutWithoutChecksumAlgorithm(t *testing.T) {
+	client := getS3Client(t)
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	key := "presigned-nosum.txt"
+	body := []byte("no checksum requested")
+
+	signedURL := presignPutURL(t, bucket, key, "")
+	uploadViaPresignedURL(t, signedURL, body, nil)
+
+	head, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+		Bucket:       aws.String(bucket),
+		Key:          aws.String(key),
+		ChecksumMode: types.ChecksumModeEnabled,
+	})
+	require.NoError(t, err)
+	assert.Nil(t, head.ChecksumSHA256)
+	assert.Nil(t, head.ChecksumSHA1)
+	assert.Nil(t, head.ChecksumCRC32)
+	assert.Nil(t, head.ChecksumCRC32C)
+}