Experiment with integrity checks

Change-type: minor

Author: otaviojacobi

lib/index.ts

@@ -10,6 +10,7 @@ import {
 	HeadObjectCommand,
 	AbortMultipartUploadCommand,
 	type StorageClass,
+	type CompleteMultipartUploadCommandInput,
 } from '@aws-sdk/client-s3';
 import { Upload } from '@aws-sdk/lib-storage';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
@@ -36,6 +37,16 @@ const normalizeHref = (href: string) => {
 	return href.split('?')[0];
 };
 
+export const supportedChecksumAlgorithms = [
+	'CRC32',
+	'CRC32C',
+	'CRC64NVME',
+] as const;
+export type SupportedChecksumAlgorithm =
+	(typeof supportedChecksumAlgorithms)[number];
+
+type ChecksumParamName = `Checksum${SupportedChecksumAlgorithm}`;
+
 export class S3Handler implements webResourceHandler.WebResourceHandler {
 	private readonly config: S3ClientConfig;
 	private readonly bucket: string;
@@ -95,6 +106,11 @@ export class S3Handler implements webResourceHandler.WebResourceHandler {
 			ContentDisposition: `inline; filename="${resource.originalname}"`,
 			StorageClass: this.storageClass,
 		};
+
+		if (resource.checksumAlgorithm != null) {
+			const headerValue = this.getS3ChecksumHeader(resource.checksumAlgorithm);
+			params[headerValue] = resource.checksum;
+		}
 		const upload = new Upload({ client: this.client, params });
 
 		upload.on('httpUploadProgress', async (ev) => {
@@ -175,15 +191,22 @@ export class S3Handler implements webResourceHandler.WebResourceHandler {
 			uploadId,
 			filename,
 			providerCommitData,
+			checksumAlgorithm,
+			checksum,
 		}: webResourceHandler.CommitMultipartUploadPayload): Promise<WebResource> => {
-			await this.client.send(
-				new CompleteMultipartUploadCommand({
-					Bucket: this.bucket,
-					Key: fileKey,
-					UploadId: uploadId,
-					MultipartUpload: providerCommitData,
-				}),
-			);
+			const params: CompleteMultipartUploadCommandInput = {
+				Bucket: this.bucket,
+				Key: fileKey,
+				UploadId: uploadId,
+				MultipartUpload: providerCommitData,
+			};
+
+			if (checksumAlgorithm != null) {
+				const headerValue = this.getS3ChecksumHeader(checksumAlgorithm);
+				params[headerValue] = checksum;
+			}
+
+			await this.client.send(new CompleteMultipartUploadCommand(params));
 
 			const headResult = await this.client.send(
 				new HeadObjectCommand({
@@ -244,6 +267,12 @@ export class S3Handler implements webResourceHandler.WebResourceHandler {
 		return `${fieldName}_${randomUUID()}`;
 	}
 
+	private getS3ChecksumHeader(
+		algorithm: SupportedChecksumAlgorithm,
+	): ChecksumParamName {
+		return `Checksum${algorithm}`;
+	}
+
 	private async getUploadParts(
 		fileKey: string,
 		uploadId: string,

package.json

@@ -19,7 +19,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@balena/lint": "^9.1.3",
-    "@balena/pinejs": "^21.3.0",
+    "@balena/pinejs": "21.6.2-build-add-integrity-check-to-webresources-0e71fb0fd93cfe4380cc23c4e8302debda126cbf-1",
     "@balena/sbvr-types": "^9.1.0",
     "@types/chai": "^5.0.1",
     "@types/chai-as-promised": "^8.0.1",
@@ -42,7 +42,7 @@
     "memoizee": "^0.4.17"
   },
   "peerDependencies": {
-    "@balena/pinejs": "^21.3.0"
+    "@balena/pinejs": "21.6.2-build-add-integrity-check-to-webresources-0e71fb0fd93cfe4380cc23c4e8302debda126cbf-1"
   },
   "versionist": {
     "publishedAt": "2025-05-26T01:49:22.588Z"