hash and etag

internal/hash

internal/hash/
├── checksum.go, checksum_test.go     # AWS-style request checksums (SHA-256, CRC32C, ...)
├── reader.go, reader_test.go         # io.Reader that hashes as bytes flow through
├── reader_norace_test.go
├── errors.go
└── sha256/                           # Standalone sha256 wrapper (selectable impl)

Most of the code is in reader.go: a streaming reader that computes one or more hashes inline, used during PUT to verify the client checksum without an extra pass. The checksum.go file knows about the AWS-style x-amz-checksum-* headers (CRC32, CRC32C, SHA-1, SHA-256). A custom SHA-256 wrapper at internal/hash/sha256/ lets the build select between Go's crypto/sha256 and an accelerated implementation when available.

internal/etag

internal/etag/
├── etag.go
└── reader.go

ETag arithmetic for multipart uploads (an ETag of N parts is MD5(MD5(part1)|MD5(part2)|...)-N) and for SSE-encrypted objects (the ETag is a wrapped value, not the raw hash). The reader.go wraps a payload reader to produce the right ETag at completion.

Why these are separate from crypto/

• hash/ is pure CPU work, no key material involved.
• etag/ exists to keep the multipart math in one place; it depends only on internal/hash/.

Integration points

• cmd/object-handlers.go uses hash.NewReader on every PUT to verify checksums and capture the ETag.
• cmd/object-multipart-handlers.go uses etag.Multipart to compute completion ETags.
• The data scanner (cmd/data-scanner.go) uses hash to verify bitrot during sweeps when configured.

Entry points for modification

• New checksum algorithm. Extend internal/hash/checksum.go with the new algorithm. Watch for AWS naming compatibility.
• ETag rewrite. internal/etag/etag.go is the single place; touch carefully because external clients expect specific opaque values.