If a checksum header is sent with an S3 API DeleteObjects POST request
then it will be verified (unlike a CompleteMultipartUpload POST) [0].
If a checksum header is not sent with an S3 API DeleteObjects POST
request then a Content-MD5 header is required. Even when not
*required* [1], a Content-MD5 value will be verified if sent.
Previously we could return 200 when we should have sent 400 (eg, when
the client sent a sha256 but no md5 or additional checksum), or return
400 when we should have sent 200 (eg, when an additional checksum was
sent with no sha256 and the auth protocol didn't require a sha256).
[0] Related-Change: Id39fd71bc59875a5b88d1d012542136acf880019
[1] Related-Change: Ifbcde9820bee72d80cab0fe3e67ea0f5817df949
Related-Bug: #2131671
Change-Id: If25a8f0a3079558544ab15c874eda666a9f69933
Signed-off-by: Alistair Coles <alistairncoles@gmail.com>
Co-authored-by: Tim Burke <tim.burke@gmail.com>
cbc3b42d7d