fix(s3): allow Object Lock on versioned buckets and reject invalid checksums (#2024)

crates/rio/src/checksum.rs

@@ -546,7 +546,26 @@ pub fn get_content_checksum(headers: &HeaderMap) -> Result<Option<Checksum>, std
         return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "Invalid checksum"));
     }
 
+    if checksum_type == ChecksumType::INVALID {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            crate::errors::ChecksumMismatch {
+                want: "valid checksum header".to_string(),
+                got: "invalid or duplicate checksum headers".to_string(),
+            },
+        ));
+    }
+
     let checksum = Checksum::new_with_type(checksum_type, &value);
+    if checksum.is_none() && !value.is_empty() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            crate::errors::ChecksumMismatch {
+                want: value,
+                got: "invalid checksum value".to_string(),
+            },
+        ));
+    }
     Ok(checksum)
 }