fix: broken Content-MD5 header for S3 upload (#527)

fix: remove broken MD5 Content-MD5 header from S3 upload

The MD5 hash was computed over an already-exhausted file reader,
always producing a hash of empty content. Since Content-MD5 is
optional for S3 presigned POST uploads and the signed policy
already enforces integrity, remove it entirely.

Author: mwbrooks

internal/api/s3_upload.go

@@ -17,8 +17,6 @@ package api
 import (
 	"bytes"
 	"context"
-	"crypto/md5"
-	"encoding/base64"
 	"fmt"
 	"io"
 	"mime/multipart"
@@ -76,13 +74,6 @@ func (c *Client) UploadPackageToS3(ctx context.Context, fs afero.Fs, appID strin
 		}
 	}
 
-	md5hash := md5.New()
-	if _, err := io.Copy(md5hash, archive); err != nil {
-		return fileName, err
-	}
-
-	md5s := base64.StdEncoding.EncodeToString(md5hash.Sum(nil))
-
 	var part io.Writer
 	h := make(textproto.MIMEHeader)
 	h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="%s"; filename="%s"`, "file", fileName))
@@ -105,7 +96,6 @@ func (c *Client) UploadPackageToS3(ctx context.Context, fs afero.Fs, appID strin
 		return fileName, err
 	}
 	request.Header.Add("Content-Type", writer.FormDataContentType())
-	request.Header.Add("Content-MD5", md5s)
 	cliVersion, err := slackcontext.Version(ctx)
 	if err != nil {
 		return fileName, err

internal/api/s3_upload_test.go

@@ -67,9 +67,6 @@ func TestClient_UploadPackageToS3(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, "this is the package", string(contentBytes))
 
-		md5Header := r.Header["Content-Md5"][0]
-		require.Equal(t, "1B2M2Y8AsgTpgAmY7PhCfg==", md5Header)
-
 		w.WriteHeader(http.StatusNoContent)
 	}))
 	defer server.Close()