carlos / platform Public

CI: fetch the pinned MinIO and mc from GitHub, because dl.min.io serves nothing now. Fixes discussion 152.

30-minio-contract fails on every branch (curl exit 22). dl.min.io answers 410 Gone for all community releases — the pinned archive, the latest build, the checksums, the listing — with a notice that open-source MinIO Server, mc and KES are archived. github.com/minio/minio is archived too. So there's nothing newer to pin to.

The pins don't move; only the URL does. The same releases are still GitHub release assets on the archived repos, and they're the same bytes: all four binaries (minio + mc, amd64 + arm64) were downloaded from GitHub on 2026-09-15 and each sha256 matched the digest already pinned in the script, as did GitHub's own .sha256sum files. The digest check still runs on every download and cache hit.

Verified: the whole step run locally on amd64 with the new URLs — both digests verified, MinIO healthy, TestDeliveredContractMinio PASS. CI on this branch runs it on the arm64 runner.

This is a stopgap, and the script header now says so: an archived project's release assets aren't a promise, and there'll be no more releases or security fixes. Durable options, recorded for later: keep a copy of the four files somewhere the deployment controls (the digests make any copy trustworthy), or move the contract test to a maintained S3-compatible server — a bigger call, since the test exists to prove IAM-policy behaviour against a real server.