amadan
ci: fetch the pinned MinIO and mc from GitHub — dl.min.io serves nothing now
30-minio-contract failed on every branch with curl exit 22. dl.min.io now answers 410 Gone for every community artifact — this pinned archive, the latest build, the .sha256sum files, the listing — with a notice that the open-source MinIO Server, mc and KES are archived and no longer served. github.com/minio/minio is archived as well. There is nothing to bump to, so the pins do not move. The same releases are still published as GitHub release assets on the archived repositories, and they are the same bytes: on 2026-09-15 all four (minio and mc, amd64 and arm64) were downloaded from GitHub and hashed, and each matched its pinned digest exactly, as did GitHub's own .sha256sum files. Only the two URLs change. The digest check still runs on every download and cache hit, so a source serving anything else still refuses to run. The whole step was run locally on amd64 against the new URLs: both downloads verified, MinIO healthy, TestDeliveredContractMinio PASS. The header now records why the source moved and says plainly that this is a stopgap: an archived project's release assets are not a promise and there will be no further releases. The durable answers — a copy of the four files somewhere this deployment controls, or a different S3-compatible server for the contract — are recorded there for whoever picks this up. Discussion 152.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+26
−7
.amadan/ci.d/30-minio-contract+26 −7
CI passed — run details
diff --git a/.amadan/ci.d/30-minio-contract b/.amadan/ci.d/30-minio-contract| index 7cf3f8bb4..be285d73d 100755 |
| --- a/.amadan/ci.d/30-minio-contract |
| +++ b/.amadan/ci.d/30-minio-contract |
| @@ -20,8 +20,8 @@ |
| # .amadan/README.md used to list this job as "not ported", on the grounds |
| # that it starts MinIO in Docker and amadan jobs get no container |
| # runtime. That reasoning conflated the job with its packaging. MinIO and |
| -# mc are single static Go binaries, published per-arch at pinned archive |
| -# URLs on dl.min.io, and contract_test.go only ever wanted MINIO_ENDPOINT |
| +# mc are single static Go binaries, published per-arch as release assets |
| +# (see "The source" below), and contract_test.go only ever wanted MINIO_ENDPOINT |
| # plus credentials over HTTP — it has no opinion about what is serving. |
| # So the container was never load-bearing; it was just how GitHub happens |
| # to hand you a MinIO. |
| @@ -54,9 +54,8 @@ done |
| # is the same one it downloaded. |
| # |
| # But a version string is a weaker pin than a container digest, which the |
| -# workflow got for free and a plain URL does not: |
| -# dl.min.io could serve different bytes at the same archive path and |
| -# nothing would notice. So each binary carries its sha256, verified after |
| +# workflow got for free and a plain URL does not: whoever serves the file |
| +# could serve different bytes at the same path and nothing would notice. So each binary carries its sha256, verified after |
| # download and again on every cache hit, and a mismatch refuses to run |
| # rather than testing whatever arrived. The four digests below were taken |
| # from upstream's own published .sha256sum files alongside each archive |
| @@ -65,6 +64,26 @@ done |
| # |
| # Bump the two releases together, and re-derive all four digests when you |
| # do. |
| +# |
| +# THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every URL |
| +# there — this pinned archive, the "latest" build, the .sha256sum files, |
| +# the archive listing — answers 410 Gone, with a notice that the |
| +# open-source MinIO Server, mc and KES are archived and no longer served, |
| +# for all community releases. (github.com/minio/minio is archived too.) |
| +# The same releases are still published as GitHub release assets on the |
| +# archived repositories, and the bytes there are the bytes pinned here: |
| +# on 2026-09-15 all four were downloaded from GitHub and their sha256 |
| +# matched the four digests below exactly, as did GitHub's own .sha256sum |
| +# files. So only the URL moved; the pins, and what a mismatch does, did |
| +# not. |
| +# |
| +# That is a stopgap and should be read as one. An archived project's |
| +# release assets are not a promise, and there will be no further |
| +# releases — no fixes, no security updates. The durable answers are a |
| +# copy of these four files somewhere this deployment controls (the |
| +# digests make any copy as trustworthy as the original), or a different |
| +# S3-compatible server for this contract, which is a larger decision: the |
| +# test exists to prove IAM-policy behaviour against a real server. |
| MINIO_RELEASE=RELEASE.2025-09-07T16-13-09Z |
| MC_RELEASE=RELEASE.2025-08-13T08-35-41Z |
| @@ -140,10 +159,10 @@ fetch_pinned() { |
| } |
| fetch_pinned minio \ |
| - "https://dl.min.io/server/minio/release/linux-$arch/archive/minio.$MINIO_RELEASE" \ |
| + "https://github.com/minio/minio/releases/download/$MINIO_RELEASE/minio.linux-$arch.$MINIO_RELEASE" \ |
| "$minio_sha" "$cache/minio" |
| fetch_pinned mc \ |
| - "https://dl.min.io/client/mc/release/linux-$arch/archive/mc.$MC_RELEASE" \ |
| + "https://github.com/minio/mc/releases/download/$MC_RELEASE/mc.linux-$arch.$MC_RELEASE" \ |
| "$mc_sha" "$cache/mc" |
| minio=$cache/minio |