amadan
ci: minio-contract comments say exactly what was checked (review fixes)
From a Fable review of this branch; no change to behaviour. "Every URL there answers 410" was wider than what was tested: every download URL does, but dl.min.io's front page still loads. And "still published as GitHub release assets" read as though the binaries had always been there; they were attached in April 2026, shortly before the archive. That makes the check stronger rather than weaker — the pinned digests came from dl.min.io in August and the GitHub bytes match them independently — and the comment now says so. A 122-character line from the previous edit is rewrapped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+17
−12
.amadan/ci.d/30-minio-contract+17 −12
CI passed — run details
diff --git a/.amadan/ci.d/30-minio-contract b/.amadan/ci.d/30-minio-contract| index be285d73d..a93b0bad9 100755 |
| --- a/.amadan/ci.d/30-minio-contract |
| +++ b/.amadan/ci.d/30-minio-contract |
| @@ -55,9 +55,10 @@ done |
| # |
| # But a version string is a weaker pin than a container digest, which the |
| # workflow got for free and a plain URL does not: whoever serves the file |
| -# could serve different bytes at the same path and nothing would notice. So each binary carries its sha256, verified after |
| -# download and again on every cache hit, and a mismatch refuses to run |
| -# rather than testing whatever arrived. The four digests below were taken |
| +# could serve different bytes at the same path and nothing would notice. |
| +# So each binary carries its sha256, verified after download and again on |
| +# every cache hit, and a mismatch refuses to run rather than testing |
| +# whatever arrived. The four digests below were taken |
| # from upstream's own published .sha256sum files alongside each archive |
| # (and independently confirmed against the downloaded bytes) on |
| # 2026-08-23. |
| @@ -65,17 +66,21 @@ done |
| # Bump the two releases together, and re-derive all four digests when you |
| # do. |
| # |
| -# THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every URL |
| -# there — this pinned archive, the "latest" build, the .sha256sum files, |
| -# the archive listing — answers 410 Gone, with a notice that the |
| -# open-source MinIO Server, mc and KES are archived and no longer served, |
| -# for all community releases. (github.com/minio/minio is archived too.) |
| -# The same releases are still published as GitHub release assets on the |
| -# archived repositories, and the bytes there are the bytes pinned here: |
| +# THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every |
| +# download URL there — this pinned archive, the "latest" build, the |
| +# .sha256sum files, the archive listing — answers 410 Gone, with a notice |
| +# that the open-source MinIO Server, mc and KES are archived and no longer |
| +# served, for all community releases and hotfix builds. (The site's front |
| +# page still loads; github.com/minio/minio and minio/mc are archived too.) |
| +# |
| +# The same releases are published as GitHub release assets on those |
| +# archived repositories — attached there in April 2026, shortly before the |
| +# archive, not there from the start. The bytes are the bytes pinned here: |
| # on 2026-09-15 all four were downloaded from GitHub and their sha256 |
| # matched the four digests below exactly, as did GitHub's own .sha256sum |
| -# files. So only the URL moved; the pins, and what a mismatch does, did |
| -# not. |
| +# files. Those digests were taken from dl.min.io in August, so the two |
| +# sources independently agree. Only the URL moved; the pins, and what a |
| +# mismatch does, did not. |
| # |
| # That is a stopgap and should be read as one. An archived project's |
| # release assets are not a promise, and there will be no further |