amadan
Merge branch 'minio-contract-github-source' into main
Merge branch 'minio-contract-github-source' into main (CI: fetch the pinned MinIO and mc from GitHub; dl.min.io serves nothing now — discussion 152)
1 file changed,
+33
−9
.amadan/ci.d/30-minio-contract+33 −9
CI passed — run details
diff --git a/.amadan/ci.d/30-minio-contract b/.amadan/ci.d/30-minio-contract| index 7cf3f8bb4..a93b0bad9 100755 |
| --- a/.amadan/ci.d/30-minio-contract |
| +++ b/.amadan/ci.d/30-minio-contract |
| @@ -20,8 +20,8 @@ |
| # .amadan/README.md used to list this job as "not ported", on the grounds |
| # that it starts MinIO in Docker and amadan jobs get no container |
| # runtime. That reasoning conflated the job with its packaging. MinIO and |
| -# mc are single static Go binaries, published per-arch at pinned archive |
| -# URLs on dl.min.io, and contract_test.go only ever wanted MINIO_ENDPOINT |
| +# mc are single static Go binaries, published per-arch as release assets |
| +# (see "The source" below), and contract_test.go only ever wanted MINIO_ENDPOINT |
| # plus credentials over HTTP — it has no opinion about what is serving. |
| # So the container was never load-bearing; it was just how GitHub happens |
| # to hand you a MinIO. |
| @@ -54,17 +54,41 @@ done |
| # is the same one it downloaded. |
| # |
| # But a version string is a weaker pin than a container digest, which the |
| -# workflow got for free and a plain URL does not: |
| -# dl.min.io could serve different bytes at the same archive path and |
| -# nothing would notice. So each binary carries its sha256, verified after |
| -# download and again on every cache hit, and a mismatch refuses to run |
| -# rather than testing whatever arrived. The four digests below were taken |
| +# workflow got for free and a plain URL does not: whoever serves the file |
| +# could serve different bytes at the same path and nothing would notice. |
| +# So each binary carries its sha256, verified after download and again on |
| +# every cache hit, and a mismatch refuses to run rather than testing |
| +# whatever arrived. The four digests below were taken |
| # from upstream's own published .sha256sum files alongside each archive |
| # (and independently confirmed against the downloaded bytes) on |
| # 2026-08-23. |
| # |
| # Bump the two releases together, and re-derive all four digests when you |
| # do. |
| +# |
| +# THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every |
| +# download URL there — this pinned archive, the "latest" build, the |
| +# .sha256sum files, the archive listing — answers 410 Gone, with a notice |
| +# that the open-source MinIO Server, mc and KES are archived and no longer |
| +# served, for all community releases and hotfix builds. (The site's front |
| +# page still loads; github.com/minio/minio and minio/mc are archived too.) |
| +# |
| +# The same releases are published as GitHub release assets on those |
| +# archived repositories — attached there in April 2026, shortly before the |
| +# archive, not there from the start. The bytes are the bytes pinned here: |
| +# on 2026-09-15 all four were downloaded from GitHub and their sha256 |
| +# matched the four digests below exactly, as did GitHub's own .sha256sum |
| +# files. Those digests were taken from dl.min.io in August, so the two |
| +# sources independently agree. Only the URL moved; the pins, and what a |
| +# mismatch does, did not. |
| +# |
| +# That is a stopgap and should be read as one. An archived project's |
| +# release assets are not a promise, and there will be no further |
| +# releases — no fixes, no security updates. The durable answers are a |
| +# copy of these four files somewhere this deployment controls (the |
| +# digests make any copy as trustworthy as the original), or a different |
| +# S3-compatible server for this contract, which is a larger decision: the |
| +# test exists to prove IAM-policy behaviour against a real server. |
| MINIO_RELEASE=RELEASE.2025-09-07T16-13-09Z |
| MC_RELEASE=RELEASE.2025-08-13T08-35-41Z |
| @@ -140,10 +164,10 @@ fetch_pinned() { |
| } |
| fetch_pinned minio \ |
| - "https://dl.min.io/server/minio/release/linux-$arch/archive/minio.$MINIO_RELEASE" \ |
| + "https://github.com/minio/minio/releases/download/$MINIO_RELEASE/minio.linux-$arch.$MINIO_RELEASE" \ |
| "$minio_sha" "$cache/minio" |
| fetch_pinned mc \ |
| - "https://dl.min.io/client/mc/release/linux-$arch/archive/mc.$MC_RELEASE" \ |
| + "https://github.com/minio/mc/releases/download/$MC_RELEASE/mc.linux-$arch.$MC_RELEASE" \ |
| "$mc_sha" "$cache/mc" |
| minio=$cache/minio |