| 1 | #!/bin/sh |
| 2 | # The S3 delivered-contract gate: internal/objstore's |
| 3 | # TestDeliveredContractMinio, run against a real MinIO, with no container |
| 4 | # runtime anywhere in sight. |
| 5 | # |
| 6 | # THIS IS THE ONLY PLACE THIS TEST RUNS LIVE. It began as a port of the |
| 7 | # `minio-contract` job in .github/workflows/ci.yml, with that workflow |
| 8 | # holding the final say; the workflow has since been deleted (10-gate's |
| 9 | # header records why), so there is no longer a second run of this |
| 10 | # anywhere. If this step does not exercise the contract against a real |
| 11 | # server, nothing does — `TestDeliveredContractMinio` skips itself |
| 12 | # without CARLOS_MINIO_TEST, and a skipped test is a green test. |
| 13 | # |
| 14 | # References to "the workflow" below are provenance: they say where a |
| 15 | # choice came from and where this deliberately diverged from it. They |
| 16 | # describe a file that no longer exists. |
| 17 | # |
| 18 | # WHY THIS CAN EXIST HERE AT ALL |
| 19 | # |
| 20 | # .amadan/README.md used to list this job as "not ported", on the grounds |
| 21 | # that it starts MinIO in Docker and amadan jobs get no container |
| 22 | # runtime. That reasoning conflated the job with its packaging. MinIO and |
| 23 | # mc are single static Go binaries, published per-arch as release assets |
| 24 | # (see "The source" below), and contract_test.go only ever wanted MINIO_ENDPOINT |
| 25 | # plus credentials over HTTP — it has no opinion about what is serving. |
| 26 | # So the container was never load-bearing; it was just how GitHub happens |
| 27 | # to hand you a MinIO. |
| 28 | # |
| 29 | # Running the server as a plain process inside the job's existing |
| 30 | # bubblewrap sandbox was, if anything, tighter than the container the |
| 31 | # workflow used, and still is the tighter of the two shapes: it binds |
| 32 | # loopback only, its data directory is the job's private /tmp tmpfs, and |
| 33 | # it dies with the job's PID namespace. Nothing persists on the box. |
| 34 | set -eu |
| 35 | |
| 36 | # Fail on a missing tool by name rather than by a confusing error forty |
| 37 | # lines down. Both are present on the runner; this is here so that a |
| 38 | # stripped-down box says which one it is missing. |
| 39 | for tool in curl sha256sum; do |
| 40 | command -v "$tool" >/dev/null 2>&1 || { |
| 41 | echo "$tool is required by this step but was not found on PATH" >&2 |
| 42 | exit 1 |
| 43 | } |
| 44 | done |
| 45 | |
| 46 | # --------------------------------------------------------------------- |
| 47 | # The pins. |
| 48 | # |
| 49 | # The workflow pinned its MinIO image and its mc download, and said why: |
| 50 | # a floating minio tag has already broken this exact job class once, when |
| 51 | # mc's admin-policy syntax churned across versions. This started as a |
| 52 | # port of that pin, not an upgrade — RELEASE.2025-09-07T16-13-09Z is the |
| 53 | # same server release that image digest resolved to, and the mc release |
| 54 | # is the same one it downloaded. |
| 55 | # |
| 56 | # But a version string is a weaker pin than a container digest, which the |
| 57 | # workflow got for free and a plain URL does not: whoever serves the file |
| 58 | # could serve different bytes at the same path and nothing would notice. |
| 59 | # So each binary carries its sha256, verified after download and again on |
| 60 | # every cache hit, and a mismatch refuses to run rather than testing |
| 61 | # whatever arrived. The four digests below were taken |
| 62 | # from upstream's own published .sha256sum files alongside each archive |
| 63 | # (and independently confirmed against the downloaded bytes) on |
| 64 | # 2026-08-23. |
| 65 | # |
| 66 | # Bump the two releases together, and re-derive all four digests when you |
| 67 | # do. |
| 68 | # |
| 69 | # THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every |
| 70 | # download URL there — this pinned archive, the "latest" build, the |
| 71 | # .sha256sum files, the archive listing — answers 410 Gone, with a notice |
| 72 | # that the open-source MinIO Server, mc and KES are archived and no longer |
| 73 | # served, for all community releases and hotfix builds. (The site's front |
| 74 | # page still loads; github.com/minio/minio and minio/mc are archived too.) |
| 75 | # |
| 76 | # The same releases are published as GitHub release assets on those |
| 77 | # archived repositories — attached there in April 2026, shortly before the |
| 78 | # archive, not there from the start. The bytes are the bytes pinned here: |
| 79 | # on 2026-09-15 all four were downloaded from GitHub and their sha256 |
| 80 | # matched the four digests below exactly, as did GitHub's own .sha256sum |
| 81 | # files. Those digests were taken from dl.min.io in August, so the two |
| 82 | # sources independently agree. Only the URL moved; the pins, and what a |
| 83 | # mismatch does, did not. |
| 84 | # |
| 85 | # That is a stopgap and should be read as one. An archived project's |
| 86 | # release assets are not a promise, and there will be no further |
| 87 | # releases — no fixes, no security updates. The durable answers are a |
| 88 | # copy of these four files somewhere this deployment controls (the |
| 89 | # digests make any copy as trustworthy as the original), or a different |
| 90 | # S3-compatible server for this contract, which is a larger decision: the |
| 91 | # test exists to prove IAM-policy behaviour against a real server. |
| 92 | MINIO_RELEASE=RELEASE.2025-09-07T16-13-09Z |
| 93 | MC_RELEASE=RELEASE.2025-08-13T08-35-41Z |
| 94 | |
| 95 | # Arch-aware on purpose. The amadan runner is arm64; the workflow's |
| 96 | # ubuntu-latest was amd64, and it hardwired linux-amd64 for its mc |
| 97 | # download — harmless there, wrong here, and a bug not to carry across. |
| 98 | # The runner fleet is also the kind of thing that changes under you, so |
| 99 | # this reads uname rather than trusting a note about what the box is. |
| 100 | case "$(uname -m)" in |
| 101 | x86_64 | amd64) |
| 102 | arch=amd64 |
| 103 | minio_sha=7c5bd8512c6e966455b1d198209358b2d191c77a83ab377c4073281065fb855f |
| 104 | mc_sha=01f866e9c5f9b87c2b09116fa5d7c06695b106242d829a8bb32990c00312e891 |
| 105 | ;; |
| 106 | aarch64 | arm64) |
| 107 | arch=arm64 |
| 108 | minio_sha=5c83cd2cf151717ba0243f73e1c7802ff36e272b67144bdd7f1f7d684fd6f03d |
| 109 | mc_sha=14c8c9616cfce4636add161304353244e8de383b2e2752c0e9dad01d4c27c12c |
| 110 | ;; |
| 111 | *) |
| 112 | echo "no pinned MinIO build for $(uname -m) — add one above, do not guess" >&2 |
| 113 | exit 1 |
| 114 | ;; |
| 115 | esac |
| 116 | |
| 117 | echo "minio contract: $arch, minio $MINIO_RELEASE, mc $MC_RELEASE" |
| 118 | |
| 119 | # --------------------------------------------------------------------- |
| 120 | # The cache. |
| 121 | # |
| 122 | # amadan reuses one workspace per repo across jobs and does not clean |
| 123 | # untracked files between them by default, so an untracked directory in |
| 124 | # the checkout IS the cache — no separate cache action, no key, nothing |
| 125 | # to expire. ~140MB of binaries then downloads once per worker rather |
| 126 | # than once per run. |
| 127 | # |
| 128 | # The dot prefix is deliberate: the Go toolchain skips dot-directories |
| 129 | # when walking ./..., so this cannot leak into `go build ./...` or |
| 130 | # `go vet ./...` in 10-gate no matter what ends up inside it. The digest |
| 131 | # check below is what makes reusing the cache safe — a truncated or |
| 132 | # half-written binary from an interrupted job fails verification and is |
| 133 | # re-fetched, so a cache hit is never taken on trust. |
| 134 | cache="$PWD/.amadan-cache/minio-$arch" |
| 135 | mkdir -p "$cache" |
| 136 | |
| 137 | fetch_pinned() { |
| 138 | fp_name=$1 |
| 139 | fp_url=$2 |
| 140 | fp_want=$3 |
| 141 | fp_dest=$4 |
| 142 | |
| 143 | if [ -f "$fp_dest" ] && [ "$(sha256sum <"$fp_dest" | cut -d' ' -f1)" = "$fp_want" ]; then |
| 144 | echo " $fp_name: cached, digest verified" |
| 145 | return 0 |
| 146 | fi |
| 147 | |
| 148 | echo " $fp_name: downloading $fp_url" |
| 149 | curl -sfL --retry 3 -o "$fp_dest.part" "$fp_url" |
| 150 | |
| 151 | fp_got=$(sha256sum <"$fp_dest.part" | cut -d' ' -f1) |
| 152 | if [ "$fp_got" != "$fp_want" ]; then |
| 153 | rm -f "$fp_dest.part" |
| 154 | echo "$fp_name digest mismatch — refusing to run" >&2 |
| 155 | echo " want $fp_want" >&2 |
| 156 | echo " got $fp_got" >&2 |
| 157 | echo " from $fp_url" >&2 |
| 158 | exit 1 |
| 159 | fi |
| 160 | |
| 161 | chmod +x "$fp_dest.part" |
| 162 | mv "$fp_dest.part" "$fp_dest" |
| 163 | echo " $fp_name: downloaded, digest verified" |
| 164 | } |
| 165 | |
| 166 | fetch_pinned minio \ |
| 167 | "https://github.com/minio/minio/releases/download/$MINIO_RELEASE/minio.linux-$arch.$MINIO_RELEASE" \ |
| 168 | "$minio_sha" "$cache/minio" |
| 169 | fetch_pinned mc \ |
| 170 | "https://github.com/minio/mc/releases/download/$MC_RELEASE/mc.linux-$arch.$MC_RELEASE" \ |
| 171 | "$mc_sha" "$cache/mc" |
| 172 | |
| 173 | minio=$cache/minio |
| 174 | mc=$cache/mc |
| 175 | |
| 176 | # --------------------------------------------------------------------- |
| 177 | # Scratch state, and getting rid of it. |
| 178 | # |
| 179 | # Everything mutable this step creates lives under one directory: MinIO's |
| 180 | # data, mc's config (MC_CONFIG_DIR, so mc never touches $HOME), the |
| 181 | # policy document, and the server log. /tmp inside an amadan job is a |
| 182 | # private tmpfs that the sandbox discards when the job ends, so this is |
| 183 | # scratch in the strongest sense available. |
| 184 | rundir=$(mktemp -d "${TMPDIR:-/tmp}/carlos-minio-contract-XXXXXX") |
| 185 | MC_CONFIG_DIR=$rundir/mc |
| 186 | export MC_CONFIG_DIR |
| 187 | |
| 188 | minio_pid= |
| 189 | |
| 190 | # The trap runs on the success path and on every failure path, because |
| 191 | # `set -eu` exits through it — which is the point. A step that leaves a |
| 192 | # MinIO listening on a shared box after it fails would poison every later |
| 193 | # run on that worker, and the failure that caused it is exactly when |
| 194 | # nobody is watching. |
| 195 | cleanup() { |
| 196 | if [ -n "$minio_pid" ]; then |
| 197 | kill "$minio_pid" 2>/dev/null || true |
| 198 | wait "$minio_pid" 2>/dev/null || true |
| 199 | fi |
| 200 | rm -rf "$rundir" |
| 201 | } |
| 202 | trap cleanup EXIT INT TERM |
| 203 | |
| 204 | # Root credentials are minted per run rather than hardcoded. They are not |
| 205 | # a secret — the server is loopback-only and lives for seconds — but |
| 206 | # random ones make the identity check below meaningful: creds that only |
| 207 | # this process knows cannot authenticate against somebody else's MinIO. |
| 208 | root_user=root$$ |
| 209 | root_pass=$(head -c 18 /dev/urandom | od -An -tx1 | tr -d ' \n') |
| 210 | |
| 211 | # --------------------------------------------------------------------- |
| 212 | # Start the server. |
| 213 | # |
| 214 | # The workflow used a fixed port 9000 because its MinIO was in a |
| 215 | # container with its own network. amadan jobs deliberately do NOT get |
| 216 | # --unshare-net (they need the Go module proxy), so a job shares the |
| 217 | # host's network |
| 218 | # namespace with the worker and with anything else on it. 9000 is a |
| 219 | # popular port; assuming it is free is assuming something this step does |
| 220 | # not know. |
| 221 | # |
| 222 | # So: pick a high port, and if MinIO cannot take it, pick another. The |
| 223 | # liveness probe alone would not be enough to tell the two cases apart — |
| 224 | # a foreign MinIO already on the port answers /health/live perfectly |
| 225 | # happily, and we would then test somebody else's server. Requiring OUR |
| 226 | # process to still be alive is what distinguishes "it started" from "the |
| 227 | # port was taken"; `mc alias set` with the random root credentials above |
| 228 | # is the second, independent check that the thing answering is ours. |
| 229 | port= |
| 230 | attempt=1 |
| 231 | while [ "$attempt" -le 5 ]; do |
| 232 | candidate=$((20000 + ($$ + attempt * 997) % 20000)) |
| 233 | rm -rf "$rundir/data" |
| 234 | mkdir -p "$rundir/data" |
| 235 | |
| 236 | MINIO_ROOT_USER=$root_user MINIO_ROOT_PASSWORD=$root_pass \ |
| 237 | "$minio" server "$rundir/data" \ |
| 238 | --address "127.0.0.1:$candidate" \ |
| 239 | --console-address "127.0.0.1:0" \ |
| 240 | >"$rundir/minio.log" 2>&1 & |
| 241 | minio_pid=$! |
| 242 | |
| 243 | waited=0 |
| 244 | while [ "$waited" -lt 30 ]; do |
| 245 | if ! kill -0 "$minio_pid" 2>/dev/null; then |
| 246 | break # died — almost certainly could not bind |
| 247 | fi |
| 248 | if curl -sf "http://127.0.0.1:$candidate/minio/health/live" >/dev/null; then |
| 249 | port=$candidate |
| 250 | break |
| 251 | fi |
| 252 | sleep 1 |
| 253 | waited=$((waited + 1)) |
| 254 | done |
| 255 | |
| 256 | [ -n "$port" ] && break |
| 257 | |
| 258 | kill "$minio_pid" 2>/dev/null || true |
| 259 | wait "$minio_pid" 2>/dev/null || true |
| 260 | minio_pid= |
| 261 | echo " minio did not come up on 127.0.0.1:$candidate, trying another port" |
| 262 | attempt=$((attempt + 1)) |
| 263 | done |
| 264 | |
| 265 | if [ -z "$port" ]; then |
| 266 | echo "minio never became healthy after 5 attempts; last log:" >&2 |
| 267 | cat "$rundir/minio.log" >&2 |
| 268 | exit 1 |
| 269 | fi |
| 270 | |
| 271 | echo " minio healthy on 127.0.0.1:$port" |
| 272 | |
| 273 | # --------------------------------------------------------------------- |
| 274 | # The fixture: two buckets and a scoped user granted exactly one of them. |
| 275 | # |
| 276 | # Carried over from the workflow's `mint scoped user` step — same bucket |
| 277 | # names, same user — because the whole value of the test is that |
| 278 | # cross-bucket denial is enforced by real IAM rather than by the client |
| 279 | # politely not asking. Nothing checks this policy against a second copy, |
| 280 | # so loosening it here is invisible: grant `denied-bucket` by accident |
| 281 | # and the test still passes while proving nothing. Change it only on |
| 282 | # purpose. |
| 283 | # |
| 284 | # THIS DOCUMENT MUST TRACK storePolicyJSON (internal/objstore/aws.go). |
| 285 | # It is a hand-written copy of what the console writes for a real store, |
| 286 | # and the test now asserts security properties OF THE POLICY — not just |
| 287 | # that an S3 client works. The two Deny statements are the anti-forgery |
| 288 | # pair, and the second one is the load-bearing one: leaving |
| 289 | # s3:PutObjectTagging out of the Allow does NOT stop an app tagging its |
| 290 | # own object, because x-amz-tagging on PutObject sets tags without ever |
| 291 | # naming that action. MinIO let the tagged upload through until the |
| 292 | # s3:RequestObjectTagKeys Deny was added. Drop either statement here and |
| 293 | # the test goes red, which is the point: this file is where the property |
| 294 | # is checked against a real server rather than argued about. |
| 295 | "$mc" --quiet alias set local "http://127.0.0.1:$port" "$root_user" "$root_pass" |
| 296 | "$mc" --quiet mb local/contract-bucket local/denied-bucket |
| 297 | |
| 298 | cat >"$rundir/policy.json" <<'EOF' |
| 299 | {"Version": "2012-10-17", "Statement": [ |
| 300 | {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::contract-bucket"]}, |
| 301 | {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectTagging"], "Resource": ["arn:aws:s3:::contract-bucket/*"]}, |
| 302 | {"Effect": "Deny", "Action": ["s3:PutObjectTagging", "s3:DeleteObjectTagging", "s3:PutObjectVersionTagging", "s3:DeleteObjectVersionTagging"], "Resource": ["arn:aws:s3:::contract-bucket/*"]}, |
| 303 | {"Effect": "Deny", "Action": ["s3:PutObject"], "Resource": ["arn:aws:s3:::contract-bucket/*"], |
| 304 | "Condition": {"ForAnyValue:StringEquals": {"s3:RequestObjectTagKeys": ["carlos-scan", "carlos-scan-version", "carlos-scan-at"]}}} |
| 305 | ]} |
| 306 | EOF |
| 307 | |
| 308 | "$mc" --quiet admin policy create local contract-only "$rundir/policy.json" |
| 309 | "$mc" --quiet admin user add local scopeduser scopedsecret1 |
| 310 | "$mc" --quiet admin policy attach local contract-only --user scopeduser |
| 311 | |
| 312 | echo " buckets and scoped user ready" |
| 313 | |
| 314 | # --------------------------------------------------------------------- |
| 315 | # Run it. |
| 316 | # |
| 317 | # Same env var names the test reads (contract_test.go's requireEnv calls), |
| 318 | # and -count=1 for the same reason 10-gate uses it: never satisfy a gate |
| 319 | # from a cached pass. Output goes to a file rather than through a pipe |
| 320 | # because POSIX sh has no pipefail, and this step needs the test's own |
| 321 | # exit status, not tee's. |
| 322 | out=$rundir/test.log |
| 323 | set +e |
| 324 | CARLOS_MINIO_TEST=1 \ |
| 325 | MINIO_ENDPOINT="http://127.0.0.1:$port" \ |
| 326 | MINIO_SCOPED_KEY=scopeduser \ |
| 327 | MINIO_SCOPED_SECRET=scopedsecret1 \ |
| 328 | MINIO_BUCKET=contract-bucket \ |
| 329 | MINIO_DENIED_BUCKET=denied-bucket \ |
| 330 | go test ./internal/objstore/ -run TestDeliveredContractMinio -count=1 -v >"$out" 2>&1 |
| 331 | test_status=$? |
| 332 | set -e |
| 333 | |
| 334 | cat "$out" |
| 335 | |
| 336 | if [ "$test_status" -ne 0 ]; then |
| 337 | exit "$test_status" |
| 338 | fi |
| 339 | |
| 340 | # THE ASSERTION. Do not delete this because the test above already |
| 341 | # "passed". |
| 342 | # |
| 343 | # TestDeliveredContractMinio skips itself unless CARLOS_MINIO_TEST=1, and |
| 344 | # a skipped Go test exits 0. So every interesting way this step can break |
| 345 | # — a typo'd env var, a MinIO that started but was never reachable, a |
| 346 | # rename of the test, a future edit that drops the env block — produces a |
| 347 | # green step that tested nothing at all. That is strictly worse than no |
| 348 | # step, because it reports coverage this repo does not have. |
| 349 | # |
| 350 | # Requiring the parent test's PASS line to actually appear closes it. The |
| 351 | # trailing " (" anchors on the parent rather than its subtests, whose |
| 352 | # PASS lines are indented anyway. |
| 353 | if ! grep -q '^--- PASS: TestDeliveredContractMinio (' "$out"; then |
| 354 | echo >&2 |
| 355 | echo "the contract test did not PASS — it was skipped, filtered out, or renamed." >&2 |
| 356 | echo "go test exited 0, which for this test means nothing was exercised: it" >&2 |
| 357 | echo "skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2 |
| 358 | echo "TestDeliveredContractMinio still exists in internal/objstore." >&2 |
| 359 | exit 1 |
| 360 | fi |
| 361 | |
| 362 | # T4's store probe (moves spec §7.3, §14.1): the same server, the same |
| 363 | # scoped user and bucket, and the same rule that its PASS line must appear, |
| 364 | # because TestT4StorageProbeMinio skips itself without CARLOS_MINIO_TEST too. |
| 365 | out2=$rundir/test-t4.log |
| 366 | set +e |
| 367 | CARLOS_MINIO_TEST=1 \ |
| 368 | MINIO_ENDPOINT="http://127.0.0.1:$port" \ |
| 369 | MINIO_SCOPED_KEY=scopeduser \ |
| 370 | MINIO_SCOPED_SECRET=scopedsecret1 \ |
| 371 | MINIO_BUCKET=contract-bucket \ |
| 372 | MINIO_DENIED_BUCKET=denied-bucket \ |
| 373 | go test ./internal/host/ -run TestT4StorageProbeMinio -count=1 -v >"$out2" 2>&1 |
| 374 | test_status=$? |
| 375 | set -e |
| 376 | |
| 377 | cat "$out2" |
| 378 | |
| 379 | if [ "$test_status" -ne 0 ]; then |
| 380 | exit "$test_status" |
| 381 | fi |
| 382 | |
| 383 | if ! grep -q '^--- PASS: TestT4StorageProbeMinio (' "$out2"; then |
| 384 | echo >&2 |
| 385 | echo "the T4 probe test did not PASS: it was skipped, filtered out, or renamed." >&2 |
| 386 | echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2 |
| 387 | echo "TestT4StorageProbeMinio still exists in internal/host." >&2 |
| 388 | exit 1 |
| 389 | fi |
| 390 | |
| 391 | # The change index (S3 change-index design §3, §6): release.S3Store against |
| 392 | # the same server. A 304 on a current ETag, an ETag listing that agrees with |
| 393 | # Get, and the index bump through every mutation path are the server's |
| 394 | # behaviour; no fake client shows them. Same rule again: the test skips |
| 395 | # without CARLOS_MINIO_TEST, so its PASS line has to appear. |
| 396 | out3=$rundir/test-s3store.log |
| 397 | set +e |
| 398 | CARLOS_MINIO_TEST=1 \ |
| 399 | MINIO_ENDPOINT="http://127.0.0.1:$port" \ |
| 400 | MINIO_SCOPED_KEY=scopeduser \ |
| 401 | MINIO_SCOPED_SECRET=scopedsecret1 \ |
| 402 | MINIO_BUCKET=contract-bucket \ |
| 403 | go test ./internal/release/ -run TestS3StoreMinioContract -count=1 -v >"$out3" 2>&1 |
| 404 | test_status=$? |
| 405 | set -e |
| 406 | |
| 407 | cat "$out3" |
| 408 | |
| 409 | if [ "$test_status" -ne 0 ]; then |
| 410 | exit "$test_status" |
| 411 | fi |
| 412 | |
| 413 | if ! grep -q '^--- PASS: TestS3StoreMinioContract (' "$out3"; then |
| 414 | echo >&2 |
| 415 | echo "the S3Store contract test did not PASS: it was skipped, filtered out, or renamed." >&2 |
| 416 | echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2 |
| 417 | echo "TestS3StoreMinioContract still exists in internal/release." >&2 |
| 418 | exit 1 |
| 419 | fi |
| 420 | |
| 421 | # The forwarded db read (db region forward plan 2: T1 and T16): one |
| 422 | # deployment bucket, versioned, and a data bucket per region, on the one |
| 423 | # server. The console user cannot read uk's data bucket; the uk box user |
| 424 | # can. Neither may delete: the protocol deletes nothing (J4), so a delete |
| 425 | # would fail at the server as well as in the tests' store wrappers. |
| 426 | "$mc" --quiet mb local/dbf-deploy local/dbf-data-ie local/dbf-data-uk |
| 427 | "$mc" --quiet version enable local/dbf-deploy |
| 428 | cat >"$rundir/dbf-console.json" <<'EOF' |
| 429 | {"Version": "2012-10-17", "Statement": [ |
| 430 | {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::dbf-deploy", "arn:aws:s3:::dbf-data-ie"]}, |
| 431 | {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": ["arn:aws:s3:::dbf-deploy/*"]}, |
| 432 | {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::dbf-data-ie/*"]} |
| 433 | ]} |
| 434 | EOF |
| 435 | cat >"$rundir/dbf-ukbox.json" <<'EOF' |
| 436 | {"Version": "2012-10-17", "Statement": [ |
| 437 | {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::dbf-deploy", "arn:aws:s3:::dbf-data-uk"]}, |
| 438 | {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": ["arn:aws:s3:::dbf-deploy/*"]}, |
| 439 | {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::dbf-data-uk/*"]} |
| 440 | ]} |
| 441 | EOF |
| 442 | "$mc" --quiet admin policy create local dbf-console "$rundir/dbf-console.json" |
| 443 | "$mc" --quiet admin policy create local dbf-ukbox "$rundir/dbf-ukbox.json" |
| 444 | "$mc" --quiet admin user add local dbfconsole dbfconsolesecret1 |
| 445 | "$mc" --quiet admin user add local dbfukbox dbfukboxsecret1 |
| 446 | "$mc" --quiet admin policy attach local dbf-console --user dbfconsole |
| 447 | "$mc" --quiet admin policy attach local dbf-ukbox --user dbfukbox |
| 448 | |
| 449 | out4=$rundir/test-dbf.log |
| 450 | set +e |
| 451 | CARLOS_MINIO_TEST=1 \ |
| 452 | MINIO_ENDPOINT="http://127.0.0.1:$port" \ |
| 453 | DBF_ROOT_KEY="$root_user" DBF_ROOT_SECRET="$root_pass" \ |
| 454 | DBF_CONSOLE_KEY=dbfconsole DBF_CONSOLE_SECRET=dbfconsolesecret1 \ |
| 455 | DBF_BOX_KEY=dbfukbox DBF_BOX_SECRET=dbfukboxsecret1 \ |
| 456 | go test ./internal/console/ -run 'TestDBForwardMinio' -count=1 -v >"$out4" 2>&1 |
| 457 | test_status=$? |
| 458 | set -e |
| 459 | cat "$out4" |
| 460 | if [ "$test_status" -ne 0 ]; then |
| 461 | exit "$test_status" |
| 462 | fi |
| 463 | if ! grep -q '^--- PASS: TestDBForwardMinio (' "$out4"; then |
| 464 | echo >&2 |
| 465 | echo "the forwarded db read test did not PASS: it was skipped, filtered out, or renamed." >&2 |
| 466 | echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2 |
| 467 | echo "TestDBForwardMinio still exists in internal/console." >&2 |
| 468 | exit 1 |
| 469 | fi |
| 470 | |
| 471 | echo "minio contract: PASS" |
| 472 | |
amadan