chore: refresh compatibility and lint baselines

Accept the new CORS test routes, resident getter, and replication header literals in the rebrand guard. Apply gofumpt, context-first helper ordering, and spelling fixes required by CI.

Signed-off-by: Feng Ruohang <rh@vonng.com>

buildscripts/rebrand-guard/compat-baseline.json

@@ -693,6 +693,7 @@
     "/%s/us-east-1/s3/aws4_request",
     "/*",
     "/../../etc",
+    "/../obj",
     "/./abc/def",
     "/.dockerenv",
     "/.trash",
@@ -705,6 +706,7 @@
     "//contains/double-forwardslash-prefix",
     "/?",
     "/?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=USWUXHGYZQYFYFFIT3RE%2F20170529%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20170529T190139Z\u0026X-Amz-Expires=600\u0026X-Amz-Signature=19b58080999df54b446fc97304eb8dda60d3df1812ae97f3e8783351bfd9781d\u0026X-Amz-SignedHeaders=host\u0026prefix=Hello%2AWorld%2A",
+    "/A/obj",
     "/a",
     "/a/b/c",
     "/a/b/c/d/e/f/g",
@@ -721,6 +723,7 @@
     "/admin",
     "/afile",
     "/api/requests",
+    "/api/v1/login",
     "/apis",
     "/audit",
     "/background-heal/status",
@@ -852,6 +855,7 @@
     "/ls",
     "/metrics",
     "/metrics/v3",
+    "/minio/admin/v3/info",
     "/minio/grid/",
     "/minio/grid/lock/",
     "/minio/health/cluster",
@@ -970,6 +974,7 @@
     "/speedtest/site",
     "/start-job",
     "/startprofiling",
+    "/startup-missing/object",
     "/status",
     "/status-job",
     "/storage",
@@ -1020,6 +1025,7 @@
     "/version",
     "/vfile",
     "/wall",
+    "/x/obj",
     "/xl.meta",
     "/{bucket}",
     "/{object:.+}"
@@ -3139,6 +3145,7 @@
     "cmd:cmd:method:BucketMetadataSys.GetPolicyConfig",
     "cmd:cmd:method:BucketMetadataSys.GetQuotaConfig",
     "cmd:cmd:method:BucketMetadataSys.GetReplicationConfig",
+    "cmd:cmd:method:BucketMetadataSys.GetResidentCorsConfig",
     "cmd:cmd:method:BucketMetadataSys.GetSSEConfig",
     "cmd:cmd:method:BucketMetadataSys.GetTaggingConfig",
     "cmd:cmd:method:BucketMetadataSys.GetVersioningConfig",
@@ -10258,6 +10265,10 @@
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Iv\"",
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm\"",
     "cmd/object-multipart-handlers.go=\"X-Minio-Replication-Server-Side-Encryption-Sealed-Key\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Encrypted-Multipart\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Iv\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Seal-Algorithm\"",
+    "cmd/replication-trust.go=\"X-Minio-Replication-Server-Side-Encryption-Sealed-Key\"",
     "cmd/s3-zip-handlers.go=\"x-minio-extract\"",
     "cmd/server-startup-msg.go=\"https://silo.pgsty.com/reference/minio-mc/#quickstart\"",
     "cmd/storage-rest-server.go=\"X-Minio-Time\"",

cmd/bucket-cors-middleware_test.go

@@ -495,7 +495,7 @@ func requireCorsOriginVary(t *testing.T, header http.Header) {
 }
 
 // markBucketMetadataInitialized marks the global bucket-metadata subsystem as
-// fully loaded, modelling a running server (the API test harness sets up the
+// fully loaded, modeling a running server (the API test harness sets up the
 // subsystem but does not run Init). It returns a function that restores the
 // previous state.
 func markBucketMetadataInitialized(t *testing.T) func() {
@@ -637,7 +637,7 @@ func testBucketCorsStartupMissFailsClosedWithoutIO(obj ObjectLayer, _ string, _
 }
 
 // markBucketMetadataLoadFailed records a bucket as one whose metadata failed to
-// load at startup while the subsystem is Initialized, modelling the degraded
+// load at startup while the subsystem is Initialized, modeling the degraded
 // state where a real bucket is not resident. Returns a restore function.
 func markBucketMetadataLoadFailed(t *testing.T, bucket string) func() {
 	t.Helper()

cmd/handler-utils_test.go

@@ -325,7 +325,7 @@ func TestCloneRequestWithoutReplicationHeaders(t *testing.T) {
 	req.Header.Set("X-Minio-Replication-Server-Side-Encryption-Sealed-Key", "sealed")
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	clone := cloneRequestWithoutReplicationHeaders(req, t.Context())
+	clone := cloneRequestWithoutReplicationHeaders(t.Context(), req)
 	if clone == req {
 		t.Fatal("expected cloned request")
 	}

cmd/object-handlers.go

@@ -2522,7 +2522,7 @@ func (api objectAPIHandlers) PutObjectExtractHandler(w http.ResponseWriter, r *h
 	trustedRequestCtx := withReplicationTrust(ctx, true, rawReplica)
 	trustedRequest := entryRequestBase.WithContext(trustedRequestCtx)
 	cleanRequestCtx := withReplicationTrust(ctx, false, false)
-	cleanRequest := cloneRequestWithoutReplicationHeaders(entryRequestBase, cleanRequestCtx)
+	cleanRequest := cloneRequestWithoutReplicationHeaders(cleanRequestCtx, entryRequestBase)
 	trustedReqParams := extractReqParams(trustedRequest)
 	cleanReqParams := extractReqParams(cleanRequest)
 
@@ -2572,7 +2572,7 @@ func (api objectAPIHandlers) PutObjectExtractHandler(w http.ResponseWriter, r *h
 		entryTrusted := markerExact && replicationPermitted
 		replicaTrusted := entryTrusted && rawReplica
 		entryCtx := cleanRequestCtx
-		entryReq := cloneRequestWithoutReplicationHeaders(entryAuthReq, cleanRequestCtx)
+		entryReq := cloneRequestWithoutReplicationHeaders(cleanRequestCtx, entryAuthReq)
 		reqParams := cleanReqParams
 		if entryTrusted {
 			entryCtx = trustedRequestCtx

cmd/replication-trust.go

@@ -20,8 +20,10 @@ import (
 	"github.com/minio/pkg/v3/policy"
 )
 
-type replicationTrustKey struct{}
+type (
-type replicaTrustKey struct{}
+	replicationTrustKey struct{}
+	replicaTrustKey     struct{}
+)
 
 // hasReplicationMarker reports whether the internal replication marker has
 // its one accepted wire value. Header presence alone is never a trust signal.
@@ -105,7 +107,7 @@ func hasReplicationRequestHeaders(h http.Header) bool {
 	return false
 }
 
-func cloneRequestWithoutReplicationHeaders(r *http.Request, ctx context.Context) *http.Request {
+func cloneRequestWithoutReplicationHeaders(ctx context.Context, r *http.Request) *http.Request {
 	clone := r.Clone(ctx)
 	stripReplicationRequestHeaders(clone.Header)
 	return clone
@@ -119,5 +121,5 @@ func applyReplicationTrust(ctx context.Context, r *http.Request, trusted, replic
 	if trusted {
 		return ctx, r.WithContext(ctx)
 	}
-	return ctx, cloneRequestWithoutReplicationHeaders(r, ctx)
+	return ctx, cloneRequestWithoutReplicationHeaders(ctx, r)
 }