build(docker): ship the silo binary and translate the legacy argv command

Dockerfile.goreleaser now copies silo to /usr/bin/silo, defaults to
CMD ["silo"], and labels the image as Silo. MINIO_UPDATE_MINISIGN_PUBKEY is
removed from the image environment: with the updater permanently disabled it
was dead weight, and leaving upstream's verification key in a Silo image
implied a trust relationship that does not exist. The MINIO_* runtime
environment variables, ports, volume and health endpoints are unchanged.

The image keeps shipping mcli with an /usr/bin/mc symlink. That is the client,
not a MinIO-branded alias for the server binary, and the Helm post-install job
and existing container scripts call it by name.

docker-entrypoint.sh translates a legacy first argument: `minio server /data`
becomes `silo server /data`, so an existing `command: minio server ...` in
compose or a Pod spec keeps working across the image swap. The translation is
argv-level only - no file named minio is installed, and an explicitly
overridden `entrypoint: /usr/bin/minio` still fails, which is the honest
outcome since that path genuinely no longer exists.

The entrypoint also fixes an unrelated startup hazard it was already carrying:
when the image runs under an arbitrary UID, HOME points at an unreadable /root
and the server probes its default config directory during initialization. It
now falls back to /tmp when HOME is unset, /root, missing or unwritable.

docker-entrypoint_test.sh pins all of it - empty argv, legacy minio, native
silo, bare flags, and an explicit shell command that must stay explicit. It is
wired into make rebrand-guard and into the go.yml, release.yml and
test-release.yml gates, so removing the shim breaks CI rather than breaking
users. Passing locally.

download-static-curl.sh gains checksum verification for the curl it fetches
into the build stage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile.goreleaser

@@ -6,7 +6,9 @@ ENV GOPATH=/go
 ENV CGO_ENABLED=0
 
 ARG MC_REPO=pgsty/mc
-ARG MC_VERSION=latest
+ARG MC_VERSION=RELEASE.2026-08-04T00-00-00Z
+ARG MC_AMD64_SHA256=4aa1fa83ea153025a3f60684e13f453749dd17587257ccb7f0dde42b560120be
+ARG MC_ARM64_SHA256=18f7bd442aec24c5eb5ffd1ef368eb44f94045e2da109a344ad184f34641e273
 
 RUN apk add -U --no-cache \
     ca-certificates \
@@ -14,8 +16,8 @@ RUN apk add -U --no-cache \
     curl \
     jq && \
     case "${TARGETARCH}" in \
-      amd64) MC_ARCH=amd64 ;; \
-      arm64) MC_ARCH=arm64 ;; \
+      amd64) MC_ARCH=amd64; MC_PINNED_SHA256="${MC_AMD64_SHA256}" ;; \
+      arm64) MC_ARCH=arm64; MC_PINNED_SHA256="${MC_ARM64_SHA256}" ;; \
       *) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
     esac && \
     if [ "${MC_VERSION}" = "latest" ]; then \
@@ -39,7 +41,8 @@ RUN apk add -U --no-cache \
     EXPECTED=$(grep "  ${ARCHIVE_NAME}$" /tmp/mcli_checksums.txt | awk '{print $1}') && \
     ACTUAL=$(sha256sum /tmp/mcli.tar.gz | awk '{print $1}') && \
     [ -n "${EXPECTED}" ] || { echo "Checksum entry not found for ${ARCHIVE_NAME}"; exit 1; } && \
-    [ "${EXPECTED}" = "${ACTUAL}" ] || { echo "Checksum mismatch: expected ${EXPECTED}, got ${ACTUAL}"; exit 1; } && \
+    [ "${EXPECTED}" = "${MC_PINNED_SHA256}" ] || { echo "Published checksum drift for ${ARCHIVE_NAME}"; exit 1; } && \
+    [ "${MC_PINNED_SHA256}" = "${ACTUAL}" ] || { echo "Checksum mismatch: expected ${MC_PINNED_SHA256}, got ${ACTUAL}"; exit 1; } && \
     echo "Checksum OK: ${ACTUAL}" && \
     mkdir -p /tmp/mcli-extract && \
     tar -xzf /tmp/mcli.tar.gz -C /tmp/mcli-extract/ && \
@@ -66,31 +69,35 @@ RUN dnf -y install ca-certificates && \
 
 FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 
-LABEL maintainer="pgsty <https://github.com/pgsty/minio>" \
-      description="MinIO community fork, build by pgsty"
+LABEL org.opencontainers.image.title="Silo" \
+      org.opencontainers.image.description="S3-Interface Libre Object Storage" \
+      org.opencontainers.image.url="https://silo.pgsty.com" \
+      org.opencontainers.image.source="https://github.com/pgsty/minio" \
+      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
+      maintainer="PGSTY <https://silo.pgsty.com>"
 
 ENV MINIO_ACCESS_KEY_FILE=access_key \
     MINIO_SECRET_KEY_FILE=secret_key \
     MINIO_ROOT_USER_FILE=access_key \
     MINIO_ROOT_PASSWORD_FILE=secret_key \
     MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
-    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
     MINIO_CONFIG_ENV_FILE=config.env \
+    HOME=/tmp \
     MC_CONFIG_DIR=/tmp/.mc
 
 COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY minio /usr/bin/minio
+COPY silo /usr/bin/silo
 COPY --from=build /go/bin/mcli /usr/bin/mcli
 COPY --from=build /go/bin/curl* /usr/bin/
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
 COPY LICENSE /licenses/LICENSE
 COPY CREDITS /licenses/CREDITS
 
-RUN chmod +x /usr/bin/minio /usr/bin/mcli /usr/bin/docker-entrypoint.sh && \
+RUN chmod +x /usr/bin/silo /usr/bin/mcli /usr/bin/docker-entrypoint.sh && \
     ln -sf mcli /usr/bin/mc
 
 EXPOSE 9000
 VOLUME ["/data"]
 
 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
-CMD ["minio"]
+CMD ["silo"]