mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
16b78eb4e5a9eac376b56f72eeeff4d8d9af2343
6 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Feng Ruohang
|
4c34d23099 |
build(docker): add the distroless image variant as a pilot
Publish pgsty/silo:<RELEASE>-distroless (and a rolling :distroless tag) alongside the classic image: gcr.io/distroless/static-debian12 plus exactly one program, the silo binary. No shell, no mc, no curl, no entrypoint script - the binary is the ENTRYPOINT and the baked-in exec-form HEALTHCHECK runs 'silo healthcheck ready'. The classic image and its mc-based health checks are deliberately unchanged. Design: silo.pgsty.com/compatibility/feature/healthcheck/ /data is created in the image layer, world-writable, because Docker seeds fresh volumes from the layer mountpoint and no entrypoint exists to repair ownership at runtime (issue #55); the parent directory is copied from a throwaway busybox stage since COPY of a directory copies contents rather than the entry itself, which would silently leave /data at root:0755 and break every non-root run. The MINIO_USERNAME drop-user path is not supported in this variant; use --user. test-release.yml now builds the real Dockerfile.distroless on every gate run (it has no download stages, so it stays offline) and asserts: the HEALTHCHECK survives into the image config, /data ships 0777, no shell and no /usr/bin/minio are present, Docker's health state turns healthy from the baked probe alone, the probe binary execs without a shell, and SIGTERM still stops the server gracefully - as root and as --user 1001:1001. docker-release.yml gains the distroless build lanes, multi-arch manifests, SBOM and provenance attestations, and a release-blocking check that the pushed manifest still carries the HEALTHCHECK (a Docker extension absent from the OCI image spec). Verified locally on linux/arm64: full gate assertions plus bare 'docker run ... healthcheck' exit-code semantics and --version passthrough. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Feng Ruohang
|
219670d317 |
build: ship LICENSE and NOTICE in every package and image
The RPM, DEB and APK payloads carried no license material at all, and
the OCI image copied LICENSE and CREDITS but not NOTICE. For an AGPL
distribution that is not defensible packaging. Every delivery channel
now carries the same license set:
- nfpm packages install LICENSE and NOTICE under /usr/share/doc/silo/.
The entries are declared once per packager because nfpm only honors
type: license on rpm and silently drops such entries from deb and apk
-- the rpm keeps its %license flag, deb and apk carry plain files at
the same path. CREDITS stays out of the OS packages deliberately: at
1.8MB it would dominate an otherwise ~40MB payload.
- The OCI image gains /licenses/NOTICE next to the existing LICENSE and
CREDITS, in the Dockerfile and in both context-staging paths (the
make docker target and docker-release.yml).
- The GoReleaser archives list their files explicitly; the default
globs would keep missing NOTICE.
NOTICE's first line now reads 2015-2025 to match the banner constants
fixed in
|
||
|
Feng Ruohang
|
b57275be34 |
docs: adopt the no-CLA plus DCO policy and fix copyright terms
Brings the server in line with the contribution and copyright policy already adopted in pgsty/mc. Copyright terms were derived from the clock: startupBanner overwrote the ldflags-injected CopyrightYear with time.Now().Year() and printed it as the end of MinIO, Inc.'s term, so every January would have extended the upstream copyright claim past the 2025 end of upstream development, and release builds silently discarded the injected year. Both banners now credit MinIO, Inc. for 2015-2025 and PGSTY from 2025 through the release-stamped year, falling back to the current year in source builds. NOTICE names PGSTY as the holder of the fork's modifications, matching the banners and the packaging vendor field. Contributions are accepted inbound=outbound under AGPL-3.0-or-later with no CLA - the core is Copyright MinIO, Inc., so the combined work can never be relicensed and a CLA would buy nothing. What a fork carrying a downstream delta does need is provenance, so DCO 1.1 sign-off is now mandatory and enforced by a workflow that rejects unsigned non-bot commits. CONTRIBUTING documents sign-off, repair, cherry-pick provenance, dual copyright headers, trailer preservation across squash merges, and that assistive-tooling trailers carry no authorship or copyright claim. verify-rebrand.sh pins the copyright split and the policy files so neither can regress. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com> |
||
|
Feng Ruohang
|
f1c77d5a2b |
ci: let the READMEs name the old repository without pointing at it
The previous commit added a rename note to both READMEs and broke the gate I added one commit earlier. That gate rejected the string pgsty/minio anywhere outside three guard files, which was the wrong invariant: the point is that the old name must never be a live target, not that it must never be spoken. A README explaining where the MinIO-named artifacts went has to name them, and doing so is the opposite of stranding a reader on a dead repository. Split into two rules that say what is actually meant: - No live URL may resolve to the old repository anywhere, READMEs included - github.com/pgsty/minio and hub.docker.com/r/pgsty/minio are rejected outright. This is the rule that protects users. - The bare name is allowed only in five files: the pinned pre-rebrand image digest in the upgrade test, the two guards that refuse a legacy image, and the two READMEs. Both halves are negative-tested: adding a github.com/pgsty/minio link to README.md fails rule one, and adding a bare pgsty/minio to docs/docker/README.md fails rule two. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Feng Ruohang
|
c46b16ec62 |
chore: cut over to pgsty/silo and main
The transitional references land in one commit, because they are only correct together: the repository is pgsty/silo, its default branch is main, and nothing in the tree should point a user at the old names. Changed: - Workflow branch filters. go.yml and vulncheck.yml gated on `branches: master` for both push and pull_request, so renaming the default branch would have taken automatic CI offline with no error and no signal - the workflows would simply never trigger again. They now name main. - Release target. goreleaser's `release.github.name` becomes silo, which is what actually decides where a tagged build publishes. sign-release-rpms.sh's GH_REPO default follows. - The OCI `image.source` label, the Helm chart `sources` entry, the security advisory link in the issue-template config, and the go.mod comment citing the LDAP TLS fix. - 115 occurrences across README, README_ZH, SECURITY, CONTRIBUTING and 30 docs pages, including 72 links that also carried the master branch in their path. Those matter most: GitHub redirects clone, fetch, push and web URLs after a rename, but raw.githubusercontent.com does not, and neither follows a branch rename - every one of those links would 404 twice over. - Three error strings in cmd/erasure-sets.go, cmd/storage-errors.go and internal/config/errors.go that print an issue URL to operators. These are Go string literals inside rebrand-guard's brand allowlist, so the baseline is regenerated. The regeneration removes exactly those three entries and adds none; all twelve other protected sets, including the 9014 exported symbols, are byte-identical. - The transitional-naming disclaimers in README, README_ZH, SECURITY and CONTRIBUTING are dropped, since they no longer describe anything. Deliberately unchanged, all three because they exist to reject or freeze the old name rather than to point at it: - buildscripts/minio-upgrade.sh pins pgsty/minio@sha256:b6bfe72... - the frozen pre-rebrand image is the control group for the MinIO-to-Silo upgrade test. - helm-migration-guard rejects any rendered container still pulling pgsty/minio. - verify-rebrand.sh rejects the same in the delivery surfaces. Also unchanged: docs/config/README.md links to pgsty/mc/blob/master, and that repository's default branch really is still master. It moves when mc does. verify-rebrand.sh gains three assertions so this cannot silently regress: no source reference may name pgsty/minio outside the three allowlisted guards, no link may target pgsty/silo's master branch, and go.yml and vulncheck.yml must filter on main. Both new rejections were negative-tested - reintroducing a master branch filter and adding a pgsty/minio URL each fail the gate with the specific message. This commit assumes the rename actually happens. Until the GitHub branch and repository renames are executed, the links it introduces do not resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Feng Ruohang
|
bd8df51665 |
ci: gate the rebrand on compatibility, packaging and provenance evidence
A rebrand of this size cannot be reviewed by reading the diff. The risk is not what was renamed but what was renamed by accident: an environment variable, a metric, a header, a route, a storage marker or an exported symbol that some deployment depends on. So the invariants get a machine check. rebrand-guard extracts the identifiers a product rename must not touch - the go.mod module path, github.com/minio/* imports, MINIO_* variables, minio_* metric literals, x-minio-* headers, route string literals, the hardcoded grid routes in internal/grid/manager.go, the reserved bucket root, .minio.sys markers, arn:minio and minio:s3 policy values, every exported symbol in cmd/ and internal/, and every branded string literal - and compares them to a checked-in baseline. Any removal or addition fails the build, in both directions, so a future change cannot quietly drop one either. The recorded delta against the pre-rebrand tree is: module path, 137 imports, 19 metrics, 15 storage markers, 58 policy values and all 9014 exported symbols byte-identical; environment 437 -> 436, headers 85 -> 84, routes 331 -> 330. Each of those three is accounted for. MINIO_CONFIG_DIR and MINIO_VERSION were a shell local and a compose variable in test scripts, never server settings. x-minio-common was a docker-compose extension key, never an HTTP header. /api/health/upload was the SUBNET upload path in the deleted callhome.go. verify-rebrand.sh covers what the identifier guard cannot see: that the retired upstream delivery paths stay deleted, that the packaging and container files name silo, that silo.service keeps its Conflicts and both EnvironmentFile lines, that silo.env contains no active assignment that would shadow the legacy file, that no active delivery surface still publishes pgsty/minio, and that no non-test Go source contains a dl.min.io, subnet.min.io, api.min.io, slack.min.io or play.min.io URL. Both, plus the entrypoint argv test, run in go.yml, release.yml and test-release.yml. test-release.yml also gets the path filters right: it was watching minio.service, which no longer exists, so the packaging gate would have gone silently dormant. It now watches the unit, defaults, sysusers, lifecycle scripts, helm chart and both guards, and asserts the four-file payload, the absence of any cross-name Provides/Obsoletes/Conflicts, and that a container started with the legacy `minio server` argv really runs silo as PID 1. release.yml and docker-release.yml additionally verify that the checked-out revision matches GITHUB_SHA before building. GitHub's OIDC certificate records GITHUB_SHA, not the ref passed to actions/checkout, so a manual dispatch from the wrong ref would have produced provenance describing different source from the bytes being published. They now emit SBOMs and attestations for archives, packages and images, and docker-release verifies the release workflow's attestation on every artifact it consumes. Images publish to pgsty/silo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |