mirror of
https://github.com/pgsty/minio.git
synced 2026-08-10 00:03:29 +03:00
Feng Ruohang
6613c2a3cb
The test and verification scripts invoked ./minio and pulled their tooling from upstream infrastructure with no integrity check. Every `curl | tar` of a client or an old server binary was an unverified execution path in a script that regularly runs as a privileged user, and several fetched a floating "latest". Two installers replace all of it: - install-mcli.sh resolves a pinned pgsty/mc release, downloads the archive and its checksum manifest, requires exactly one valid manifest entry for the asset, verifies it, and installs. MCLI_BIN with a mandatory MCLI_SHA256 lets an offline or air-gapped run supply its own binary, still checksum-checked. - install-verified-fixture.sh takes source, expected SHA-256 and target, and refuses anything that does not match. Sources may be a URL or a local file. Every script that previously downloaded mc now calls install-mcli.sh. The three places that genuinely need an upstream artifact - the old MinIO server binary for the LDAP IAM upgrade-import test, the 2021 mc for the three-site replication test, and the functional-tests.sh fixture - go through install-verified-fixture.sh with the digest recorded inline. Those dl.min.io URLs remain on purpose: they are historical upstream artifacts needed to prove upgrade compatibility, and they are now pinned and verified rather than trusted. The scripts otherwise switch to ./silo, silo.service, the silo container and compose service names, and SILO_CONFIG_DIR. run-multi-site-minio-idp.sh is renamed to run-multi-site-silo-idp.sh with the Makefile target following. buildscripts/minio-upgrade.sh keeps its name and its `minio server` argv - it exists to test the MinIO-to-Silo upgrade, so the old side must stay old - but it is now pinned to an image digest rather than a tag, and its `docker system prune` and `docker volume prune` calls are removed. Those ran unfiltered against the developer's whole Docker installation; the resiliency tests had the same problem and lose their prune and `docker ps -q` sweeps too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
47 lines
1.5 KiB
Bash
Executable File
47 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# This script will run inside ubuntu-pod that is located at default namespace in the cluster
|
|
# This script will not and should not be executed in the self hosted runner
|
|
|
|
echo "script failed" >resiliency-initial.log # assume initial state
|
|
|
|
echo "sleep to wait for Silo Server to be ready prior mc commands"
|
|
# https://github.com/minio/mc/issues/3599
|
|
|
|
MINIO_SERVER_URL="http://127.0.0.1:9000"
|
|
ALIAS_NAME=mysilo
|
|
BUCKET="test-bucket"
|
|
SRC_DIR="/tmp/data"
|
|
INLINED_DIR="/tmp/inlined"
|
|
DEST_DIR="/tmp/dest"
|
|
|
|
TIMEOUT=10
|
|
while true; do
|
|
if [[ ${TIMEOUT} -le 0 ]]; then
|
|
echo retry: timeout while running: mc alias set
|
|
exit 1
|
|
fi
|
|
eval ./mc alias set "${ALIAS_NAME}" "${MINIO_SERVER_URL}" minioadmin minioadmin && break
|
|
TIMEOUT=$((TIMEOUT - 1))
|
|
sleep 1
|
|
done
|
|
|
|
./mc ready "${ALIAS_NAME}"
|
|
|
|
./mc mb "${ALIAS_NAME}"/"${BUCKET}"
|
|
rm -rf "${SRC_DIR}" "${INLINED_DIR}" "${DEST_DIR}" && mkdir -p "${SRC_DIR}" "${INLINED_DIR}" "${DEST_DIR}"
|
|
for idx in {1..10}; do
|
|
# generate random nr of blocks
|
|
COUNT=$((RANDOM % 100 + 100))
|
|
# generate random content
|
|
dd if=/dev/urandom bs=50K count="${COUNT}" of="${SRC_DIR}"/file"$idx"
|
|
done
|
|
|
|
# create small object that will be inlined into xl.meta
|
|
dd if=/dev/urandom bs=50K count=1 of="${INLINED_DIR}"/inlined
|
|
|
|
if ./mc cp --quiet --recursive "${SRC_DIR}/" "${ALIAS_NAME}"/"${BUCKET}"/initial-data/; then
|
|
if ./mc cp --quiet --recursive "${INLINED_DIR}/" "${ALIAS_NAME}"/"${BUCKET}"/inlined-data/; then
|
|
echo "script passed" >resiliency-initial.log
|
|
fi
|
|
fi
|