mirror of
https://github.com/pgsty/minio.git
synced 2026-08-10 00:03:29 +03:00
Feng Ruohang
219670d317
The RPM, DEB and APK payloads carried no license material at all, and
the OCI image copied LICENSE and CREDITS but not NOTICE. For an AGPL
distribution that is not defensible packaging. Every delivery channel
now carries the same license set:
- nfpm packages install LICENSE and NOTICE under /usr/share/doc/silo/.
The entries are declared once per packager because nfpm only honors
type: license on rpm and silently drops such entries from deb and apk
-- the rpm keeps its %license flag, deb and apk carry plain files at
the same path. CREDITS stays out of the OS packages deliberately: at
1.8MB it would dominate an otherwise ~40MB payload.
- The OCI image gains /licenses/NOTICE next to the existing LICENSE and
CREDITS, in the Dockerfile and in both context-staging paths (the
make docker target and docker-release.yml).
- The GoReleaser archives list their files explicitly; the default
globs would keep missing NOTICE.
NOTICE's first line now reads 2015-2025 to match the banner constants
fixed in b57275be3 -- it had kept upstream's stale 2015-2023 claim --
and verify-rebrand.sh pins both NOTICE copyright lines.
The payload locks move in the same commit: sign-release-rpms.sh expects
the six-file listing, and the test-release validation asserts presence,
count, the rpm %license flag, and sha256 equality of the packaged
LICENSE and NOTICE against the repository files across all three
formats and both architectures.
Also dropped the unit's WorkingDirectory=/usr/local, a leftover from
upstream's /usr/local/bin install layout. Debian policy 9.1.2 keeps
packages out of /usr/local entirely; the binary already installs to
/usr/bin and the service does not depend on its working directory.
Verified locally with nfpm v2.47.0 (the CI-pinned version): built all
six packages via package-release.sh, then ran the test-release
validation step verbatim (extracted from the workflow YAML) and the
signing script's payload comparison against them in an Ubuntu 24.04
container -- both pass. Built the arm64 image from the real
Dockerfile.goreleaser and confirmed /licenses holds CREDITS, LICENSE
and NOTICE. make rebrand-guard passes with the new NOTICE pins.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>
215 lines
10 KiB
Bash
Executable File
215 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_dir="$(cd "${script_dir}/.." && pwd)"
|
|
cd "${repo_dir}"
|
|
|
|
fail() {
|
|
echo "Silo rebrand verification failed: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_file() {
|
|
[ -f "$1" ] || fail "missing required file: $1"
|
|
}
|
|
|
|
require_text() {
|
|
local file="$1"
|
|
local text="$2"
|
|
grep -Fq -- "${text}" "${file}" || fail "${file} does not contain: ${text}"
|
|
}
|
|
|
|
reject_text() {
|
|
local file="$1"
|
|
local text="$2"
|
|
if grep -Fq -- "${text}" "${file}"; then
|
|
fail "${file} still contains forbidden delivery text: ${text}"
|
|
fi
|
|
}
|
|
|
|
for file in \
|
|
.github/goreleaser.yml \
|
|
.github/nfpm.yml \
|
|
buildscripts/package/lifecycle_test.sh \
|
|
buildscripts/verify-helm-migration.sh \
|
|
Dockerfile.goreleaser \
|
|
dockerscripts/download-static-curl.sh \
|
|
dockerscripts/docker-entrypoint.sh \
|
|
helm/silo/Chart.yaml \
|
|
helm/silo/values.yaml \
|
|
silo.service \
|
|
silo.env \
|
|
silo.sysusers; do
|
|
require_file "${file}"
|
|
done
|
|
|
|
for retired_path in \
|
|
CNAME _config.yml index.yaml helm-reindex.sh helm/minio helm-releases \
|
|
Dockerfile Dockerfile.cicd Dockerfile.hotfix Dockerfile.release \
|
|
Dockerfile.release.old_cpu Dockerfile.scratch docker-buildx.sh \
|
|
minio.service cmd/callhome.go buildscripts/upgrade-tests .github/logo.svg \
|
|
docs/federation/lookup/bucket-lookup.png \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.jpg \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.png \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_8.jpg \
|
|
docs/screenshots/Architecture-diagram_distributed_8.png \
|
|
docs/screenshots/Architecture-diagram_distributed_8.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_16.jpg \
|
|
docs/screenshots/Architecture-diagram_distributed_16.png \
|
|
docs/screenshots/Architecture-diagram_distributed_16.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_nm.png \
|
|
docs/screenshots/Example-1.jpg docs/screenshots/Example-1.png \
|
|
docs/screenshots/Example-2.jpg docs/screenshots/Example-2.png \
|
|
docs/screenshots/Example-3.jpg docs/screenshots/Example-3.png \
|
|
docs/screenshots/pic1.png docs/screenshots/pic2.png \
|
|
docs/metrics/prometheus/grafana/grafana-minio.png \
|
|
docs/metrics/prometheus/grafana/bucket/grafana-bucket.png \
|
|
docs/metrics/prometheus/grafana/node/grafana-node.png \
|
|
docs/metrics/prometheus/grafana/replication/grafana-replication-cluster.png \
|
|
docs/metrics/prometheus/grafana/replication/grafana-replication-node.png; do
|
|
[ ! -e "${retired_path}" ] || fail "retired upstream delivery path remains: ${retired_path}"
|
|
done
|
|
|
|
require_text .github/goreleaser.yml "binary: silo"
|
|
require_text .github/goreleaser.yml 'name_template: "silo_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"'
|
|
require_text .github/goreleaser.yml "sboms:"
|
|
require_text .github/goreleaser.yml "artifacts: archive"
|
|
require_text .github/goreleaser.yml "cmd: cosign"
|
|
# shellcheck disable=SC2016 # Match the literal GoReleaser template variable.
|
|
require_text .github/goreleaser.yml 'signature: "${artifact}.sigstore.json"'
|
|
require_text .github/nfpm.yml "name: silo"
|
|
require_text .github/nfpm.yml "dst: /usr/bin/silo"
|
|
require_text .github/nfpm.yml "dst: /etc/default/silo"
|
|
require_text .github/nfpm.yml "dst: /usr/lib/sysusers.d/silo.conf"
|
|
require_text buildscripts/package/lifecycle_test.sh "Silo package lifecycle checks passed"
|
|
require_text buildscripts/verify-helm-migration.sh "Silo Helm lint, render, legacy-upgrade, and package checks passed"
|
|
require_text silo.service "Conflicts=minio.service"
|
|
require_text silo.service "EnvironmentFile=-/etc/default/minio"
|
|
require_text silo.service "EnvironmentFile=-/etc/default/silo"
|
|
# shellcheck disable=SC2016 # Match the literal service environment variables.
|
|
require_text silo.service 'ExecStart=/usr/bin/silo server $MINIO_OPTS $MINIO_VOLUMES'
|
|
require_text README.md "/etc/systemd/system/silo.service.d/10-legacy-user.conf"
|
|
require_text README_ZH.md "/etc/systemd/system/silo.service.d/10-legacy-user.conf"
|
|
require_text Dockerfile.goreleaser "COPY silo /usr/bin/silo"
|
|
require_text Dockerfile.goreleaser 'CMD ["silo"]'
|
|
require_text Dockerfile.goreleaser "MC_AMD64_SHA256="
|
|
require_text Dockerfile.goreleaser "Published checksum drift"
|
|
require_text dockerscripts/download-static-curl.sh "sha256sum -c"
|
|
require_text helm/silo/Chart.yaml "name: silo"
|
|
require_text helm/silo/values.yaml "repository: pgsty/silo"
|
|
require_text helm/silo/templates/deployment.yaml "/usr/bin/docker-entrypoint.sh silo server"
|
|
require_text helm/silo/templates/statefulset.yaml "/usr/bin/docker-entrypoint.sh silo server"
|
|
require_text docs/orchestration/docker-compose/docker-compose.yaml 'http://silo{1...4}/data{1...2}'
|
|
require_text docs/resiliency/docker-compose.yaml 'http://silo{1...4}/data{1...8}'
|
|
require_text docs/distributed/DECOMMISSION.md 'systemctl restart silo'
|
|
# shellcheck disable=SC2016 # Match the literal shell variable.
|
|
require_text docs/resiliency/resiliency-tests.sh 'docker exec resiliency-silo$NODE-1'
|
|
require_text .github/workflows/release.yml "Attest downloadable release artifacts"
|
|
require_text .github/workflows/release.yml "packages_checksums.txt"
|
|
require_text .github/workflows/docker-release.yml "Attest multi-architecture image provenance"
|
|
require_text .github/workflows/docker-release.yml "index.docker.io/pgsty/silo"
|
|
|
|
# Copyright notices credit both parties with fixed terms: upstream MinIO
|
|
# development ends at its own last year, and the fork's own term starts when
|
|
# the fork did. Deriving the upstream end year from the clock would extend
|
|
# MinIO's copyright term every January.
|
|
require_text cmd/build-constants.go 'upstreamCopyrightEndYear = "2025"'
|
|
require_text cmd/build-constants.go 'forkCopyrightStartYear = "2025"'
|
|
require_text cmd/main.go 'upstreamCopyrightEndYear'
|
|
reject_text cmd/main.go 'CopyrightYear = strconv.Itoa(time.Now().Year())'
|
|
require_text NOTICE 'MinIO Project, (C) 2015-2025 MinIO, Inc.'
|
|
require_text NOTICE 'Silo Project modifications, (C) 2025-2026 PGSTY.'
|
|
|
|
# Contribution policy: no CLA, inbound=outbound, DCO sign-off enforced in CI.
|
|
require_file .github/workflows/dco.yml
|
|
require_text .github/workflows/dco.yml "Signed-off-by"
|
|
require_text CONTRIBUTING.md "developercertificate.org"
|
|
require_text CONTRIBUTING.md "No CLA"
|
|
|
|
for file in .github/nfpm.yml Dockerfile.goreleaser silo.service; do
|
|
reject_text "${file}" "/usr/bin/minio"
|
|
reject_text "${file}" "/usr/local/bin/minio"
|
|
done
|
|
reject_text Dockerfile.goreleaser "MINIO_UPDATE_MINISIGN_PUBKEY"
|
|
reject_text buildscripts/minio-upgrade.sh "docker system prune"
|
|
reject_text buildscripts/minio-upgrade.sh "docker volume prune"
|
|
reject_text docs/orchestration/docker-compose/docker-compose.yaml 'http://minio{1...4}'
|
|
reject_text docs/resiliency/docker-compose.yaml 'http://minio{1...4}'
|
|
reject_text docs/distributed/DECOMMISSION.md 'systemctl restart minio'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'resiliency-minio'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker system prune'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker image prune'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker ps -q'
|
|
|
|
if grep -Ev '^[[:space:]]*(#|$)' silo.env | grep -q '='; then
|
|
fail "silo.env must not contain active assignments that shadow /etc/default/minio"
|
|
fi
|
|
|
|
if rg -n 'pgsty/minio:' .github/workflows Dockerfile.goreleaser helm/silo; then
|
|
fail "an active delivery surface still publishes the frozen pgsty/minio image"
|
|
fi
|
|
|
|
# The repository and its default branch are pgsty/silo and main. The invariant
|
|
# is that the old name is never a live target, not that it is never spoken: the
|
|
# READMEs have to name it to explain the rename and to point at the archived
|
|
# artifacts, which is the opposite of stranding a reader on it.
|
|
#
|
|
# So two rules. First, no live URL may resolve to the old repository anywhere,
|
|
# READMEs included.
|
|
stale_repo_url="$(rg -n -e 'github\.com/pgsty/minio' -e 'hub\.docker\.com/r/pgsty/minio' \
|
|
--glob '!.git/**' --glob '!dist/**' \
|
|
--glob '!SILO_REBRANDING_MIGRATION.md' \
|
|
--glob '!buildscripts/rebrand-guard/compat-baseline.json' . |
|
|
sed 's#^\./##' | grep -v '^buildscripts/verify-rebrand\.sh:' || true)"
|
|
if [ -n "${stale_repo_url}" ]; then
|
|
printf '%s\n' "${stale_repo_url}" >&2
|
|
fail "a link still resolves to the pre-rename pgsty/minio repository"
|
|
fi
|
|
|
|
# Second, the bare name may only appear where it is deliberate: the pinned
|
|
# pre-rebrand image digest in the upgrade test, the two guards that refuse a
|
|
# legacy image, and the two READMEs that document the rename and the archived
|
|
# minio branch.
|
|
repo_guard_allowlist='^(buildscripts/minio-upgrade\.sh|buildscripts/verify-rebrand\.sh|buildscripts/helm-migration-guard/main\.go|README\.md|README_ZH\.md):'
|
|
stale_repo="$(rg -n 'pgsty/minio' --glob '!.git/**' --glob '!dist/**' \
|
|
--glob '!SILO_REBRANDING_MIGRATION.md' \
|
|
--glob '!buildscripts/rebrand-guard/compat-baseline.json' . |
|
|
sed 's#^\./##' | grep -Ev "${repo_guard_allowlist}" || true)"
|
|
if [ -n "${stale_repo}" ]; then
|
|
printf '%s\n' "${stale_repo}" >&2
|
|
fail "a source reference still names the pre-rename pgsty/minio repository"
|
|
fi
|
|
|
|
stale_branch="$(rg -n 'pgsty/silo/(blob/|tree/|raw/)?master' \
|
|
--glob '!.git/**' --glob '!dist/**' . || true)"
|
|
if [ -n "${stale_branch}" ]; then
|
|
printf '%s\n' "${stale_branch}" >&2
|
|
fail "a link still targets the retired master branch; raw and Actions URLs do not follow a branch rename"
|
|
fi
|
|
|
|
for workflow in .github/workflows/go.yml .github/workflows/vulncheck.yml; do
|
|
if rg -q '^\s+- master$' "${workflow}"; then
|
|
fail "${workflow} still filters on master and would go silently dormant on main"
|
|
fi
|
|
require_text "${workflow}" " - main"
|
|
done
|
|
|
|
network_hits="$(rg -n --glob '*.go' --glob '!**/*_test.go' \
|
|
'https?://[^"`[:space:]]*(dl\.min\.io|subnet\.min\.io|api\.min\.io|slack\.min\.io|play\.min\.io)' \
|
|
cmd internal || true)"
|
|
network_hits="$(printf '%s\n' "${network_hits}" | grep -Ev '^[^:]+:[0-9]+:[[:space:]]*//' || true)"
|
|
if [ -n "${network_hits}" ]; then
|
|
printf '%s\n' "${network_hits}" >&2
|
|
fail "runtime code still contains an upstream MinIO service endpoint"
|
|
fi
|
|
|
|
require_text cmd/build-constants.go 'MinioReleaseBaseURL = ""'
|
|
require_text cmd/globals.go "globalInplaceUpdateDisabled = true"
|
|
reject_text cmd/globals.go "subnetAdminPublicKey"
|
|
reject_text cmd/admin-handlers.go "getSubnetAdminPublicKey"
|
|
|
|
echo "Silo delivery and runtime rebrand checks passed"
|