mirror of
https://github.com/pgsty/minio.git
synced 2026-07-15 16:30:29 +03:00
Feng Ruohang
df627ff896
Update the module Go directive and release Docker build images from Go 1.26.2 to Go 1.26.4 so local, CI, hotfix, and release builds use the same patched toolchain. Keep ordinary Go module requirements and replacements unchanged; this intentionally avoids a third-party dependency refresh while allowing container system packages to refresh through the newer golang Alpine base image and existing apk resolution. Update the security advisory index to record the Go 1.26.4 toolchain bump alongside the earlier Go 1.26.2 security update. Verified with go build ./..., go vet ./cmd/, and focused cmd tests. go mod tidy -diff was attempted as a read-only dependency drift check but could not complete because proxy.golang.org timed out while fetching uncached transitive test modules. Co-authored-by: Codex <codex@openai.com>
97 lines
3.7 KiB
Docker
97 lines
3.7 KiB
Docker
FROM golang:1.26.4-alpine AS build
|
|
|
|
ARG TARGETARCH
|
|
|
|
ENV GOPATH=/go
|
|
ENV CGO_ENABLED=0
|
|
|
|
ARG MC_REPO=pgsty/mc
|
|
ARG MC_VERSION=latest
|
|
|
|
RUN apk add -U --no-cache \
|
|
ca-certificates \
|
|
bash \
|
|
curl \
|
|
jq && \
|
|
case "${TARGETARCH}" in \
|
|
amd64) MC_ARCH=amd64 ;; \
|
|
arm64) MC_ARCH=arm64 ;; \
|
|
*) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
|
|
esac && \
|
|
if [ "${MC_VERSION}" = "latest" ]; then \
|
|
MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/latest"; \
|
|
else \
|
|
MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/tags/${MC_VERSION}"; \
|
|
fi && \
|
|
curl -fsSL "${MC_RELEASE_URL}" -o /tmp/mc-release.json && \
|
|
MC_ARCHIVE_URL=$(jq -r --arg arch "${MC_ARCH}" \
|
|
'.assets[] | select(.name | endswith("_linux_" + $arch + ".tar.gz")) | .browser_download_url' \
|
|
/tmp/mc-release.json | head -n 1) && \
|
|
MC_CHECKSUM_URL=$(jq -r \
|
|
'.assets[] | select(.name | endswith("_checksums.txt")) | .browser_download_url' \
|
|
/tmp/mc-release.json | head -n 1) && \
|
|
[ -n "${MC_ARCHIVE_URL}" ] || { echo "Cannot find mcli archive for linux/${MC_ARCH}"; exit 1; } && \
|
|
[ -n "${MC_CHECKSUM_URL}" ] || { echo "Cannot find mcli checksums file"; exit 1; } && \
|
|
ARCHIVE_NAME=$(basename "${MC_ARCHIVE_URL}") && \
|
|
echo "Downloading ${ARCHIVE_NAME} ..." && \
|
|
curl -fsSL "${MC_ARCHIVE_URL}" -o /tmp/mcli.tar.gz && \
|
|
curl -fsSL "${MC_CHECKSUM_URL}" -o /tmp/mcli_checksums.txt && \
|
|
EXPECTED=$(grep " ${ARCHIVE_NAME}$" /tmp/mcli_checksums.txt | awk '{print $1}') && \
|
|
ACTUAL=$(sha256sum /tmp/mcli.tar.gz | awk '{print $1}') && \
|
|
[ -n "${EXPECTED}" ] || { echo "Checksum entry not found for ${ARCHIVE_NAME}"; exit 1; } && \
|
|
[ "${EXPECTED}" = "${ACTUAL}" ] || { echo "Checksum mismatch: expected ${EXPECTED}, got ${ACTUAL}"; exit 1; } && \
|
|
echo "Checksum OK: ${ACTUAL}" && \
|
|
mkdir -p /tmp/mcli-extract && \
|
|
tar -xzf /tmp/mcli.tar.gz -C /tmp/mcli-extract/ && \
|
|
if [ -f /tmp/mcli-extract/mcli ]; then \
|
|
cp /tmp/mcli-extract/mcli /go/bin/mcli; \
|
|
elif [ -f /tmp/mcli-extract/mc ]; then \
|
|
cp /tmp/mcli-extract/mc /go/bin/mcli; \
|
|
else \
|
|
echo "No mc or mcli binary found in archive:"; ls -la /tmp/mcli-extract/; exit 1; \
|
|
fi && \
|
|
chmod +x /go/bin/mcli && \
|
|
ln -sf mcli /go/bin/mc
|
|
|
|
COPY dockerscripts/download-static-curl.sh /build/download-static-curl
|
|
RUN chmod +x /build/download-static-curl && \
|
|
/build/download-static-curl
|
|
|
|
FROM registry.access.redhat.com/ubi9/ubi:latest AS certs
|
|
RUN dnf -y install ca-certificates && \
|
|
update-ca-trust && \
|
|
cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf
|
|
|
|
FROM registry.access.redhat.com/ubi9/ubi-micro:latest
|
|
|
|
LABEL maintainer="pgsty <https://github.com/pgsty/minio>" \
|
|
description="MinIO community fork, build by pgsty"
|
|
|
|
ENV MINIO_ACCESS_KEY_FILE=access_key \
|
|
MINIO_SECRET_KEY_FILE=secret_key \
|
|
MINIO_ROOT_USER_FILE=access_key \
|
|
MINIO_ROOT_PASSWORD_FILE=secret_key \
|
|
MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
|
|
MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
|
|
MINIO_CONFIG_ENV_FILE=config.env \
|
|
MC_CONFIG_DIR=/tmp/.mc
|
|
|
|
COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY minio /usr/bin/minio
|
|
COPY --from=build /go/bin/mcli /usr/bin/mcli
|
|
COPY --from=build /go/bin/curl* /usr/bin/
|
|
COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
|
|
COPY LICENSE /licenses/LICENSE
|
|
COPY CREDITS /licenses/CREDITS
|
|
|
|
RUN chmod +x /usr/bin/minio /usr/bin/mcli /usr/bin/docker-entrypoint.sh && \
|
|
ln -sf mcli /usr/bin/mc
|
|
|
|
EXPOSE 9000
|
|
VOLUME ["/data"]
|
|
|
|
ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
|
|
CMD ["minio"]
|