mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
bd8df51665
A rebrand of this size cannot be reviewed by reading the diff. The risk is not what was renamed but what was renamed by accident: an environment variable, a metric, a header, a route, a storage marker or an exported symbol that some deployment depends on. So the invariants get a machine check. rebrand-guard extracts the identifiers a product rename must not touch - the go.mod module path, github.com/minio/* imports, MINIO_* variables, minio_* metric literals, x-minio-* headers, route string literals, the hardcoded grid routes in internal/grid/manager.go, the reserved bucket root, .minio.sys markers, arn:minio and minio:s3 policy values, every exported symbol in cmd/ and internal/, and every branded string literal - and compares them to a checked-in baseline. Any removal or addition fails the build, in both directions, so a future change cannot quietly drop one either. The recorded delta against the pre-rebrand tree is: module path, 137 imports, 19 metrics, 15 storage markers, 58 policy values and all 9014 exported symbols byte-identical; environment 437 -> 436, headers 85 -> 84, routes 331 -> 330. Each of those three is accounted for. MINIO_CONFIG_DIR and MINIO_VERSION were a shell local and a compose variable in test scripts, never server settings. x-minio-common was a docker-compose extension key, never an HTTP header. /api/health/upload was the SUBNET upload path in the deleted callhome.go. verify-rebrand.sh covers what the identifier guard cannot see: that the retired upstream delivery paths stay deleted, that the packaging and container files name silo, that silo.service keeps its Conflicts and both EnvironmentFile lines, that silo.env contains no active assignment that would shadow the legacy file, that no active delivery surface still publishes pgsty/minio, and that no non-test Go source contains a dl.min.io, subnet.min.io, api.min.io, slack.min.io or play.min.io URL. Both, plus the entrypoint argv test, run in go.yml, release.yml and test-release.yml. test-release.yml also gets the path filters right: it was watching minio.service, which no longer exists, so the packaging gate would have gone silently dormant. It now watches the unit, defaults, sysusers, lifecycle scripts, helm chart and both guards, and asserts the four-file payload, the absence of any cross-name Provides/Obsoletes/Conflicts, and that a container started with the legacy `minio server` argv really runs silo as PID 1. release.yml and docker-release.yml additionally verify that the checked-out revision matches GITHUB_SHA before building. GitHub's OIDC certificate records GITHUB_SHA, not the ref passed to actions/checkout, so a manual dispatch from the wrong ref would have produced provenance describing different source from the bytes being published. They now emit SBOMs and attestations for archives, packages and images, and docker-release verifies the release workflow's attestation on every artifact it consumes. Images publish to pgsty/silo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
153 lines
7.0 KiB
Bash
Executable File
153 lines
7.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_dir="$(cd "${script_dir}/.." && pwd)"
|
|
cd "${repo_dir}"
|
|
|
|
fail() {
|
|
echo "Silo rebrand verification failed: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_file() {
|
|
[ -f "$1" ] || fail "missing required file: $1"
|
|
}
|
|
|
|
require_text() {
|
|
local file="$1"
|
|
local text="$2"
|
|
grep -Fq -- "${text}" "${file}" || fail "${file} does not contain: ${text}"
|
|
}
|
|
|
|
reject_text() {
|
|
local file="$1"
|
|
local text="$2"
|
|
if grep -Fq -- "${text}" "${file}"; then
|
|
fail "${file} still contains forbidden delivery text: ${text}"
|
|
fi
|
|
}
|
|
|
|
for file in \
|
|
.github/goreleaser.yml \
|
|
.github/nfpm.yml \
|
|
buildscripts/package/lifecycle_test.sh \
|
|
buildscripts/verify-helm-migration.sh \
|
|
Dockerfile.goreleaser \
|
|
dockerscripts/download-static-curl.sh \
|
|
dockerscripts/docker-entrypoint.sh \
|
|
helm/silo/Chart.yaml \
|
|
helm/silo/values.yaml \
|
|
silo.service \
|
|
silo.env \
|
|
silo.sysusers; do
|
|
require_file "${file}"
|
|
done
|
|
|
|
for retired_path in \
|
|
CNAME _config.yml index.yaml helm-reindex.sh helm/minio helm-releases \
|
|
Dockerfile Dockerfile.cicd Dockerfile.hotfix Dockerfile.release \
|
|
Dockerfile.release.old_cpu Dockerfile.scratch docker-buildx.sh \
|
|
minio.service cmd/callhome.go buildscripts/upgrade-tests .github/logo.svg \
|
|
docs/federation/lookup/bucket-lookup.png \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.jpg \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.png \
|
|
docs/screenshots/Minio_Cloud_Native_Arch.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_8.jpg \
|
|
docs/screenshots/Architecture-diagram_distributed_8.png \
|
|
docs/screenshots/Architecture-diagram_distributed_8.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_16.jpg \
|
|
docs/screenshots/Architecture-diagram_distributed_16.png \
|
|
docs/screenshots/Architecture-diagram_distributed_16.svg \
|
|
docs/screenshots/Architecture-diagram_distributed_nm.png \
|
|
docs/screenshots/Example-1.jpg docs/screenshots/Example-1.png \
|
|
docs/screenshots/Example-2.jpg docs/screenshots/Example-2.png \
|
|
docs/screenshots/Example-3.jpg docs/screenshots/Example-3.png \
|
|
docs/screenshots/pic1.png docs/screenshots/pic2.png \
|
|
docs/metrics/prometheus/grafana/grafana-minio.png \
|
|
docs/metrics/prometheus/grafana/bucket/grafana-bucket.png \
|
|
docs/metrics/prometheus/grafana/node/grafana-node.png \
|
|
docs/metrics/prometheus/grafana/replication/grafana-replication-cluster.png \
|
|
docs/metrics/prometheus/grafana/replication/grafana-replication-node.png; do
|
|
[ ! -e "${retired_path}" ] || fail "retired upstream delivery path remains: ${retired_path}"
|
|
done
|
|
|
|
require_text .github/goreleaser.yml "binary: silo"
|
|
require_text .github/goreleaser.yml 'name_template: "silo_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"'
|
|
require_text .github/goreleaser.yml "sboms:"
|
|
require_text .github/goreleaser.yml "artifacts: archive"
|
|
require_text .github/goreleaser.yml "cmd: cosign"
|
|
# shellcheck disable=SC2016 # Match the literal GoReleaser template variable.
|
|
require_text .github/goreleaser.yml 'signature: "${artifact}.sigstore.json"'
|
|
require_text .github/nfpm.yml "name: silo"
|
|
require_text .github/nfpm.yml "dst: /usr/bin/silo"
|
|
require_text .github/nfpm.yml "dst: /etc/default/silo"
|
|
require_text .github/nfpm.yml "dst: /usr/lib/sysusers.d/silo.conf"
|
|
require_text buildscripts/package/lifecycle_test.sh "Silo package lifecycle checks passed"
|
|
require_text buildscripts/verify-helm-migration.sh "Silo Helm lint, render, legacy-upgrade, and package checks passed"
|
|
require_text silo.service "Conflicts=minio.service"
|
|
require_text silo.service "EnvironmentFile=-/etc/default/minio"
|
|
require_text silo.service "EnvironmentFile=-/etc/default/silo"
|
|
# shellcheck disable=SC2016 # Match the literal service environment variables.
|
|
require_text silo.service 'ExecStart=/usr/bin/silo server $MINIO_OPTS $MINIO_VOLUMES'
|
|
require_text README.md "/etc/systemd/system/silo.service.d/10-legacy-user.conf"
|
|
require_text README_ZH.md "/etc/systemd/system/silo.service.d/10-legacy-user.conf"
|
|
require_text Dockerfile.goreleaser "COPY silo /usr/bin/silo"
|
|
require_text Dockerfile.goreleaser 'CMD ["silo"]'
|
|
require_text Dockerfile.goreleaser "MC_AMD64_SHA256="
|
|
require_text Dockerfile.goreleaser "Published checksum drift"
|
|
require_text dockerscripts/download-static-curl.sh "sha256sum -c"
|
|
require_text helm/silo/Chart.yaml "name: silo"
|
|
require_text helm/silo/values.yaml "repository: pgsty/silo"
|
|
require_text helm/silo/templates/deployment.yaml "/usr/bin/docker-entrypoint.sh silo server"
|
|
require_text helm/silo/templates/statefulset.yaml "/usr/bin/docker-entrypoint.sh silo server"
|
|
require_text docs/orchestration/docker-compose/docker-compose.yaml 'http://silo{1...4}/data{1...2}'
|
|
require_text docs/resiliency/docker-compose.yaml 'http://silo{1...4}/data{1...8}'
|
|
require_text docs/distributed/DECOMMISSION.md 'systemctl restart silo'
|
|
# shellcheck disable=SC2016 # Match the literal shell variable.
|
|
require_text docs/resiliency/resiliency-tests.sh 'docker exec resiliency-silo$NODE-1'
|
|
require_text .github/workflows/release.yml "Attest downloadable release artifacts"
|
|
require_text .github/workflows/release.yml "packages_checksums.txt"
|
|
require_text .github/workflows/docker-release.yml "Attest multi-architecture image provenance"
|
|
require_text .github/workflows/docker-release.yml "index.docker.io/pgsty/silo"
|
|
|
|
for file in .github/nfpm.yml Dockerfile.goreleaser silo.service; do
|
|
reject_text "${file}" "/usr/bin/minio"
|
|
reject_text "${file}" "/usr/local/bin/minio"
|
|
done
|
|
reject_text Dockerfile.goreleaser "MINIO_UPDATE_MINISIGN_PUBKEY"
|
|
reject_text buildscripts/minio-upgrade.sh "docker system prune"
|
|
reject_text buildscripts/minio-upgrade.sh "docker volume prune"
|
|
reject_text docs/orchestration/docker-compose/docker-compose.yaml 'http://minio{1...4}'
|
|
reject_text docs/resiliency/docker-compose.yaml 'http://minio{1...4}'
|
|
reject_text docs/distributed/DECOMMISSION.md 'systemctl restart minio'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'resiliency-minio'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker system prune'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker image prune'
|
|
reject_text docs/resiliency/resiliency-tests.sh 'docker ps -q'
|
|
|
|
if grep -Ev '^[[:space:]]*(#|$)' silo.env | grep -q '='; then
|
|
fail "silo.env must not contain active assignments that shadow /etc/default/minio"
|
|
fi
|
|
|
|
if rg -n 'pgsty/minio:' .github/workflows Dockerfile.goreleaser helm/silo; then
|
|
fail "an active delivery surface still publishes the frozen pgsty/minio image"
|
|
fi
|
|
|
|
network_hits="$(rg -n --glob '*.go' --glob '!**/*_test.go' \
|
|
'https?://[^"`[:space:]]*(dl\.min\.io|subnet\.min\.io|api\.min\.io|slack\.min\.io|play\.min\.io)' \
|
|
cmd internal || true)"
|
|
network_hits="$(printf '%s\n' "${network_hits}" | grep -Ev '^[^:]+:[0-9]+:[[:space:]]*//' || true)"
|
|
if [ -n "${network_hits}" ]; then
|
|
printf '%s\n' "${network_hits}" >&2
|
|
fail "runtime code still contains an upstream MinIO service endpoint"
|
|
fi
|
|
|
|
require_text cmd/build-constants.go 'MinioReleaseBaseURL = ""'
|
|
require_text cmd/globals.go "globalInplaceUpdateDisabled = true"
|
|
reject_text cmd/globals.go "subnetAdminPublicKey"
|
|
reject_text cmd/admin-handlers.go "getSubnetAdminPublicKey"
|
|
|
|
echo "Silo delivery and runtime rebrand checks passed"
|