mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 07:43:29 +03:00
Feng Ruohang
6613c2a3cb
The test and verification scripts invoked ./minio and pulled their tooling from upstream infrastructure with no integrity check. Every `curl | tar` of a client or an old server binary was an unverified execution path in a script that regularly runs as a privileged user, and several fetched a floating "latest". Two installers replace all of it: - install-mcli.sh resolves a pinned pgsty/mc release, downloads the archive and its checksum manifest, requires exactly one valid manifest entry for the asset, verifies it, and installs. MCLI_BIN with a mandatory MCLI_SHA256 lets an offline or air-gapped run supply its own binary, still checksum-checked. - install-verified-fixture.sh takes source, expected SHA-256 and target, and refuses anything that does not match. Sources may be a URL or a local file. Every script that previously downloaded mc now calls install-mcli.sh. The three places that genuinely need an upstream artifact - the old MinIO server binary for the LDAP IAM upgrade-import test, the 2021 mc for the three-site replication test, and the functional-tests.sh fixture - go through install-verified-fixture.sh with the digest recorded inline. Those dl.min.io URLs remain on purpose: they are historical upstream artifacts needed to prove upgrade compatibility, and they are now pinned and verified rather than trusted. The scripts otherwise switch to ./silo, silo.service, the silo container and compose service names, and SILO_CONFIG_DIR. run-multi-site-minio-idp.sh is renamed to run-multi-site-silo-idp.sh with the Makefile target following. buildscripts/minio-upgrade.sh keeps its name and its `minio server` argv - it exists to test the MinIO-to-Silo upgrade, so the old side must stay old - but it is now pinned to an image digest rather than a tag, and its `docker system prune` and `docker volume prune` calls are removed. Those ran unfiltered against the developer's whole Docker installation; the resiliency tests had the same problem and lose their prune and `docker ps -q` sweeps too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
34 lines
1.0 KiB
Python
34 lines
1.0 KiB
Python
#!/usr/bin/env/env python3
|
|
import boto3
|
|
|
|
s3 = boto3.client('s3',
|
|
endpoint_url='http://localhost:9000',
|
|
aws_access_key_id='minio',
|
|
aws_secret_access_key='silo123',
|
|
region_name='us-east-1')
|
|
|
|
r = s3.select_object_content(
|
|
Bucket='mycsvbucket',
|
|
Key='sampledata/TotalPopulation.csv.gz',
|
|
ExpressionType='SQL',
|
|
Expression="select * from s3object s where s.Location like '%United States%'",
|
|
InputSerialization={
|
|
'CSV': {
|
|
"FileHeaderInfo": "USE",
|
|
},
|
|
'CompressionType': 'GZIP',
|
|
},
|
|
OutputSerialization={'CSV': {}},
|
|
)
|
|
|
|
for event in r['Payload']:
|
|
if 'Records' in event:
|
|
records = event['Records']['Payload'].decode('utf-8')
|
|
print(records)
|
|
elif 'Stats' in event:
|
|
statsDetails = event['Stats']['Details']
|
|
print("Stats details bytesScanned: ")
|
|
print(statsDetails['BytesScanned'])
|
|
print("Stats details bytesProcessed: ")
|
|
print(statsDetails['BytesProcessed'])
|