mirror of
https://github.com/pgsty/minio.git
synced 2026-09-12 21:44:04 +03:00
Feng Ruohang
48e1846525
Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0 across Server listeners, node links and outbound transports. Remove the unused shared curve option and add wire-level regression coverage. Document CA trust and TLS upgrade behavior, retain the investigation artifacts, and exclude their synthetic routes from the rebrand guard. The product compatibility baseline remains unchanged. Validation: focused race tests, HTTP tests, lint, compatibility guard positive/negative controls, and a fresh Linux build with three isolated OIDC integration scenarios all pass. Adversarial review: Claude Code Fable 5.1, max effort. Final verdict: APPROVE FOR COMMIT. Signed-off-by: Feng Ruohang <rh@vonng.com>
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
# Historical OIDC-only candidate; superseded by ../go127-stack.md. Do not apply on top of the stack fix.
|
|
--- a/cmd/utils.go
|
|
+++ b/cmd/utils.go
|
|
@@ -654,6 +654,14 @@
|
|
return NewHTTPTransportWithTimeout(1 * time.Minute)
|
|
}
|
|
|
|
+// NewOpenIDHTTPTransport uses Go defaults for external identity-provider key exchange.
|
|
+// This lets tlsmlkem/tlssecpmlkem configure their documented default sets.
|
|
+func NewOpenIDHTTPTransport() *http.Transport {
|
|
+ tr := NewHTTPTransport()
|
|
+ tr.TLSClientConfig.CurvePreferences = nil
|
|
+ return tr
|
|
+}
|
|
+
|
|
// Default values for dial timeout
|
|
const defaultDialTimeout = 5 * time.Second
|
|
|
|
--- a/cmd/iam.go
|
|
+++ b/cmd/iam.go
|
|
@@ -277,7 +277,7 @@
|
|
for {
|
|
if !openidInit {
|
|
openidConfig, err := openid.LookupConfig(s,
|
|
- xhttp.WithUserAgent(NewHTTPTransport(), func() string {
|
|
+ xhttp.WithUserAgent(NewOpenIDHTTPTransport(), func() string {
|
|
return getUserAgent(getMinioMode())
|
|
}), xhttp.DrainBody, globalSite.Region())
|
|
if err != nil {
|
|
--- a/cmd/config-current.go
|
|
+++ b/cmd/config-current.go
|
|
@@ -352,7 +352,7 @@
|
|
}
|
|
case config.IdentityOpenIDSubSys:
|
|
if _, err := openid.LookupConfig(s,
|
|
- xhttp.WithUserAgent(NewHTTPTransport(), func() string {
|
|
+ xhttp.WithUserAgent(NewOpenIDHTTPTransport(), func() string {
|
|
return getUserAgent(getMinioMode())
|
|
}), xhttp.DrainBody, globalSite.Region()); err != nil {
|
|
return err
|