This is an automated email from the ASF dual-hosted git repository.
tustvold pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-rs-object-store.git
The following commit(s) were added to refs/heads/main by this push:
new 47e7a75 ci: use RustFS for presigned URL tests (#898)
47e7a75 is described below
commit 47e7a75ece7c662fee057f0fe844d1409883fd3b
Author: Xin Sun <[email protected]>
AuthorDate: Sat Oct 31 18:11:00 2026 +0800
ci: use RustFS for presigned URL tests (#898)
---
.github/workflows/ci.yml | 26 ++++++++++++++------------
CONTRIBUTING.md | 14 +++++++-------
2 files changed, 21 insertions(+), 19 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dadfcf6..efdb076 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -215,14 +215,16 @@ jobs:
AWS_SSE_KMS_KEY_ID=$(jq -r .KeyMetadata.KeyId <<< "$KMS_KEY")
echo "AWS_SSE_KMS_KEY_ID=$AWS_SSE_KMS_KEY_ID" >> $GITHUB_ENV
- # MinIO validates SigV4 (LocalStack does not), so it backs the
presigned-URL
+ # RustFS validates SigV4 (LocalStack does not), so it backs the
presigned-URL
# signature-enforcement tests below.
- - name: Setup MinIO (SigV4-validating S3)
+ - name: Setup RustFS (SigV4-validating S3)
run: |
- MINIO_CONTAINER=$(docker run -d -p 9000:9000 -e
MINIO_ROOT_USER=minio -e MINIO_ROOT_PASSWORD=minio123 minio/minio server /data)
- echo "MINIO_CONTAINER=$MINIO_CONTAINER" >> $GITHUB_ENV
- for _ in $(seq 1 30); do curl -fsS
http://localhost:9000/minio/health/ready && break; sleep 1; done
- AWS_ACCESS_KEY_ID=minio AWS_SECRET_ACCESS_KEY=minio123 \
+ RUSTFS_CONTAINER=$(docker run -d -p 9000:9000 \
+ -e RUSTFS_ACCESS_KEY=rustfs -e RUSTFS_SECRET_KEY=rustfs123 \
+ -e RUSTFS_CONSOLE_ENABLE=false rustfs/rustfs:1.0.0)
+ echo "RUSTFS_CONTAINER=$RUSTFS_CONTAINER" >> $GITHUB_ENV
+ for _ in $(seq 1 30); do curl -fsS
http://localhost:9000/health/ready && break; sleep 1; done
+ AWS_ACCESS_KEY_ID=rustfs AWS_SECRET_ACCESS_KEY=rustfs123 \
aws --endpoint-url=http://localhost:9000 s3 mb
s3://test-bucket-for-signing
- name: Configure Azurite (Azure emulation)
@@ -253,15 +255,15 @@ jobs:
# These tests assert the backend REJECTS a tampered signature, an
expired URL, or an
# altered signed header, so they need a backend that validates SigV4 and
are gated behind
# TEST_S3_SIGNATURE_ENFORCEMENT (skipped against LocalStack elsewhere).
Run them against
- # MinIO. `env -u` drops the job-wide SSE-KMS settings, whose LocalStack
key MinIO does not
+ # RustFS. `env -u` drops the job-wide SSE-KMS settings, whose LocalStack
key RustFS does not
# have; the tests only need a plain authenticated round trip.
- - name: Run presigned-URL signature-enforcement tests (MinIO)
+ - name: Run presigned-URL signature-enforcement tests (RustFS)
run: env -u AWS_SERVER_SIDE_ENCRYPTION -u AWS_SSE_KMS_KEY_ID cargo
test --lib --features=aws aws::tests::signed_url
env:
TEST_S3_SIGNATURE_ENFORCEMENT: 1
AWS_ENDPOINT: http://localhost:9000
- AWS_ACCESS_KEY_ID: minio
- AWS_SECRET_ACCESS_KEY: minio123
+ AWS_ACCESS_KEY_ID: rustfs
+ AWS_SECRET_ACCESS_KEY: rustfs123
AWS_BUCKET: test-bucket-for-signing
# Exercise the `ring` crypto provider at runtime (the other jobs only
@@ -283,9 +285,9 @@ jobs:
if: ${{ !cancelled() }}
run: docker logs $LOCALSTACK_CONTAINER
- - name: MinIO Output
+ - name: RustFS Output
if: ${{ !cancelled() }}
- run: docker logs $MINIO_CONTAINER
+ run: docker logs $RUSTFS_CONTAINER
- name: EC2 Metadata Output
if: ${{ !cancelled() }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e15db34..74cbdae 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -156,28 +156,28 @@ a tampered signature, an expired URL, or a signed header
whose value the client
require a backend that actually validates SigV4. LocalStack does not (it
accepts presigned
requests regardless of signature or expiry), so these tests are gated behind a
separate
`TEST_S3_SIGNATURE_ENFORCEMENT` variable rather than running in the main
LocalStack integration
-pass. CI runs them against MinIO instead, which does validate SigV4 (the "Run
presigned-URL
-signature-enforcement tests (MinIO)" step in `ci.yml`), so they stay
exercised. The steps below
+pass. CI runs them against RustFS instead, which does validate SigV4 (the "Run
presigned-URL
+signature-enforcement tests (RustFS)" step in `ci.yml`), so they stay
exercised. The steps below
reproduce that locally or point at real S3.
These tests use a dedicated `test-bucket-for-signing` bucket so their writes
cannot contaminate the
shared `test-bucket` whose exact contents `s3_test` asserts. To point at a
bucket in your own
account instead, set `OBJECT_STORE_SIGNING_BUCKET` (no source edit required).
-MinIO is the recommended local backend: unlike LocalStack it validates SigV4
signatures and expiry,
+RustFS is the recommended local backend: unlike LocalStack it validates SigV4
signatures and expiry,
so the enforcement assertions actually exercise. Plain HTTP is enough (these
tests don't use SSE-C,
so the self-signed-cert setup from the SSE-C section is not needed, and the
test client would
reject that cert anyway):
```shell
docker run -d -p 9000:9000 \
- -e MINIO_ROOT_USER=minio -e MINIO_ROOT_PASSWORD=minio123 \
- minio/minio server /data
+ -e RUSTFS_ACCESS_KEY=rustfs -e RUSTFS_SECRET_KEY=rustfs123 \
+ -e RUSTFS_CONSOLE_ENABLE=false rustfs/rustfs:1.0.0
export AWS_ENDPOINT=http://localhost:9000
export AWS_ALLOW_HTTP=true
-export AWS_ACCESS_KEY_ID=minio
-export AWS_SECRET_ACCESS_KEY=minio123
+export AWS_ACCESS_KEY_ID=rustfs
+export AWS_SECRET_ACCESS_KEY=rustfs123
export AWS_REGION=us-east-1
aws --endpoint-url=http://localhost:9000 s3 mb s3://test-bucket-for-signing
```
