feat(object-store): declare workflows, pkg and the thirteen package identities

sean commented

2026-09-10 01:08:29 +00:00

Owner

The last two buckets and their thirteen writers, policies verbatim from MinIO under the same user names; pkg declared anonymous download for pkg-host; a whole-bucket migration-writer for the two mirrors. Contract now maps resources to buckets by first path segment like the authority. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 01:08:29 +00:00

feat(object-store): declare workflows, pkg and the thirteen package identities

binjovi/ci Binjovi completed the frozen plan

Details

0b0d658186

The last two buckets on MinIO, and the identities that write them.

WHY THIRTEEN. The live MinIO tenant carries 55 policies on workflows and 30 on
pkg. Twelve of the thirteen identities that matter are 52-day-old Secrets in
namespace workflows that nothing in git produces -- the retired MinIO resource
operator and Pipelines made them -- and the other seventy-odd are the same
generation, dead. The set declared here is what seanfarm's own
binjovi/*-agent-secrets.yaml files actually deliver to the package agents,
read out of git rather than out of the tenant. Each policy is the MinIO one,
verbatim, so nothing an agent could do on MinIO is lost or gained on RustFS.

THE NAMES ARE THE MINIO USER NAMES, on purpose. Every package agent mounts its
binjovi-native-*-s3 Secret and reads two files, accesskey and secretkey; the
publisher tools hand that access key to `mc alias set`. Declaring the RustFS
identities under the same names means the value in accesskey never changes,
so the cutover is a store change in one ExternalSecret per identity and an
endpoint change in one image. No agent learns anything new.

PREFIX-SCOPED POLICIES ARE ACCEPTED AS THEY ARE. These identities are scoped
to prefixes inside the shared buckets -- workflows/zdns/staging/*, pkg/rpg-*/
and so on -- and the authority already maps a resource to its bucket by the
first path segment (ObjectStorePlan.policy_resource/2). tests/object-store-test
did not: it stripped only a trailing "/*", so any prefix would have failed the
contract while the authority accepted it. The two must agree; the test now
does what the authority does. The converge's isolation proof remains
bucket-level, exactly as it was on MinIO.

pkg IS PUBLIC, AND SAYS SO. It is the RPM repository, and pkg-host is a plain
HTTP proxy with no S3 SDK and no signing, so the bucket must answer
unauthenticated GETs. "anonymous": "download" is the declaration; the contract
allows that key, refuses any other value, and requires that pkg is the ONLY
bucket carrying it. Five new negative controls, each confirmed red: anonymous
upload, a second public bucket, anonymous public, the key misspelled, and a
prefix resource pointing at an undeclared bucket.

Held until seanfarm delivers the thirteen generated keys to the converge; a
release before that fails, correctly, with "no generated key for identity".

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 0b0d658186 into trunk

2026-09-10 01:22:49 +00:00

Rows
Columns

feat(object-store): declare workflows, pkg and the thirteen package identities #171