install-linux-binary.sh and install-mac.sh were 443 lines that differed
in three places: the OS check and architecture allowlist, the platform
token in the pointer URL and asset name, and clearing the macOS
quarantine attribute. The other ~190 lines were identical.
That duplication already cost something. Hardening the installers meant
applying five fixes twice, by hand, in parallel -- pin-bypass path
traversal, pipeline masking, digest normalisation, directory
destination, and the cross-origin digest check. The next fix would have
had the same shape, and eventually one would land in only one file.
Merge them into install-binary.sh, which detects Linux or macOS and
validates the architecture against what is published for that platform:
Linux ships amd64 and arm64, macOS ships Apple Silicon only.
The release workflow publishes it under the old names as well, so URLs
already in the wild, in the docs, and in the blog post keep working and
pick up the merged behaviour on every release. Nothing needs to change
on the reader's side, and there is no window where a documented command
404s.
Two benign consequences: install-mac.sh now also works on Linux and
install-linux-binary.sh on macOS, and error messages self-identify as
install-binary.sh whichever URL was fetched.
install-linux-binary.sh was adapted from install-mac.sh and inherited
several weaknesses from it. Fix them in all three installers so the
platforms behave consistently.
- Validate the release tag on the pinned path as well as the resolved
one. BUCKIT_VERSION previously bypassed the RELEASE.* guard entirely,
so a value like ../../evil reached the download URL as path traversal.
Both paths now share one check, and it requires a non-empty suffix and
a conservative character set, rejecting '/', whitespace, control
characters, and URL delimiters.
- Require the gh-pages pointer filename to actually carry the buckit.
prefix. Stripping it with ${name#buckit.} silently accepted a payload
that never had it.
- Fetch the published checksum into a variable before parsing it. Piping
the fetch straight into awk hid a failed transfer behind awk's exit
status; a partial response with a complete leading token could pass.
The hash utilities are now invoked outside a pipeline for the same
reason.
- Normalise digests to lowercase and require exactly 64 hex characters,
so an uppercase digest cannot cause a spurious mismatch and a truncated
record cannot be compared as if it were valid.
- Refuse to run when the destination is a directory. mv and Move-Item
both place the temp file inside it, after which the installer reported
success while leaving nothing runnable at the path it printed.
Also cross-check the pointer digest against the release-host digest on
macOS and Windows, matching the new Linux script.
install-linux.sh downloads a native package and registers a systemd
service, which is the wrong shape for deployments that run the server
binary directly -- a hand-run process, a non-systemd supervisor, or a
MinIO deployment being migrated in place.
Add a Linux counterpart to install-mac.sh that fetches only the binary:
resolve the current release from the gh-pages pointer, download the
matching asset, verify its SHA-256, chmod it, and leave ./buckit in the
working directory. It does not touch PATH and does not install a service.
The checksum is verified against both the release-host .sha256sum and the
digest published in the gh-pages pointer, and the two must agree. The
binary and its adjacent checksum share an origin, so that digest alone
only proves the transfer was not corrupted; the pointer is served from a
different origin and turns the check into something an attacker must
defeat in two places. A pinned BUCKIT_VERSION skips the cross-check,
since the pointer only ever describes the latest release.
Publish the script to gh-pages alongside the others, and advertise it in
the README and the generated release-notes install table.
Buckit handles XFS errors itself, so the kernel default (retry-on-error
forever) only adds latency. Ship a systemd timer that periodically sets
max_retries=0 for the EIO, ENOSPC, and default error classes on the block
devices backing MINIO_VOLUMES.
The values reset on every mount, so the timer (re-)applies them after boot
and after a restart-free drive hot-swap. The script reads MINIO_VOLUMES from
the running server's process environment, scopes writes to only the mounted
Buckit data drives (never the root fs or unrelated XFS volumes), and exits
cleanly when the server is down or no XFS is present. Genuine write failures
are logged and surface the unit as failed.
postinstall enables the timer (idempotent across upgrades); postremove
disables it only on full removal.
Drop the move-to-PATH instruction; the verified binary stays in the download
directory and the script prints how to run it from there, matching
install-windows.ps1.
Fail fast when run under cross-platform PowerShell on Linux/macOS (rather than
fetching the Windows .exe), treating undefined $IsWindows on Windows
PowerShell 5.1 as Windows. Make the printed install example create the target
directory before moving the executable into it.
Add install-mac.sh (downloads the Apple Silicon binary, verifies SHA-256,
clears the macOS quarantine attr, prints the move-to-PATH command) and
install-windows.ps1 (downloads the .exe, verifies SHA-256, prints the
move-to-PATH command). Both write to a predictable filename (buckit /
buckit.exe) and use the same atomic temp-then-move + checksum-gate flow as
install-linux.sh.
Publish both to gh-pages in the release workflow, and point install-linux.sh's
non-Linux error at the new scripts.
Set SUDO once (empty when already root, "sudo " when sudo is available,
empty with a warning otherwise) and build INSTALL_CMD from it, so the printed
install command is correct on root/container hosts without sudo.
Write the download to a temporary sibling file and only mv it into the
predictable buckit.<ext> path after the checksum verifies, with an EXIT trap
to clean up on failure. A failed or interrupted download can no longer leave
a partial/unverified file or overwrite an existing good package.
Revert the --install non-interactive mode. The script again only downloads,
verifies, and prints the install command. Instead of a versioned name in a
temp dir, the package is saved to a predictable buckit.rpm / buckit.deb /
buckit.apk in the current directory (overridable via BUCKIT_DOWNLOAD_DIR), so
the printed install command is stable and copy-pasteable in docs.
Default behavior is unchanged (download, verify, print the install command).
Passing --install runs the detected install command automatically after a
successful checksum verification, for docs and automation use.
Execution reuses the detected command via unquoted word-splitting of the
fixed INSTALL_CMD words with the package path as a single quoted argument —
reliable in POSIX sh without eval.
Add packaging/install-rpm.sh, a POSIX sh helper served from gh-pages that
detects the host package manager (dnf/yum/zypper, apt/apt-get/dpkg, or apk),
downloads the matching .rpm/.deb/.apk for the latest stable release, verifies
its published SHA-256 checksum, and prints the install command to run. It does
not invoke the package manager itself.
Wire the update-gh-pages release job to check out source and publish the
script to pages/install-rpm.sh so it ships at
https://buckit-io.github.io/buckit/install-rpm.sh during a normal release.
- packaging/scripts: convert 4-space indentation to tabs (shfmt)
- docs/distributed/decom*.sh: add consistent trailing slashes to
mc ls bucket paths so before/after diffs compare identical formats
The previous packaging step used minio/pkger, which is hardcoded for
MinIO's portfolio: its nfpm template only attaches a systemd unit when
the binary name matches "minio", "aistor", or "sidekick". Invoking it
with --appName buckit silently dropped the unit (and the maintainer/
homepage fields stayed MinIO-branded) — the published .rpm/.deb shipped
only /usr/local/bin/buckit with no service definition.
Switch to nfpm directly, driven by a config in packaging/nfpm.yaml that
we own. The packages now contain:
/usr/local/bin/buckit
/lib/systemd/system/buckit.service (Type=notify, LimitNOFILE=1048576,
OOMScoreAdjust=-1000, etc.)
A postinstall script creates the buckit system user/group idempotently;
preremove stops the service; postremove reloads systemd but deliberately
leaves the user in place to avoid orphaning data on attached storage.
The unit is modeled on MinIO's production unit but reads
EnvironmentFile=-/etc/default/minio (leading - = optional), keeping
fresh buckit nodes byte-compatible with the env file MinIO already
ships, so the manager's in-place migration story works without any
config translation.
Verified locally by building rpm/deb/apk against the published
RELEASE.2026-05-11T17-20-40Z binary and inspecting the output.
abuckit