Add packaging/install-rpm.sh, a POSIX sh helper served from gh-pages that
detects the host package manager (dnf/yum/zypper, apt/apt-get/dpkg, or apk),
downloads the matching .rpm/.deb/.apk for the latest stable release, verifies
its published SHA-256 checksum, and prints the install command to run. It does
not invoke the package manager itself.
Wire the update-gh-pages release job to check out source and publish the
script to pages/install-rpm.sh so it ships at
https://buckit-io.github.io/buckit/install-rpm.sh during a normal release.
Document the container A/B on the corrected single-pool rig (one 16-drive
EC:4 set, 2 MiB non-inlined objects):
- single-trip proven directly: with xl.meta and the canonical data dir
deleted on all drives, FAST_GET=1 still serves byte-exact from the shadow
(multi-pool returned 404).
- cold single-stream TTFB ~26% lower (server-side trace) / ~21% (curl),
captured paired on the same requests; saturated throughput flat on the
seek-free loopback medium.
- record the two rig traps (multi-pool xl.meta pre-read; inline cutoff is
per-shard, so EC:4 inlines everything below ~1.5 MiB).
Design note: the on-disk shadow header should be variable-length with a
self-describing payload so fields can evolve without lockstep; the fixed
1024-byte positional header is a phase-1 shortcut.
cluster.sh emitted one endpoint arg per node, which brought the rig up as
four independent server pools. Multi-pool GET resolves the owning pool via
getLatestObjectInfoWithIdx (a per-pool xl.meta read) before the set-level
fast path runs, so BUCKIT_FAST_GET=1 still read xl.meta and the single-trip
path was never exercised.
Emit a single pool spanning all nodes (http://node{1...4}:9000/data/...)
so SinglePool() is true and GET dispatches straight to the set, letting the
fast path bypass xl.meta. Regenerated docker-compose.yml reflects the change.
Address security review: specify the exact epoch-key derivation scheme
(deterministic KMS MAC, or random-and-wrap) since cloud KMS GenerateDataKey
is random by default and would otherwise make keys unrecoverable. Promote
authenticated metadata binding, basic token scoping, a minimal revocation
path, and bounded historical cache into MVP requirements; keep full replay
protection and coordinated revocation as phase-2. Add the accepted-residual-
risk note and a multi-instance proxy section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Switch the design to a true-HSM model where the master key never leaves
the KMS, unlike KES/MinKMS which load it into memory. The KMS produces an
epoch key per window; bucket and object keys derive locally. Adds the
two-window model (12h epoch + ~15min Buckit cache TTL), corrected near-zero
cost analysis, the bounded-compromise security framing, and clarifies that
only the bucket key is cached.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Design for replacing deprecated MinIO KES with an open-source approach:
a cached per-cluster encryption key in Buckit (L1) plus a stateless
KMS-auth proxy (Fargate, L2) that holds the cloud credentials so they
never live in Buckit. Covers cost analysis, the two-tier cache, security
boundary (credential isolation vs. key-material exposure), and open
decisions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
abuckit