@specific.dev/spectest 0.131.5 → 0.131.7

package/dist/components/s3-runtime/README.md

@@ -16,6 +16,19 @@ uploads, multipart initiation and copies. Upstream currently drops these headers
 in `metadataHeaders`. The patch applies to the vendored, checksum-verified module;
 a failed patch stops the build. Recheck it when changing the upstream pin.
 
+`multipart.patch` adds SHA256 composite multipart integrity to the existing
+uploader: supplied part checksums are validated before storage, completion checks
+each part and its ordering, and the composite checksum survives HEAD/GET for
+reconciliation. Completion conditions use the backend's atomic conditional write.
+Overwriting an object does not inherit the previous object's checksum metadata.
+This patch supports SHA256/COMPOSITE; it does not implement every S3 checksum
+algorithm or streaming checksum trailers.
+
+Run `./test.sh` from this directory to exercise real HTTP requests against the
+same patched sources used in the image, including corrupt retries, conditional
+completion races, abort, metadata reconciliation and unchecksummed uploads.
+The test runs in a temporary vendor directory and enables Go's race detector.
+
 From `sdk`, run the real-image contract on a Linux Docker host:
 
 ```

package/dist/components/s3-runtime/main.go

@@ -11,6 +11,10 @@ import (
 )
 
 func main() {
+	log.Fatal(http.ListenAndServe(":9090", newServer()))
+}
+
+func newServer() http.Handler {
 	// VM snapshots include RAM: buckets, versions and in-flight multipart state
 	// fork together. A fresh process starts empty, as S3Mock did by default.
 	// Unlike the Bolt backend, s3mem also supports bucket versioning.
@@ -21,7 +25,7 @@ func main() {
 		gofakes3.WithAutoBucket(false),
 		gofakes3.WithLogger(gofakes3.GlobalLog()),
 	).Server()
-	log.Fatal(http.ListenAndServe(":9090", cors(server)))
+	return cors(server)
 }
 
 // Preserve S3Mock's permissive browser uploads, including arbitrary metadata

package/dist/components/s3-runtime/main_test.go

@@ -0,0 +1,199 @@
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+type s3Response struct {
+	status int
+	header http.Header
+	body   []byte
+}
+type s3Probe struct {
+	t      *testing.T
+	server *httptest.Server
+}
+
+func newProbe(t *testing.T) *s3Probe {
+	t.Helper()
+	p := &s3Probe{t, httptest.NewServer(newServer())}
+	t.Cleanup(p.server.Close)
+	p.request("PUT", "/uploads", nil, nil, 200)
+	return p
+}
+func (p *s3Probe) request(method, path string, body []byte, headers map[string]string, want int) s3Response {
+	p.t.Helper()
+	req, err := http.NewRequest(method, p.server.URL+path, bytes.NewReader(body))
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	res, err := p.server.Client().Do(req)
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	defer res.Body.Close()
+	data, err := io.ReadAll(res.Body)
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	if res.StatusCode != want {
+		p.t.Fatalf("%s %s: got %d want %d: %s", method, path, res.StatusCode, want, data)
+	}
+	return s3Response{res.StatusCode, res.Header, data}
+}
+func sum(body []byte) string {
+	digest := sha256.Sum256(body)
+	return base64.StdEncoding.EncodeToString(digest[:])
+}
+func (p *s3Probe) start(key string, checksum bool) string {
+	p.t.Helper()
+	headers := map[string]string{"Cache-Control": "private, max-age=60"}
+	if checksum {
+		headers["x-amz-checksum-algorithm"] = "SHA256"
+		headers["x-amz-checksum-type"] = "COMPOSITE"
+	}
+	res := p.request("POST", "/uploads/"+key+"?uploads", nil, headers, 200)
+	var out struct {
+		UploadID string `xml:"UploadId"`
+	}
+	if err := xml.Unmarshal(res.body, &out); err != nil || out.UploadID == "" {
+		p.t.Fatalf("initiate: %s, %v", res.body, err)
+	}
+	return "/uploads/" + key + "?uploadId=" + out.UploadID
+}
+func (p *s3Probe) part(path string, number int, body []byte, checksum bool) string {
+	p.t.Helper()
+	headers := map[string]string{}
+	if checksum {
+		headers["x-amz-checksum-sha256"] = sum(body)
+	}
+	res := p.request("PUT", fmt.Sprintf("%s&partNumber=%d", path, number), body, headers, 200)
+	if checksum && res.header.Get("x-amz-checksum-sha256") != sum(body) {
+		p.t.Fatalf("part checksum acknowledgement: %v", res.header)
+	}
+	tag := res.header.Get("ETag")
+	if tag == "" {
+		p.t.Fatal("missing ETag")
+	}
+	digest := ""
+	if checksum {
+		digest = "<ChecksumSHA256>" + sum(body) + "</ChecksumSHA256>"
+	}
+	return fmt.Sprintf("<Part><PartNumber>%d</PartNumber><ETag>%s</ETag>%s</Part>", number, tag, digest)
+}
+func completion(parts ...string) []byte {
+	return []byte("<CompleteMultipartUpload>" + strings.Join(parts, "") + "</CompleteMultipartUpload>")
+}
+
+func TestMultipartSHA256IntegrityAndReconciliation(t *testing.T) {
+	p := newProbe(t)
+	path := p.start("large", true)
+	first := bytes.Repeat([]byte("a"), 8*1024*1024)
+	last := bytes.Repeat([]byte("b"), 1024*1024)
+	part1 := p.part(path, 1, first, true)
+	// A rejected retry must not replace the already acknowledged part.
+	res := p.request("PUT", path+"&partNumber=1", []byte("corrupt"), map[string]string{"x-amz-checksum-sha256": sum(first)}, 400)
+	if !bytes.Contains(res.body, []byte("BadDigest")) {
+		t.Fatalf("corrupt part: %s", res.body)
+	}
+	part2 := p.part(path, 2, last, true)
+	for _, parts := range [][]string{{part2, part1}, {part1, part1}, {strings.Replace(part1, "<PartNumber>1", "<PartNumber>-1", 1)}, {strings.Replace(part1, sum(first), sum(last), 1), part2}, {strings.Replace(part1, "<ETag>", "<ETag>bad", 1), part2}} {
+		p.request("POST", path, completion(parts...), nil, 400)
+	}
+	p.request("POST", path, completion(part1, part2), map[string]string{"x-amz-checksum-type": "FULL_OBJECT"}, 400)
+	p.request("POST", path, completion(part1, part2), map[string]string{"x-amz-checksum-sha256": "wrong"}, 400)
+	a, b := sha256.Sum256(first), sha256.Sum256(last)
+	expected := sum(append(a[:], b[:]...)) + "-2"
+	res = p.request("POST", path, completion(part1, part2), map[string]string{"If-None-Match": "*", "x-amz-checksum-type": "COMPOSITE", "x-amz-checksum-sha256": expected}, 200)
+	var completed struct {
+		ChecksumSHA256 string
+		ChecksumType   string
+	}
+	if err := xml.Unmarshal(res.body, &completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.ChecksumSHA256 != expected || completed.ChecksumType != "COMPOSITE" {
+		t.Fatalf("complete: %s", res.body)
+	}
+	// Reconcile using retained metadata after an unobserved completion response.
+	head := p.request("HEAD", "/uploads/large", nil, map[string]string{"x-amz-checksum-mode": "ENABLED"}, 200)
+	if head.header.Get("x-amz-checksum-sha256") != expected || head.header.Get("x-amz-checksum-type") != "COMPOSITE" || head.header.Get("Content-Length") != fmt.Sprint(len(first)+len(last)) || head.header.Get("Cache-Control") != "private, max-age=60" {
+		t.Fatalf("reconciliation: %v", head.header)
+	}
+	got := p.request("GET", "/uploads/large", nil, nil, 200)
+	if !bytes.Equal(got.body, append(first, last...)) {
+		t.Fatal("completed bytes differ")
+	}
+	p.request("PUT", path+"&partNumber=1", first, nil, 404)
+	// An ordinary overwrite must not inherit an obsolete composite checksum.
+	p.request("PUT", "/uploads/large", []byte("replacement"), nil, 200)
+	head = p.request("HEAD", "/uploads/large", nil, nil, 200)
+	if head.header.Get("x-amz-checksum-sha256") != "" || head.header.Get("x-amz-checksum-type") != "" {
+		t.Fatal("overwrite retained stale checksum")
+	}
+}
+
+func TestMultipartConditionalCompletionIsAtomic(t *testing.T) {
+	p := newProbe(t)
+	paths := []string{p.start("same", true), p.start("same", true)}
+	parts := []string{p.part(paths[0], 1, []byte("first"), true), p.part(paths[1], 1, []byte("second"), true)}
+	statuses := make(chan int, 2)
+	var wg sync.WaitGroup
+	for i := range paths {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req, _ := http.NewRequest("POST", p.server.URL+paths[i], bytes.NewReader(completion(parts[i])))
+			req.Header.Set("If-None-Match", "*")
+			res, err := p.server.Client().Do(req)
+			if err != nil {
+				statuses <- 0
+				return
+			}
+			defer res.Body.Close()
+			io.Copy(io.Discard, res.Body)
+			statuses <- res.StatusCode
+		}(i)
+	}
+	wg.Wait()
+	close(statuses)
+	counts := map[int]int{}
+	for s := range statuses {
+		counts[s]++
+	}
+	if counts[200] != 1 || counts[412] != 1 {
+		t.Fatalf("competing creates: %v", counts)
+	}
+	body := p.request("GET", "/uploads/same", nil, nil, 200).body
+	if string(body) != "first" && string(body) != "second" {
+		t.Fatalf("bad winner: %s", body)
+	}
+}
+
+func TestMultipartAbortAndLegacyUpload(t *testing.T) {
+	p := newProbe(t)
+	path := p.start("aborted", true)
+	part := p.part(path, 1, []byte("abc"), true)
+	p.request("DELETE", path, nil, nil, 204)
+	p.request("POST", path, completion(part), nil, 404)
+	p.request("HEAD", "/uploads/aborted", nil, nil, 404)
+	path = p.start("legacy", false)
+	part = p.part(path, 1, []byte("legacy"), false)
+	p.request("POST", path, completion(part), nil, 200)
+	if got := p.request("GET", "/uploads/legacy", nil, nil, 200); string(got.body) != "legacy" {
+		t.Fatal("legacy multipart changed")
+	}
+}

package/dist/components/s3-runtime/multipart.patch

@@ -0,0 +1,241 @@
+--- a/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
++++ b/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
+@@ -933,6 +933,14 @@
+ 		return err
+ 	}
+ 
++	if meta["X-Amz-Checksum-Algorithm"] == "SHA256" {
++		if kind := meta["X-Amz-Checksum-Type"]; kind != "" && kind != "COMPOSITE" {
++			return ErrInvalidArgument
++		}
++		meta["X-Amz-Checksum-Type"] = "COMPOSITE"
++		w.Header().Set("x-amz-checksum-algorithm", "SHA256")
++		w.Header().Set("x-amz-checksum-type", "COMPOSITE")
++	}
+ 	uploadID, err := g.uploader.CreateMultipartUpload(bucket, object, meta)
+ 	if err != nil {
+ 		return err
+@@ -983,12 +991,20 @@
+ 		}
+ 	}
+ 
++	var checksum *sha256PartReader
++	if expected := r.Header.Get("x-amz-checksum-sha256"); expected != "" {
++		checksum = newSHA256PartReader(rdr, expected)
++		rdr = checksum
++	}
+ 	etag, err := g.uploader.UploadPart(bucket, object, uploadID, int(partNumber), r.ContentLength, rdr)
+ 	if err != nil {
+ 		return err
+ 	}
+ 
+ 	w.Header().Add("ETag", etag)
++	if checksum != nil {
++		w.Header().Set("x-amz-checksum-sha256", checksum.sum())
++	}
+ 	return nil
+ }
+ 
+@@ -1009,6 +1025,13 @@
+ 		return err
+ 	}
+ 
++	var err error
++	in.Conditions, err = parsePutConditions(r.Header)
++	if err != nil {
++		return err
++	}
++	in.ChecksumSHA256 = r.Header.Get("x-amz-checksum-sha256")
++	in.ChecksumType = r.Header.Get("x-amz-checksum-type")
+ 	versionID, etag, err := g.uploader.CompleteMultipartUpload(bucket, object, uploadID, &in)
+ 	if err != nil {
+ 		return err
+@@ -1031,10 +1054,12 @@
+ 	}
+ 
+ 	return g.xmlEncoder(w).Encode(&CompleteMultipartUploadResult{
+-		ETag:     etag,
+-		Bucket:   bucket,
+-		Key:      object,
+-		Location: location,
++		ETag:           etag,
++		Bucket:         bucket,
++		Key:            object,
++		Location:       location,
++		ChecksumSHA256: in.ChecksumSHA256,
++		ChecksumType:   in.ChecksumType,
+ 	})
+ }
+ 
+--- a/vendor/github.com/johannesboyne/gofakes3/uploader.go
++++ b/vendor/github.com/johannesboyne/gofakes3/uploader.go
+@@ -3,6 +3,8 @@
+ import (
+ 	"bytes"
+ 	"crypto/md5"
++	"crypto/sha256"
++	"encoding/base64"
+ 	"encoding/hex"
+ 	"fmt"
+ 	"io"
+@@ -428,13 +430,26 @@
+ 		return "", "", ErrInvalidPart
+ 	}
+ 
+-	if !input.partsAreSorted() {
++	if len(input.Parts) == 0 || !input.partsAreSorted() {
+ 		return "", "", ErrInvalidPartOrder
+ 	}
+ 
+ 	var size int64
+ 
+-	for _, inPart := range input.Parts {
++	composite := sha256.New()
++	withSHA256 := mpu.Meta["X-Amz-Checksum-Algorithm"] == "SHA256"
++	if withSHA256 && input.ChecksumType != "" && input.ChecksumType != "COMPOSITE" {
++		return "", "", ErrBadDigest
++	}
++	previous := 0
++	for i, inPart := range input.Parts {
++		if inPart.PartNumber <= previous {
++			return "", "", ErrInvalidPartOrder
++		}
++		previous = inPart.PartNumber
++		if withSHA256 && inPart.PartNumber != i+1 {
++			return "", "", ErrInvalidPartOrder
++		}
+ 		if inPart.PartNumber >= mpuPartsLen || mpu.parts[inPart.PartNumber] == nil {
+ 			return "", "", ErrorMessagef(ErrInvalidPart, "unexpected part number %d in complete request", inPart.PartNumber)
+ 		}
+@@ -444,6 +459,13 @@
+ 			return "", "", ErrorMessagef(ErrInvalidPart, "unexpected part etag for number %d in complete request", inPart.PartNumber)
+ 		}
+ 
++		if withSHA256 {
++			digest := sha256.Sum256(upPart.Body)
++			if inPart.ChecksumSHA256 != base64.StdEncoding.EncodeToString(digest[:]) {
++				return "", "", ErrBadDigest
++			}
++			composite.Write(digest[:])
++		}
+ 		size += int64(len(upPart.Body))
+ 	}
+ 
+@@ -461,7 +483,20 @@
+ 
+ 	etag = fmt.Sprintf(`"%s-%d"`, hex.EncodeToString(hash.Sum(nil)), len(input.Parts))
+ 
+-	result, err := u.storage.PutObject(bucket, object, mpu.Meta, bytes.NewReader(body), int64(len(body)), nil)
++	if withSHA256 {
++		checksum := fmt.Sprintf("%s-%d", base64.StdEncoding.EncodeToString(composite.Sum(nil)), len(input.Parts))
++		if input.ChecksumSHA256 != "" && input.ChecksumSHA256 != checksum {
++			return "", "", ErrBadDigest
++		}
++		input.ChecksumSHA256 = checksum
++		input.ChecksumType = "COMPOSITE"
++		mpu.Meta["X-Amz-Checksum-Sha256"] = checksum
++		mpu.Meta["X-Amz-Checksum-Type"] = "COMPOSITE"
++	} else {
++		input.ChecksumSHA256 = ""
++		input.ChecksumType = ""
++	}
++	result, err := u.storage.PutObject(bucket, object, mpu.Meta, bytes.NewReader(body), int64(len(body)), input.Conditions)
+ 	if err != nil {
+ 		return "", "", err
+ 	}
+--- a/vendor/github.com/johannesboyne/gofakes3/messages.go
++++ b/vendor/github.com/johannesboyne/gofakes3/messages.go
+@@ -48,12 +48,16 @@
+ }
+ 
+ type CompletedPart struct {
+-	PartNumber int    `xml:"PartNumber"`
+-	ETag       string `xml:"ETag"`
++	ChecksumSHA256 string `xml:"ChecksumSHA256,omitempty"`
++	PartNumber     int    `xml:"PartNumber"`
++	ETag           string `xml:"ETag"`
+ }
+ 
+ type CompleteMultipartUploadRequest struct {
+-	Parts []CompletedPart `xml:"Part"`
++	Conditions     *PutConditions  `xml:"-"`
++	ChecksumSHA256 string          `xml:"-"`
++	ChecksumType   string          `xml:"-"`
++	Parts          []CompletedPart `xml:"Part"`
+ }
+ 
+ func (c CompleteMultipartUploadRequest) partsAreSorted() bool {
+@@ -70,10 +74,12 @@
+ }
+ 
+ type CompleteMultipartUploadResult struct {
+-	Location string `xml:"Location"`
+-	Bucket   string `xml:"Bucket"`
+-	Key      string `xml:"Key"`
+-	ETag     string `xml:"ETag"`
++	ChecksumSHA256 string `xml:"ChecksumSHA256,omitempty"`
++	ChecksumType   string `xml:"ChecksumType,omitempty"`
++	Location       string `xml:"Location"`
++	Bucket         string `xml:"Bucket"`
++	Key            string `xml:"Key"`
++	ETag           string `xml:"ETag"`
+ }
+ 
+ type Content struct {
+--- a/vendor/github.com/johannesboyne/gofakes3/checksum.go
++++ b/vendor/github.com/johannesboyne/gofakes3/checksum.go
+@@ -0,0 +1,32 @@
++package gofakes3
++
++import (
++	"crypto/sha256"
++	"encoding/base64"
++	"hash"
++	"io"
++)
++
++// Validate before UploadPart commits bytes to the existing multipart store.
++type sha256PartReader struct {
++	input    io.Reader
++	digest   hash.Hash
++	expected string
++}
++
++func newSHA256PartReader(input io.Reader, expected string) *sha256PartReader {
++	return &sha256PartReader{input: input, digest: sha256.New(), expected: expected}
++}
++
++func (r *sha256PartReader) sum() string {
++	return base64.StdEncoding.EncodeToString(r.digest.Sum(nil))
++}
++
++func (r *sha256PartReader) Read(p []byte) (int, error) {
++	n, err := r.input.Read(p)
++	r.digest.Write(p[:n])
++	if err == io.EOF && r.sum() != r.expected {
++		return n, ErrBadDigest
++	}
++	return n, err
++}
+--- a/vendor/github.com/johannesboyne/gofakes3/backend.go
++++ b/vendor/github.com/johannesboyne/gofakes3/backend.go
+@@ -3,6 +3,7 @@
+ import (
+ 	"encoding/hex"
+ 	"errors"
++	"strings"
+ 
+ 	"io"
+ 	"time"
+@@ -434,6 +435,11 @@
+ 	// carry over metadata if it exists
+ 	if existingObj != nil {
+ 		for k, v := range existingObj.Metadata {
++			// Integrity metadata belongs to the bytes being written, never a
++			// previous version of this key. CopyObject supplies its own metadata.
++			if strings.HasPrefix(k, "X-Amz-Checksum-") {
++				continue
++			}
+ 			// new metadata overwrites old but keep the rest
+ 			// TODO: check how metadata can be deleted?!
+ 			if _, ok := meta[k]; !ok {

package/dist/components/s3-runtime/test.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Exercise the exact vendored compatibility patches used by the runtime image.
+set -eu
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT HUP INT TERM
+cp "$source_dir"/*.go "$source_dir/go.mod" "$source_dir/go.sum" "$source_dir"/*.patch "$test_dir/"
+cd "$test_dir"
+go mod vendor
+patch -p1 < metadata.patch
+patch -p1 < multipart.patch
+go test -mod=vendor -race ./...

package/dist/components/s3.js

@@ -8,11 +8,11 @@ const S3_DOCKERFILE = `
 FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS build
 RUN apk add --no-cache patch
 WORKDIR /src
-${["go.mod", "go.sum", "main.go", "metadata.patch"].map((file) => {
+${["go.mod", "go.sum", "main.go", "metadata.patch", "multipart.patch"].map((file) => {
     const data = readFileSync(new URL(`./s3-runtime/${file}`, import.meta.url)).toString("base64");
     return `RUN printf '%s' '${data}' | base64 -d > ${file}`;
 }).join("\n")}
-RUN go mod vendor && patch -p1 < metadata.patch
+RUN go mod vendor && patch -p1 < metadata.patch && patch -p1 < multipart.patch
 RUN CGO_ENABLED=0 go build -mod=vendor -trimpath -ldflags='-s -w' -o /s3-server .
 FROM scratch
 COPY --from=build /s3-server /s3-server

package/dist/harness/sticky-consumer.d.ts

@@ -19,13 +19,17 @@ export declare function validateStickyConfig(config: StickyConsumerConfig): void
  * only minFreeSpace, BuildKit 0.32.2 sets keepBytes == totalSize when healthy,
  * and pruneOnce's strict '<' check can still evict a record on every GC pass.
  * Actual filesystem capacity is smaller than the device due to metadata. */
-export declare function stickyBuildkitConfig(config: StickyConsumerConfig): string;
+export declare function stickyBuildkitConfig(config: StickyConsumerConfig, reservedBytes?: number): string;
 export declare function initializeStickyConsumer(config: StickyConsumerConfig): Promise<void>;
 /** Builds can finish before automatic GC restores its free-space reserve.
  * Reclaim only unused BuildKit records before project setup adds runtime data.
  * Docker images, containers, volumes and nested Kubernetes stores stay live.
  */
-export declare function ensureBuildHeadroom(config: StickyConsumerConfig, run?: typeof exec, available?: () => Promise<number>): Promise<void>;
+export declare function ensureBuildHeadroom(config: StickyConsumerConfig, run?: typeof exec, usage?: () => Promise<{
+    freeBytes: number;
+    totalBytes: number;
+    reservedBytes: number;
+}>): Promise<void>;
 export declare function ensureStickyBuildHeadroom(): Promise<void>;
 /** Filesystem pressure takes precedence over cache age/BuildKit record sizes.
  * Only called after runtime containers/volumes have been removed on the
@@ -34,6 +38,7 @@ export declare function ensureStickyBuildHeadroom(): Promise<void>;
 export declare function collectStickyCache(config: StickyConsumerConfig, retention: StickyImageRetention, run?: typeof exec, usage?: () => Promise<{
     freeBytes: number;
     totalBytes: number;
+    reservedBytes?: number;
 }>, kubernetes?: KubernetesCacheMaintenance): Promise<void>;
 /** Only on an isolated maintenance clone; never on the live ready environment. */
 export declare function prepareStickyConsumer(artifact?: boolean): Promise<{

package/dist/harness/sticky-consumer.js

@@ -45,7 +45,7 @@ export function validateStickyConfig(config) {
  * only minFreeSpace, BuildKit 0.32.2 sets keepBytes == totalSize when healthy,
  * and pruneOnce's strict '<' check can still evict a record on every GC pass.
  * Actual filesystem capacity is smaller than the device due to metadata. */
-export function stickyBuildkitConfig(config) {
+export function stickyBuildkitConfig(config, reservedBytes = 0) {
     validateStickyConfig(config);
     return `root = "${config.path}/buildkit"
 # This standalone BuildKit does not inherit dockerd's registry mirrors.
@@ -65,7 +65,7 @@ export function stickyBuildkitConfig(config) {
 [[worker.containerd.gcpolicy]]
   all = true
   maxUsedSpace = ${config.capacityBytes}
-  minFreeSpace = ${config.headroomBytes}
+  minFreeSpace = ${config.headroomBytes + reservedBytes}
 `;
 }
 export async function initializeStickyConsumer(config) {
@@ -102,7 +102,7 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
     dockerConfig.features = { "containerd-snapshotter": true };
     dockerConfig["storage-driver"] = "overlayfs";
     await writeFile(`${STICKY_RUNTIME}/docker.json`, JSON.stringify(dockerConfig));
-    await writeFile(`${STICKY_RUNTIME}/buildkit.toml`, stickyBuildkitConfig(config));
+    await writeFile(`${STICKY_RUNTIME}/buildkit.toml`, stickyBuildkitConfig(config, (await diskUsage(config.path)).reservedBytes));
     const start = async (unit, program, args) => {
         await exec("systemd-run", ["--quiet", "--unit", unit, "-p", "TimeoutStopSec=30",
             // Pinned BuildKit 0.32.2 returns 1 after its normal first-SIGTERM
@@ -121,23 +121,31 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
     await exec("docker", ["buildx", "create", "--name", "spectest-local", "--driver", "remote", "tcp://127.0.0.1:1234"]);
     await exec("docker", ["buildx", "inspect", "--bootstrap", "spectest-local"]);
 }
+async function diskUsage(path) {
+    const fs = await statfs(path);
+    return { freeBytes: fs.bavail * fs.bsize, totalBytes: fs.blocks * fs.bsize,
+        reservedBytes: Math.max(0, fs.bfree - fs.bavail) * fs.bsize };
+}
+// BuildKit 0.32.2 compares MinFreeSpace against statfs.bfree, whereas
+// applications and kubelet need bavail. Include ext4's reserved blocks so
+// pruning restores the required usable space instead of stopping early.
+function pruneTarget(config, usage) {
+    return String(Math.ceil((config.headroomBytes + (usage.reservedBytes ?? 0)) / 1e6));
+}
 /** Builds can finish before automatic GC restores its free-space reserve.
  * Reclaim only unused BuildKit records before project setup adds runtime data.
  * Docker images, containers, volumes and nested Kubernetes stores stay live.
  */
-export async function ensureBuildHeadroom(config, run = exec, available = async () => {
-    const fs = await statfs(config.path);
-    return fs.bavail * fs.bsize;
-}) {
+export async function ensureBuildHeadroom(config, run = exec, usage = () => diskUsage(config.path)) {
     validateStickyConfig(config);
-    let free = await available();
-    for (let pass = 0; free < config.headroomBytes && pass < 3; pass++) {
+    let fs = await usage();
+    for (let pass = 0; fs.freeBytes < config.headroomBytes && pass < 3; pass++) {
         await run("buildctl", ["--addr", "tcp://127.0.0.1:1234", "prune", "--all", "--free-storage",
-            String(Math.ceil(config.headroomBytes / 1e6))], 120_000);
-        free = await available();
+            pruneTarget(config, fs)], 120_000);
+        fs = await usage();
     }
-    if (free < config.headroomBytes) {
-        throw new Error(`environment build left insufficient disk headroom: ${Math.floor(free / 2 ** 20)} MiB available, ${Math.ceil(config.headroomBytes / 2 ** 20)} MiB required`);
+    if (fs.freeBytes < config.headroomBytes) {
+        throw new Error(`environment build left insufficient disk headroom: ${Math.floor(fs.freeBytes / 2 ** 20)} MiB available, ${Math.ceil(config.headroomBytes / 2 ** 20)} MiB required`);
     }
 }
 export async function ensureStickyBuildHeadroom() {
@@ -153,10 +161,7 @@ export async function ensureStickyBuildHeadroom() {
  * Only called after runtime containers/volumes have been removed on the
  * isolated publication clone. Never removes files behind the daemons' backs.
  */
-export async function collectStickyCache(config, retention, run = exec, usage = async () => {
-    const fs = await statfs(config.path);
-    return { freeBytes: fs.bavail * fs.bsize, totalBytes: fs.blocks * fs.bsize };
-}, kubernetes) {
+export async function collectStickyCache(config, retention, run = exec, usage = () => diskUsage(config.path), kubernetes) {
     validateStickyConfig(config);
     const buildctl = ["--addr", "tcp://127.0.0.1:1234", "prune"];
     // Docker 29's containerd until filter uses local image-record creation;
@@ -184,7 +189,7 @@ export async function collectStickyCache(config, retention, run = exec, usage =
     // a per-consumer cap evicts useful cache even when the disk is mostly empty.
     const pruneBuildkit = async () => {
         await run("buildctl", [...buildctl, "--all", "--free-storage",
-            String(Math.ceil(config.headroomBytes / 1e6))], 120_000);
+            pruneTarget(config, fs)], 120_000);
         fs = await usage();
     };
     await pruneBuildkit();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.131.5",
+  "version": "0.131.7",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/s3-runtime/README.md

@@ -16,6 +16,19 @@ uploads, multipart initiation and copies. Upstream currently drops these headers
 in `metadataHeaders`. The patch applies to the vendored, checksum-verified module;
 a failed patch stops the build. Recheck it when changing the upstream pin.
 
+`multipart.patch` adds SHA256 composite multipart integrity to the existing
+uploader: supplied part checksums are validated before storage, completion checks
+each part and its ordering, and the composite checksum survives HEAD/GET for
+reconciliation. Completion conditions use the backend's atomic conditional write.
+Overwriting an object does not inherit the previous object's checksum metadata.
+This patch supports SHA256/COMPOSITE; it does not implement every S3 checksum
+algorithm or streaming checksum trailers.
+
+Run `./test.sh` from this directory to exercise real HTTP requests against the
+same patched sources used in the image, including corrupt retries, conditional
+completion races, abort, metadata reconciliation and unchecksummed uploads.
+The test runs in a temporary vendor directory and enables Go's race detector.
+
 From `sdk`, run the real-image contract on a Linux Docker host:
 
 ```

package/src/components/s3-runtime/main.go

@@ -11,6 +11,10 @@ import (
 )
 
 func main() {
+	log.Fatal(http.ListenAndServe(":9090", newServer()))
+}
+
+func newServer() http.Handler {
 	// VM snapshots include RAM: buckets, versions and in-flight multipart state
 	// fork together. A fresh process starts empty, as S3Mock did by default.
 	// Unlike the Bolt backend, s3mem also supports bucket versioning.
@@ -21,7 +25,7 @@ func main() {
 		gofakes3.WithAutoBucket(false),
 		gofakes3.WithLogger(gofakes3.GlobalLog()),
 	).Server()
-	log.Fatal(http.ListenAndServe(":9090", cors(server)))
+	return cors(server)
 }
 
 // Preserve S3Mock's permissive browser uploads, including arbitrary metadata

package/src/components/s3-runtime/main_test.go

@@ -0,0 +1,199 @@
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+type s3Response struct {
+	status int
+	header http.Header
+	body   []byte
+}
+type s3Probe struct {
+	t      *testing.T
+	server *httptest.Server
+}
+
+func newProbe(t *testing.T) *s3Probe {
+	t.Helper()
+	p := &s3Probe{t, httptest.NewServer(newServer())}
+	t.Cleanup(p.server.Close)
+	p.request("PUT", "/uploads", nil, nil, 200)
+	return p
+}
+func (p *s3Probe) request(method, path string, body []byte, headers map[string]string, want int) s3Response {
+	p.t.Helper()
+	req, err := http.NewRequest(method, p.server.URL+path, bytes.NewReader(body))
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	res, err := p.server.Client().Do(req)
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	defer res.Body.Close()
+	data, err := io.ReadAll(res.Body)
+	if err != nil {
+		p.t.Fatal(err)
+	}
+	if res.StatusCode != want {
+		p.t.Fatalf("%s %s: got %d want %d: %s", method, path, res.StatusCode, want, data)
+	}
+	return s3Response{res.StatusCode, res.Header, data}
+}
+func sum(body []byte) string {
+	digest := sha256.Sum256(body)
+	return base64.StdEncoding.EncodeToString(digest[:])
+}
+func (p *s3Probe) start(key string, checksum bool) string {
+	p.t.Helper()
+	headers := map[string]string{"Cache-Control": "private, max-age=60"}
+	if checksum {
+		headers["x-amz-checksum-algorithm"] = "SHA256"
+		headers["x-amz-checksum-type"] = "COMPOSITE"
+	}
+	res := p.request("POST", "/uploads/"+key+"?uploads", nil, headers, 200)
+	var out struct {
+		UploadID string `xml:"UploadId"`
+	}
+	if err := xml.Unmarshal(res.body, &out); err != nil || out.UploadID == "" {
+		p.t.Fatalf("initiate: %s, %v", res.body, err)
+	}
+	return "/uploads/" + key + "?uploadId=" + out.UploadID
+}
+func (p *s3Probe) part(path string, number int, body []byte, checksum bool) string {
+	p.t.Helper()
+	headers := map[string]string{}
+	if checksum {
+		headers["x-amz-checksum-sha256"] = sum(body)
+	}
+	res := p.request("PUT", fmt.Sprintf("%s&partNumber=%d", path, number), body, headers, 200)
+	if checksum && res.header.Get("x-amz-checksum-sha256") != sum(body) {
+		p.t.Fatalf("part checksum acknowledgement: %v", res.header)
+	}
+	tag := res.header.Get("ETag")
+	if tag == "" {
+		p.t.Fatal("missing ETag")
+	}
+	digest := ""
+	if checksum {
+		digest = "<ChecksumSHA256>" + sum(body) + "</ChecksumSHA256>"
+	}
+	return fmt.Sprintf("<Part><PartNumber>%d</PartNumber><ETag>%s</ETag>%s</Part>", number, tag, digest)
+}
+func completion(parts ...string) []byte {
+	return []byte("<CompleteMultipartUpload>" + strings.Join(parts, "") + "</CompleteMultipartUpload>")
+}
+
+func TestMultipartSHA256IntegrityAndReconciliation(t *testing.T) {
+	p := newProbe(t)
+	path := p.start("large", true)
+	first := bytes.Repeat([]byte("a"), 8*1024*1024)
+	last := bytes.Repeat([]byte("b"), 1024*1024)
+	part1 := p.part(path, 1, first, true)
+	// A rejected retry must not replace the already acknowledged part.
+	res := p.request("PUT", path+"&partNumber=1", []byte("corrupt"), map[string]string{"x-amz-checksum-sha256": sum(first)}, 400)
+	if !bytes.Contains(res.body, []byte("BadDigest")) {
+		t.Fatalf("corrupt part: %s", res.body)
+	}
+	part2 := p.part(path, 2, last, true)
+	for _, parts := range [][]string{{part2, part1}, {part1, part1}, {strings.Replace(part1, "<PartNumber>1", "<PartNumber>-1", 1)}, {strings.Replace(part1, sum(first), sum(last), 1), part2}, {strings.Replace(part1, "<ETag>", "<ETag>bad", 1), part2}} {
+		p.request("POST", path, completion(parts...), nil, 400)
+	}
+	p.request("POST", path, completion(part1, part2), map[string]string{"x-amz-checksum-type": "FULL_OBJECT"}, 400)
+	p.request("POST", path, completion(part1, part2), map[string]string{"x-amz-checksum-sha256": "wrong"}, 400)
+	a, b := sha256.Sum256(first), sha256.Sum256(last)
+	expected := sum(append(a[:], b[:]...)) + "-2"
+	res = p.request("POST", path, completion(part1, part2), map[string]string{"If-None-Match": "*", "x-amz-checksum-type": "COMPOSITE", "x-amz-checksum-sha256": expected}, 200)
+	var completed struct {
+		ChecksumSHA256 string
+		ChecksumType   string
+	}
+	if err := xml.Unmarshal(res.body, &completed); err != nil {
+		t.Fatal(err)
+	}
+	if completed.ChecksumSHA256 != expected || completed.ChecksumType != "COMPOSITE" {
+		t.Fatalf("complete: %s", res.body)
+	}
+	// Reconcile using retained metadata after an unobserved completion response.
+	head := p.request("HEAD", "/uploads/large", nil, map[string]string{"x-amz-checksum-mode": "ENABLED"}, 200)
+	if head.header.Get("x-amz-checksum-sha256") != expected || head.header.Get("x-amz-checksum-type") != "COMPOSITE" || head.header.Get("Content-Length") != fmt.Sprint(len(first)+len(last)) || head.header.Get("Cache-Control") != "private, max-age=60" {
+		t.Fatalf("reconciliation: %v", head.header)
+	}
+	got := p.request("GET", "/uploads/large", nil, nil, 200)
+	if !bytes.Equal(got.body, append(first, last...)) {
+		t.Fatal("completed bytes differ")
+	}
+	p.request("PUT", path+"&partNumber=1", first, nil, 404)
+	// An ordinary overwrite must not inherit an obsolete composite checksum.
+	p.request("PUT", "/uploads/large", []byte("replacement"), nil, 200)
+	head = p.request("HEAD", "/uploads/large", nil, nil, 200)
+	if head.header.Get("x-amz-checksum-sha256") != "" || head.header.Get("x-amz-checksum-type") != "" {
+		t.Fatal("overwrite retained stale checksum")
+	}
+}
+
+func TestMultipartConditionalCompletionIsAtomic(t *testing.T) {
+	p := newProbe(t)
+	paths := []string{p.start("same", true), p.start("same", true)}
+	parts := []string{p.part(paths[0], 1, []byte("first"), true), p.part(paths[1], 1, []byte("second"), true)}
+	statuses := make(chan int, 2)
+	var wg sync.WaitGroup
+	for i := range paths {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			req, _ := http.NewRequest("POST", p.server.URL+paths[i], bytes.NewReader(completion(parts[i])))
+			req.Header.Set("If-None-Match", "*")
+			res, err := p.server.Client().Do(req)
+			if err != nil {
+				statuses <- 0
+				return
+			}
+			defer res.Body.Close()
+			io.Copy(io.Discard, res.Body)
+			statuses <- res.StatusCode
+		}(i)
+	}
+	wg.Wait()
+	close(statuses)
+	counts := map[int]int{}
+	for s := range statuses {
+		counts[s]++
+	}
+	if counts[200] != 1 || counts[412] != 1 {
+		t.Fatalf("competing creates: %v", counts)
+	}
+	body := p.request("GET", "/uploads/same", nil, nil, 200).body
+	if string(body) != "first" && string(body) != "second" {
+		t.Fatalf("bad winner: %s", body)
+	}
+}
+
+func TestMultipartAbortAndLegacyUpload(t *testing.T) {
+	p := newProbe(t)
+	path := p.start("aborted", true)
+	part := p.part(path, 1, []byte("abc"), true)
+	p.request("DELETE", path, nil, nil, 204)
+	p.request("POST", path, completion(part), nil, 404)
+	p.request("HEAD", "/uploads/aborted", nil, nil, 404)
+	path = p.start("legacy", false)
+	part = p.part(path, 1, []byte("legacy"), false)
+	p.request("POST", path, completion(part), nil, 200)
+	if got := p.request("GET", "/uploads/legacy", nil, nil, 200); string(got.body) != "legacy" {
+		t.Fatal("legacy multipart changed")
+	}
+}

package/src/components/s3-runtime/multipart.patch

@@ -0,0 +1,241 @@
+--- a/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
++++ b/vendor/github.com/johannesboyne/gofakes3/gofakes3.go
+@@ -933,6 +933,14 @@
+ 		return err
+ 	}
+ 
++	if meta["X-Amz-Checksum-Algorithm"] == "SHA256" {
++		if kind := meta["X-Amz-Checksum-Type"]; kind != "" && kind != "COMPOSITE" {
++			return ErrInvalidArgument
++		}
++		meta["X-Amz-Checksum-Type"] = "COMPOSITE"
++		w.Header().Set("x-amz-checksum-algorithm", "SHA256")
++		w.Header().Set("x-amz-checksum-type", "COMPOSITE")
++	}
+ 	uploadID, err := g.uploader.CreateMultipartUpload(bucket, object, meta)
+ 	if err != nil {
+ 		return err
+@@ -983,12 +991,20 @@
+ 		}
+ 	}
+ 
++	var checksum *sha256PartReader
++	if expected := r.Header.Get("x-amz-checksum-sha256"); expected != "" {
++		checksum = newSHA256PartReader(rdr, expected)
++		rdr = checksum
++	}
+ 	etag, err := g.uploader.UploadPart(bucket, object, uploadID, int(partNumber), r.ContentLength, rdr)
+ 	if err != nil {
+ 		return err
+ 	}
+ 
+ 	w.Header().Add("ETag", etag)
++	if checksum != nil {
++		w.Header().Set("x-amz-checksum-sha256", checksum.sum())
++	}
+ 	return nil
+ }
+ 
+@@ -1009,6 +1025,13 @@
+ 		return err
+ 	}
+ 
++	var err error
++	in.Conditions, err = parsePutConditions(r.Header)
++	if err != nil {
++		return err
++	}
++	in.ChecksumSHA256 = r.Header.Get("x-amz-checksum-sha256")
++	in.ChecksumType = r.Header.Get("x-amz-checksum-type")
+ 	versionID, etag, err := g.uploader.CompleteMultipartUpload(bucket, object, uploadID, &in)
+ 	if err != nil {
+ 		return err
+@@ -1031,10 +1054,12 @@
+ 	}
+ 
+ 	return g.xmlEncoder(w).Encode(&CompleteMultipartUploadResult{
+-		ETag:     etag,
+-		Bucket:   bucket,
+-		Key:      object,
+-		Location: location,
++		ETag:           etag,
++		Bucket:         bucket,
++		Key:            object,
++		Location:       location,
++		ChecksumSHA256: in.ChecksumSHA256,
++		ChecksumType:   in.ChecksumType,
+ 	})
+ }
+ 
+--- a/vendor/github.com/johannesboyne/gofakes3/uploader.go
++++ b/vendor/github.com/johannesboyne/gofakes3/uploader.go
+@@ -3,6 +3,8 @@
+ import (
+ 	"bytes"
+ 	"crypto/md5"
++	"crypto/sha256"
++	"encoding/base64"
+ 	"encoding/hex"
+ 	"fmt"
+ 	"io"
+@@ -428,13 +430,26 @@
+ 		return "", "", ErrInvalidPart
+ 	}
+ 
+-	if !input.partsAreSorted() {
++	if len(input.Parts) == 0 || !input.partsAreSorted() {
+ 		return "", "", ErrInvalidPartOrder
+ 	}
+ 
+ 	var size int64
+ 
+-	for _, inPart := range input.Parts {
++	composite := sha256.New()
++	withSHA256 := mpu.Meta["X-Amz-Checksum-Algorithm"] == "SHA256"
++	if withSHA256 && input.ChecksumType != "" && input.ChecksumType != "COMPOSITE" {
++		return "", "", ErrBadDigest
++	}
++	previous := 0
++	for i, inPart := range input.Parts {
++		if inPart.PartNumber <= previous {
++			return "", "", ErrInvalidPartOrder
++		}
++		previous = inPart.PartNumber
++		if withSHA256 && inPart.PartNumber != i+1 {
++			return "", "", ErrInvalidPartOrder
++		}
+ 		if inPart.PartNumber >= mpuPartsLen || mpu.parts[inPart.PartNumber] == nil {
+ 			return "", "", ErrorMessagef(ErrInvalidPart, "unexpected part number %d in complete request", inPart.PartNumber)
+ 		}
+@@ -444,6 +459,13 @@
+ 			return "", "", ErrorMessagef(ErrInvalidPart, "unexpected part etag for number %d in complete request", inPart.PartNumber)
+ 		}
+ 
++		if withSHA256 {
++			digest := sha256.Sum256(upPart.Body)
++			if inPart.ChecksumSHA256 != base64.StdEncoding.EncodeToString(digest[:]) {
++				return "", "", ErrBadDigest
++			}
++			composite.Write(digest[:])
++		}
+ 		size += int64(len(upPart.Body))
+ 	}
+ 
+@@ -461,7 +483,20 @@
+ 
+ 	etag = fmt.Sprintf(`"%s-%d"`, hex.EncodeToString(hash.Sum(nil)), len(input.Parts))
+ 
+-	result, err := u.storage.PutObject(bucket, object, mpu.Meta, bytes.NewReader(body), int64(len(body)), nil)
++	if withSHA256 {
++		checksum := fmt.Sprintf("%s-%d", base64.StdEncoding.EncodeToString(composite.Sum(nil)), len(input.Parts))
++		if input.ChecksumSHA256 != "" && input.ChecksumSHA256 != checksum {
++			return "", "", ErrBadDigest
++		}
++		input.ChecksumSHA256 = checksum
++		input.ChecksumType = "COMPOSITE"
++		mpu.Meta["X-Amz-Checksum-Sha256"] = checksum
++		mpu.Meta["X-Amz-Checksum-Type"] = "COMPOSITE"
++	} else {
++		input.ChecksumSHA256 = ""
++		input.ChecksumType = ""
++	}
++	result, err := u.storage.PutObject(bucket, object, mpu.Meta, bytes.NewReader(body), int64(len(body)), input.Conditions)
+ 	if err != nil {
+ 		return "", "", err
+ 	}
+--- a/vendor/github.com/johannesboyne/gofakes3/messages.go
++++ b/vendor/github.com/johannesboyne/gofakes3/messages.go
+@@ -48,12 +48,16 @@
+ }
+ 
+ type CompletedPart struct {
+-	PartNumber int    `xml:"PartNumber"`
+-	ETag       string `xml:"ETag"`
++	ChecksumSHA256 string `xml:"ChecksumSHA256,omitempty"`
++	PartNumber     int    `xml:"PartNumber"`
++	ETag           string `xml:"ETag"`
+ }
+ 
+ type CompleteMultipartUploadRequest struct {
+-	Parts []CompletedPart `xml:"Part"`
++	Conditions     *PutConditions  `xml:"-"`
++	ChecksumSHA256 string          `xml:"-"`
++	ChecksumType   string          `xml:"-"`
++	Parts          []CompletedPart `xml:"Part"`
+ }
+ 
+ func (c CompleteMultipartUploadRequest) partsAreSorted() bool {
+@@ -70,10 +74,12 @@
+ }
+ 
+ type CompleteMultipartUploadResult struct {
+-	Location string `xml:"Location"`
+-	Bucket   string `xml:"Bucket"`
+-	Key      string `xml:"Key"`
+-	ETag     string `xml:"ETag"`
++	ChecksumSHA256 string `xml:"ChecksumSHA256,omitempty"`
++	ChecksumType   string `xml:"ChecksumType,omitempty"`
++	Location       string `xml:"Location"`
++	Bucket         string `xml:"Bucket"`
++	Key            string `xml:"Key"`
++	ETag           string `xml:"ETag"`
+ }
+ 
+ type Content struct {
+--- a/vendor/github.com/johannesboyne/gofakes3/checksum.go
++++ b/vendor/github.com/johannesboyne/gofakes3/checksum.go
+@@ -0,0 +1,32 @@
++package gofakes3
++
++import (
++	"crypto/sha256"
++	"encoding/base64"
++	"hash"
++	"io"
++)
++
++// Validate before UploadPart commits bytes to the existing multipart store.
++type sha256PartReader struct {
++	input    io.Reader
++	digest   hash.Hash
++	expected string
++}
++
++func newSHA256PartReader(input io.Reader, expected string) *sha256PartReader {
++	return &sha256PartReader{input: input, digest: sha256.New(), expected: expected}
++}
++
++func (r *sha256PartReader) sum() string {
++	return base64.StdEncoding.EncodeToString(r.digest.Sum(nil))
++}
++
++func (r *sha256PartReader) Read(p []byte) (int, error) {
++	n, err := r.input.Read(p)
++	r.digest.Write(p[:n])
++	if err == io.EOF && r.sum() != r.expected {
++		return n, ErrBadDigest
++	}
++	return n, err
++}
+--- a/vendor/github.com/johannesboyne/gofakes3/backend.go
++++ b/vendor/github.com/johannesboyne/gofakes3/backend.go
+@@ -3,6 +3,7 @@
+ import (
+ 	"encoding/hex"
+ 	"errors"
++	"strings"
+ 
+ 	"io"
+ 	"time"
+@@ -434,6 +435,11 @@
+ 	// carry over metadata if it exists
+ 	if existingObj != nil {
+ 		for k, v := range existingObj.Metadata {
++			// Integrity metadata belongs to the bytes being written, never a
++			// previous version of this key. CopyObject supplies its own metadata.
++			if strings.HasPrefix(k, "X-Amz-Checksum-") {
++				continue
++			}
+ 			// new metadata overwrites old but keep the rest
+ 			// TODO: check how metadata can be deleted?!
+ 			if _, ok := meta[k]; !ok {

package/src/components/s3-runtime/test.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Exercise the exact vendored compatibility patches used by the runtime image.
+set -eu
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT HUP INT TERM
+cp "$source_dir"/*.go "$source_dir/go.mod" "$source_dir/go.sum" "$source_dir"/*.patch "$test_dir/"
+cd "$test_dir"
+go mod vendor
+patch -p1 < metadata.patch
+patch -p1 < multipart.patch
+go test -mod=vendor -race ./...

package/src/components/s3.ts

@@ -52,11 +52,11 @@ const S3_DOCKERFILE = `
 FROM golang:1.27.2-alpine@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS build
 RUN apk add --no-cache patch
 WORKDIR /src
-${["go.mod", "go.sum", "main.go", "metadata.patch"].map((file) => {
+${["go.mod", "go.sum", "main.go", "metadata.patch", "multipart.patch"].map((file) => {
   const data = readFileSync(new URL(`./s3-runtime/${file}`, import.meta.url)).toString("base64");
   return `RUN printf '%s' '${data}' | base64 -d > ${file}`;
 }).join("\n")}
-RUN go mod vendor && patch -p1 < metadata.patch
+RUN go mod vendor && patch -p1 < metadata.patch && patch -p1 < multipart.patch
 RUN CGO_ENABLED=0 go build -mod=vendor -trimpath -ldflags='-s -w' -o /s3-server .
 FROM scratch
 COPY --from=build /s3-server /s3-server

package/src/harness/sticky-consumer.test.ts

@@ -20,12 +20,12 @@ test("completed builds preserve healthy caches and restore only missing runtime
     free += 10 * GiB;
     return "";
   };
-  await ensureBuildHeadroom(config, run, async () => free);
+  await ensureBuildHeadroom(config, run, async () => ({ freeBytes: free, totalBytes: 251 * GiB, reservedBytes: 0 }));
   expect(calls).toEqual([]);
   // Tangent's build left 13 GiB before native scratch crossed the
   // kubelet eviction threshold. Containerd reclamation can take passes.
   free = 13 * GiB;
-  await ensureBuildHeadroom(config, run, async () => free);
+  await ensureBuildHeadroom(config, run, async () => ({ freeBytes: free, totalBytes: 251 * GiB, reservedBytes: 0 }));
   expect(free).toBe(33 * GiB);
   expect(calls).toEqual(Array.from({ length: 2 }, () => ["buildctl", "--addr", "tcp://127.0.0.1:1234",
     "prune", "--all", "--free-storage", String(Math.ceil(32 * GiB / 1e6))]));
@@ -36,13 +36,13 @@ test("unreclaimable build storage fails before project setup without deleting ru
   await expect(ensureBuildHeadroom(config, async (command) => {
     commands.push(command);
     return "";
-  }, async () => 13 * GiB)).rejects.toThrow("13312 MiB available, 32768 MiB required");
+  }, async () => ({ freeBytes: 13 * GiB, totalBytes: 251 * GiB, reservedBytes: 0 }))).rejects.toThrow("13312 MiB available, 32768 MiB required");
   expect(commands).toEqual(["buildctl", "buildctl", "buildctl"]);
 });
 
 test("build headroom checks propagate failed GC and disk observations", async () => {
   await expect(ensureBuildHeadroom(config, async () => { throw new Error("GC unavailable"); },
-    async () => 13 * GiB)).rejects.toThrow("GC unavailable");
+    async () => ({ freeBytes: 13 * GiB, totalBytes: 251 * GiB, reservedBytes: 0 }))).rejects.toThrow("GC unavailable");
   await expect(ensureBuildHeadroom(config, async () => { throw new Error("must not run"); },
     async () => { throw new Error("filesystem unavailable"); })).rejects.toThrow("filesystem unavailable");
 });
@@ -195,3 +195,30 @@ test("GC does not remove an image while it supplies the Kubernetes maintenance d
   });
   expect(removed).toEqual(["old"]);
 });
+
+
+test("BuildKit thresholds include ext4 reserved blocks for build and publication GC", async () => {
+  // The failed Tangent build had 23 GiB available but more than 32 GiB
+  // physically free, so an unadjusted BuildKit request reclaimed nothing.
+  const reservedBytes = 13 * GiB;
+  const worker = (Bun.TOML.parse(stickyBuildkitConfig(config, reservedBytes)) as any).worker.containerd;
+  expect(worker.gcpolicy[0].minFreeSpace).toBe(45 * GiB);
+  for (const build of [true, false]) {
+    let freeBytes = 23 * GiB;
+    const requests: number[] = [];
+    const run = async (_command: string, args: string[]) => {
+      const index = args.indexOf("--free-storage");
+      if (index >= 0) {
+        requests.push(Number(args[index + 1]) * 1e6);
+        freeBytes = 33 * GiB;
+      }
+      return "";
+    };
+    const usage = async () => ({ freeBytes, totalBytes: 251 * GiB, reservedBytes });
+    if (build) await ensureBuildHeadroom(config, run, usage);
+    else await collectStickyCache(config, retention(), run, usage);
+    expect(requests).toHaveLength(1);
+    expect(requests[0]).toBeGreaterThanOrEqual(45 * GiB);
+    expect(requests[0]).toBeLessThan(45 * GiB + 1e6);
+  }
+});

package/src/harness/sticky-consumer.ts

@@ -50,7 +50,7 @@ export function validateStickyConfig(config: StickyConsumerConfig): void {
  * only minFreeSpace, BuildKit 0.32.2 sets keepBytes == totalSize when healthy,
  * and pruneOnce's strict '<' check can still evict a record on every GC pass.
  * Actual filesystem capacity is smaller than the device due to metadata. */
-export function stickyBuildkitConfig(config: StickyConsumerConfig): string {
+export function stickyBuildkitConfig(config: StickyConsumerConfig, reservedBytes = 0): string {
   validateStickyConfig(config);
   return `root = "${config.path}/buildkit"
 # This standalone BuildKit does not inherit dockerd's registry mirrors.
@@ -70,7 +70,7 @@ export function stickyBuildkitConfig(config: StickyConsumerConfig): string {
 [[worker.containerd.gcpolicy]]
   all = true
   maxUsedSpace = ${config.capacityBytes}
-  minFreeSpace = ${config.headroomBytes}
+  minFreeSpace = ${config.headroomBytes + reservedBytes}
 `;
 }
 
@@ -105,7 +105,7 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
   dockerConfig.features = { "containerd-snapshotter": true };
   dockerConfig["storage-driver"] = "overlayfs";
   await writeFile(`${STICKY_RUNTIME}/docker.json`, JSON.stringify(dockerConfig));
-  await writeFile(`${STICKY_RUNTIME}/buildkit.toml`, stickyBuildkitConfig(config));
+  await writeFile(`${STICKY_RUNTIME}/buildkit.toml`, stickyBuildkitConfig(config, (await diskUsage(config.path)).reservedBytes));
   const start = async (unit: string, program: string, args: string[]) => {
     await exec("systemd-run", ["--quiet", "--unit", unit, "-p", "TimeoutStopSec=30",
       // Pinned BuildKit 0.32.2 returns 1 after its normal first-SIGTERM
@@ -125,6 +125,19 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
   await exec("docker", ["buildx", "inspect", "--bootstrap", "spectest-local"]);
 }
 
+async function diskUsage(path: string) {
+  const fs = await statfs(path);
+  return { freeBytes: fs.bavail * fs.bsize, totalBytes: fs.blocks * fs.bsize,
+    reservedBytes: Math.max(0, fs.bfree - fs.bavail) * fs.bsize };
+}
+
+// BuildKit 0.32.2 compares MinFreeSpace against statfs.bfree, whereas
+// applications and kubelet need bavail. Include ext4's reserved blocks so
+// pruning restores the required usable space instead of stopping early.
+function pruneTarget(config: StickyConsumerConfig, usage: { reservedBytes?: number }): string {
+  return String(Math.ceil((config.headroomBytes + (usage.reservedBytes ?? 0)) / 1e6));
+}
+
 /** Builds can finish before automatic GC restores its free-space reserve.
  * Reclaim only unused BuildKit records before project setup adds runtime data.
  * Docker images, containers, volumes and nested Kubernetes stores stay live.
@@ -132,20 +145,17 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
 export async function ensureBuildHeadroom(
   config: StickyConsumerConfig,
   run: typeof exec = exec,
-  available = async () => {
-    const fs = await statfs(config.path);
-    return fs.bavail * fs.bsize;
-  },
+  usage = () => diskUsage(config.path),
 ): Promise<void> {
   validateStickyConfig(config);
-  let free = await available();
-  for (let pass = 0; free < config.headroomBytes && pass < 3; pass++) {
+  let fs = await usage();
+  for (let pass = 0; fs.freeBytes < config.headroomBytes && pass < 3; pass++) {
     await run("buildctl", ["--addr", "tcp://127.0.0.1:1234", "prune", "--all", "--free-storage",
-      String(Math.ceil(config.headroomBytes / 1e6))], 120_000);
-    free = await available();
+      pruneTarget(config, fs)], 120_000);
+    fs = await usage();
   }
-  if (free < config.headroomBytes) {
-    throw new Error(`environment build left insufficient disk headroom: ${Math.floor(free / 2 ** 20)} MiB available, ${Math.ceil(config.headroomBytes / 2 ** 20)} MiB required`);
+  if (fs.freeBytes < config.headroomBytes) {
+    throw new Error(`environment build left insufficient disk headroom: ${Math.floor(fs.freeBytes / 2 ** 20)} MiB available, ${Math.ceil(config.headroomBytes / 2 ** 20)} MiB required`);
   }
 }
 
@@ -165,10 +175,7 @@ export async function collectStickyCache(
   config: StickyConsumerConfig,
   retention: StickyImageRetention,
   run: typeof exec = exec,
-  usage = async (): Promise<{ freeBytes: number; totalBytes: number }> => {
-    const fs = await statfs(config.path);
-    return { freeBytes: fs.bavail * fs.bsize, totalBytes: fs.blocks * fs.bsize };
-  },
+  usage: () => Promise<{ freeBytes: number; totalBytes: number; reservedBytes?: number }> = () => diskUsage(config.path),
   kubernetes?: KubernetesCacheMaintenance,
 ): Promise<void> {
   validateStickyConfig(config);
@@ -196,7 +203,7 @@ export async function collectStickyCache(
   // a per-consumer cap evicts useful cache even when the disk is mostly empty.
   const pruneBuildkit = async () => {
     await run("buildctl", [...buildctl, "--all", "--free-storage",
-      String(Math.ceil(config.headroomBytes / 1e6))], 120_000);
+      pruneTarget(config, fs)], 120_000);
     fs = await usage();
   };
   await pruneBuildkit();