object-storage-proxy 0.6.0__tar.gz → 0.6.2__tar.gz

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/.github/workflows/ci.yml

@@ -2,11 +2,8 @@ name: CI
 
 on:
   push:
-    branches:
-      - main
-      - master
     tags:
-      - '*'
+      - 'v*'
   pull_request:
   workflow_dispatch:
 

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/.gitignore

@@ -14,3 +14,5 @@ integration/docker/jars/
 **/__pycache__/
 **/*.py[cod]
 target/
+libobject_storage_proxy.so
+.env.minio

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/CHANGELOG.md

@@ -5,12 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.2] - 2026-05-14
+
+### Chores
+- Cleanup gitignore
+
+- Fix spark warning test
+
+
+### Documentation
+- Update CHANGELOG for v0.6.0 [skip ci]
+
+
+### Fixed
+- **test**: Add minio backend integration and compatibility fixes
+
+- **ci**: Only trigger ci on tag push (release)
+
+
+### Testing
+- Add more tests, based on aws own s3 sdk tests -- garage does not implement some features, so xfail until alternative found
+
+
 ## [0.6.0] - 2026-05-13
 
 ### Added
 - Spark streaming
 
 
+### Chores
+- Release v0.6.0
+
+
 ### Documentation
 - Update README
 

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/Cargo.lock

@@ -1672,7 +1672,7 @@ dependencies = [
 
 [[package]]
 name = "object-storage-proxy"
-version = "0.6.0"
+version = "0.6.2"
 dependencies = [
  "async-trait",
  "base64",

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "object-storage-proxy"
-version = "0.6.0"
+version = "0.6.2"
 edition = "2024"
-description = "A fast in-process reverse proxy for AWS S3 and IBM COS with a Python interface for auth and credential management."
+description = "A fast in-process reverse proxy for AWS S3, IBM COS, and other object storage providers, with a Python interface for auth and credential management."
 license = "MIT"
 homepage = "https://osp.flexworks.eu"
 repository = "https://github.com/opensourceworks-org/object-storage-proxy"

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/DEVELOP.md

@@ -18,20 +18,21 @@
 | `task test:rust` | Rust unit tests via `cargo nextest` |
 | `task test:rust:cargo` | Rust unit tests via plain `cargo test` |
 | `task test:integration` | run `test_integration.sh` |
-| `task test` | build → `test:rust` → `test:integration` |
+| `task test` | build -> `test:rust` -> `test:integration` |
 | `task fmt` | `cargo fmt` |
 | `task lint` | `cargo clippy -- -D warnings` |
-| `task wheel` | debug wheel → `target/wheels/` |
-| `task wheel:release` | release wheel → `target/wheels/` |
+| `task wheel` | debug wheel -> `target/wheels/` |
+| `task wheel:release` | release wheel -> `target/wheels/` |
 | `task clean` | remove Rust artefacts and `.venv` |
 | `task clean:wheels` | remove `target/wheels/` only |
-| `task integration:run` | automated integration test: up → test → down |
-| `task integration:up` | start Garage + bootstrap + OSP proxy |
-| `task integration:down` | stop proxy + stop Garage |
+| `task integration:run` | automated integration test: up -> test -> down |
+| `task integration:up` | start Garage + MinIO + bootstrap both + OSP proxy |
+| `task integration:down` | stop proxy + stop Garage + MinIO |
+| `task integration:bootstrap` | bootstrap both backends (write `.env` + `.env.minio`) |
 | `task integration:test` | run pytest suite (excludes Spark) |
-| `task integration:test:spark` | run only the Spark tests (`-m spark`) |
-| `task integration:test:all` | run full suite including Spark tests |
-| `task integration:test:spark` | run only the Spark tests (`-m spark`) |
+| `task integration:test:spark` | Spark tests against all backends (Garage + MinIO) |
+| `task integration:test:spark:garage` | Spark tests against Garage only |
+| `task integration:test:spark:minio` | Spark tests against MinIO only |
 | `task integration:test:all` | run full suite including Spark tests |
 | `task hooks:install` | install (or re-install) the pre-commit git hooks |
 | `task hooks:run` | run all pre-commit checks against every file |
@@ -131,13 +132,13 @@ pip install target/wheels/object_storage_proxy-*.whl
 Copy `.env.example` to `.env` (if provided) or export the variables manually, then run:
 
 ```bash
-task run          # dev build → start test_server.py
-task run:release  # release build → start test_server.py
+task run          # dev build -> start test_server.py
+task run:release  # release build -> start test_server.py
 ```
 
 The server listens on:
-- HTTP  → `0.0.0.0:6190`
-- HTTPS → `0.0.0.0:8443`
+- HTTP  -> `0.0.0.0:6190`
+- HTTPS -> `0.0.0.0:8443`
 
 ---
 
@@ -146,7 +147,7 @@ The server listens on:
 ```bash
 task test:rust        # Rust unit tests via cargo nextest (recommended)
 task test:rust:cargo  # Rust unit tests via plain cargo test
-task test             # full suite: build → rust tests → integration tests
+task test             # full suite: build -> rust tests -> integration tests
 ```
 
 `cargo nextest` runs tests in parallel and gives richer output.  Install it once with:
@@ -311,7 +312,12 @@ Pushing a `v*` tag triggers `.github/workflows/release.yml`, which:
 
 ## Integration testing
 
-The integration test suite runs OSP against a real [Garage](https://garagehq.deuxfleurs.fr/) S3-compatible storage node inside Docker. All tests live under `integration/test_server/tests/` and use pytest + boto3.
+The integration test suite runs OSP against two real S3-compatible storage backends inside Docker:
+
+- **[Garage](https://garagehq.deuxfleurs.fr/)** — a self-hosted S3-compatible store; the primary test target.
+- **[MinIO](https://min.io/)** — used to verify compatibility with stricter S3 API enforcement (see [S3 API compliance](#s3-api-compliance-differences) below).
+
+All tests live under `integration/test_server/tests/` and use pytest + boto3.
 
 ### Prerequisites
 
@@ -322,7 +328,7 @@ The integration test suite runs OSP against a real [Garage](https://garagehq.deu
 
 ```bash
 task integration:setup    # install test Python deps (once)
-task integration:run      # garage up → bootstrap → proxy → test → teardown
+task integration:run      # garage up -> bootstrap -> proxy -> test -> teardown
 ```
 
 `integration:run` tears everything down even if tests fail.
@@ -334,10 +340,17 @@ Bring the stack up once and iterate on tests without restarting:
 ```bash
 task integration:setup           # install test Python deps (once)
 task integration:garage:up       # start Garage container
-task integration:garage:bootstrap  # create bucket + HMAC key, write .env
+task integration:minio:up        # start MinIO container
+task integration:bootstrap       # create buckets + keys, write .env + .env.minio
 task integration:server:start    # start the OSP proxy in the background
 ```
 
+Or use the single convenience shortcut that does all of the above:
+
+```bash
+task integration:up
+```
+
 Run the tests:
 
 ```bash
@@ -357,22 +370,31 @@ task integration:garage:destroy  # also wipe Garage data volumes
 | Task | Description |
 |------|-------------|
 | `integration:setup` | `uv sync` in `integration/test_server/` |
-| `integration:up` | Garage up → bootstrap → proxy start |
-| `integration:down` | Stop proxy → stop Garage |
-| `integration:run` | Automated: up → test → down (teardown on failure too) |
+| `integration:up` | Garage + MinIO up -> bootstrap both -> proxy start |
+| `integration:down` | Stop proxy -> stop Garage + MinIO |
+| `integration:bootstrap` | Bootstrap both backends (write `.env` + `.env.minio`) |
+| `integration:run` | Automated: up -> test -> down (teardown on failure too) |
 | `integration:garage:up` | Start the Garage Docker container |
-| `integration:garage:down` | Stop and remove the container |
+| `integration:garage:down` | Stop and remove the Garage container |
 | `integration:garage:destroy` | Stop container **and** remove data volumes |
 | `integration:garage:bootstrap` | Create bucket + HMAC key in Garage, write `.env` |
 | `integration:garage:logs` | Follow Garage container logs |
 | `integration:garage:status` | Query Garage cluster status via admin API |
-| `integration:server:start` | Start OSP proxy in the background (logs → `proxy.log`) |
+| `integration:minio:up` | Start the MinIO Docker container |
+| `integration:minio:down` | Stop and remove the MinIO container |
+| `integration:minio:destroy` | Stop container **and** remove data volumes |
+| `integration:minio:bootstrap` | Create MinIO bucket, write `.env.minio` |
+| `integration:server:start` | Start OSP proxy in the background (logs -> `proxy.log`) |
 | `integration:server:stop` | Stop the background proxy |
 | `integration:server:logs` | Tail the proxy log |
-| `integration:test` | Run pytest suite against the running environment |
+| `integration:test` | Run pytest suite against the running environment (excludes Spark) |
 | `integration:test:fast` | Same, with `-x` (stop on first failure) |
-| `integration:test:spark` | Run only the Spark tests (`-m spark`) |
-| `integration:test:spark:fast` | Same, with `-x` (stop on first failure) |
+| `integration:test:spark` | Spark tests against all backends (Garage + MinIO) |
+| `integration:test:spark:garage` | Spark tests against Garage only |
+| `integration:test:spark:garage:fast` | Same, with `-x` |
+| `integration:test:spark:minio` | Spark tests against MinIO only |
+| `integration:test:spark:minio:fast` | Same, with `-x` |
+| `integration:test:spark:fast` | Spark tests against all backends, stop on first failure |
 | `integration:test:all` | Run full suite including Spark tests |
 
 ### What the tests cover
@@ -383,7 +405,38 @@ task integration:garage:destroy  # also wipe Garage data volumes
 | `tests/test_multipart.py` | CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListParts |
 | `tests/test_presigned.py` | Presigned GET/PUT, expiry enforcement, repeated-use limiting |
 | `tests/test_aws_cli.py` | `aws s3 ls`, `cp`, `sync`, `rm` via subprocess |
-| `tests/test_spark.py` | Spark s3a read/write: Parquet, JSON, overwrite, empty DataFrame, large DataFrame (10 000 rows) |
+| `tests/test_range_requests.py` | Byte-range GET (single, multi, suffix, full), `206 Partial Content`, conditional GET headers (`If-Match`, `If-None-Match`, `If-Modified-Since`, `If-Unmodified-Since`) |
+| `tests/test_metadata.py` | Custom `x-amz-meta-*` headers, `Content-Type`, `Cache-Control`, `Content-Disposition`, `Content-Encoding`, copy metadata directives (`COPY` / `REPLACE`) |
+| `tests/test_etag.py` | ETag format for single-part and multipart objects, ETag preservation through CopyObject, checksum header tolerance |
+| `tests/test_tagging.py` | `PutObjectTagging`, `GetObjectTagging`, `DeleteObjectTagging` — `xfail` for Garage (not implemented), **expected to pass** for MinIO |
+| `tests/test_bucket_ops.py` | HeadBucket, ListBuckets, GetBucketLocation, ListObjectsV1/V2 extended params, ListMultipartUploads |
+| `tests/test_advanced_objects.py` | DeleteObjects (quiet/mixed), UploadPartCopy (full source + byte-range), presigned HEAD/DELETE/GET-with-range, `response-*` query overrides, 12 MB streaming PUT |
+| `tests/test_spark.py` | Spark s3a read/write via OSP → **Garage**: Parquet, JSON, overwrite, empty DataFrame, large DataFrame (10 000 rows) |
+| `tests/test_spark_minio.py` | Same five tests via OSP → **MinIO** — also serves as a regression guard for `Content-MD5` forwarding on `DeleteObjects` (see [S3 API compliance](#s3-api-compliance-differences)) |
+
+### Known backend limitations
+
+The following S3 operations are known to behave differently across backends. The proxy forwards all requests correctly — the limitations are entirely in the storage backends. Because the test suite runs against **both** Garage and MinIO (parametrized as `[garage]` and `[minio]`), each limitation is isolated to the relevant backend's run.
+
+**Garage v1.0.1 — xfail on `[garage]`, passes on `[minio]`:**
+
+| Operation | Garage symptom |
+|-----------|---------------|
+| `PutObjectTagging` | `NotImplemented` |
+| `GetObjectTagging` | `NotImplemented` |
+| `DeleteObjectTagging` | `NotImplemented` |
+| `If-Match` enforcement on `GET` | Returns `200` instead of `412` |
+| `If-Unmodified-Since` enforcement on `GET` | Returns `200` instead of `412` |
+
+> `If-None-Match` (→ `304`) and `If-Modified-Since` (→ `304`) **are** enforced correctly by both backends.
+
+**MinIO — xfail on `[minio]`, passes on `[garage]`:**
+
+| Operation | MinIO symptom |
+|-----------|---------------|
+| `ListMultipartUploads` with `Prefix` ending in `/` | Returns empty `Uploads` list; using the full key as `Prefix` (without trailing slash) works correctly |
+
+All xfail markers use `strict=False` so the suite stays green and will automatically promote to a pass if the backend is upgraded.
 
 ### Spark tests
 
@@ -481,8 +534,88 @@ Key Hadoop S3A settings applied:
 | 3901 | Garage RPC |
 | 3903 | Garage admin API |
 | 6190 | OSP proxy (S3 frontend) |
+| 9000 | MinIO S3 API |
+| 9001 | MinIO web console |
 | 9091 | OSP Prometheus metrics |
 
 ### Environment
 
-`bootstrap.py` writes `integration/test_server/.env` with the generated Garage credentials. `server.py` and the pytest fixtures both load this file automatically. The file is gitignored — never commit it.
+`bootstrap.py` writes `integration/test_server/.env` with the generated Garage credentials.
+`minio_bootstrap.py` writes `integration/test_server/.env.minio` with the MinIO credentials.
+Both files are loaded automatically by `server.py` and the pytest fixtures. Both are gitignored — never commit them.
+
+Tests in `test_spark_minio.py` are skipped automatically when `.env.minio` is absent, so the Garage-only suite always works without MinIO running.
+
+---
+
+## S3 API compliance differences
+
+Different S3-compatible backends vary in how strictly they follow the AWS S3 specification. OSP is tested against both Garage and MinIO to catch these differences early.
+
+| Operation | AWS spec | Garage v1.0.1 | MinIO | Test status |
+|-----------|----------|---------------|-------|-------------|
+| `DeleteObjects` — `Content-MD5` header | **Required** | Accepted without it (lenient) | Rejected without it (`400 InvalidRequest`) | passes on both (see note below) |
+| `x-amz-tagging-directive` on `CopyObject` | `COPY` or `REPLACE` | N/A (tagging not implemented) | ✅ enforced | passes on MinIO |
+| `PutObjectTagging` / `GetObjectTagging` / `DeleteObjectTagging` | Supported | `NotImplemented` | ✅ Supported | `xfail` Garage, passes MinIO |
+| `If-Match` / `If-Unmodified-Since` on `GET` | Must return `412` when condition fails | Returns `200` (header ignored) | ✅ Returns `412` | `xfail` Garage, passes MinIO |
+| `ListMultipartUploads` with `Prefix` ending in `/` | Returns matching uploads | ✅ works | Returns empty list | passes Garage, `xfail` MinIO |
+
+### botocore ≥ 1.43 and Content-MD5
+
+botocore 1.43 changed `DeleteObjects` to send `x-amz-checksum-crc32` instead of `Content-MD5` for body integrity. This behaviour **cannot** be overridden via the `request_checksum_calculation` config option — the old header is simply never emitted regardless of settings.
+
+MinIO still **requires** `Content-MD5` on `DeleteObjects` and rejects requests without it with `400 MissingContentMD5`. To keep the test suite working correctly against both backends, `conftest.py` injects the header via a botocore event hook that runs _before_ SigV4 signing (so it appears in `SignedHeaders`):
+
+```python
+def _register_delete_objects_md5(client) -> None:
+    def _inject(request, **kwargs):
+        body = request.body
+        if body is None:
+            return
+        if isinstance(body, str):
+            body = body.encode("utf-8")
+        request.headers["Content-MD5"] = base64.b64encode(
+            hashlib.md5(body).digest()
+        ).decode()
+
+    client.meta.events.register("before-sign.s3.DeleteObjects", _inject)
+```
+
+OSP itself forwards `Content-MD5` unchanged when it is present — it is in the upstream allowlist and is never stripped. If you use boto3 ≥ 1.43 in your own application against a MinIO backend through OSP, you will need the same hook.
+
+### Internal proxy fixes discovered during dual-backend testing
+
+These bugs in OSP were found and fixed while adding MinIO to the test matrix.
+
+#### Bare sub-resource query keys (`?delete`, `?uploads`, `?tagging`)
+
+The S3 protocol uses bare query parameters (no `=value`) as sub-resource identifiers. OSP's query parser previously required every key to have an `=` sign, causing `DeleteObjects` (`?delete`), `ListMultipartUploads` (`?uploads`), and `PutObjectTagging` (`?tagging`) to return `500`. Fixed in `src/parsers/path.rs`:
+
+```rust
+// Bare sub-resource key with no value (e.g. "delete", "uploads", "tagging").
+let (input, key) = map_res(take_until_either("&"), decode_segment).parse(input)?;
+Ok((input, (key, String::new())))
+```
+
+#### Bucket-root trailing slash (path-style addressing)
+
+For path-style backends, bucket-level requests (`GET /bucket?uploads&prefix=…`) were forwarded upstream as `GET /bucket/?uploads&prefix=…` (extra trailing slash), causing signature mismatches. Fixed in `upstream_request_filter` in `src/lib.rs`:
+
+```rust
+// Strip trailing slash for bucket-root requests in path-style mode.
+let u_url = if my_updated_url == "/" {
+    format!("/{}", bucket)
+} else {
+    format!("/{}{}", bucket, my_updated_url)
+};
+```
+
+#### `x-amz-tagging-directive` stripped by the proxy
+
+`CopyObject` with `TaggingDirective: REPLACE` requires `x-amz-tagging-directive` to reach the backend. It was not in OSP's upstream header allowlist, so it was silently dropped. Fixed by adding it alongside `x-amz-tagging` in `src/lib.rs`.
+
+#### Separate bucket names required per backend
+
+Both backends initially used `test-bucket`, causing MinIO's `cos_map` entry to silently overwrite Garage's. All requests then routed to MinIO regardless of the parametrized backend. Fixed by giving MinIO a distinct name (`test-bucket-minio`) in `minio_bootstrap.py`.
+
+> **cos_map constraint:** each key in `cos_map` must be globally unique. If you need the same logical bucket name on multiple backends, use distinct proxy-side names and map them in your `authorize` callback.

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: object-storage-proxy
-Version: 0.6.0
+Version: 0.6.2
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
@@ -53,6 +53,7 @@ This proxy solves that by:
 ## Features
 
 - Compatible with any AWS S3-compatible client: aws-cli, boto3, polars, spark, datafusion, presto, trino, ...
+- Normalises differences between S3-compatible backends so clients work regardless of whether the backend is AWS S3, MinIO, Garage, or IBM COS (see [Backend compatibility](#backend-compatibility) below).
 - Decouples frontend authentication (what the client sends) from backend authentication (what the storage expects).
 - Python callables for credential fetching, HMAC key lookup, and per-request authorization.
 - TTL-based credential and authorization caching.
@@ -215,6 +216,22 @@ def lookup_secret(access_key: str) -> str | None: ...
 def authorize(token: str, bucket: str, request: dict | None = None) -> bool: ...
 ```
 
+## Backend compatibility
+
+S3-compatible backends differ in how strictly they follow the AWS S3 specification. OSP irons out these differences so clients don't need to care which backend is underneath.
+
+| Behaviour | AWS S3 spec | Garage | MinIO | OSP handling |
+|-----------|-------------|--------|-------|-------------|
+| `Content-MD5` on `DeleteObjects` | **Required** | Accepted without it (lenient) | Enforced (`400` if missing) | Forwarded when present; test suite injects it because botocore ≥ 1.43 no longer sends it by default |
+| `x-amz-tagging-directive` on `CopyObject` | `COPY` or `REPLACE` | N/A (tagging not implemented) | ✅ enforced | Header is in OSP's forwarding allowlist — was previously stripped |
+| `PutObjectTagging` / `GetObjectTagging` | Supported | `NotImplemented` | ✅ | Forwarded; backend limitation is transparent |
+| `If-Match` / `If-Unmodified-Since` on `GET` | Must return `412` | Returns `200` (header ignored) | ✅ Returns `412` | Forwarded; backend limitation is transparent |
+| `ListMultipartUploads` with `Prefix` ending in `/` | Returns matching uploads | ✅ works | Returns empty list (MinIO bug) | Forwarded; MinIO limitation documented as `xfail` in the test suite |
+
+> **botocore ≥ 1.43 note:** Recent versions of boto3 switched from `Content-MD5` to `x-amz-checksum-crc32` for body integrity on `DeleteObjects`, regardless of the `request_checksum_calculation` setting. `Content-MD5` is still required by MinIO. If you use boto3 ≥ 1.43 directly against MinIO through OSP you may need to inject `Content-MD5` manually via a `before-sign` event hook — see [DEVELOP.md](DEVELOP.md#botocore-43-and-content-md5) for details and example code.
+
+The integration test suite covers all of the above: every test runs parametrized over both Garage and MinIO backends, so regressions surface immediately. See [DEVELOP.md](DEVELOP.md#s3-api-compliance-differences) for the full compliance table and the internal proxy fixes that enable it.
+
 ## Prometheus metrics
 
 The proxy ships with a built-in Prometheus scrape endpoint. Set `metrics_port` to enable it:

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/README.md

@@ -33,6 +33,7 @@ This proxy solves that by:
 ## Features
 
 - Compatible with any AWS S3-compatible client: aws-cli, boto3, polars, spark, datafusion, presto, trino, ...
+- Normalises differences between S3-compatible backends so clients work regardless of whether the backend is AWS S3, MinIO, Garage, or IBM COS (see [Backend compatibility](#backend-compatibility) below).
 - Decouples frontend authentication (what the client sends) from backend authentication (what the storage expects).
 - Python callables for credential fetching, HMAC key lookup, and per-request authorization.
 - TTL-based credential and authorization caching.
@@ -195,6 +196,22 @@ def lookup_secret(access_key: str) -> str | None: ...
 def authorize(token: str, bucket: str, request: dict | None = None) -> bool: ...
 ```
 
+## Backend compatibility
+
+S3-compatible backends differ in how strictly they follow the AWS S3 specification. OSP irons out these differences so clients don't need to care which backend is underneath.
+
+| Behaviour | AWS S3 spec | Garage | MinIO | OSP handling |
+|-----------|-------------|--------|-------|-------------|
+| `Content-MD5` on `DeleteObjects` | **Required** | Accepted without it (lenient) | Enforced (`400` if missing) | Forwarded when present; test suite injects it because botocore ≥ 1.43 no longer sends it by default |
+| `x-amz-tagging-directive` on `CopyObject` | `COPY` or `REPLACE` | N/A (tagging not implemented) | ✅ enforced | Header is in OSP's forwarding allowlist — was previously stripped |
+| `PutObjectTagging` / `GetObjectTagging` | Supported | `NotImplemented` | ✅ | Forwarded; backend limitation is transparent |
+| `If-Match` / `If-Unmodified-Since` on `GET` | Must return `412` | Returns `200` (header ignored) | ✅ Returns `412` | Forwarded; backend limitation is transparent |
+| `ListMultipartUploads` with `Prefix` ending in `/` | Returns matching uploads | ✅ works | Returns empty list (MinIO bug) | Forwarded; MinIO limitation documented as `xfail` in the test suite |
+
+> **botocore ≥ 1.43 note:** Recent versions of boto3 switched from `Content-MD5` to `x-amz-checksum-crc32` for body integrity on `DeleteObjects`, regardless of the `request_checksum_calculation` setting. `Content-MD5` is still required by MinIO. If you use boto3 ≥ 1.43 directly against MinIO through OSP you may need to inject `Content-MD5` manually via a `before-sign` event hook — see [DEVELOP.md](DEVELOP.md#botocore-43-and-content-md5) for details and example code.
+
+The integration test suite covers all of the above: every test runs parametrized over both Garage and MinIO backends, so regressions surface immediately. See [DEVELOP.md](DEVELOP.md#s3-api-compliance-differences) for the full compliance table and the internal proxy fixes that enable it.
+
 ## Prometheus metrics
 
 The proxy ships with a built-in Prometheus scrape endpoint. Set `metrics_port` to enable it:

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/Taskfile.yml

@@ -146,15 +146,23 @@ tasks:
   # manual dev/testing while restarting just the proxy (or vice-versa).
   #
   # Quick reference:
-  #   task integration:up           # full stack (garage + bootstrap + proxy)
-  #   task integration:down         # tear everything down
-  #   task integration:test         # run tests against whatever is running
-  #   task integration:run          # automated: up → test → down
+  #   task integration:up             # full stack (garage + bootstrap + proxy)
+  #   task integration:down           # tear everything down
+  #   task integration:test           # run tests against whatever is running
+  #   task integration:run            # automated: up -> test -> down
   #
-  #   task integration:garage:up    # just Garage (stays running)
+  #   task integration:garage:up      # just Garage (stays running)
   #   task integration:garage:bootstrap   # create bucket + key, write .env
-  #   task integration:server:start # just the OSP proxy (background)
-  #   task integration:server:stop  # kill the proxy
+  #   task integration:server:start   # just the OSP proxy (background)
+  #   task integration:server:stop    # kill the proxy
+  #
+  #   task integration:minio:up       # start MinIO container
+  #   task integration:minio:bootstrap # create bucket, write .env.minio
+  #   task integration:minio:down     # stop MinIO container
+  #   task integration:minio:destroy  # stop MinIO AND remove volumes
+  #   task integration:test:spark         # Spark tests against all backends
+  #   task integration:test:spark:garage  # Spark tests (Garage only)
+  #   task integration:test:spark:minio   # Spark tests (MinIO only)
 
   integration:setup:
     desc: "Install Python deps for the integration test project"
@@ -170,7 +178,7 @@ tasks:
       - echo "Garage starting — waiting for healthy status …"
       - |
         for i in $(seq 1 30); do
-          status=$(docker inspect --format='{{.State.Health.Status}}' osp-garage 2>/dev/null)
+          status=$(docker inspect --format='{{"{{"}}{{".State.Health.Status"}}{{"}}"}}' osp-garage 2>/dev/null)
           if [ "$status" = "healthy" ]; then echo "Garage is healthy"; exit 0; fi
           echo "  waiting… ($i/30) status=$status"; sleep 2
         done
@@ -207,14 +215,47 @@ tasks:
     cmds:
       - uv run python bootstrap.py
 
+  integration:minio:up:
+    desc: "Start the MinIO container (stays running)"
+    dir: integration/test_server
+    cmds:
+      - docker compose up -d minio
+      - echo "MinIO starting — waiting for healthy status …"
+      - |
+        for i in $(seq 1 30); do
+          status=$(docker inspect --format='{{"{{"}}{{".State.Health.Status"}}{{"}}"}}' osp-minio 2>/dev/null)
+          if [ "$status" = "healthy" ]; then echo "MinIO is healthy"; exit 0; fi
+          echo "  waiting… ($i/30) status=$status"; sleep 2
+        done
+        echo "MinIO did not become healthy in time" >&2; exit 1
+
+  integration:minio:bootstrap:
+    desc: "Create MinIO bucket and write integration/test_server/.env.minio"
+    dir: integration/test_server
+    cmds:
+      - uv run python minio_bootstrap.py
+
+  integration:minio:down:
+    desc: "Stop and remove the MinIO container"
+    dir: integration/test_server
+    cmds:
+      - docker compose stop minio
+      - docker compose rm -f minio
+
+  integration:minio:destroy:
+    desc: "Stop MinIO AND remove its data volumes"
+    dir: integration/test_server
+    cmds:
+      - docker compose down -v minio
+
   integration:server:start:
-    desc: "Start the OSP proxy in the background (logs → integration/test_server/proxy.log)"
+    desc: "Start the OSP proxy in the background (logs -> integration/test_server/proxy.log)"
     cmds:
       - |
         nohup uv run --no-sync python integration/test_server/server.py \
           > integration/test_server/proxy.log 2>&1 &
-        echo $! > integration/test_server/.proxy.pid
         sleep 2
+        pgrep -f "server\.py" | head -1 > integration/test_server/.proxy.pid
         if kill -0 $(cat integration/test_server/.proxy.pid) 2>/dev/null; then
           echo "✅ Proxy started (PID=$(cat integration/test_server/.proxy.pid))"
           echo "   logs: integration/test_server/proxy.log"
@@ -242,51 +283,83 @@ tasks:
     cmds:
       - tail -f integration/test_server/proxy.log
 
+  integration:bootstrap:
+    desc: "Bootstrap both backends: create Garage bucket+key and MinIO bucket, write .env files"
+    cmds:
+      - task: integration:garage:bootstrap
+      - task: integration:minio:bootstrap
+
   integration:up:
-    desc: "Full environment: Garage up → bootstrap → proxy start"
+    desc: "Full environment: Garage + MinIO up -> bootstrap both -> proxy start"
     cmds:
       - task: integration:garage:up
-      - task: integration:garage:bootstrap
+      - task: integration:minio:up
+      - task: integration:bootstrap
       - task: integration:server:start
 
   integration:down:
-    desc: "Tear down: stop proxy → stop Garage"
+    desc: "Tear down: stop proxy -> stop Garage + MinIO"
     cmds:
       - task: integration:server:stop
       - task: integration:garage:down
+      - task: integration:minio:down
 
   integration:test:
     desc: "Run integration tests against the running environment (excludes Spark)"
     dir: integration/test_server
     cmds:
-      - uv run pytest tests/ -v -m 'not spark'
+      - uv run pytest tests/ -q -m 'not spark and not spark_minio'
 
   integration:test:fast:
     desc: "Run integration tests, stop on first failure (excludes Spark)"
     dir: integration/test_server
     cmds:
-      - uv run pytest tests/ -v -x -m 'not spark'
+      - uv run pytest tests/ -q -x -m 'not spark and not spark_minio'
 
   integration:test:spark:
-    desc: "Run only the Spark s3a tests"
+    desc: "Run Spark s3a tests against all backends (Garage + MinIO)"
+    cmds:
+      - task: integration:test:spark:garage
+      - task: integration:test:spark:minio
+
+  integration:test:spark:garage:
+    desc: "Run only the Spark s3a tests (Garage backend)"
+    dir: integration/test_server
+    cmds:
+      - uv run pytest tests/test_spark.py -q -m spark
+
+  integration:test:spark:garage:fast:
+    desc: "Run Spark tests (Garage), stop on first failure"
     dir: integration/test_server
     cmds:
-      - uv run pytest tests/test_spark.py -v -m spark
+      - uv run pytest tests/test_spark.py -q -m spark -x
 
   integration:test:spark:fast:
-    desc: "Run Spark tests, stop on first failure"
+    desc: "Run Spark tests against all backends, stop on first failure"
+    dir: integration/test_server
+    cmds:
+      - uv run pytest tests/test_spark.py tests/test_spark_minio.py -q -m 'spark or spark_minio' -x
+
+  integration:test:spark:minio:
+    desc: "Run only the Spark s3a tests (MinIO backend)"
+    dir: integration/test_server
+    cmds:
+      - uv run pytest tests/test_spark_minio.py -q -m spark_minio
+
+  integration:test:spark:minio:fast:
+    desc: "Run Spark tests (MinIO), stop on first failure"
     dir: integration/test_server
     cmds:
-      - uv run pytest tests/test_spark.py -v -m spark -x
+      - uv run pytest tests/test_spark_minio.py -q -m spark_minio -x
 
   integration:test:all:
     desc: "Run full test suite including Spark tests"
     dir: integration/test_server
     cmds:
-      - uv run pytest tests/ -v
+      - uv run pytest tests/ -q
 
   integration:run:
-    desc: "Automated: up → test → down (tears down even on failure)"
+    desc: "Automated: up -> test -> down (tears down even on failure)"
     cmds:
       - task: integration:up
       - defer: {task: integration:down}

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/flake.nix

@@ -58,6 +58,9 @@
             OPENSSL_DIR = "${pkgs.openssl.dev}";
             OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
             OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
+            # Needed for compiled Python extensions (e.g. pyzmq) that link against
+            # libstdc++.so.6 — on NixOS this is not on the default search path.
+            LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
           };
 
           shellHook = ''

{object_storage_proxy-0.6.0 → object_storage_proxy-0.6.2}/integration/presto/docker-compose.yml

@@ -35,7 +35,7 @@ services:
         limits:
           memory: 4G
     ports:
-      - "8080:8080"                  # host 8001 → container 8080
+      - "8080:8080"                  # host 8001 -> container 8080
     # depends_on:
     #   hive-metastore:
     #     condition: service_healthy

object_storage_proxy-0.6.2/integration/test_server/.proxy.pid

@@ -0,0 +1 @@
+246334