0.2.4

scripts/validate-release-static.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Static/offline release checks for RustBox 0.2.3.
+"""Static/offline release checks for RustBox 0.2.4.
 
 These checks intentionally avoid pretending to replace `cargo test`: they validate
 configuration, SQL migrations, Docker examples, query-catalog parity and release
@@ -49,10 +49,10 @@ def extract_section(text: str, begin: str, end: str) -> str:
 
 # Release/toolchain metadata.
 cargo = tomllib.loads(read("Cargo.toml"))
-require(cargo["package"]["version"] == "0.2.3", "Cargo package version is 0.2.3")
-require(cargo["package"]["rust-version"] == "1.88", "Cargo rust-version is 1.88")
+require(cargo["package"]["version"] == "0.2.4", "Cargo package version is 0.2.4")
+require(cargo["package"]["rust-version"] == "1.99.1", "Cargo rust-version is 1.99.1")
 toolchain = tomllib.loads(read("rust-toolchain.toml"))
-require(toolchain["toolchain"]["channel"] == "1.88.0", "rust-toolchain pins Rust 1.88.0")
+require(toolchain["toolchain"]["channel"] == "1.99.1", "rust-toolchain pins Rust 1.99.1")
 require(not (ROOT / "Cargo.lock").exists(), "stale Cargo.lock is not shipped")
 require("cargo generate-lockfile" in read("scripts/build-release.sh"), "release script regenerates Cargo.lock")
 release_script = read("scripts/build-release.sh")
@@ -65,15 +65,28 @@ require("make_zip.py" in package_script and "sha256sum" in package_script, "rele
 require("cargo generate-lockfile" in read(".github/workflows/ci.yml"), "CI regenerates Cargo.lock before --locked checks")
 require("validate-release-static.py" in read("scripts/build-release.sh"), "release script runs offline/static release gate")
 require("validate-release-static.py" in read(".github/workflows/ci.yml"), "CI runs offline/static release gate")
-require(read("README.md").startswith("# RustBox 0.2.3"), "README identifies RustBox 0.2.3")
-require(read("RELEASE-MANIFEST.txt").startswith("RustBox 0.2.3"), "release manifest identifies RustBox 0.2.3")
-require(read("RELEASE-VALIDATION.txt").startswith("RustBox 0.2.3"), "release validation identifies RustBox 0.2.3")
-require(read("docs/IMPLEMENTATION_STATUS.md").startswith("# RustBox 0.2.3"), "implementation status identifies RustBox 0.2.3")
+require(read("README.md").startswith("# RustBox 0.2.4"), "README identifies RustBox 0.2.4")
+require(read("RELEASE-MANIFEST.txt").startswith("RustBox 0.2.4"), "release manifest identifies RustBox 0.2.4")
+require(read("RELEASE-VALIDATION.txt").startswith("RustBox 0.2.4"), "release validation identifies RustBox 0.2.4")
+require(read("docs/IMPLEMENTATION_STATUS.md").startswith("# RustBox 0.2.4"), "implementation status identifies RustBox 0.2.4")
 require((ROOT / "docs/STORAGE_SEARCH_OPERATIONS.md").is_file(), "storage/search operations guide exists")
 require('imap_host = ""' not in read("config.dev.toml"), "development config does not override IMAP host with an invalid empty value")
 require(not re.search(r"(?m)^IMAP_HOST=\s*$", read(".env.example")), "environment example does not set an invalid empty IMAP host")
 require("pgp_enabled: bool" in read("src/routes/auth.rs"), "auth policy exposes OpenPGP availability")
 require("setOpenPgpAvailability" in read("src/web/js/72-openpgp-identities.js"), "UI hides administratively disabled OpenPGP")
+storage_rs = read("src/storage/mod.rs")
+require(
+    ".with_allow_http(storage.allow_http)" in storage_rs.split("let client_options = ClientOptions::new()", 1)[1].split("let retry =", 1)[0],
+    "S3 allow_http is applied to the final ClientOptions",
+)
+require(
+    ".with_allow_http(storage.allow_http)" not in storage_rs.split("let mut builder = AmazonS3Builder::from_env()", 1)[1].split("if let Some(endpoint)", 1)[0],
+    "S3 builder does not overwrite allow_http with replacement client options",
+)
+require(
+    "s3_http_endpoint_works_when_explicitly_allowed" in storage_rs,
+    "S3 HTTP regression test is present",
+)
 config_rs = read("src/config.rs")
 routes_mod = read("src/routes/mod.rs")
 require("pub sieve_enabled: bool" in config_rs and "pub diagnostics_enabled: bool" in config_rs and "pub about_enabled: bool" in config_rs, "configuration exposes Sieve, diagnostics and About feature gates")
@@ -215,7 +228,16 @@ require(ha["cluster_mode"] is True and ha["session_backend"] == "redis", "HA/Gar
 require(ha["redis_url"] == "redis://valkey:6379/", "HA/Garage config targets Valkey for shared sessions")
 require(ha["storage"]["backend"] == "s3" and ha["storage"]["endpoint"] == "http://garage:3900", "HA/Garage config stores blobs in Garage S3")
 require(ha["search"]["backend"] == "opensearch", "HA/Garage config uses OpenSearch")
+dockerfile = read("docker/Dockerfile")
+require("FROM rust:1.99.1-trixie AS builder" in dockerfile, "Docker builder pins Rust 1.99.1 on Debian Trixie")
+require("FROM debian:trixie-slim" in dockerfile, "Docker runtime uses Debian Trixie slim")
+require("libssl3t64" in dockerfile and "libssl3 " not in dockerfile, "Docker runtime uses the Debian Trixie OpenSSL runtime package")
+require("bookworm" not in dockerfile.lower(), "RustBox Dockerfile no longer uses Debian Bookworm")
+require("postgres:17-trixie" in read("docker/compose-postgres-s3-opensearch.yml"), "PostgreSQL/S3 Compose uses PostgreSQL 17 Trixie")
+require("bookworm" not in read("docker/compose-postgres-s3-opensearch.yml").lower(), "PostgreSQL/S3 Compose no longer uses Bookworm")
 ha_compose = read("docker/compose-ha-garage.yml")
+require("postgres:17-trixie" in ha_compose, "HA Compose uses PostgreSQL 17 Trixie")
+require("bookworm" not in ha_compose.lower(), "HA Compose no longer uses Bookworm")
 require("rustbox-1:" in ha_compose and "rustbox-2:" in ha_compose, "HA Compose defines two RustBox application nodes")
 for service in ["postgres:", "valkey:", "opensearch:", "garage:", "envoy:"]:
     require(service in ha_compose, f"HA Compose includes {service.removesuffix(':')}")