---
id: ARTIFACT-STORE-WP-0007
type: workplan
title: "MinIO Compatibility, MaxIO Fork Assessment, And STS Credential Vending"
repo: artifact-store
domain: stack
status: active
owner: codex
topic_slug: stack
planning_priority: high
planning_order: 7
created: "2026-05-17"
updated: "2026-05-17"
state_hub_workstream_id: "2f34bb96-7206-4cb5-acdf-43880b57a9ec"
---

# ARTIFACT-STORE-WP-0007: MinIO Compatibility, MaxIO Fork Assessment, And STS Credential Vending

## Purpose

Create a dedicated workstream for the work that should not keep
artifact-store's S3 backend and guide-board pilot workstreams open:
MinIO-compatible test infrastructure, the "MaxIO" fork/community
opportunity, and whether NetKingdom already supports the Security Token
Service credential-vending pattern for object storage.

## Context

As of 2026-05-17, upstream `minio/minio` is archived/read-only on
GitHub and the README says the repository is no longer maintained.
The same README says Community Edition is now source-only, while the
source remains AGPLv3. The latest GitHub release visible there is
`RELEASE.2025-10-15T17-29-55Z`.

Relevant source references:

- https://github.com/minio/minio
- https://min.io/docs/minio/linux/developers/security-token-service.html
- https://min.io/docs/minio/linux/developers/security-token-service/AssumeRoleWithWebIdentity.html
- https://github.com/OpenMaxIO/openmaxio-object-browser

Initial local scan of `/home/worsch/net-kingdom` found credential
bootstrap, Vault/KeePassXC, OIDC, Keycloak/Authelia, and static S3/MinIO
backup references, but no explicit STS credential-vending implementation
or MinIO `AssumeRoleWithWebIdentity` path yet.

## Constraints

- Do not put MinIO fork or community governance assumptions into the
  artifact-store S3 adapter.
- Treat AGPLv3, trademark/brand, release provenance, and security patch
  obligations as first-class risks before any "MaxIO" fork decision.
- STS credential vending should issue short-lived credentials from
  workload/user identity; long-lived root access keys should not become
  the default integration pattern.
- NetKingdom owns identity/security architecture; artifact-store owns
  whether its S3 backend can consume vendored temporary credentials.

## D7.1 - MinIO / Fork Landscape Assessment

```task
id: ARTIFACT-STORE-WP-0007-T001
status: todo
priority: high
state_hub_task_id: "11d84b56-be7a-4013-8e21-36b7b656b69b"
```

Acceptance:

- Record a dated assessment of upstream MinIO status, latest usable
  source tag, AGPL obligations, removed/enterprise-shifted features,
  and available community forks.
- Compare at least: upstream source build, OpenMaxIO UI pieces, Pigsty
  MinIO fork, Garage, RustFS, SeaweedFS, and Ceph RGW.
- Decide whether "MaxIO" should be a direct fork, a packaging/build
  distribution, a compatibility profile, or not pursued.

## D7.2 - MinIO Compatibility Harness

```task
id: ARTIFACT-STORE-WP-0007-T002
status: todo
priority: high
state_hub_task_id: "c826f3ac-2ed7-4150-aa7c-e778ae71a72b"
```

Acceptance:

- Restore or define the dependency/bootstrap path for MinIO-compatible
  integration tests (`uv`/Python deps, Docker/testcontainers or a
  deterministic compose fixture).
- Run artifact-store S3 backend tests against the selected MinIO or fork
  target.
- Document manual smoke commands and expected health/verify outputs.

## D7.3 - STS Credential Vending Assessment For NetKingdom

```task
id: ARTIFACT-STORE-WP-0007-T003
status: todo
priority: high
state_hub_task_id: "d3d5c4c1-d3b2-4163-b99d-1b08f90566d1"
```

Acceptance:

- Inventory NetKingdom's current object-storage credential path,
  including backup jobs and any S3/MinIO secrets.
- Determine whether Keycloak/Authelia/local-identity can act as the OIDC
  identity provider for MinIO-compatible `AssumeRoleWithWebIdentity`.
- Produce a target architecture for credential vending: issuer,
  token audience, role/policy mapping, expiration, revocation, audit,
  and break-glass behavior.

## D7.4 - Artifact-Store Temporary Credential Support

```task
id: ARTIFACT-STORE-WP-0007-T004
status: todo
priority: medium
state_hub_task_id: "9b80057a-d86e-4f14-9d14-928ee29f970d"
```

Acceptance:

- Decide whether artifact-store's S3 backend needs dynamic credential
  refresh for STS-vended credentials or whether refresh belongs in a
  sidecar/secret controller.
- If needed, design the minimal configuration shape for short-lived
  credentials without storing them in request bodies or event payloads.
- Verify that `artifactstore storage verify --backend s3` can run with
  temporary credentials.

## D7.5 - Follow-Up Workstream Routing

```task
id: ARTIFACT-STORE-WP-0007-T005
status: todo
priority: medium
state_hub_task_id: "614f7918-6fef-4460-b3fc-f9ff3c156422"
```

Acceptance:

- Create or link NetKingdom follow-up work for STS credential vending if
  the implementation belongs outside artifact-store.
- Create or link producer-side guide-board/open-cmis-tck work for the
  missing `reports/cmis-summary.md` fragment.
- Close this workstream with a decision: adopt existing fork, build
  MaxIO, use another S3-compatible store, or defer.

## Success criteria

- Artifact-store no longer treats MinIO as an incidental CI detail; it
  has a clear compatibility and governance strategy.
- NetKingdom has a concrete answer on STS credential vending for object
  storage.
- Any MaxIO fork work starts only after legal, security, governance,
  and community-support duties are explicit.