[overtrue]

Related failure

Restores the scheduled Integration Tests run, where the three --enc-s3 cases returned HTTP 500 and prevented the S3 golden step from running.

Root cause and solution

• RustFS beta.10 requires a base64-encoded 32-byte RUSTFS_SSE_S3_MASTER_KEY when no KMS is configured. Neither CI container launch supplied it. Add an explicitly public, test-only fixture and keep the local Compose and documented Docker setup consistent.
• Run the existing cp, mv, and pipe SSE-S3 cases in beta.10 PR smoke coverage, rather than discovering regressions only in the nightly full suite.
• Once encryption succeeds, the previously blocked S3 golden step exposes three stale JSON assertions. Align them with the existing documented contracts: mb's v3 bucket_operations, rb's v3 bucket_remove, and unversioned stat's name. Assert exact bucket identity, outcomes, completion stage, object name, and size.

No production command behavior, schema, dependency, or real credential changes.

Validation

Validated with Rust 1.99.1 and the official RustFS 1.0.0-beta.10 Linux binary, whose release archive SHA-256 was verified.

• Before/after reproduction: without the key, all three SSE-S3 operations fail with HTTP 500 and the server explicitly reports the missing master key; adding only the test key makes all three pass.
• cargo fmt --all --check: passed.
• cargo clippy --locked --workspace --all-targets -- -D warnings: passed.
• cargo test --locked --workspace: 1,988 passed, 2 existing ignored. Local mock-server tests used an offline run with proxy environment variables unset.
• Full integration suite over HTTP, matching the nightly configuration: 71 passed.
• cargo test --locked --package rustfs-cli --test golden --features golden,integration -- --test-threads=1: 10 passed.
• Python script tests: 13 passed. Compatibility manifest validation, workflow/Compose YAML parsing, embedded Bash syntax, key length/propagation, and git diff --check passed.
• Independent review found no blocking issues.

Docker is unavailable in the local validation environment. PR CI will exercise the actual containers; the full-target GitHub Actions job still runs on schedule or manual dispatch, not on an ordinary PR event.

CI status for 3a5f8ec

• Integration Tests: all four executed jobs passed. The beta.10 smoke log confirms cp, mv, and pipe SSE-S3 each executed and passed against the PR merge commit. The full-target job was skipped on this PR event; local full-suite results above remain separate.
• Dependency Advisories fails on existing pin-utils 0.1.1, RUSTSEC-2026-0441 (unmaintained), through AWS Smithy. Cargo.lock is byte-for-byte identical to the base. This PR does not suppress the advisory.
• All other checks, including the Linux build, passed: 11 successful jobs, 1 failed advisory job, and the full-target job skipped. Merge is held while CI is not green.