Skip to main content
An S3-compatible API is not automatically equivalent to AWS S3 and is not automatically supported. Certify each product, exact version, endpoint mode, bucket policy, and CaseBender release independently.

​
Required contract

The release matrix is authoritative. A candidate commonly needs:
  • verified HTTPS, including the deployed private CA path;
  • access to an existing bucket without bucket-administration permission;
  • upload, HEAD/metadata, download, SHA-256 integrity, copy, pagination, conditional create, versioning, delete, and delete-marker behavior;
  • server-side encryption;
  • retention and legal hold when required for the records profile; and
  • cleanup limited to a unique test prefix and exact versions.
Do not infer capability from an advertised S3 API level. Conditional writes, checksum headers, version IDs, copy semantics, delete markers, Object Lock, and private-CA behavior differ among products and versions.

​
Qualification procedure

  1. Record the product name and exact server version, CaseBender revision/image digests, endpoint mode, CA digest, bucket policy, and identity policy.
  2. Use pre-created dedicated test buckets or a dedicated prefix.
  3. Run from the same network, DNS, proxy, CA, and identity context as the web and worker.
  4. Set each capability flag truthfully. false means skipped and cannot satisfy a required matrix operation.
  5. Run the application upload/quarantine/scan/promote/download/delete lifecycle.
  6. Exercise backup, restore, migration, rollback, retention, and legal-hold workflows required by the customer.
  7. Sanitize, hash, review, and sign the evidence bundle.
For Ceph RGW:
The general smoke contract is:
The general script is supplementary and does not cover the complete exact-version release gate.

​
Evidence rules

Use scripts/storage/certification-evidence.template.json and validate with:
Evidence must name an exact target version and include a digest. It must not contain access keys, session tokens, connection strings, private keys, signed URLs, customer object names, or object contents.

​
Emulator limitation

./scripts/storage/run-emulator-contracts.sh s3 checks the S3 adapter against LocalStack. It creates an emulator artifact that explicitly says it is not live certification. Never reuse that result for Ceph RGW, MinIO, AWS S3, or another S3-compatible product.

​
Change control

Requalify after any server upgrade, gateway/configuration change, TLS/CA rotation, identity/policy change, versioning/Object Lock change, network/proxy change, CaseBender release, or storage SDK update. See Provider Selection and Certification and OpenShift ODF and Ceph RGW.