fix(test): replace MinIO test image with RustFS

CLAUDE.md

@@ -193,7 +193,7 @@ chainloop --insecure auth login --skip-browser
 - **Dex OIDC**: `localhost:5556`, static users with password `"password"`
 - **Control Plane**: `localhost:9000` (gRPC) / `localhost:8000` (HTTP)
 - **Artifact CAS**: `localhost:9001` (gRPC) / `localhost:8001` (HTTP)
-- **Optional Minio S3**: `localhost:9002` (API) / `localhost:9003` (Console) with `--profile optional`
+- **Optional RustFS S3**: `localhost:9002` (API) / `localhost:9003/rustfs/console/index.html` (Console) with `--profile optional` (default credentials `rustfsadmin` / `rustfsadmin`)
 
 **Development Credentials**:
 - **OIDC Users**: `sarah@chainloop.local` / `john@chainloop.local` (password: `password`)

app/artifact-cas/internal/service/bytestream_e2e_test.go

@@ -278,13 +278,12 @@ func startMinio(t *testing.T) string {
 	instance, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: testcontainers.ContainerRequest{
 			// Same pinned image the s3 backend suite uses.
-			Image:        "quay.io/minio/minio@sha256:a1a8bd4ac40ad7881a245bab97323e18f971e4d4cba2c2007ec1bedd21cbaba2",
+			Image:        "rustfs/rustfs@sha256:8cc9801755448b71a786705ce76692c77e14936cccd87cf2fc31842e58f4d1ff",
 			ExposedPorts: []string{port},
 			Env: map[string]string{
-				"MINIO_ROOT_USER":     "root",
-				"MINIO_ROOT_PASSWORD": "test-password",
+				"RUSTFS_ACCESS_KEY": "root",
+				"RUSTFS_SECRET_KEY": "test-password",
 			},
-			Cmd:        []string{"server", "/data"},
 			WaitingFor: wait.ForListeningPort(port).WithStartupTimeout(5 * time.Minute),
 		},
 		Started: true,

devel/compose.labs.yml

@@ -66,12 +66,13 @@ services:
         condition: service_healthy
     command: "migrate apply --url postgres://postgres:@postgresql:5432/controlplane?sslmode=disable --dir file:///migrations"
 
-  # Optional Minio S3 backend. Run it with `--profile optional`
-  minio:
-    image: minio/minio@sha256:2f5049ec2e993621e8beed610fe381d92e6775c54a1b67ecaa866fc4b72e2935
+  # Optional S3-compatible backend (RustFS). Run it with `--profile optional`
+  rustfs:
+    image: rustfs/rustfs@sha256:8cc9801755448b71a786705ce76692c77e14936cccd87cf2fc31842e58f4d1ff
     ports:
       - 9002:9000
       - 9003:9001
-    command: server /data --console-address ":9001"
+    environment:
+      RUSTFS_CONSOLE_ENABLE: "true"
     profiles:
       - optional

pkg/blobmanager/s3/backend_test.go

@@ -329,15 +329,14 @@ func newMinioInstance(t *testing.T) *minioInstance {
 	const port = "9000/tcp"
 
 	req := testcontainers.ContainerRequest{
-		// Pinned to a fixed digest to keep the test reproducible; update the digest manually to adopt new MinIO releases.
-		// https://quay.io/repository/minio/minio/manifest/sha256:a1a8bd4ac40ad7881a245bab97323e18f971e4d4cba2c2007ec1bedd21cbaba2
-		Image:        "quay.io/minio/minio@sha256:a1a8bd4ac40ad7881a245bab97323e18f971e4d4cba2c2007ec1bedd21cbaba2",
+		// RustFS is an S3-compatible server. MinIO no longer publishes public images.
+		// Pinned to a fixed digest (v1.0.0) to keep the test reproducible; update the digest manually to adopt new releases.
+		Image:        "rustfs/rustfs@sha256:8cc9801755448b71a786705ce76692c77e14936cccd87cf2fc31842e58f4d1ff",
 		ExposedPorts: []string{port},
 		Env: map[string]string{
-			"MINIO_ROOT_USER":     "root",
-			"MINIO_ROOT_PASSWORD": "test-password",
+			"RUSTFS_ACCESS_KEY": "root",
+			"RUSTFS_SECRET_KEY": "test-password",
 		},
-		Cmd:        []string{"server", "/data"},
 		WaitingFor: wait.ForListeningPort(port).WithStartupTimeout(5 * time.Minute),
 	}