From 3309c441902303a46e6b68ba1d1e1a58f2a14ced Mon Sep 17 00:00:00 2001
From: Eugene Blikh <bigbes@gmail.com>
Date: Mon, 25 May 2026 09:34:59 +0300
Subject: [PATCH] ci: install awscli v2 from upstream (noble dropped the system
 package)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ubuntu noble removed the unmaintained 'awscli' v1 package; apt install
fails with 'no installation candidate'. Switch to the official v2
installer (curl + unzip + ./aws/install).

Also add AWS_REQUEST/RESPONSE_CHECKSUM env vars set to 'when_required'
— boto3 1.36+ defaults to sending CRC32 trailing checksums on every
PutObject, which older Garage releases don't validate. Disabling them
for non-mandatory operations keeps us compatible across the matrix.

Caught by srht job 121.
---
 .builds/conformance-image-rebuild.yml | 10 +++++++++-
 .builds/conformance.yml               | 15 ++++++++++++++-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/.builds/conformance-image-rebuild.yml b/.builds/conformance-image-rebuild.yml
index d105cfc3079c46b72c36f2f704280c4d8f04ce5d..32fcbb7e1e143f75806c234104bc1d311cc78269 100644
--- a/.builds/conformance-image-rebuild.yml
+++ b/.builds/conformance-image-rebuild.yml
@@ -12,7 +12,7 @@ packages:
   - curl
   - ca-certificates
   - docker.io
-  - awscli
+  - unzip
   - zstd
 secrets:
   - a42011da-a362-40da-9db6-1bf1f9be8be3   # ~/.s3-cache-key-id
@@ -29,6 +29,12 @@ submitter:
     enabled: false
     allow-refs: []
 tasks:
+  - install_awscli: |
+      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+        -o /tmp/awscliv2.zip
+      unzip -q /tmp/awscliv2.zip -d /tmp
+      sudo /tmp/aws/install
+      aws --version
   - aws_credentials: |
       mkdir -p ~/.aws
       cat > ~/.aws/config <<EOF
@@ -38,6 +44,8 @@ tasks:
           addressing_style = path
           signature_version = s3v4
       EOF
+      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
+      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
       set +x
       export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
       export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)
diff --git a/.builds/conformance.yml b/.builds/conformance.yml
index 728fbc4aff80c7f8f011d36065623237950ec639..672fd9d353e65b8c24368c484174d8f1f793be9b 100644
--- a/.builds/conformance.yml
+++ b/.builds/conformance.yml
@@ -7,7 +7,7 @@ packages:
   - cmake
   - build-essential
   - docker.io
-  - awscli
+  - unzip
   - zstd
 secrets:
   - a42011da-a362-40da-9db6-1bf1f9be8be3   # ~/.s3-cache-key-id
@@ -30,6 +30,13 @@ submitter:
       - refs/heads/master
       - "refs/tags/*"
 tasks:
+  - install_awscli: |
+      # awscli was dropped from Ubuntu noble's repos; install v2 from upstream.
+      curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+        -o /tmp/awscliv2.zip
+      unzip -q /tmp/awscliv2.zip -d /tmp
+      sudo /tmp/aws/install
+      aws --version
   - aws_credentials: |
       mkdir -p ~/.aws
       cat > ~/.aws/config <<EOF
@@ -39,6 +46,12 @@ tasks:
           addressing_style = path
           signature_version = s3v4
       EOF
+      # Garage doesn't implement the newer trailing CRC32 checksums that
+      # boto3 1.36+ sends by default — switch to "only when required".
+      echo 'export AWS_REQUEST_CHECKSUM_CALCULATION=when_required'  >> ~/.buildenv
+      echo 'export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required' >> ~/.buildenv
+      export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
+      export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
       set +x
       export AWS_ACCESS_KEY_ID=$(cat ~/.s3-cache-key-id)
       export AWS_SECRET_ACCESS_KEY=$(cat ~/.s3-cache-key-secret)