version: '3.7'
# starts 4 docker containers running minio server instances. Each# minio server's web interface will be accessible on the host at port# 9001 through 9004.services:  minio1:    image: minio/minio:RELEASE.2020-01-16T22-40-29Z    container_name: minio1    volumes:      - data1-1:/data1      - data1-2:/data2    ports:      - "9001:9000"    environment:      MINIO_ACCESS_KEY: minio      MINIO_SECRET_KEY: minio123    command: server http://minio{1...4}/data{1...2}    healthcheck:      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]      interval: 30s      timeout: 20s      retries: 3
  minio2:    image: minio/minio:RELEASE.2020-01-16T22-40-29Z    container_name: minio2    volumes:      - data2-1:/data1      - data2-2:/data2    ports:      - "9002:9000"    environment:      MINIO_ACCESS_KEY: minio      MINIO_SECRET_KEY: minio123    command: server http://minio{1...4}/data{1...2}    healthcheck:      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]      interval: 30s      timeout: 20s      retries: 3
  minio3:    image: minio/minio:RELEASE.2020-01-16T22-40-29Z    container_name: minio3    volumes:      - data3-1:/data1      - data3-2:/data2    ports:      - "9003:9000"    environment:      MINIO_ACCESS_KEY: minio      MINIO_SECRET_KEY: minio123    command: server http://minio{1...4}/data{1...2}    healthcheck:      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]      interval: 30s      timeout: 20s      retries: 3
  minio4:    image: minio/minio:RELEASE.2020-01-16T22-40-29Z    container_name: minio4    volumes:      - data4-1:/data1      - data4-2:/data2    ports:      - "9004:9000"    environment:      MINIO_ACCESS_KEY: minio      MINIO_SECRET_KEY: minio123    command: server http://minio{1...4}/data{1...2}    healthcheck:      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]      interval: 30s      timeout: 20s      retries: 3
## By default this config uses default local driver,## For custom volumes replace with volume driver configuration.volumes:  data1-1:  data1-2:  data2-1:  data2-2:  data3-1:  data3-2:  data4-1:  data4-2:

docker-compose pulldocker-compose up

// minio/cmd/bootstrap-peer-server.gofunc (b *bootstrapRESTServer) VerifyHandler(w http.ResponseWriter, r *http.Request) {  ctx := newContext(r, w, "VerifyHandler")  cfg := getServerSystemCfg()  logger.LogIf(ctx, json.NewEncoder(w).Encode(&cfg))}
// minio/cmd/bootstrap-peer-server.gofunc getServerSystemCfg() ServerSystemConfig {  envs := env.List("MINIO_")  envValues := make(map[string]string, len(envs))  for _, envK := range envs {    // skip certain environment variables as part    // of the whitelist and could be configured    // differently on each nodes, update skipEnvs()    // map if there are such environment values    if _, ok := skipEnvs[envK]; ok {      continue    }    envValues[envK] = env.Get(envK, "")  }  return ServerSystemConfig{    MinioEndpoints: globalEndpoints,    MinioEnv:       envValues,  }}

curl -XPOST http://172.16.16.128:9001/minio/bootstrap/v1/verify

func (a adminAPIHandlers) ServerUpdateHandler(w http.ResponseWriter, r *http.Request) {  // 验证是否是admin权限  objectAPI, _ := validateAdminReq(ctx, w, r, iampolicy.ServerUpdateAdminAction)
  // 从POST /minio/admin/v3/update?updateURL={updateURL}取updateURL参数  vars := mux.Vars(r)  updateURL := vars["updateURL"]  mode := getMinioMode()
  // 解析url  u, err := url.Parse(updateURL)
  // 下载Release信息并解析出对应的更新信息  content, err := downloadReleaseURL(u, updateTimeout, mode)  sha256Sum, lrTime, releaseInfo, err := parseReleaseData(content)
  // 指定二进制文件的下载路径  u.Path = path.Dir(u.Path) + SlashSeparator + releaseInfo
  // 下载二进制文件  reader, err := downloadBinary(u, mode)
  // 验证签名  err = verifyBinary(u, sha256Sum, releaseInfo, mode, reader)
  // 提交二进制文件  err = commitBinary()
  // 发送重启信号给channel  globalServiceSignalCh <- serviceRestart}

原文地址：https://y4er.com/posts/minio-cve-2023-28432/