Fix bugs found during code audit across api, adminapi, functional, examples

api:
- Compose/copy >5GiB: send per-part x-amz-copy-source-range (was loop-invariant)
- Checksum.CRC64NVME.update: bound the slicing loop by len, not p.length
- messages/Filter: keep And(String,Map) tags; "exactly one" via new Utils.xor
- Http BaseUrl: ELB endpoints derive the real region (was "com")
- messages/Checksum.headers(): emit x-amz-checksum-<algo>
- PromptObjectArgs prompt setter; ListPartsArgs.Builder extends ObjectArgs.Builder
- maxKeys() null-safe; Arrays.hashCode for array-backed args
- downloadObject error propagation + temp cleanup; snowball/appendObject RAF close
- uploadPartsParallelly buffer return/abort; executeAsync 304 return
- credential providers: AwsConfig/MinioClientConfig/MinioEnvironment NPE -> clean
- GetPresignedObjectUrlArgs expiry overflow; ObjectLockConfiguration duration();
  AccessControlPolicy null owner; ListenBucketNotificationArgs requires bucket;
  GetObjectAttributesArgs validation; LifecycleConfiguration via Utils.xor;
  VersioningConfiguration.excludeFolders() primitive; ReplicationConfiguration text

adminapi:
- updateServiceAccount newStatus nullable (no silent disable)
- Status.fromString null-guard; thread signing Credentials through execute()
- getBucketQuota asLong(); Crypto.encrypt exact-multiple chunk; map getters
  return empty map when absent

functional:
- PutObjectRunnable surfaces thread failures; notification tests assert;
  legal-hold tests fixed; stream/temp-file cleanup; TestUserAgent guards;
  MintLogger throws UncheckedIOException instead of blank log

examples:
- close getObject/Response/progress streams (try-with-resources); fix
  GetObjectProgressBar/SelectObjectContent object names; real file size as object
  size; provider isSuccessful() check; placeholder credentials

Also add CLAUDE.md with build commands and architecture overview.

Signed-off-by: Bala.FA <bala@minio.io>

Author: balamurugana

.github/workflows/gradle.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Check limited Guava usage
         if: matrix.os == 'ubuntu-latest'
         run: |
-          if grep --with-filename --line-number --no-messages --recursive --exclude-dir=.github "com.google.common.base.Objects" .; then
+          if grep --with-filename --line-number --no-messages --recursive --exclude-dir=.github --exclude=CLAUDE.md "com.google.common.base.Objects" .; then
             echo "Error: use java.util.Objects instead of com.google.common.base.Objects"
             exit 1
           fi

adminapi/src/main/java/io/minio/admin/Crypto.java

@@ -209,7 +209,9 @@ public static byte[] encrypt(byte[] payload, String password) throws MinioExcept
     boolean done = false;
     for (int nonceId = 1; !done; nonceId++) {
       int to = from + CHUNK_SIZE;
-      if (to > payload.length) {
+      // Use >= so a payload that is an exact multiple of CHUNK_SIZE marks its final full chunk as
+      // the last one, rather than emitting an extra empty trailing chunk (matches madmin-go/sio).
+      if (to >= payload.length) {
         additionalData = markAsLast(additionalData);
         to = payload.length;
         done = true;

adminapi/src/main/java/io/minio/admin/GetDataUsageInfoResponse.java

@@ -75,19 +75,25 @@ public long objectsTotalSize() {
   }
 
   public Map<String, BucketTargetUsageInfo> objectsReplicationInfo() {
-    return Collections.unmodifiableMap(this.objectsReplicationInfo);
+    return this.objectsReplicationInfo == null
+        ? Collections.emptyMap()
+        : Collections.unmodifiableMap(this.objectsReplicationInfo);
   }
 
   public long bucketsCount() {
     return bucketsCount;
   }
 
   public Map<String, BucketUsageInfo> bucketsUsageInfo() {
-    return Collections.unmodifiableMap(this.bucketsUsageInfo);
+    return this.bucketsUsageInfo == null
+        ? Collections.emptyMap()
+        : Collections.unmodifiableMap(this.bucketsUsageInfo);
   }
 
   public Map<String, Long> bucketsSizes() {
-    return Collections.unmodifiableMap(bucketsSizes);
+    return bucketsSizes == null
+        ? Collections.emptyMap()
+        : Collections.unmodifiableMap(bucketsSizes);
   }
 
   public AllTierStats tierStats() {
@@ -203,7 +209,9 @@ public long objectsCount() {
     }
 
     public Map<String, Long> objectsSizesHistogram() {
-      return Collections.unmodifiableMap(this.objectsSizesHistogram);
+      return this.objectsSizesHistogram == null
+          ? Collections.emptyMap()
+          : Collections.unmodifiableMap(this.objectsSizesHistogram);
     }
 
     public long versionsCount() {
@@ -215,7 +223,9 @@ public long objectReplicaTotalSize() {
     }
 
     public Map<String, BucketTargetUsageInfo> objectsReplicationInfo() {
-      return Collections.unmodifiableMap(this.objectsReplicationInfo);
+      return this.objectsReplicationInfo == null
+          ? Collections.emptyMap()
+          : Collections.unmodifiableMap(this.objectsReplicationInfo);
     }
   }
 
@@ -249,7 +259,7 @@ public static class AllTierStats {
     private Map<String, TierStats> tiers;
 
     public Map<String, TierStats> tiers() {
-      return Collections.unmodifiableMap(this.tiers);
+      return this.tiers == null ? Collections.emptyMap() : Collections.unmodifiableMap(this.tiers);
     }
   }
 }

adminapi/src/main/java/io/minio/admin/GetServerInfoResponse.java

@@ -289,7 +289,9 @@ public String commitID() {
     }
 
     public Map<String, String> network() {
-      return Collections.unmodifiableMap(this.network);
+      return this.network == null
+          ? Collections.emptyMap()
+          : Collections.unmodifiableMap(this.network);
     }
 
     public List<Disk> disks() {
@@ -321,7 +323,9 @@ public GCStats gCStats() {
     }
 
     public Map<String, String> minioEnvVars() {
-      return Collections.unmodifiableMap(this.minioEnvVars);
+      return this.minioEnvVars == null
+          ? Collections.emptyMap()
+          : Collections.unmodifiableMap(this.minioEnvVars);
     }
 
     @JsonIgnoreProperties(ignoreUnknown = true)
@@ -613,11 +617,13 @@ public Integer totalErrorsTimeout() {
       }
 
       public Map<String, TimedAction> lastMinute() {
-        return Collections.unmodifiableMap(lastMinute);
+        return lastMinute == null
+            ? Collections.emptyMap()
+            : Collections.unmodifiableMap(lastMinute);
       }
 
       public Map<String, String> apiCalls() {
-        return Collections.unmodifiableMap(apiCalls);
+        return apiCalls == null ? Collections.emptyMap() : Collections.unmodifiableMap(apiCalls);
       }
 
       public Long totalTokens() {

adminapi/src/main/java/io/minio/admin/MinioAdminClient.java

@@ -167,10 +167,12 @@ private OkHttpClient getHttpClient(PrintWriter traceStream) {
   }
 
   private Response httpExecute(
-      Http.Method method, Command command, Multimap<String, String> queryParamMap, byte[] body)
+      Http.Method method,
+      Command command,
+      Multimap<String, String> queryParamMap,
+      byte[] body,
+      Credentials creds)
       throws IOException, MinioException {
-    Credentials creds = getCredentials();
-
     HttpUrl.Builder urlBuilder =
         this.baseUrl
             .newBuilder()
@@ -224,7 +226,21 @@ private Response execute(
       Http.Method method, Command command, Multimap<String, String> queryParamMap, byte[] body)
       throws MinioException {
     try {
-      return httpExecute(method, command, queryParamMap, body);
+      return httpExecute(method, command, queryParamMap, body, getCredentials());
+    } catch (IOException e) {
+      throw new MinioException(e);
+    }
+  }
+
+  private Response execute(
+      Http.Method method,
+      Command command,
+      Multimap<String, String> queryParamMap,
+      byte[] body,
+      Credentials creds)
+      throws MinioException {
+    try {
+      return httpExecute(method, command, queryParamMap, body, creds);
     } catch (IOException e) {
       throw new MinioException(e);
     }
@@ -258,7 +274,8 @@ public void addUser(
             Http.Method.PUT,
             Command.ADD_USER,
             ImmutableMultimap.of("accessKey", accessKey),
-            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(userInfo), creds.secretKey()))) {
+            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(userInfo), creds.secretKey()),
+            creds)) {
     } catch (JsonProcessingException e) {
       throw new MinioException(e);
     }
@@ -292,8 +309,8 @@ public UserInfo getUserInfo(String accessKey) throws MinioException {
    * @throws MinioException thrown to indicate SDK exception.
    */
   public Map<String, UserInfo> listUsers() throws MinioException {
-    try (Response response = execute(Http.Method.GET, Command.LIST_USERS, null, null)) {
-      Credentials creds = getCredentials();
+    Credentials creds = getCredentials();
+    try (Response response = execute(Http.Method.GET, Command.LIST_USERS, null, null, creds)) {
       byte[] jsonData = Crypto.decrypt(response.body().byteStream(), creds.secretKey());
       MapType mapType =
           OBJECT_MAPPER
@@ -459,8 +476,8 @@ public long getBucketQuota(String bucketName) throws MinioException {
           .stream()
           .filter(entry -> "quota".equals(entry.getKey()))
           .findFirst()
-          .map(entry -> Long.valueOf(entry.getValue().toString()))
-          .orElseThrow(() -> new IllegalArgumentException("found not quota"));
+          .map(entry -> entry.getValue().asLong())
+          .orElseThrow(() -> new IllegalArgumentException("quota not found in response"));
     } catch (IOException e) {
       throw new MinioException(e);
     }
@@ -676,7 +693,8 @@ public Credentials addServiceAccount(
             Http.Method.PUT,
             Command.ADD_SERVICE_ACCOUNT,
             null,
-            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(serviceAccount), creds.secretKey()))) {
+            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(serviceAccount), creds.secretKey()),
+            creds)) {
       byte[] jsonData = Crypto.decrypt(response.body().byteStream(), creds.secretKey());
       return OBJECT_MAPPER.readValue(jsonData, AddServiceAccountResponse.class).credentials();
     } catch (JsonProcessingException e) {
@@ -691,7 +709,7 @@ public Credentials addServiceAccount(
    *
    * @param accessKey Access key.
    * @param newSecretKey New secret key.
-   * @param newPolicy New policy as JSON string .
+   * @param newPolicy New policy as JSON string.
    * @param newStatus New service account status.
    * @param newName New service account name.
    * @param newDescription New description.
@@ -702,7 +720,7 @@ public void updateServiceAccount(
       @Nonnull String accessKey,
       @Nullable String newSecretKey,
       @Nullable Map<String, Object> newPolicy,
-      @Nullable boolean newStatus,
+      @Nullable Boolean newStatus,
       @Nullable String newName,
       @Nullable String newDescription,
       @Nullable ZonedDateTime newExpiration)
@@ -724,7 +742,7 @@ public void updateServiceAccount(
       serviceAccount.put("newSecretKey", newSecretKey);
     }
     if (newPolicy != null && !newPolicy.isEmpty()) serviceAccount.put("newPolicy", newPolicy);
-    serviceAccount.put("newStatus", newStatus ? "on" : "off");
+    if (newStatus != null) serviceAccount.put("newStatus", newStatus ? "on" : "off");
     if (newName != null && !newName.isEmpty()) serviceAccount.put("newName", newName);
     if (newDescription != null && !newDescription.isEmpty()) {
       serviceAccount.put("newDescription", newDescription);
@@ -739,7 +757,8 @@ public void updateServiceAccount(
             Http.Method.POST,
             Command.UPDATE_SERVICE_ACCOUNT,
             ImmutableMultimap.of("accessKey", accessKey),
-            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(serviceAccount), creds.secretKey()))) {
+            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(serviceAccount), creds.secretKey()),
+            creds)) {
     } catch (JsonProcessingException e) {
       throw new MinioException(e);
     }
@@ -777,13 +796,14 @@ public ListServiceAccountResponse listServiceAccount(@Nonnull String username)
       throw new IllegalArgumentException("user name must be provided");
     }
 
+    Credentials creds = getCredentials();
     try (Response response =
         execute(
             Http.Method.GET,
             Command.LIST_SERVICE_ACCOUNTS,
             ImmutableMultimap.of("user", username),
-            null)) {
-      Credentials creds = getCredentials();
+            null,
+            creds)) {
       byte[] jsonData = Crypto.decrypt(response.body().byteStream(), creds.secretKey());
       return OBJECT_MAPPER.readValue(jsonData, ListServiceAccountResponse.class);
     } catch (IOException e) {
@@ -804,13 +824,14 @@ public GetServiceAccountInfoResponse getServiceAccountInfo(@Nonnull String acces
     if (accessKey == null || accessKey.isEmpty()) {
       throw new IllegalArgumentException("access key must be provided");
     }
+    Credentials creds = getCredentials();
     try (Response response =
         execute(
             Http.Method.GET,
             Command.INFO_SERVICE_ACCOUNT,
             ImmutableMultimap.of("accessKey", accessKey),
-            null)) {
-      Credentials creds = getCredentials();
+            null,
+            creds)) {
       byte[] jsonData = Crypto.decrypt(response.body().byteStream(), creds.secretKey());
       return OBJECT_MAPPER.readValue(jsonData, GetServiceAccountInfoResponse.class);
     } catch (IOException e) {
@@ -824,7 +845,7 @@ private PolicyAssociationResponse attachDetachPolicy(
       @Nullable String user,
       @Nullable String group)
       throws MinioException {
-    if (!(user != null ^ group != null)) {
+    if (!Utils.xor(user, group)) {
       throw new IllegalArgumentException("either user or group must be provided");
     }
 
@@ -842,7 +863,8 @@ private PolicyAssociationResponse attachDetachPolicy(
             Http.Method.POST,
             command,
             null,
-            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(map), creds.secretKey()))) {
+            Crypto.encrypt(OBJECT_MAPPER.writeValueAsBytes(map), creds.secretKey()),
+            creds)) {
       return OBJECT_MAPPER.readValue(
           Crypto.decrypt(response.body().byteStream(), creds.secretKey()),
           PolicyAssociationResponse.class);

adminapi/src/main/java/io/minio/admin/Status.java

@@ -45,7 +45,7 @@ public static Status fromString(String statusString) {
       return DISABLED;
     }
 
-    if (statusString.isEmpty()) {
+    if (statusString == null || statusString.isEmpty()) {
       return null;
     }
 

api/src/main/java/io/minio/AppendObjectArgs.java

@@ -135,6 +135,7 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(super.hashCode(), filename, stream, data, length, chunkSize);
+    return Objects.hash(
+        super.hashCode(), filename, stream, Arrays.hashCode(data), length, chunkSize);
   }
 }

api/src/main/java/io/minio/BaseS3Client.java

@@ -406,12 +406,13 @@ private void onResponse(final Response response) throws IOException {
                 if (!s3request.method().equals(Http.Method.HEAD)
                     && (contentType == null
                         || !Arrays.asList(contentType.split(";")).contains("application/xml"))) {
-                  if (response.code() == 304 && response.body().contentLength() == 0) {
+                  if (response.code() == 304 && errorXml.isEmpty()) {
                     completableFuture.completeExceptionally(
                         new ServerException(
                             "server failed with HTTP status code " + response.code(),
                             response.code(),
                             traceBuilder.toString()));
+                    return;
                   }
 
                   completableFuture.completeExceptionally(
@@ -475,8 +476,8 @@ private void onResponse(final Response response) throws IOException {
                       break;
                     case 409:
                       if (s3request.bucket() != null) {
-                        code = NO_SUCH_BUCKET;
-                        message = NO_SUCH_BUCKET_MESSAGE;
+                        code = "Conflict";
+                        message = "Bucket not empty";
                       } else {
                         code = "ResourceConflict";
                         message = "Request resource conflicts";

api/src/main/java/io/minio/Checksum.java

@@ -343,12 +343,13 @@ public CRC64NVME() {}
 
     @Override
     public void update(byte[] p, int off, int len) {
+      int limit = off + len;
       java.nio.ByteBuffer byteBuffer = java.nio.ByteBuffer.wrap(p, off, len);
       byteBuffer.order(ByteOrder.LITTLE_ENDIAN);
       int offset = byteBuffer.position();
 
       crc = ~crc;
-      while (p.length >= 64 && (p.length - offset) > 8) {
+      while (len >= 64 && (limit - offset) > 8) {
         long value = byteBuffer.getLong();
         crc ^= value;
         crc =
@@ -363,7 +364,7 @@ public void update(byte[] p, int off, int len) {
         offset = byteBuffer.position();
       }
 
-      for (; offset < len; offset++) {
+      for (; offset < limit; offset++) {
         crc = CRC64_TABLE[(int) ((crc ^ (long) p[offset]) & 0xFF)] ^ (crc >>> 8);
       }
 

api/src/main/java/io/minio/CompleteMultipartUploadArgs.java

@@ -132,6 +132,7 @@ public boolean equals(Object o) {
 
   @Override
   public int hashCode() {
-    return Objects.hash(super.hashCode(), uploadId, parts, ssec, delayMs, maxRetries);
+    return Objects.hash(
+        super.hashCode(), uploadId, Arrays.hashCode(parts), ssec, delayMs, maxRetries);
   }
 }