Use AWS S3 SDK instead of Minio Client SDK

[junoberryferry]

No description provided.

[silverwind]

I think we should rename modules/storage/minio.* to modules/storage/s3.*. The PR diff for these two files should remain readable after such a rename.

[silverwind]

Seems like I was wrong and GitHub's (or git's) move heuristic has split the diff of modules/storage/s3.go into two files. The proper diff can still be reviewed at this link:

https://github.com/go-gitea/gitea/pull/36118/changes/BASE..7064923a7d27181e0a22df8cb3073bbeee4eaf57

[wxiaoguang]

Sorry but there are still concerns needing to address.

1. data, err := io.ReadAll(r) will cause OOM when uploading files with GB sizes
   • It will make the instance crash and lead to DoS attack
2. Changed logic, need to review carefully (I haven't really looked into details)

---

And another question is: whether it's worth to use AWS SDK to replace MinIO SDK?

• Server side:
  • AWS: closed source
  • MinIO: still open-source (althought only the core code)
• SDK side:
  • AWS: Apache-2, actively maintained
  • MinIO: Apache-2, actively maintained

So I don't see necessity at the moment.

---

Feel free to dismiss the change request if these concerns get addressed.

[wxiaoguang]

It will cause OOM if the uploaded file is large.