fix: storage(minio): prevent io.Reader close (#8541)

Fixes #8529, reverts #8527.

I was able to reproduce the problem in a test:
- it triggered only when the reader was an io.Reader
- and the size was provided (-1 takes another code path in minio)

287b1f21e1 should fail when running:
```
docker run --rm -e MINIO_DOMAIN=minio -e MINIO_ROOT_USER=123456 -e MINIO_ROOT_PASSWORD=12345678 -p 9000:9000  data.forgejo.org/oci/bitnami/minio:2024.8.17
```

and

```
TEST_MINIO_ENDPOINT=localhost:9000  go test -v -run ^TestMinioStorageIterator$ ./modules/storage
```

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8541
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>

modules/storage/minio.go

@@ -209,7 +209,7 @@ func (m *MinioStorage) Save(path string, r io.Reader, size int64) (int64, error)
 		m.ctx,
 		m.bucket,
 		m.buildMinioPath(path),
-		r,
+		io.NopCloser(r), // prevent minio from closing the reader
 		size,
 		minio.PutObjectOptions{
 			ContentType: "application/octet-stream",

modules/storage/storage_test.go

@@ -5,6 +5,7 @@ package storage
 
 import (
 	"bytes"
+	"io"
 	"testing"
 
 	"forgejo.org/modules/setting"
@@ -13,22 +14,39 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type spyCloser struct {
+	io.Reader
+	closed int
+}
+
+func (s *spyCloser) Close() error {
+	s.closed++
+	return nil
+}
+
+var _ io.ReadCloser = &spyCloser{}
+
 func testStorageIterator(t *testing.T, typStr Type, cfg *setting.Storage) {
 	l, err := NewStorage(typStr, cfg)
 	require.NoError(t, err)
 
-	testFiles := [][]string{
+	testFiles := []struct {
-		{"a/1.txt", "a1"},
+		path, content string
-		{"/a/1.txt", "aa1"}, // same as above, but with leading slash that will be trim
+		size          int64
-		{"ab/1.txt", "ab1"},
+	}{
-		{"b/1.txt", "b1"},
+		{"a/1.txt", "a1", -1},
-		{"b/2.txt", "b2"},
+		{"/a/1.txt", "aa1", -1}, // same as above, but with leading slash that will be trim
-		{"b/3.txt", "b3"},
+		{"ab/1.txt", "ab1", 3},
-		{"b/x 4.txt", "bx4"},
+		{"b/1.txt", "b1", 2}, // minio closes when the size is set
+		{"b/2.txt", "b2", -1},
+		{"b/3.txt", "b3", -1},
+		{"b/x 4.txt", "bx4", -1},
 	}
 	for _, f := range testFiles {
-		_, err = l.Save(f[0], bytes.NewBufferString(f[1]), -1)
+		sc := &spyCloser{bytes.NewBufferString(f.content), 0}
+		_, err = l.Save(f.path, sc, f.size)
 		require.NoError(t, err)
+		assert.Equal(t, 0, sc.closed)
 	}
 
 	expectedList := map[string][]string{

routers/api/packages/container/container.go

@@ -399,7 +399,12 @@ func EndUploadBlob(ctx *context.Context) {
 		}
 		return
 	}
-	defer uploader.Close()
+	doClose := true
+	defer func() {
+		if doClose {
+			uploader.Close()
+		}
+	}()
 
 	if ctx.Req.Body != nil {
 		if err := uploader.Append(ctx, ctx.Req.Body); err != nil {
@@ -432,10 +437,11 @@ func EndUploadBlob(ctx *context.Context) {
 		return
 	}
 
-	// There was a strange bug: the "Close" fails with error "close .../tmp/package-upload/....: file already closed"
+	doClose = false
-	// AFAIK there should be no other "Close" call to the uploader between NewBlobUploader and this line.
+	if err := uploader.Close(); err != nil {
-	// At least it's safe to call Close twice, so ignore the error.
+		apiError(ctx, http.StatusInternalServerError, err)
-	_ = uploader.Close()
+		return
+	}
 
 	if err := container_service.RemoveBlobUploadByID(ctx, uploader.ID); err != nil {
 		apiError(ctx, http.StatusInternalServerError, err)