From 9c8410a3f54e1f5bedd19b21db4abb23773151f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Cumplido?= <raulcumplido@gmail.com>
Date: Mon, 14 Sep 2026 11:47:11 +0200
Subject: [PATCH 1/3] GH-47908: [CI][Dev] Change download minIO URLs for GitHub
 releases URL

---
 ...thon-wheel-windows-test-vs2022-base.dockerfile |  2 +-
 ci/scripts/install_minio.sh                       | 15 +++++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/ci/docker/python-wheel-windows-test-vs2022-base.dockerfile b/ci/docker/python-wheel-windows-test-vs2022-base.dockerfile
index bd1da7b14b37..74b2e99c84d2 100644
--- a/ci/docker/python-wheel-windows-test-vs2022-base.dockerfile
+++ b/ci/docker/python-wheel-windows-test-vs2022-base.dockerfile
@@ -51,7 +51,7 @@ SHELL ["cmd", "/S", "/C"]
 
 # Install git, wget, minio
 RUN choco install --no-progress -r -y git wget
-RUN curl https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2025-01-20T14-49-07Z `
+RUN curl -L https://github.com/minio/minio/releases/download/RELEASE.2025-01-20T14-49-07Z/minio.windows-amd64.RELEASE.2025-01-20T14-49-07Z.exe `
     --output "C:\Windows\Minio.exe"
 
 # Install the GCS testbench using a well-known Python version.
diff --git a/ci/scripts/install_minio.sh b/ci/scripts/install_minio.sh
index 5efa03e82e20..edc550d6778e 100755
--- a/ci/scripts/install_minio.sh
+++ b/ci/scripts/install_minio.sh
@@ -62,9 +62,16 @@ if [ "${version}" != "latest" ]; then
   exit 1
 fi
 
+# The binaries are no longer available from https://dl.min.io (HTTP 410),
+# so they are fetched from the GitHub releases instead. See GH-47908.
 # Use specific versions for minio server and client to avoid CI failures on new releases.
-minio_version="minio.RELEASE.2025-01-20T14-49-07Z"
-mc_version="mc.RELEASE.2024-09-16T17-43-14Z"
+minio_version="RELEASE.2025-01-20T14-49-07Z"
+mc_version="RELEASE.2024-09-16T17-43-14Z"
+
+exe_suffix=""
+if [ "${platform}" = "windows" ]; then
+  exe_suffix=".exe"
+fi
 
 download()
 {
@@ -80,13 +87,13 @@ download()
 }
 
 if [[ ! -x ${prefix}/bin/minio ]]; then
-  url="https://dl.min.io/server/minio/release/${platform}-${arch}/archive/${minio_version}"
+  url="https://github.com/minio/minio/releases/download/${minio_version}/minio.${platform}-${arch}.${minio_version}${exe_suffix}"
   echo "Fetching ${url}..."
   download "${prefix}/bin/minio" "${url}"
   chmod +x "${prefix}/bin/minio"
 fi
 if [[ ! -x ${prefix}/bin/mc ]]; then
-  url="https://dl.min.io/client/mc/release/${platform}-${arch}/archive/${mc_version}"
+  url="https://github.com/minio/mc/releases/download/${mc_version}/mc.${platform}-${arch}.${mc_version}${exe_suffix}"
   echo "Fetching ${url}..."
   download "${prefix}/bin/mc" "${url}"
   chmod +x "${prefix}/bin/mc"

From 35c116bb90dbebc0f010354fb51caa89199f8c73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Cumplido?= <raulcumplido@gmail.com>
Date: Mon, 14 Sep 2026 11:58:53 +0200
Subject: [PATCH 2/3] Some more commit fixes

---
 .env                        | 2 +-
 .github/workflows/cpp.yml   | 2 +-
 ci/scripts/install_minio.sh | 5 ++---
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.env b/.env
index 302335352749..660f589bf466 100644
--- a/.env
+++ b/.env
@@ -99,5 +99,5 @@ VCPKG="9b965a116838c6cdcd36bca60d1b81b030c8ab8d"    # 2026.05.27 (not release, u
 # This is a workaround for our CI problem that "archery docker build" doesn't
 # use pulled built images in dev/tasks/python-wheels/github.windows.yml.
 PYTHON_WHEEL_WINDOWS_IMAGE_REVISION=2026-09-09
-PYTHON_WHEEL_WINDOWS_TEST_IMAGE_REVISION=2026-09-09
+PYTHON_WHEEL_WINDOWS_TEST_IMAGE_REVISION=2026-09-14
 
diff --git a/.github/workflows/cpp.yml b/.github/workflows/cpp.yml
index e7b6323b30d9..ee66637f140a 100644
--- a/.github/workflows/cpp.yml
+++ b/.github/workflows/cpp.yml
@@ -408,7 +408,7 @@ jobs:
           mkdir -p /usr/local/bin
           wget \
             --output-document /usr/local/bin/minio.exe \
-            https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2025-01-20T14-49-07Z
+            https://github.com/minio/minio/releases/download/RELEASE.2025-01-20T14-49-07Z/minio.windows-amd64.RELEASE.2025-01-20T14-49-07Z.exe
           chmod +x /usr/local/bin/minio.exe
       - name: Set up Python
         uses: actions/setup-python@v7
diff --git a/ci/scripts/install_minio.sh b/ci/scripts/install_minio.sh
index edc550d6778e..c81497b57c32 100755
--- a/ci/scripts/install_minio.sh
+++ b/ci/scripts/install_minio.sh
@@ -30,11 +30,10 @@ prefix=$2
 declare -A archs
 archs=([x86_64]=amd64
        [arm64]=arm64
-       [aarch64]=arm64
-       [s390x]=s390x)
+       [aarch64]=arm64)
 
 arch=$(uname -m)
-if [ -z "${archs[$arch]}" ]; then
+if [ -z "${archs[$arch]:-}" ]; then
   echo "Unsupported architecture: ${arch}"
   exit 0
 fi

From fd2d61f4b881e98c65ed96b098db353be66f86b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ra=C3=BAl=20Cumplido?= <raulcumplido@gmail.com>
Date: Mon, 14 Sep 2026 12:54:43 +0200
Subject: [PATCH 3/3] Add check for sha256. Hardcode values here to guard
 against updated assets

---
 ci/scripts/install_minio.sh | 43 +++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/ci/scripts/install_minio.sh b/ci/scripts/install_minio.sh
index c81497b57c32..2a51ec11ee7e 100755
--- a/ci/scripts/install_minio.sh
+++ b/ci/scripts/install_minio.sh
@@ -67,6 +67,22 @@ fi
 minio_version="RELEASE.2025-01-20T14-49-07Z"
 mc_version="RELEASE.2024-09-16T17-43-14Z"
 
+# Hardcoded so that a replaced or tampered release asset is detected. Fetching
+# the .sha256sum assets instead would only detect a corrupted download, as they
+# are served from the same release.
+declare -A minio_checksums
+minio_checksums=([linux-amd64]=3439ca54a18f931cb900b35db0fa223f9ef9ab0c872ec63bbd115777863f4f91
+                 [linux-arm64]=ca96cbe3ee773aec918319be3d0a9f1566fd0dd3c52b973c97abd030dde84d38
+                 [darwin-amd64]=80e7bf28a337313189a8f54403f623f2f1894a672bafb0cc08665d958d8bd1c0
+                 [darwin-arm64]=f8469f3eaa868bf21cc09b5a6087cf4997bf63d73979ecd5d3fb8b8358ac3f55
+                 [windows-amd64]=ec1bf8de91729ef670abdbc9e743560c4957de251168ce5b48b0ae1154c45d85)
+declare -A mc_checksums
+mc_checksums=([linux-amd64]=9a9e7d32c175f2804d6880d5ad3623097ea439f0e0304aa6039874d0f0c493d8
+              [linux-arm64]=f4a269854283736f46024e73a35a3194f8286067a36877f2aecacf3bf6e41bf0
+              [darwin-amd64]=0638adf8be9052fc04a8e08e0df5ab516c11c16a67aa62b14f1c653b46fdd0cc
+              [darwin-arm64]=668db3dd797e4f285b33ba652c6de8f8edc4bed31d74d9f17f3c0ab829482c4d
+              [windows-amd64]=b2378ff1d04370df15436362cbd6660ceb1a401886659a0b86747cddbe9f8722)
+
 exe_suffix=""
 if [ "${platform}" = "windows" ]; then
   exe_suffix=".exe"
@@ -85,15 +101,42 @@ download()
   fi
 }
 
+verify_checksum()
+{
+  local file=$1
+  local expected=$2
+  local actual
+
+  if [ -z "${expected}" ]; then
+    echo "No known checksum for ${file} on ${platform}-${arch}"
+    rm -f "${file}"
+    exit 1
+  fi
+  if type sha256sum > /dev/null 2>&1; then
+    actual=$(sha256sum "${file}" | cut -d ' ' -f 1)
+  else
+    actual=$(shasum --algorithm 256 "${file}" | cut -d ' ' -f 1)
+  fi
+  if [ "${actual}" != "${expected}" ]; then
+    echo "Checksum mismatch for ${file}"
+    echo "  expected: ${expected}"
+    echo "  actual:   ${actual}"
+    rm -f "${file}"
+    exit 1
+  fi
+}
+
 if [[ ! -x ${prefix}/bin/minio ]]; then
   url="https://github.com/minio/minio/releases/download/${minio_version}/minio.${platform}-${arch}.${minio_version}${exe_suffix}"
   echo "Fetching ${url}..."
   download "${prefix}/bin/minio" "${url}"
+  verify_checksum "${prefix}/bin/minio" "${minio_checksums[${platform}-${arch}]:-}"
   chmod +x "${prefix}/bin/minio"
 fi
 if [[ ! -x ${prefix}/bin/mc ]]; then
   url="https://github.com/minio/mc/releases/download/${mc_version}/mc.${platform}-${arch}.${mc_version}${exe_suffix}"
   echo "Fetching ${url}..."
   download "${prefix}/bin/mc" "${url}"
+  verify_checksum "${prefix}/bin/mc" "${mc_checksums[${platform}-${arch}]:-}"
   chmod +x "${prefix}/bin/mc"
 fi