Fix Multi-Level Namespace Signing & Add Iceberg Compatibility Tests

This PR fixes a critical SignatureDoesNotMatch (403) error for multi-level namespace
operations and adds comprehensive Iceberg REST Compatibility Kit (RCK) test coverage.

Changes

Bug Fixes

1. Multi-Level Namespace Signature Mismatch

Problem: All operations on multi-level namespaces (e.g., ["parent", "child"]) failed with
SignatureDoesNotMatch (403).

Root Cause: The Iceberg REST Catalog spec uses \u{001F} (unit separator) to join namespace
levels. When URL-encoded, this becomes %1F. However, AWS SigV4 requires the canonical URI
to be fully URI-encoded, meaning % must be encoded as %25 (so %1F becomes %251F).

The client was signing with %1F, but MinIO server's signature-v4.go:96 calls s3utils.EncodePath()
which produces %251F.

2. DataFusion ETag Type Mismatch

Fixed type error in src/s3tables/datafusion/object_store.rs where PartInfo::new() received String
instead of ETag.

3. Removed Unsupported Scan Planning Test

Removed test_server_accepts_filter_json_format from datafusion_full_integration.rs as MinIO server does
not support the scan planning API (returns 400 "unsupported API call").

New Test Coverage

- iceberg_catalog_compat.rs - 15 tests for namespace/table properties, schema management
- iceberg_view_compat.rs - 20 tests for view properties, versions, SQL dialects
- iceberg_transactions_compat.rs - 19 tests for data append, concurrent operations
- catalog_api_compliance.rs - 26 tests for HTTP headers, edge cases, error responses
- Total: 80 new tests for full Iceberg RCK coverage

Documentation

Added tests/s3tables/README.md with:
- Test categories and how to run them
- Multi-level namespace compliance explanation
- RCK test alignment details
- Troubleshooting guide

CI/CD

Added .github/workflows/s3tables-integration.yml with jobs for:
- Basic S3 Tables integration tests
- Iceberg compatibility tests (Phases 1-4)
- Advanced/concurrent operations
- DataFusion integration
- Stress tests (manual trigger)

How to Test

1. Start MinIO Server
MINIO_ROOT_USER=minioadmin \
MINIO_ROOT_PASSWORD=minioadmin \
MINIO_SITE_REGION=us-east-1 \
./minio server /tmp/minio-data --console-address ":9001"

2. Set Environment Variables
export SERVER_ENDPOINT=localhost:9000
export ACCESS_KEY=minioadmin
export SECRET_KEY=minioadmin
export SERVER_REGION=us-east-1
export TABLES_ENDPOINT=http://localhost:9000

3. Run the tests
cargo test -p minio s3tables:: -- --test-threads=4

cargo test -p minio iceberg_catalog_compat -- --nocapture
cargo test -p minio iceberg_view_compat -- --nocapture
cargo test -p minio iceberg_transactions_compat -- --nocapture

cargo test -p minio rck_conformance::nested -- --nocapture

Signed-off-by: Shubhendu Ram Tripathi <shubhendu@minio.io>

Author: shtripat

.github/workflows/rust-clippy.yml

@@ -30,6 +30,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev
+
       - name: Install Rust toolchain
         uses: actions-rs/toolchain@v1
         with:

.github/workflows/rust.yml

@@ -23,12 +23,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev
       - name: clippy
         run: cargo clippy --all-targets --all-features --workspace -- -D warnings
   test-multi-thread:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev
       - name: Run tests
         run: |
           ./tests/start-server.sh
@@ -38,11 +42,14 @@ jobs:
           export ENABLE_HTTPS=1
           export SERVER_REGION=us-east-1
           export MINIO_SSL_CERT_FILE=./tests/public.crt
-          MINIO_TEST_TOKIO_RUNTIME_FLAVOR="multi_thread" cargo test -- --nocapture
+          # Exclude s3tables tests - they have their own workflow (s3tables-integration.yml)
+          MINIO_TEST_TOKIO_RUNTIME_FLAVOR="multi_thread" cargo test -- --nocapture --skip s3tables
   test-current-thread:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev
       - name: Run tests
         run: |
           ./tests/start-server.sh
@@ -52,13 +59,16 @@ jobs:
           export ENABLE_HTTPS=1
           export SERVER_REGION=us-east-1
           export MINIO_SSL_CERT_FILE=./tests/public.crt
-          MINIO_TEST_TOKIO_RUNTIME_FLAVOR="current_thread" cargo test -- --nocapture
+          # Exclude s3tables tests - they have their own workflow (s3tables-integration.yml)
+          MINIO_TEST_TOKIO_RUNTIME_FLAVOR="current_thread" cargo test -- --nocapture --skip s3tables
 
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
     - uses: actions/checkout@v4
+    - name: Install system dependencies
+      run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev
     - name: Build
       run: |
         cargo --version