pgsty/silo RELEASE.2026-09-16T00-00-00Z

on GitHub

SILO 20260916 is a security and correctness release following RELEASE.2026-09-03T13-18-01Z, built from 2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c. The package version is 20260916000000.0.0.

Highlights

• Authentication and policies: reject unsigned x-amz-* operation headers, verify header-bound presigned payloads, and align signature-age and payload-hash conditions with authenticated values. Shared policy fixes preserve distinct Deny statements and avoid exponential wildcard matching. See SN-2026-011 through SN-2026-014.
• Durable IAM revocation: retain deletion revisions, membership grant times and parent revocation boundaries so stale replication events and old child credentials cannot cross retained revocations. Peer notifications reload committed state. Password self-service now checks admin:ChangeMyPassword separately from admin:CreateUser.
• Multi-pool consistency: evaluate conditional PUT and multipart completion against the logical current object; honor single-object conditional DELETE; reconcile addressed-version deletion and independently ordered tags/Object Lock metadata across pools. Rebalance and decommission preserve object tags and their revisions for ordinary and multipart objects (fced86303).
• Listing and delete-marker repairs: retain a quorate null version when a newer minority would hide it; require majority-confirmed absence for missing-version purge retries; preserve marker replication/purge metadata through healing; recheck queued marker creations under the replication lock; and report a purged data version without incorrectly identifying it as a delete marker (8d06424b1, eb4f5e5b3, 254b19ac0, 358ab38fb).
• Encrypted and federated copies: preserve raw SSE-C replicas, logical multipart sizes, lock/tag revisions and key-rotation checksums; prevent new compressed SSE-C writes; bind federated CopyObject checksums, version and timestamps to the actual destination write.
• Replication and configuration: repair ordered tag deletion, marker purge/MRF recovery, resync counters and cancellation, bucket metadata convergence and CORS export/import. Prevent transport-only aws-chunked from being stored as object encoding.
• Multipart discovery: add durable, quorum-checked listing and preflight with global prefix, delimiter and pagination behavior. Legacy remains the default. Strict mode is enabled only through MINIO_API_MULTIPART_LISTING=strict after the documented upgrade and capacity checks (#198, #213).
• Runtime reliability: enforce the configured absolute HTTP/1 header deadline, honor Go TLS defaults, synchronize CPU metrics reads during Prometheus scraping (#210), and correct quota/logger metrics.

Coordinated components

Console adds bounded object browsing, streaming ZIP downloads, restricted anonymous sharing, and session/UI recovery. mcli includes reliable failure exit codes, Object Lock/mirror/move fixes, and the SDK repair for CopyObject errors embedded in HTTP 200. Server and mcli images use Docker Hub: docker.io/pgsty/silo and docker.io/pgsty/mc. The standalone docker.io/pgsty/silo-console image is not currently available for anonymous pulls; use the embedded Console or the standalone release binary. The maintained four-component SILO stack is the supported integration target; upstream MinIO/MC compatibility is best effort.

Release verification

The exact tagged source passed Go CI, VulnCheck, and the complete release pipeline test, including package metadata, runtime shutdown and distroless health checks. The release build and signed-package finalization also passed.

All 36 downloadable assets were independently downloaded and checked against GitHub asset digests; the archive and package manifests, package sidecars, and both manifests' provenance identities were verified. Both RPM architectures carry the PGSTY GPG signature. A smoke test of the downloaded macOS ARM64 Server with the released mcli passed readiness, embedded Console HTTP, object write/read SHA-256 comparison, tags, versioning and delete-marker checks. These checks do not remove the known distributed-operation limitations below.

Container images

The Docker Hub publication workflow passed and published both linux/amd64 and linux/arm64:

• Classic: docker.io/pgsty/silo:RELEASE.2026-09-16T00-00-00Z and :latest — sha256:635197cb9f36d01bee221d34d1c7d7960f6a95c48b0b6c01d99cd13bdae51a46.
• Distroless: docker.io/pgsty/silo:RELEASE.2026-09-16T00-00-00Z-distroless and :distroless — sha256:32a8a777d90f3296294c9a57da5e8d397121187c4b868b2a7fc7874c726c0291.

Anonymous access, architecture coverage, source labels, rolling-tag equality and workflow provenance were independently verified. Runtime checks passed for the amd64 classic version and for both ARM64 variants' startup, readiness and S3 write/read checksums; the classic bundled mcli and distroless Docker health check also passed. Container write/read smoke tests used isolated temporary memory storage because the local Docker data disk was full; they are not persistence or distributed-cluster acceptance.

Upgrade requirements

1. Coordinate all nodes and sites. Mixed old/new processes sharing an IAM backend and rolling downgrade are unsupported. Back up complete IAM storage and encryption material; live IAM exports omit deletion history. Follow the IAM upgrade and recovery guide.
2. Review password policies. To retain an old combined password/user-administration restriction, deny both admin:CreateUser and admin:ChangeMyPassword, preserving the original conditions and resources. Saved policies are not rewritten. See migration guidance.
3. Enable optional changes separately. Bucket metadata tombstone export stays off by default. Strict multipart listing requires upgraded writers, drained legacy uploads, read-only preflight and capacity validation. See the multipart contract.
4. Audit historical state independently. Upgrading does not restore previously lost tags, policy clauses or revocation history, nor automatically repair old encrypted objects or every pending purge. See the replica audit runbook.

Known limitations

• #217: source-side marker rechecks do not fence creations already in flight or replayed from another site, or guarantee cleanup of post-crash minority residue.
• #218: successful ListObjects can still omit readable keys during rolling restarts with concurrent overwrites. Do not run sync tools that delete destination objects based on such listings; list again after the cluster stabilizes.
• #79: strict multipart pages rescan durable state, require capacity validation, and do not provide a durable fence against delayed upload-creation writes after cancellation.
• Conditional multi-pool writes/deletes can fail when relevant metadata is unreadable even if another pool can serve GET. The GET-frequency pool-tiering experiment was removed before this release; ordinary lifecycle, remote tiers, rebalance and decommission remain.

Thanks to the reporters, contributors and reviewers listed in the contributor record.

Full release notes · 中文发布说明

Complete source comparison · Download and install · Component matrix