SILO 20261015 is the first formal Server release containing the Object Lock fixes from #234 and #235. Object Lock users should upgrade promptly.
The release enforces retention authorization, protects immutable versions during writes, and rejects Object Lock preflight read failures. Authorized GOVERNANCE bypass requires the retention permission, bypass permission, and explicit bypass request. Active COMPLIANCE retention and legal holds remain protected. #237 makes the existing Object Lock regression suite with the race detector a mandatory step before release builds or uploads.
Upgrade every node and replication site that accepts writes. An upgrade does not restore already overwritten data or previous retention metadata. See the security advisory and repair design for scope and compatibility.
This release includes the full merged Server change set since 20260916, including scanner response, legacy metadata decoder, checksum, event-target, and Go/toolchain changes. The generated changelog follows below; the complete source comparison includes documentation and test changes as well.
- Source:
7a3ca0f82100cce06289a465f54139da2639f642 - Package version:
20261015000000.0.0 - Server tag:
RELEASE.2026-10-15T00-00-00Z - Official containers:
docker.io/pgsty/silo:RELEASE.2026-10-15T00-00-00Zanddocker.io/pgsty/silo:RELEASE.2026-10-15T00-00-00Z-distroless - Classic multiarch digest:
sha256:aaac6bce13eb99316b3c88bd20143fc3c38ab607585256a411a095c44ee57f62 - Distroless multiarch digest:
sha256:70cac541c5a928be5cd16d6b8732d85ac06e891a0e3d9956a745381330692fc6
Both indexes include linux/amd64 and linux/arm64. Anonymous registry checks confirmed that latest and distroless resolve to their respective versioned index digests.
Validation and acceptance
- Exact-source Go CI and VulnCheck passed. The release build passed its mandatory Object Lock race gate; package finalization passed.
- All 36 assets matched their published digests. Archive/package manifests and all six package sidecars verified; all six packages contained the exact accepted binaries and five support files. Both RPMs verified against PGSTY signing fingerprint
9592A7BC7A682E7333376E09E7935D8DB9BD8B20. All 34 attested subjects verified against the exact tag, source commit, and appropriate release/finalize workflow. - All six platform binaries passed static source/platform/embedded-version identity checks. The actual macOS ARM64 archive binary passed 49 fresh Object Lock checks, 12 checks after upgrading preserved 20260916 data, and 49 post-upgrade checks: 110 passed, 0 failed. Native archive execution covered macOS ARM64; the Windows and macOS AMD64 binaries received static identity checks.
- The Docker publication workflow passed. Both multiarch index provenance signatures independently verified against the exact source commit, tag, and Docker release workflow. All four image manifests had matching source/version labels, and both distroless manifests retained their native ready HEALTHCHECK configuration.
- The published classic and distroless images each passed 49 Object Lock checks on Linux ARM64 and 49 on Linux AMD64: 196 passed, 0 failed. ARM64 ran natively in Docker Desktop ARM64; AMD64 ran through its emulation. The actual
/usr/bin/silobytes copied from all four containers matched the corresponding accepted Linux release archives. All 120 rejected operations preserved complete object state, and all four test containers exited successfully and were removed. - Combined native, upgrade, and image acceptance: 306 passed, 0 failed.
Changelog
- 394d9db Align some checksum error messages with S3
- cdc3b8c Merge remote-tracking branch 'origin/main' into codex/pr-233-maintainer-fix
- 7a3ca0f build: gate releases on Object Lock regressions (#237)
- fa565ec build: update Go to 1.27.2 and x/net to 0.60.0
- 38a5ab5 build: use golangci-lint compatible with Go 1.27.2
- 3196480 fix: enforce retention authorization and immutable version writes
- 86c5a92 fix: keep scanner response resets local and strengthen regression tests
- 71a1631 fix: reject object lock preflight read failures
- ba6e8c8 fix: reset Signature when unmarshaling legacy V1 xl.meta headers
- a54d0c4 fix: reset pooled NSScanner RPC responses to avoid stale usage data
- 00d4a20 fix: zero EcM when unmarshaling legacy xl.meta V2 headers
- efd5698 lambda/event: fix TargetIDSet.IsEmpty and add regression test