SILO 20261018000000 — RELEASE.2026-10-18T00-00-00Z
Source: 0cd388c666f8211f552604ae73448a066e9c25ce. Package version: 20261018000000.0.0.
Changes
- Repair Object Lock retention authorization and existing-version overwrite paths, and enforce IAM administrator, session-policy and explicit-deny boundaries.
- Prevent rebalance/decommission from overwriting a newer copy, losing delete markers or deleting concurrent source updates. Includes #248 with Denis Babchuk's authorship and original DCO.
- Make scoped STS revocation enumerate durable identities and propagate committed tombstones to sibling caches and replication peers; recover missed revocations through existing refresh and deletion-healing paths.
- Recover eligible readable objects omitted by ordinary LIST metadata disagreements, preserving directory/common-prefix entries and bounding recovery lock waits.
- Return
503 SlowDownWritefor missing commit metadata; repair stale metadata reuse, native multipart timestamps, empty upload-parent cleanup, checksum messages and embedded Console error mapping. - Coordinate Go 1.27.2, Console v2.4.2, mcli 20261018, silo-pkg v3.14.3 and upstream minio-go v7.4.1.
Complete changes since 20260916.
Upgrade compatibility
The supported stack is PGSTY SILO, Console, mcli and silo-pkg. Coordinate all Server processes and replication sites on this version; mixing old/new binaries against one IAM backend and rolling downgrades are unsupported. The final migration/STS repairs add no public S3 API, CLI, object-storage format or module-dependency change.
- Strict multipart listing is retired.
MINIO_API_MULTIPART_LISTING=strictis ignored with a warning; the obsolete shared configuration key is tolerated. Users who enabled it lose durable listing and strict cancellation. Default legacy listing/Abort behavior remains; complete persistent enumeration and creation fencing remain open in #79. Empty lists or HTTP 204 are not proofs that all physical uploads are gone. - Object Lock and IAM repairs intentionally reject operations previously admitted by security defects. Check retry behavior for
503 SlowDownWrite, and match checksum error codes rather than exact English messages. - Updated JOSE rejects OIDC/JWK RSA keys larger than 4096 bits. Verify discovery, JWKS and login before upgrading.
- STS revocation covers the requesting cluster's durable snapshot, selected by parent/type and operation cutoff. Tokens created at an isolated site and never replicated into that cluster are outside that snapshot; reconnection healing is eventual.
- Back up complete IAM state, configuration and required encryption material. This upgrade does not reconstruct content, tags, delete markers or revocation history already lost. The separate cross-site marker issue #217 remains open.
Performance and acceptance
Correctness and compatibility are the release gates. The measured performance costs below were reviewed and accepted for this release; they are not a claim of zero regression.
The final three repairs add metadata checks and per-version migration cleanup, and a durable-identity scan to administrative STS revocation. They add no per-authentication network query. Local migration time per item increased about 1.18–2.15× across the tested histories (up to 128 versions/object). Revoking 10 selected tokens among 2048 unrelated tokens increased from about 42 ms to 724 ms; unrelated authenticated reads remained successful.
Short-window GET/PUT/LIST/STS throughput stayed within roughly 2.4% of the prior release. In a separate 30-second multipart comparison, final median throughput was 11.7% lower and p95 32.7% higher than 20260916. Runs had substantial, overlapping variance on shared local storage; attribution remains unresolved. These are single-host observations, not production capacity or latency SLOs.
The exact source passed Go CI, VulnCheck, Release and Finalize Release Packages. Final local validation covers the full unit suite, focused migration/IAM race regressions, and the actual release binaries. Existing exact-SHA acceptance includes native Darwin/Linux S3/IAM/STS/Object Lock, LDAP/OIDC, upgrade from 20260916, replication and recovery, multi-process STS revocation, 2/3-pool migration, package upgrades and container variants. Eight-process/two-pool tests completed 2896 rolling-restart scans and 1270 fault-recovery scans without missing keys, duplicates or corrupted reads.
All 36 assets retain their accepted identities: six platform archives, six package payloads, checksums, signatures and SBOMs. Verification includes the signed Git tag, 34 artifact attestations, both Sigstore checksum signatures, both signed RPMs and 12 SBOMs. Windows and Darwin amd64 received static checks; amd64 containers ran under emulation. Tests shared one physical host and do not certify independent failure domains or real cloud IAM/KMS.
Published containers
Both standard and distroless images support linux/amd64 and linux/arm64. The versioned tags and their rolling aliases (latest / distroless) were verified against the same manifests.
docker pull pgsty/silo:RELEASE.2026-10-18T00-00-00Z
docker pull pgsty/silo:RELEASE.2026-10-18T00-00-00Z-distroless- Standard manifest:
pgsty/silo@sha256:2636fc4155d9a7e41ff58cdb65ddd13ba9304e67184e13c25bc5cb34016269d7 - Distroless manifest:
pgsty/silo@sha256:472f59c7be537571f0f9a2ee6b8fe033a220939d521255bd4bf5339e53db7218
Docker publication workflow passed at the exact release SHA. All four publicly pulled image variants passed 92 HTTP assertions each (368 total), binary identity checks, health checks and graceful shutdown. Six image attestations were verified, including registry copies of both multi-architecture provenance statements. amd64 runtime checks used local emulation; arm64 ran natively in the Docker VM.
中文：标准与 distroless 镜像均已完成 amd64/arm64 发布，固定版本和滚动标签指向相同清单。四种公开镜像共通过 368 项 HTTP 断言，二进制身份、健康检查、正常退出及六份镜像证明均验证通过。可使用上面的固定版本或摘要部署。
中文
正式版本 20261018000000，源码固定为 0cd388c666f8211f552604ae73448a066e9c25ce。本版修复 Object Lock 与 IAM 授权、迁移覆盖新版本和删除标记丢失、持久 STS 撤销及通知恢复、限定范围的 LIST 遗漏、提交元数据错误和分片清理问题；配套 Console v2.4.2、mcli 20261018、silo-pkg v3.14.3、minio-go v7.4.1 与 Go 1.27.2。
正确性与受支持升级路径验收通过。已明确接受性能成本：测试中的迁移每项耗时约为此前的 1.18–2.15 倍；2048 个无关令牌下撤销 10 个目标令牌约从 42 ms 增至 724 ms，无关令牌读取正常。30 秒分片上传对照中，吞吐中位数比 20260916 低 11.7%，p95 高 32.7%；本机共享存储波动较大，尚不能归因到具体代码，也不宣称没有退化。
升级须协调全部 Server 和复制站点，保留完整 IAM 状态及密钥备份。strict 分片模式退役，此前启用者会失去持久列表和严格取消能力；默认 legacy 行为保留，#79 仍开放。Object Lock/IAM 拒绝历史错误放行的操作，提交元数据缺失改为 503，OIDC/JWK 超过 4096 位的 RSA 密钥被拒绝。STS 撤销不覆盖从未复制到请求集群的孤立站点令牌，也不是分区下的瞬时全球屏障；#217 的独立跨站删除标记问题仍开放。升级不会恢复此前已经丢失的数据或撤销历史。
36 个发行资产经过摘要、签名、来源和载荷核验，最终源码与实际制品的功能、迁移、撤销、升级和恢复验收通过。测试边界为本机多进程/容器，不能外推为生产性能承诺或独立物理故障域验收。