pgsty/silo RELEASE.2026-10-18T00-00-00Z

SILO 20261018000000

on GitHub

SILO 20261018000000 improves authorization, data-movement safety, and recovery from inconsistent object metadata. This release also includes clearer S3 errors and faster policy evaluation through silo-pkg v3.14.3.

What's changed

• Stronger Object Lock protection. Retention updates now enforce the required permissions and request conditions, and protected versions are checked before in-place or version-addressed writes. These fixes address retention bypasses and overwrite paths in #234 and #235.
• More consistent IAM authorization. Administrative credential operations respect explicit denies, session restrictions, and parent-account boundaries. Restricted credentials cannot create broader service accounts under built-in authorization. See #242.
• Durable, scoped STS revocation. Administrative revocation discovers persisted identities, propagates revocation records to sibling processes and replication peers, and recovers missed updates through refresh and healing.
• Safer rebalance and decommission. Moving an older copy no longer overwrites a newer destination copy. Migration preserves delete markers and removes only confirmed moved versions, protecting concurrent source updates. This incorporates #248, with further migration safeguards.
• More reliable object listings. LIST recovery checks eligible ambiguous entries against the locked read path, preserves directory and common-prefix entries, and bounds lock waits. See #221 and #239.
• Better error handling and cleanup. Missing commit metadata returns a retryable 503 SlowDownWrite; reused metadata fields are cleared; stale multipart-upload timestamps and empty upload directories are handled correctly. Checksum errors identify the algorithm, and the embedded Console preserves wrapped S3 errors. See #232, #233, #236, and #238.
• Faster policy evaluation. silo-pkg v3.14.3 reduces admin-action classification overhead while preserving authorization decisions. The many-bucket policy microbenchmark improved by about 82%; application gains depend on workload.

Built with Go 1.27.2, embedded Console v2.4.2, silo-pkg v3.14.3, and upstream minio-go v7.4.1. Use mcli 20261018 for administration.

Before upgrading

The supported combination is the maintained PGSTY SILO, Console, mcli, and silo-pkg stack. Coordinate the upgrade across all server processes and replication sites. Mixing old and new binaries against one IAM backend, and rolling downgrades, are unsupported.

• Strict multipart listing has been removed. MINIO_API_MULTIPART_LISTING=strict is ignored with a startup warning; the old shared configuration key is tolerated. Deployments that enabled strict mode lose its durable listing and strict cancellation behavior. Default listing and best-effort abort behavior remain unchanged. Complete persistent enumeration and creation fencing are still tracked in #79; an empty listing or HTTP 204 does not prove that all physical uploads are gone.
• Authorization fixes can reject previously permitted operations. Review Object Lock and IAM policies. Clients should handle 503 SlowDownWrite according to their retry policy and match checksum error codes rather than exact message text.
• OIDC keys have a size limit. The updated JOSE library rejects RSA keys larger than 4096 bits. Verify discovery, JWKS retrieval, and login before upgrading.
• STS revocation has a defined scope. It covers persisted identities visible to the requesting cluster, filtered by parent, credential type, and the operation cutoff. Tokens issued at an isolated site and never replicated into that cluster are outside this scope. Recovery after a partition is eventual.
• Keep backups and audit existing state. Back up IAM state, configuration, and required encryption material. The upgrade cannot restore content, tags, delete markers, or revocation history already lost. The separate cross-site delete-marker issue #217 remains open.

Performance notes

The additional migration checks and per-version cleanup trade some background throughput for data safety. In local tests with up to 128 versions per object, migration time per item increased by about 1.18–2.15×. Revoking 10 selected STS tokens among 2,048 unrelated tokens increased from about 42 ms to 724 ms. The durable scan runs during administrative revocation; it adds no network query to each authentication.

Short-window GET, PUT, LIST, and STS throughput stayed within roughly 2.4% of the previous release. A separate 30-second multipart comparison measured 11.7% lower median throughput and 32.7% higher p95 latency. Those runs had substantial, overlapping variance on shared local storage, so the cause remains unresolved. These measurements describe the test environment, not production capacity guarantees.

Downloads and containers

The assets below include Linux, macOS, and Windows archives, Linux packages, checksums, signatures, and SBOMs. The package version is 20261018000000.0.0.

Standard and distroless images are available for linux/amd64 and linux/arm64:

docker pull pgsty/silo:RELEASE.2026-10-18T00-00-00Z
docker pull pgsty/silo:RELEASE.2026-10-18T00-00-00Z-distroless

For digest-pinned deployments:

• Standard: pgsty/silo@sha256:2636fc4155d9a7e41ff58cdb65ddd13ba9304e67184e13c25bc5cb34016269d7
• Distroless: pgsty/silo@sha256:472f59c7be537571f0f9a2ee6b8fe033a220939d521255bd4bf5339e53db7218

Source: 0cd388c666f82. Full changelog since 20260916.

Thank you

This release brings together code contributions, bug reports, documentation checks, and private security disclosures. Thank you to:

• Denis Babchuk (@botdeniska) for the migration overwrite repair in SILO #248 and policy fast paths and regression coverage in silo-pkg #11. The migration repair was incorporated with its original authorship and DCO; the original PR remains open. Thanks also to Klaus Post (@klauspost) for the original policy optimization.
• mr javad seydi (@mrjavadseydi) for the original LIST recovery work in #221, multipart-upload work, and continued testing and proposals.
• Julien Laurenceau (@julienlau) for the missing-commit-metadata fix in #232, stale metadata repair in #233, and replication reports and proposals.
• GiBum Park (@clown15) for the multipart cleanup timestamp fix in #236.
• Christophe Bornet (@cbornet) and Paris Y. (@yupoet) for checksum reports and message improvements in #225, #226, and #229. Paris also cross-checked the two-drive EC:1 documentation in #197 and proposed an upgrade guide.
• Aleksa Majkić (@AleksaMCode) for the Lambda target-set fix and regression test in #220.
• @szopi00 for the Object Lock security report, Sarthak Mittal (@naiveHobo) for the IAM access-control report and reporting-channel feedback in #222, and Dominik Klug (@nik0xFF) for reporting a security issue privately by email. Dominik is credited by name with his permission.

Thanks also to @aschyolkin, @tiredenzo, @heroes1412, @jiri-pejchal, @0mp, @ztarbug, @zmstone, @Crowley723, @devTeam-AiReg, and @geraldcombs for reports, follow-up checks, and suggestions across the project. Open proposals are recognized in the contributor record with their current status.