SILO Server 20261109 is a maintenance release after 20261026, built from d998292387ccf1d2907749e0fb1575ef5fb93fda with Go 1.27.3, embedded Console 2.7.0, mcli 20261109 and silo-pkg 3.16.0. Package version: 20261109000000.0.0.
Changes
- Reconcile lifecycle decisions, version history, Object Lock and remote-tier ownership across pools; protect shared tier data and clean up only the intended restored copy or exact key.
- Stage native restores without holding an object write lock throughout download; validate ownership before publication and bound synchronous cancellation cleanup before background recovery.
- Enforce Object Lock during S3 bulk version deletion, including directory null versions and protection held by another pool. Replicated deletion obeys destination retention and legal hold.
- Bind batch execution to the authenticated submitter's current permissions; pause on unavailable authorization dependencies, retry discovery and preserve completed jobs.
- Align single-pool object locks, fix CopyObject lock ordering and evaluate multipart initiation conditions against the current object.
- Update persisted IAM edits, long-DN LDAP login, embedded Console login with LDAP, webhook reloads, partial-view reads and healing behavior.
- Ship Windows ZIP archives, six Linux packages, standard and distroless multi-architecture images, SBOMs and workflow provenance. RPMs are GPG-signed before final package checksums and attestations are regenerated.
Upgrade requirements and costs
- Stop batch submissions and drain or cancel unfinished jobs before changing versions. Resubmit unfinished legacy jobs after all nodes upgrade. New submitter-bound manifests and reports cannot be resumed by 20261026; do not downgrade with pending or paused new jobs. Batch upgrade checklist.
- A single pool whose erasure sets do not all occupy the same host set requires a drained restart, rather than mixed old/new lock domains. Pause new restores during mixed-version operation: upgraded nodes return
503while any peer is old or unreachable. Full multi-pool protection requires every serving node to upgrade. readyandclusterdo not independently prove that a restarted node can serve S3. Perform bounded signed writes and readback through every node before resuming applications, preserving peer discovery during bootstrap. Healthcheck contract.- With
helm upgrade --reuse-values, explicitly setimage.tag=RELEASE.2026-11-09T00-00-00Z.
Physical version removal in Object Lock buckets now checks each item under its mutation lock. This intentionally increases large-batch deletion latency; a bounded Linux ARM64 two-pool check measured about 202→310ms per 1,000 removable versions. Ordinary buckets and delete-marker creation keep the bulk path. Local disk timings varied materially even when testing the same binary against itself; these tests are not production capacity or tail-latency guarantees.
Known limits remain in multipart listing (#79), multi-site delete-marker purge (#217), replayed bucket creation (#241), and tag-only authorization (#293). ILM-created deletions are not replicated. The pinned upstream SDK can drop multipart-completion conditions, so mcli put --if-not-exists does not provide an uninterrupted multipart no-overwrite guarantee. Existing distributed fencing and recovery boundaries remain unchanged.
Full changelog · Go CI · VulnCheck · Release pipeline validation
简体中文
SILO Server 20261109 汇集了 20261026 之后的维护修复，内嵌 Console 2.7.0、mcli 20261109 与 silo-pkg 3.16.0，使用 Go 1.27.3 构建，包版本为 20261109000000.0.0。
本版重点修复多池生命周期与远端分层清理、两阶段原生恢复、S3 批量版本删除的 Object Lock 保护、批处理持续授权、单池锁域和 CopyObject 锁顺序，以及 IAM、LDAP、Webhook 和读取／自愈行为。对象锁批量清除逐项持锁检查，安全性提升伴随批量删除延迟增加；普通桶和删除标记创建保留批量路径。
升级前必须停交并排空／取消未完成 batch 作业，保存定义，全部升级后重交旧任务。新格式作业不能由 20261026 续跑，仍有新任务未完成时不要降级。跨主机 set 布局的单池按文档排空重启；混合版本期间暂停 restore，完整多池保护需要所有服务节点升级。重启后用逐节点签名 PUT／GET 验证数据路径，不能仅依赖 ready 或 cluster。Helm 使用 --reuse-values 时显式设置服务端镜像标签。
精确发布源码已通过完整 Go/race、漏洞扫描、平台打包及标准／distroless 镜像门禁；本地完成双池、四节点、单节点故障、API／客户端交叉、混合升级和已测对象／IAM 回退验收。性能测试保留了同一二进制自身也会出现的大幅磁盘波动，不将有界虚拟机结果作为生产性能或长期稳定性承诺。已知问题和升级代价详见完整 CHANGELOG。