pgsty/silo RELEASE.2026-11-12T00-00-00Z

SILO 20261112

on GitHub

SILO Server 20261112 is a security and correctness release after 20261109, built from 44e848fedf8cec3d8c0da4b1aa8422390a2b7a8b with Go 1.27.4, embedded Console 2.7.2, mcli 20261112, and silo-pkg 3.16.1. Package version: 20261112000000.0.0 (Helm chart 7.0.5).

Security Advisories Addressed

• SN-2026-020 (Critical): Reject dot-segment, backslash, control-character, and non-canonical keys in S3 DeleteObjects across single-pool and multi-pool deployments; route all explicit VersionId deletes and unaddressed deletes that could replace a locked null version through single-object validation; enforce Object Lock across suspended/prefix-excluded replication targets (b3e69bca2, cf486df66). Advisory.
• SN-2026-021 & SN-2026-025 (High): Preserve existing service-account inline session policies when UpdateServiceAccount omits newPolicy while resetting inheritance on explicit empty documents ({} / {"Statement":[]}), replicate stored service-account policy modes across sites instead of rendered parent policies (da8d8a54b), preserve disabled service-account and group status during ImportIAM, normalize versionless inline policies to "2012-10-17", and pair with Console 2.7.2 (c11bfda8f, 1d714834c, 44e848fed). SN-2026-021 · SN-2026-025.
• SN-2026-022 (Critical): Authenticate DeleteObjectTagging before local lookup or replication proxying; inspect and authorize stored tags across every present active-active replica before proxied GET/PUT/DELETE ?tagging while tolerating missing lagging peers and failing closed on unreadable targets; gate x-amz-tagging-count and X-Amz-Object-Lock-* headers on local and proxied GET/HEAD (14ecb222e, 67a90dfef, 293ab78b4, c39605d4f, ea37a7e8b). Advisory.
• SN-2026-023 (High): Enforce the 15-minute X-Amz-Date clock-skew window and signed-header coverage on Authorization-authenticated STREAMING-UNSIGNED-PAYLOAD-TRAILER uploads (keeping anonymous public-bucket streams intact), and populate s3:signatureversion / s3:authType across trailer streaming modes (14ecb222e, 296c9710b). Advisory.
• SN-2026-024 (High): Authorize GetObjectAttributes and read-only .zip archive requests (x-minio-extract: true on GET, HEAD, ListObjectsV2) against stored UserTags, require s3:GetObject on the archive before member listing, and make read-time .zip index construction strictly in-memory (f746d0707, 296c9710b). Advisory.

Storage, Lifecycle, Migration, and Encryption Fixes

• Compressed + encrypted ranged reads (#352): Fix indexed sub-block byte-range reads on objects that are both server-side compressed (.zstd/.s2) and encrypted (SSE-S3/SSE-C/SSE-KMS) instead of returning 500 InternalError (7c0a99284, 939cb2600).
• Lifecycle & restore revision identity (#332, #344): Unify revision keys across pre-2024-04-28 MinIO headers, healed drives, and derived xlFlagUsesDataDir differences so lifecycle expiration and native restore generation checks no longer stall permanently (36c8d1683, b5d97e3e1).
• Pool decommission & rebalance (#334, #335): Repeat bucket drain passes when source removals expose nested child keys, count lifecycle expirations as progress, tolerate offline drives within read quorum, and fail closed when physical metadata remains (ce5d19107, 5dc4bd6a1, 322cd8d2c, 8587e061b).
• Multi-pool copy, strict policy JSON, KMS context & site replication: Preserve authoritative historical placement, compression indexes, and draining-pool content on CopyObject/UploadPartCopy (a8824b341, cd3e46a2b, e36ea51d9); preserve 503 SlowDown on unreadable tag-conditioned reads (89028732a, a2ff3c2ec); enforce strict IAM/bucket policy JSON parsing and 400 InvalidArgument on malformed SSE-KMS contexts while preserving batch keyrotate KMS context (34ba7cc1f, 2ed720a7f, 467ce760e, 4a9bdb540); and release site-replication topology locks before peer RPCs (ef6efd312, 745fbf043, 2f228284f).

Upgrade Requirements and Operational Notes

1. Quorum & cross-release prerequisites: Verify healthy .minio.sys and erasure read quorum before restarting. Direct upgrades from 20261026 or earlier must also follow the 20261109 upgrade checklist (drain/cancel unfinished batch jobs; stop all nodes simultaneously when single-pool erasure sets do not share identical hosts; pause POST ?restore during mixed-version windows).
2. Multi-pool & multi-site rollout: Drain or pause concurrent S3 writes during mixed-version multi-pool rolling restarts, and freeze service-account edits on un-upgraded 20261109 sites until every site runs 20261112. Audit service accounts showing Policy: implied and historical mcli admin cluster iam import clusters after upgrade rather than running blind site-replication resync.
3. Strict policy & KMS context validation: Automation sending misspelled policy keys (e.g. Conditions), trailing JSON, empty Principal: {}, NotPrincipal, or non-string KMS encryption-context values now receives 400.
4. Helm & post-restart verification: Pass --set image.tag=RELEASE.2026-11-12T00-00-00Z when running helm upgrade --reuse-values (chart 7.0.5), and verify bounded signed S3 write/readback on every restarted node (healthcheck contract).

Explicit VersionId removals in DeleteObjects now run sequentially across all buckets (alongside unaddressed deletes that could replace a locked null version), trading bulk version-purge throughput for per-version validation safety; ordinary delete-marker creation and unversioned bulk deletes retain concurrent execution. Existing limits remain in ListMultipartUploads (#79), multi-site delete-marker purge (#217), replayed bucket creation (#241), and SDK multipart-completion retry headers (mcli put --if-not-exists).

Docker Hub multi-architecture images (linux/amd64 and linux/arm64):

• docker.io/pgsty/silo:RELEASE.2026-11-12T00-00-00Z (latest): sha256:c20d112390b9a9ce8c11b8af95ad35bcaa62f4759663c09c936cd8d2b511f329
• docker.io/pgsty/silo:RELEASE.2026-11-12T00-00-00Z-distroless (distroless): sha256:a72e17773bdeb151999f9bf9d3bd842fb03850a577b730ab8c63343bb1f468fd

Release Notes · 中文发布说明 · Full Changelog · Go CI · VulnCheck · Release Pipeline Validation · Tagged Build · Package Finalization · Docker Publish