PGSTY SILO Blog on SILO

Adding Multilingual Support to SILO

Mon, 09 Nov 2026 00:00:00 +0000

Why SILO adds ten UI languages, how the registry and maintenance tiers work, and why per-language compression with eager loading balances size, caching and implementation cost.

mcli 20261109: Data Safety and Automation Fixes

Mon, 09 Nov 2026 00:00:00 +0000

mcli 20261109 is released. Tag: RELEASE.2026-11-09T00-00-00Z; package version: 20261109000000.0.0; source: e1d4cc5abfe0. These notes describe changes since 20261026.

This is a standalone mcli maintenance release. It does not replace the client embedded in an existing Server or Console build. The maintained and release-tested server is PGSTY SILO; compatibility with upstream MinIO and other S3-compatible services remains best effort.

Removal, moves and downloads

Dry runs stay read-only. rm --purge --dry-run previews the requested prefix without deleting it. Namespace removal protection applies to every command-line target and each stdin target; adding another argument no longer bypasses --dangerous.
Each copy or move uses its own source alias. Multi-source operations no longer reuse the first alias when reading or deleting later objects.
Known self-moves are rejected before copying or deleting the source. This includes resolved object URLs, normalized filesystem paths, symlinks and hardlinks. The endpoint guard also rejects the same bucket/key across endpoints with the same scheme and port when their IP addresses overlap, including --resolve mappings.
Multipart od downloads read the requested sequence. Downloads no longer repeat the last part, and opened readers are closed on success or failure. Invalid operands, zero part sizes, negative sizes and arithmetic overflow are rejected before changing the target; empty copies no longer produce invalid rate output.

The move guard is conservative: distinct virtual hosts on a shared IP and port can be refused. Establish that the stores are independent before copying, verifying and deleting explicitly; matching bytes through two aliases does not prove independence. Different IPs, ports, proxy routing, virtual-host addressing or changing DNS can conceal a shared backend. Use consistent endpoint URLs for aliases to the same store.

SILO Console 2.7.0: Ten Languages, Usage Worker and Container Fixes

Mon, 09 Nov 2026 00:00:00 +0000

Console 2.7.0 expands the administration interface to ten languages, fixes container HTTPS and temporary files, adopts the released mcli 20261109 and silo-pkg 3.16.0 and updates API documentation. It also fixes usage-worker TLS and scheduling, folder sizes over plain HTTP and malformed uploads, all found in the final pre-release review. Publication status and assets are on GitHub releases.

GitHub releases · Changes since 2.6.0 · Console compatibility

Fixes found before release

The final review before release found defects that 2.6.0 already shipped with. 2.7.0 fixes them:

silo-pkg 3.16: JOSE Security and Configuration Fixes

Sun, 08 Nov 2026 00:00:00 +0000

silo-pkg v3.16.0 is a source-only maintenance release of github.com/pgsty/silo-pkg/v3. It requires Go 1.27.3 and remains API-compatible with v3.15.2. Server, Console and mcli receive the changes only after adopting this version and rebuilding; their existing release artifacts are not replaced by a library release.

Dependency updates

Module	v3.15.2	v3.16.0
`github.com/go-jose/go-jose/v4`	`v4.1.6`	`v4.1.9`
`golang.org/x/net`	`v0.61.0`	`v0.62.0`
`golang.org/x/crypto`	`v0.58.0`	`v0.58.1-0.20261009181718-2f1f834330b2`
`github.com/klauspost/cpuid/v2`	`v2.4.1`	`v2.4.2`
`go.yaml.in/yaml/v3`	`v3.0.5`	`v3.0.6`

The JOSE update includes the five security fixes in go-jose v4.1.7: invalid RSA thumbprints, JSON decoding of embedded unexported fields, JWE protected/unprotected header handling, RSA certificate-verification limits, and limits on JWS signatures/JWE recipients. Version 4.1.9 also restores OpaqueSigner support for unrecognized public-key types and improves unsupported-key errors. These are dependency advisories; their applicability depends on which operations a consuming application exposes.

Native Restore in Two Phases

Fri, 06 Nov 2026 00:00:00 +0000

Why a native restore held the object lock for its whole tier download, why the first fix of #281 also stranded failed ordinary uploads, and how staging outside the lock and a short, checked commit replace the private upload.

A Partial View Must Not Report an Existing Object as Missing

Fri, 06 Nov 2026 00:00:00 +0000

Why a node that reaches only some drives of an erasure set can answer 404 NoSuchKey for an object that exists, and why mapping inconsistent metadata to “not found” only when every drive answered is the minimum complete repair.

A Failed Multipart Completion Can Strand the Upload

Fri, 06 Nov 2026 00:00:00 +0000

Why a CompleteMultipartUpload that misses write quorum can destroy the upload on the drives where its rename succeeded, leaving it stuck until stale-upload cleanup, and why the repair is deferred until storage operations can be fenced.

SILO Console 2.6.0: Usage Scans and Safer Bucket Administration

Thu, 05 Nov 2026 00:00:00 +0000

Console 2.6.0 was published on 2026-11-05 (UTC+8), following 2.5.1. The GitHub release records source commit f8ab146695fd1df74e4b84128a286d552921bf00, release assets and verification evidence. This is a standalone Console release; Server’s embedded Console has its own release cycle.

GitHub releases · Release preparation PR #82 · Object management

Folder and bucket usage

The object browser can calculate folder sizes with cancellable metadata scans, including optional retained-version totals. Current object bytes and retained bytes are shown separately. The scan does not download object contents or measure physical disk consumption. It runs with the caller’s permissions; listing versions requires permission to list versions.

Lock Domains of Large Single-Pool Clusters

Wed, 04 Nov 2026 00:00:00 +0000

Why DELETE and CopyObject can fail to exclude PUT on the same key in a distributed single-pool deployment whose erasure sets do not share the same hosts, which layouts that covers, what the race does to xl.meta, and the smallest routing change that closes it.

Restored Copies: Expire the Copy, Not the Object

Wed, 04 Nov 2026 00:00:00 +0000

Why the expiry of a restored copy of a current version hid the object or stripped an older null version, why addressing the exact version is the core repair, and which storage and native-restore safeguards have to ship with it.

Failed Writes and Phantom Empty Prefixes

Wed, 04 Nov 2026 00:00:00 +0000

Why a write whose staged data is already gone can leave an empty object directory that later appears as a common prefix with nothing under it, and why removing empty directories on the rename failure path is the minimum complete repair.

Multi-Pool Lifecycle Expiry: Decide on the Whole Object

Wed, 04 Nov 2026 00:00:00 +0000

Why lifecycle rules evaluated on the versions of one pool hide, delete, or resurrect versions stored in another pool, and why a recheck on the merged version list under the object lock is the minimum complete repair.

Heal Dry Run Must Not Delete Data

Wed, 04 Nov 2026 00:00:00 +0000

Why an admin heal run as a dry run can still delete a dangling object version when its metadata has no read quorum, why a five-line early return is the right fix for this release, and why the same fix must also carry the dry-run flag to remote nodes during bucket heal.

Lifecycle Delete-All Must Stay on One Key

Wed, 04 Nov 2026 00:00:00 +0000

Why a lifecycle or batch “delete all versions” of one key also deletes every object stored under that key’s name, and why purging the key’s own versions by ID, under the object lock and after a recheck, is the minimum complete repair.

Bucket Quota in the Console: List Display and Numeric Validation

Wed, 04 Nov 2026 00:00:00 +0000

Why a quota set in the web Console showed as a dash in the bucket list, why the bucket-creation form turned 1000 Ei into a one-byte quota and rejected 0.5 Gi, which releases carried each defect, and why one shared conversion and one shared quota reader are the minimum complete repair.

Audit Webhooks After a Peer Reload

Wed, 04 Nov 2026 00:00:00 +0000

Why a runtime change to audit_webhook leaves every server except the one that served it with a webhook target whose worker has already exited, which other subsystems share the defect, and why building logger targets on the server context is the minimum complete repair.

ILM Expiry and Pool Migration Ordering

Tue, 27 Oct 2026 00:00:00 +0000

Why lifecycle expiry and pool migration disagree about a versioned current object, what #266 fixes, and how #276 completes the tier and lifecycle safety boundaries.

Tier Free Versions Are Internal Cleanup Records

Tue, 27 Oct 2026 00:00:00 +0000

Why a tier free version is an internal cleanup record, how treating it as a normal version breaks lifecycle and pool migration, and why PR #264 is the minimum complete repair.

Mixed EC Layouts and Migration Listing

Tue, 27 Oct 2026 00:00:00 +0000

Why an object with two readable erasure-code layouts can disappear from decommission and rebalance listings, and why the narrow recount in PR #262 is the minimum safe repair.

Pool Migration Integrity Review: #261, #263, and #265

Tue, 27 Oct 2026 00:00:00 +0000

A maintainer review of three storage-pool migration reports: mixed erasure-code layouts, tier free versions, and lifecycle expiry ordering. It records root causes, minimum safe fixes, evidence, and merge order.

SILO at One Year: What Actually Changed Since Upstream MinIO?

Mon, 26 Oct 2026 00:00:00 +0000

From MinIO’s final public release on 2025-10-15 to SILO 20261026: 376 days and 604 commits. Here is the engineering ledger of what SILO actually changed across security boundaries, S3 protocol and checksums, replication and lifecycle, storage write/rollback and multi-pool safety, Console and mcli, and operational delivery—plus the boundaries that remain unchanged.

silo-pkg 3.15: Go 1.27.3 and S3 SDK Fixes

Mon, 26 Oct 2026 00:00:00 +0000

silo-pkg v3.15.2 is now released (commit 0416eb1f4505) and is adopted directly across the SILO 20261026 stack as github.com/pgsty/silo-pkg/v3. This note summarizes the full 3.15 series (v3.15.0, v3.15.1, and v3.15.2) since v3.14.3.

3.15.0: Toolchain and shared dependencies

The module’s minimum Go version increases from 1.26 to 1.27.3, alongside updates to 13 direct dependencies: JWX 3.4.0, etcd api / client/pkg / client 3.7.3, gRPC 1.84.0, grpc-gateway 2.32.0, go-json 0.11.2, swag/conv 0.29.2, go-colorable 0.1.16, cpuid 2.4.1, fwd 1.2.1, and the two Google generated API/RPC modules pinned at ce908d29299b.

SILO Console 2.5: Interface and Administration Updates

Mon, 26 Oct 2026 00:00:00 +0000

SILO Console v2.5.1 is now released (commit fff1618d9abb) and ships embedded inside SILO 20261026. This note summarizes the full 2.5 release series since v2.4.2, combining the v2.5.0 interface overhaul and the v2.5.1 patch fixes.

GitHub release · Downloads · Full commit comparison

Navigation, overview, and metrics

The 2.5 interface adopts neutral light and dark themes, system typography, consistent information density, Lucide icons, clear keyboard focus states, and prefers-reduced-motion support. A mobile drawer and tablet rail adapt navigation to narrow viewports while respecting saved user preferences; object details open in a focus-restoring bottom sheet on mobile, and dialogs and forms scale cleanly to smaller screens. English and Chinese localization, accessible controls, and license attributions remain built in.

SILO 20261026: Server, mcli and KES

Mon, 26 Oct 2026 00:00:00 +0000

SILO, mcli, and PGSTY KES 20261026 are now released, alongside SILO Console 2.5.1 and silo-pkg 3.15.2. This article consolidates the October 24–25 maintenance records and summarizes all changes since the 20261018 release. All three executables share the same release date and package version; KES remains an optional, independently deployed key encryption service.

Note

Subsequent standalone releases ship mcli 20261109, Console 2.6.0, and silo-pkg 3.16.0. Additional post-20261026 Server maintenance repairs are merged on main and await the next Server release; see the Server compatibility page and component matrix.

Multi-Pool Deletion: Preserve the Latest Copy on Failure

Sat, 24 Oct 2026 00:00:00 +0000

Why error reporting and online-drive checks were insufficient for multi-pool deletion, how staged cleanup protects the authoritative copy, and the measured performance and compatibility costs of PR #257.

Overwrite Pool Affinity: Why #245 Was Not Adopted

Sat, 24 Oct 2026 00:00:00 +0000

The design, correctness fixes, two rounds of m3 benchmarks, and decision to stop the overwrite-affinity experiment: fewer stale copies did not justify the remaining small-object write cost.

FULL_OBJECT Checksum Replication: Preserve the Type at Upload Initiation

Sat, 24 Oct 2026 00:00:00 +0000

PR #255 restores the FULL_OBJECT checksum type when replicating multipart CRC objects. This note documents the BadDigest failure chain, the upstream regression, why a three-line guard also repairs CopyObject replication, and the verification and upgrade guidance.

LDAP Long DNs: Restoring Login Without Hiding Revocation Errors

Fri, 23 Oct 2026 00:00:00 +0000

Why LDAP DN normalization exposed an IAM filename limit, how parent-revision reads turned it into a login regression, and why the fix classifies only impossible ASCII path components as absent.

IAM Policy Reloads: Lock Scope, Cancellation, and Time Budgets

Fri, 23 Oct 2026 00:00:00 +0000

Why a slow policy list blocked ordinary S3 authentication, how request cancellation was lost before reaching KES, and why fixing context propagation required separating etcd read timeouts from decryption budgets.

Alias regions: a small configuration change with compatibility boundaries

Fri, 23 Oct 2026 00:00:00 +0000

Why mcli needs an optional region per alias, why the resolved region belongs in the client cache key, and how to preserve ordinary upgrades without promising lossless downgrades.

SILO 20261018 Release Notes

Sun, 18 Oct 2026 00:00:00 +0000

Server 20261018 is available with versioned archives, native packages, and standard/distroless Docker Hub images for amd64 and arm64. It supersedes Server 20260916 (20261015 is retained as a superseded historical draft record).

Identity	Value
Release tag	`RELEASE.2026-10-18T00-00-00Z`
Package version	`20261018000000.0.0`
Release source	`0cd388c666f8211f552604ae73448a066e9c25ce`
Previous public source	`2a4d51406b7ed87af5fe6fe0f801f3290f96eb3c` (Server 20260916)
Complete change set	20260916 → 20261018

See the download page for versioned archives, native packages, and pinned container commands.

Object Lock and IAM security

SN-2026-015 / SN-2026-016 — Object Lock retention authorization and in-place overwrite protection. #234 and #235 repair retention authorization and in-place overwrites:

SILO, KES and OpenBao: Key Ownership and Recovery

Sun, 18 Oct 2026 00:00:00 +0000

Separate object encryption, key-service authorization and persistent root-key storage, with explicit upgrade and recovery checks.

October Security Update: Object Lock, Admin Credentials and JWK Parsing

Sun, 18 Oct 2026 00:00:00 +0000

SILO Server 20261018 delivers the fixes for SN-2026-015, SN-2026-016, and SN-2026-017, scoped STS token revocation, and Go toolchain and dependency updates across silo, mcli, and silo-console. Server 20260916 and 20260903 are affected (and 20261015 was a superseded pre-release draft).

Object Lock: SN-2026-015 and SN-2026-016

The SN-2026-015 & SN-2026-016 advisory and repair design note document the affected PutObjectRetention and in-place version overwrite paths, reproductions, and mitigations. PR #234 (14042b5aa) and PR #235 (0d3ba5d4c) enforce s3:PutObjectRetention before object lookup, require both x-amz-bypass-governance-retention: true and s3:BypassGovernanceRetention when weakening active GOVERNANCE retention, and reject caller-addressed ?versionId= overwrites while enforcing WORM checks under the object write lock for null-version overwrites.

silo-pkg 3.14.3 Released

Sun, 18 Oct 2026 07:29:13 +0800

Release: v3.14.3 · Source: e9d585ba1e7a. See the v3.14.2 release notes for the October dependency baseline.

github.com/pgsty/silo-pkg/v3 v3.14.3 reduces the cost of classifying admin: actions during IAM policy evaluation and is selected by Server 20261018.

AdminAction.IsValid and HasResource now perform exact map lookups before scanning the action sets: literal misses return immediately, and wildcard patterns whose prefix cannot match the admin: namespace skip the validation scan, while patterns such as adm* and a*d*m*i*n* retain their exact existing behavior.

PGSTY KES 20261018 Released

Sun, 18 Oct 2026 00:57:52 +0800

Release: RELEASE.2026-10-18T00-00-00Z · Package: 20261018000000.0.0 · Source: 2f7e741db905.

This is the first maintained PGSTY release of the Key Encryption Service (KES). KES is a standalone stateless service for SILO deployments that require external KMS-backed server-side encryption (see the component matrix).

Changes

Establish PGSTY maintenance and release pipelines while preserving upstream copyright, attribution, and third-party licenses. The executable and system packages remain kes, and the Go module path remains github.com/minio/kes.
Build with Go 1.27.2, refresh dependencies, and migrate the AWS Secrets Manager backend from the deprecated AWS SDK for Go v1 to AWS SDK for Go v2. Preserve YAML configuration fields, explicit credential precedence, custom endpoints, and stored key formats (continuing to ignore ~/.aws/config and SDK endpoint environment overrides).
Preserve the KES HTTP API, MINIO_KMS_KES_* configuration settings, existing root keys, and encrypted objects so existing SILO + KES deployments can upgrade in place without key migration.
Add upgrade, rollback, and restart integration suites pairing SILO with OpenBao KV v2 and the Moto Secrets Manager emulator, restarting SILO at each version transition so in-memory key caches cannot mask compatibility regressions.
Ship signed Git tags, GitHub build provenance attestations, GPG-signed RPMs, and non-root container images, with the built-in kes update self-updater disabled.

Deployment and upgrade

In a server-side encryption deployment, SILO encrypts object contents, KES authenticates mTLS client requests and wraps or unwraps data encryption keys (DEKs), and OpenBao persists the root key encryption keys (KEKs). Point MINIO_KMS_KES_ENDPOINT at KES, not OpenBao (see the KES and OpenBao design note for architecture boundaries and recovery requirements).

SILO Console 2.4.2 Released

Sat, 17 Oct 2026 20:49:49 +0800

Release: v2.4.2 · Source: ef2dd2c41d21.

Console v2.4.2 ships both as a standalone release and as the embedded Console in Server 20261018 (see also the silo-pkg v3.14.2 release notes).

Changes

Adopt mcli 20261018, silo-pkg v3.14.2, and upstream minio-go v7.4.1. The SDK cleans up failed multipart uploads after cancellation, formats retention timestamps in UTC, and preserves requested STS durations (parallel GET and ComposeObject remain opt-in).
Preserve wrapped S3 error codes during bucket-versioning operations so attempting to suspend versioning on an Object Lock bucket surfaces InvalidBucketState cleanly.
Build with Go 1.27.2 and Node 24.22.0 LTS. Refresh golang.org/x/* modules alongside compress v1.20.3, msgp v1.6.5, etcd v3.7.2, fwd v1.2.1, and cpuid v2.4.1 (retaining go-systemd v22.6.0 for NetBSD and tablewriter v0.0.5 for MC API compatibility).
Pin GoReleaser v2.18.3, golangci-lint v2.15.0, and govulncheck v1.9.0, rebuild embedded frontend assets as Console 2.4.2, and update pinned container build stages.

Integration

Because the retained module path has no /v2 suffix, Go consumers reference Console v2.4.2 via pseudo-version v0.0.0-20261017112417-ef2dd2c41d21. An embedding Server must declare both Console and MC replacements explicitly:

mcli 20261018 Released

Sat, 17 Oct 2026 19:06:00 +0800

Release: RELEASE.2026-10-18T00-00-00Z · Package: 20261018000000.0.0 · Source: fa3b8bf72458.

mcli 20261018 ships both as the standalone CLI client and as the coordinated client module in Server 20261018 and Console v2.4.2 (see also the silo-pkg v3.14.2 release notes).

Changes

Adopt silo-pkg v3.14.2 and upstream minio-go v7.4.1. The SDK cleans up failed multipart uploads after cancellation, formats retention timestamps in UTC, and preserves requested STS durations while retaining existing CopyObject embedded-error and checksum handling (parallel GET and ComposeObject remain opt-in).
Build with Go 1.27.2. Refresh golang.org/x/* modules, compress v1.20.3, msgp v1.6.5, and etcd clients v3.7.2 (with fwd v1.2.1 fixing reads that return bytes alongside an error as well as Skip offsets, and cpuid v2.4.1 fixing cache detection).
Pull in go-jose v4.1.6 (fixing excessive CPU usage on oversized RSA JWKs in GHSA-mgcc-cww5-fp2q) and LDAP v3.4.15 via silo-pkg.
Refresh pinned UBI 9 base images and release tooling: GoReleaser v2.18.3 (including log secret redaction and archive fixes), nFPM v2.48.0, golangci-lint v2.15.0, govulncheck v1.9.0, and gofumpt v0.12.0.

Upgrade

CLI commands, aliases, MC_* environment variables, and configuration formats are unchanged (retaining the go-systemd v22.6.0 replacement for NetBSD builds and tablewriter v0.0.5). See the component matrix for version pairings.

LIST Recovery: Confirm Only Uncertain Names and Bound the Waiting Cost

Sat, 17 Oct 2026 00:00:00 +0000

The #218 / #239 design keeps ordinary listings on their fast path, confirms eligible disagreements across pools, distinguishes confirmed deletion from drive or decode failures, covers existing writer lock domains, and bounds short-conflict lock waiting.

IAM Admin API Authorization Boundaries

Fri, 16 Oct 2026 00:00:00 +0000

Enforcing self-service policy decisions, preventing session credentials from escaping their restrictions, protecting root credentials, and preserving empty-policy and damaged-key cleanup behavior with a small handler-level repair.

silo-pkg 3.14.2 Released

Thu, 15 Oct 2026 21:32:32 +0800

Release: v3.14.2 · Source: c6835145176f.

github.com/pgsty/silo-pkg/v3 v3.14.2 provides the October dependency baseline for mcli 20261018 and Console v2.4.2; follow-up patch v3.14.3 adds an admin-action classification optimization used by Server 20261018.

Changes

Update upstream minio-go to v7.4.1: clean up failed multipart uploads even after caller context cancellation, serialize Object Lock retention timestamps in UTC, preserve requested STS durations, and support projected Kubernetes service-account token files (parallel GET and ComposeObject remain opt-in).
Update go-jose to v4.1.6: fix excessive CPU consumption when parsing oversized RSA JWKs (GHSA-mgcc-cww5-fp2q); update LDAP to v3.4.15, msgp to v1.6.5, and etcd clients to v3.7.2.
Refresh golang.org/x/*: x/crypto v0.58.0, x/net v0.61.0, x/sys v0.49.0, and x/text v0.43.0. Built and tested with Go 1.27.2 while retaining the go 1.26 module floor and the go-systemd v22.6.0 NetBSD replacement.

Compatibility and adoption

require github.com/pgsty/silo-pkg/v3 v3.14.2

Public package signatures and password-policy semantics are unchanged (see the password-permission migration guide when upgrading from before v3.14.0, and the component matrix for version pairings).

Clearing Stale Fields in Legacy Metadata and Scanner Responses

Thu, 15 Oct 2026 00:00:00 +0000

PR #233 fixes stale fields carried over when legacy xl.meta headers and namespace-scanner responses are reused. This note documents the triggers, observed behavior, targeted field resets, deterministic regression tests, distributed scanner verification, and operator guidance.

SILO 20261015: Superseded Draft Record

Thu, 15 Oct 2026 00:00:00 +0000

Status: Superseded by Server 20261018. RELEASE.2026-10-15T00-00-00Z was briefly published at 2026-10-15 13:52:28 (UTC+8), then reverted to Draft and superseded by Server 20261018, which includes the complete October repair and component stack. This page archives the candidate source scope and acceptance test results; use 20261018 for all deployments and upgrades.

Historical tag: RELEASE.2026-10-15T00-00-00Z
Package version: 20261015000000.0.0
Candidate source: 7a3ca0f82100cce06289a465f54139da2639f642 (full diff against Server 20260916)

Object Lock repairs

SN-2026-015 — Retention authorization (#234): every PutObjectRetention request requires s3:PutObjectRetention, evaluated with request-body Object Lock condition keys before reading object state. Shortening, clearing, or changing the mode of active GOVERNANCE retention additionally requires the explicit bypass header and s3:BypassGovernanceRetention (which does not override a Deny on s3:PutObjectRetention). Clearing retention evaluates remaining days as 0, and distant future dates no longer saturate duration arithmetic.
SN-2026-016 — Protected version writes (#235): caller-selected write versionId parameters require trusted replication credentials (s3:ReplicateObject). Directory null versions and persisted multipart targets are checked under the destination write lock before overwrite (including uploads initiated before upgrading or recovered from legacy staging state), enforcing active GOVERNANCE, COMPLIANCE, and legal-hold protections; unreadable lock metadata fails closed.
Release gate (#237): the release workflow runs the Object Lock race regression suite as a build prerequisite, covering slow-body directory overwrites, preflight read failures, legacy multipart completions against COMPLIANCE, and recovered-upload UUID collisions.

See the security advisory and repair design for full details.

Object Lock Retention Bypass and Version-Overwrite Repair Design (SN-2026-015 / SN-2026-016)

Wed, 14 Oct 2026 00:00:00 +0000

Report verification, Git provenance, entry and write-lock defense-in-depth design, fail-closed preflight hardening, and candidate trade-off evaluation for SN-2026-015 and SN-2026-016.

SN-2026-015 & SN-2026-016: S3 Object Lock Governance Retention Bypass and Version-Addressed Overwrites

Sat, 26 Sep 2026 00:00:00 +0000

SN-2026-015 and SN-2026-016 cover two S3 Object Lock retention and immutability vulnerabilities fixed in SILO Server 20261018 via PR #234 (14042b5aa) and PR #235 (0d3ba5d4c), as detailed in the companion repair design note. While the delete path already enforced s3:BypassGovernanceRetention (CVE-2023-25812), the retention-write path (PutObjectRetention) and four in-place version overwrite paths remained bypassable.

Advisory Scope: `SN-2026-015` and `SN-2026-016`

SN-2026-015: `PutObjectRetention` Authorization and Governance Bypass (`#231`)

In PutObjectRetentionHandler (cmd/object-handlers.go), three interacting flaws in enforceRetentionBypassForPut and isPutRetentionAllowed broke S3 Object Lock authorization:

Pinned TLS Parameters and Handshake Compatibility

Thu, 17 Sep 2026 00:00:00 +0000

Why Go 1.27 changed the TLS 1.3 ClientHello, how SILO’s inherited explicit curve list prevented GODEBUG=tlsmlkem=0 from taking effect, what the 20260916 repair covers, and the remediation options when a TLS-inspecting middlebox resets connections over new post-quantum identifiers.

SILO Console 2.4.1 Released

Wed, 16 Sep 2026 16:36:03 +0800

SILO Console v2.4.1 was released on September 16, 2026 from 1360e26d976d. It integrates pkg v3.14.1 and mcli 20260916, restricts the anonymous sharing proxy, streams multi-object ZIP downloads and adds signed, traceable release artifacts.

The fix for #52 restricts the anonymous proxy to object-content GET requests at the configured S3 origin. It rejects redirects, system paths and query-selected operations that are not object downloads. Public objects, presigned links and version-specific downloads continue to work. No new sharing-disable environment variable is needed.

silo-pkg 3.14.1 Released

Wed, 16 Sep 2026 12:16:06 +0800

v3.14.1 was published from fa657ef4. This is a dependency and tooling release of github.com/pgsty/silo-pkg/v3; the diff from v3.14.0 changes no package Go source or public API.

Dependency changes

JWX advances from v3.2.0 to v3.3.0. The vendor’s release notes identify GHSA-4cf7-xm37-g63h: custom JSON field names must be escaped during encoding. Reachability depends on accepting attacker-controlled custom claim names; this package’s env JWT path uses registered claim names.
Upstream minio-go advances to v7.3.1-0.20260915093545-32e1f32cb176, including minio-go #2306: recognize an S3 CopyObject error embedded in an HTTP 200 response instead of reporting a successful copy.
Testify advances to v1.12.1 and the lint configuration adopts gomodguard_v2. The Go 1.26 floor, Go 1.27.1 toolchain and go-systemd NetBSD replacement remain.

Component and migration boundary

The v3.14.0 password-policy change remains in force; this patch does not revert it. Preserve the paired admin:CreateUser / admin:ChangeMyPassword Deny where that was the intended restriction, using the migration guide.

A Listing Must Not Drop a Null Version That Still Has Quorum

Wed, 16 Sep 2026 00:00:00 +0000

A successful ListObjects omitted keys that existed and were readable. One cause is an order-sensitive version selection inherited from upstream healing tolerance; it is repaired in Server 20260916. A second, rolling-restart omission reproduced on the repaired build and was subsequently closed in Server 20261018.

Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

Wed, 16 Sep 2026 00:00:00 +0000

What the Go 1.27 toolchain upgrade changed at the TLS layer, how to diagnose OIDC discovery failures by connection phase, and which health endpoint reports an offline identity provider. Distilled from the investigation of issue #154 and verified with synthetic experiments.

Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for PR #196’s HTTP deadline repair (fix 055030ea5): the connection wrapper’s rolling deadline overwrote every absolute read-header deadline, and the –read-header-timeout flag was never wired into the server. Covers the two timeout classes, the configuration matrix, how HTTP/1, HTTP/2, and TLS behave across phases, and why the rejected alternatives would have killed long uploads.

Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for PR #194 (fix 4fcdf37ce): trusted replication COPY re-extracted raw request metadata through the permissive path, so transport-only aws-chunked encodings and GHSA-redacted user metadata came back into stored objects. Covers the expected encoding mappings, the Snowball behavior change, why upgrading does not repair existing objects, and the status of the stored-metadata remediation proposal.

Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

Wed, 16 Sep 2026 00:00:00 +0000

The decision record for the replicated-tag repairs merged as PR #193 and #196: SSE-KMS destination copies silently dropped tag revision timestamps, and an empty tag value had no representable revision, so a delayed replication event could resurrect deleted tags. Covers the tombstone semantics, the stored-wins tie change, the two-ended upgrade requirement, and the cost of extra metadata copies during resync.

SSE-C Replica Integrity

Wed, 16 Sep 2026 00:00:00 +0000

Raw ciphertext, logical multipart sizes, retransmission and compression exclusions form one replica contract.

Object Lock Replication Ordering

Wed, 16 Sep 2026 00:00:00 +0000

Retention, legal hold and their removals are independently ordered state across replica writes and pools.

Multi-Pool Object Consistency

Wed, 16 Sep 2026 00:00:00 +0000

Select one logical object under a shared lock before evaluating conditions or merging tags and Object Lock state.

Federated CopyObject: Preserve the Destination Contract

Wed, 16 Sep 2026 00:00:00 +0000

Shipped in Server 20260916 (PR #157, #159, #163, #177, #179), legacy etcd federated CopyObject forwards logical source bytes, preserves destination encryption defaults and Object Lock headers, validates full-object checksums, and returns the exact committed write identity.

Durable IAM Revocations

Wed, 16 Sep 2026 00:00:00 +0000

Persistent deletion revisions, signed parent boundaries, safe replay, coordinated upgrades and the limits of IAM recovery.

SILO 20260916 Release Notes

Wed, 16 Sep 2026 00:00:00 +0000

Version date: 2026-09-16 · Published: 2026-09-16 UTC (September 17 in China) · Tag: RELEASE.2026-09-16T00-00-00Z · Package version: 20260916000000.0.0. Use the download page for installation.

The source range runs from released commit 9b11dc9469e6 to released 2a4d51406b7e: 210 commits, including 140 non-merge commits. These notes describe the final behavior, including the listing-quorum, version-purge and migration-tag repairs after #214.

Highlights

Stronger request authentication: reject unsigned operation headers in ordinary and presigned SigV4, verify presigned body hashes, and use authenticated inputs for signature-age and payload-hash policies.
Durable IAM revocation: retain deletion revisions, parent revocation boundaries and membership grant times across delayed events, same-name recreation and restart/recovery.
One logical object across pools: coordinate conditional PUT, multipart completion, conditional DELETE, addressed-version deletion and metadata updates under consistent selection and locking rules.
Preserve tags during pool migration: rebalance and decommission retain tags, their original revision and ordered empty states for ordinary and multipart objects.
Correct encrypted and federated copies: preserve raw SSE-C replicas, plaintext part sizes, independently ordered lock/tag metadata, and the checksum, version and time of the actual destination write.
More reliable replication and configuration convergence: repair tag resurrection, marker purge/MRF recovery, resync counters/cancellation, and bucket metadata source timestamps and deletions.
Opt-in durable multipart discovery: add persistent scanning, global pagination and read-only preflight. Legacy remains the default; capacity and late-creation-write limitations remain explicit.
Updated administration stack: select Console 2.4.1, mcli 20260916 and pkg 3.14.1, including bounded browsing, streaming ZIPs, reliable failure exits and policy correctness fixes.
Two upgrade requirements need advance preparation: password permissions change the meaning of existing policies, and durable IAM revocation requires coordinated upgrades and complete backend backups.

Versions and components

Component	Server 20260903	Server 20260916
Server	`RELEASE.2026-09-03T13-18-01Z`	`RELEASE.2026-09-16T00-00-00Z`; inspected source `2a4d51406b7e`
Embedded Console	Source `464a59d73ada`, v2.3.0 identity	Released v2.4.1, source `1360e26d976d`
MC module / image-bundled mcli	20260903	Released 20260916, source `e952aa78f10a`
Shared package	`github.com/pgsty/silo-pkg/v3 v3.13.2`	v3.14.1, including the v3.13.3 and v3.14.0 changes
Upstream S3 SDK	`minio-go/v7`, revision `0e78d3f18efe`	`v7.3.1-0.20260915093545-32e1f32cb176`
Go / madmin-go	Go 1.27.1 / v3.0.110	Unchanged
Helm	7.0.2	Chart 7.0.3 in the tagged source; no separate chart package or Helm repository publication

The release explicitly replaces Console and MC with v0.0.0-20260916075814-1360e26d976d and v0.0.0-20260916070421-e952aa78f10a. Go does not inherit a dependency’s replacements. The shared package uses the PGSTY module path directly; Server, Console and MC retain their historical module identities and protocol names. minio-go/v7 continues to use a verified upstream revision.

September Security Repairs: Payload Integrity, IAM Revocation and Console Sharing

Wed, 16 Sep 2026 00:00:00 +0000

This bulletin covers three security repairs (SN-2026-012 through SN-2026-014) and adjacent dependency updates shipped in Server 20260916 and Console v2.4.1. See the security advisory ledger for the complete index.

Finding	Fixed source	Delivery status
`SN-2026-012`: presigned payload integrity	Server `c4b5e1cb4`, PR #177	Shipped in Server 20260916 (affected in `RELEASE.2026-09-03T13-18-01Z` and earlier)
`SN-2026-013`: durable IAM revocation	Server PR #191 / PR #192	Shipped in Server 20260916; requires coordinated multi-node/multi-site upgrade
`SN-2026-014`: anonymous Console share proxy	Console PR #56; Server PR #209	Shipped in standalone Console v2.4.1 and embedded in Server 20260916

Presigned payload integrity — SN-2026-012

The generic authenticated handler path could verify a presigned request using a payload digest supplied via the X-Amz-Content-Sha256 header without verifying the actual request body bytes against that digest. A caller holding a presigned write URL could therefore substitute a different request body (the regression suite reproduces this against presigned PutBucketPolicy).

mcli 20260916 Released

Wed, 16 Sep 2026 00:00:00 +0800

Release: RELEASE.2026-09-16T00-00-00Z · Package: 20260916000000.0.0 · Source: e952aa78f10a.

Changes since 20260913

Adopt silo-pkg v3.14.1, upstream minio-go v7.3.1-0.20260915093545-32e1f32cb176, and JWX v3.3.0. CopyObject retries and propagates S3 errors embedded in HTTP 200 responses, so a failed copy cannot authorize mv to delete its source. JWX correctly escapes JSON field names.
Report mirror permission failures, including unreadable sources, rejected writes and failed local destination removals. Later objects continue; a finite mirror with failures exits 1. These per-object permission errors do not require --skip-errors and do not restart an entire watch scan.
Preserve the existing cancellation/retry path for listing and watcher failures. Persistent listing permission denial can still cause repeated scans; this release does not redesign that retry policy.
Suppress normal final success statistics after a failed mirror. Explicit --summary retains statistics: JSON uses status: failure; text error diagnostics remain on stderr. Transfers completed within one clock tick no longer produce infinite JSON speeds.
Return failure for legalhold set/clear errors, partial recursive retention failures, and moves whose source deletion fails. mv waits for deletion results; successful copies are not rolled back. Retention reports each failed object once instead of duplicate or misleading diagnostics.
Reject empty retention durations and invalid find --regex expressions with normal CLI errors instead of panics.

Automation and upgrade notes

Affected failure paths that returned 0 now return 1. Check final exit status and error records. For mv, a deletion failure may leave both the source and the successfully copied destination; inspect both before retrying.

mcli 20260913 Released

Sun, 13 Sep 2026 09:47:11 +0800

Release: RELEASE.2026-09-13T00-00-00Z · Package: 20260913000000.0.0 · Source: 4f609a4d.

Changes since 20260903

Preserve historical destination versions under mirror --remove --watch.
Keep service-restart dry runs from executing a restart and make noninteractive behavior explicit.
Return failure for transfer and S3 Select errors, honor explicit checksums on empty uploads, and retain pipe JSON output when quiet mode is enabled.
Accept on/off boolean environment values and repair CLI/JSON behavior across supported platforms.
Adopt pkg v3.14.0 and upstream SDK v7.3.1-0.20260910142817-60bd07042d49, refresh Go x/* and UBI dependencies, and keep Go 1.27.1. NetBSD retains the go-systemd v22.6.0 portability pin.

The package retains the policy Deny/NotResource and bounded wildcard repairs from pkg v3.13.3. Correctly preserved denies may now reject requests that relied on lost clauses. Recover already-lost clauses from the original policy source.

silo-pkg 3.14.0 Released

Sun, 13 Sep 2026 08:55:28 +0800

v3.14.0 was published on 2026-09-13 from commit 827f8109 under the module path github.com/pgsty/silo-pkg/v3.

Password-policy migration

This release updates authorization semantics for self-service password changes:

Policy.IsAllowedActions now allows admin:ChangeMyPassword by default unless explicitly denied, while admin:CreateUser still requires an explicit Allow. On matching Server and Console builds, denying admin:CreateUser alone no longer blocks a caller from changing their own password; denying admin:ChangeMyPassword does.
The built-in readonly policy drops its previous admin:CreateUser Deny rule (so an explicit admin:CreateUser Allow granted by another attached policy can now take effect). The new consolereadonly policy adds bucket listing and uses the same permission split. Neither built-in policy grants user-management permissions on its own.
Existing custom policies and user-level policy overrides stored in the cluster are not rewritten automatically.

To keep the previous restriction that blocks both user administration and self-service password changes, include both admin:CreateUser and admin:ChangeMyPassword in the same Deny statement (preserving its original resource scope and conditions) before upgrading and throughout your rollback window—older Server builds do not enforce a standalone admin:ChangeMyPassword deny on this endpoint. See the full password-permission migration guide.

SN-2026-011: Fix and Release Status

Sun, 13 Sep 2026 00:00:00 +0000

SN-2026-011 was fixed on main starting with 123325430 on 2026-09-13 and shipped in Server 20260916. Server RELEASE.2026-09-03T13-18-01Z and earlier releases are affected (silo-pkg v3.14.0 and mcli 20260913 are client/library releases and do not patch existing Server deployments).

A holder of a signed PUT request could append an unsigned x-amz-copy-source header and turn the authorized upload into a server-side CopyObject of another object readable by the signing key. If the destination permits anonymous reads, the copied object’s contents become readable without holding the signing credentials. Both presigned URLs and Authorization-header requests were affected.

Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

Sat, 12 Sep 2026 00:00:00 +0000

The engineering and design record for SILO #77 (shipped in Server 20260916, PR #180): why source timestamps, deletion tombstones, and the whole-bucket metadata lock are all required; how six configuration types handle duplicates and reordering; why rollout requires a default-off switch; and which alternatives were rejected.

Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

Wed, 09 Sep 2026 00:00:00 +0000

The engineering record for SILO #153, #152, and #137: classify delete-marker purges accurately, expose drops from the bounded MRF queue, and bind resync cancellation to per-run contexts. Includes Round 2 on worker-side purge classification and persisted MRF marker recovery (PR #196), and Round 3 on exact-version purges, marker healing, and stale queued creations.

SigV4 Signed-Header Coverage: Rejecting Unsigned x-amz-* Headers

Wed, 09 Sep 2026 00:00:00 +0000

A presigned or signed PUT authorized for a single object could be turned into a server-side copy of any object the signing key can read, because SigV4 verification only walked the list of signed header names without checking the x-amz-* headers that actually arrived, while the router dispatches CopyObject from an unsigned x-amz-copy-source header. This record documents SILO’s unsigned-header rejection boundary, the payload-hash exemption and signature-age derivation, the PutObjectTagging injection reorder, scope across signature modes, and verification evidence.

SILO Console 2.4.0 Released

Tue, 08 Sep 2026 22:51:37 +0800

v2.4.0 was published on 2026-09-08 from c103d08e.

Released behavior

Object-browser directories load 100 entries per page by default, with choices of 50, 100, 250, 500 and 1000. Each page uses one S3 continuation-token request. Sorting, filtering and selection apply to the displayed page, not a complete directory scan; there is no unbounded “all” mode.
Version deletion stays bound to the selected object and directory deletion to its prefix. Lifecycle edits preserve independent actions and unexposed settings; replication rule deletion is saved consistently.
Transient network failures preserve sessions. Empty versioning state, malformed sidebar preferences and stale dropdown selections are handled.
Embedded Console restores loopback proxy behavior when Server explicitly enables the policy; standalone trust defaults remain unchanged.
Dependencies include pkg v3.13.3, MC source v0.0.0-20260908140805-c8aa5d25a63a, and upstream SDK 0e78d3f18efe. This release consumed MC as source and did not itself publish a new mcli tag.

Correctly preserved Deny/NotResource clauses may reject requests that relied on old deduplication defects. Restore already-lost clauses from the original policy source. Embedders must copy the MC replacement from the tagged README.

mcli 20260903 Released

Thu, 03 Sep 2026 15:39:20 +0800

Published: 2026-09-03 · Version: RELEASE.2026-09-03T07-13-05Z · Source: a2ef95c0

Twenty-eight days after mcli 20260806, this release carries everything the client accumulated since. The toolchain moves to Go 1.27.1 and the shared dependency stack is aligned with the SILO family, with silo-pkg imported under its own module path so go.mod says what the binary is built from. The first genuinely new command since the fork arrives — mcli checksum verify, a read-only audit of stored S3 additional checksums against the bytes an endpoint actually returns. The panic that made --json admin prometheus metrics unusable is fixed, as is the response double-close that could panic after mcli sql had printed valid rows. Every path that can print a credential — --debug traces, admin trace, error messages, JSON error documents, checksum reports — was rewritten fail-closed. The release process changed as much as the code: artifacts come from a GPG-signed tag at the exact tip of main with green CI for that commit, ship LICENSE, NOTICE, and a generated CREDITS in every format, carry Sigstore build provenance, and land in an immutable GitHub release.

Silo 20260903 Released

Thu, 03 Sep 2026 00:00:00 +0000

Version date: 2026-09-03 · Published: 2026-09-04 · Version: RELEASE.2026-09-03T13-18-01Z · Previous release: RELEASE.2026-08-06T00-00-00Z

SILO 20260903 is the security and correctness release following the first fully rebranded Silo release. It tightens core server invariants: client headers do not create replication authority, browser origins cannot trigger bucket-metadata I/O before authentication, concurrent bucket-configuration writers cannot silently overwrite one another, and authorization and checksum behavior more closely match AWS S3.

This note consolidates the complete server, Console, shared-package, and client baseline delivered on 2026-09-03 relative to 20260806. Later fixes—including SN-2026-011—shipped in SILO 20260916, SILO 20261015, and SILO 20261018.

SILO Server 20260903 Pre-release Review

Thu, 03 Sep 2026 00:00:00 +0000

The pre-release engineering review of every server change after 20260806: confirmed defects, fixes, complexity tradeoffs, validation evidence, explicit deferrals, and release gates. Includes the #116 restart-and-readback verification method.

SILO 20260903 Security Notes: SN-2026-006 through 010

Thu, 03 Sep 2026 00:00:00 +0000

This bulletin covers five security findings fixed in SILO Server 20260903 (RELEASE.2026-09-03T13-18-01Z), spanning customer-provided encryption keys (SSE-C), client-supplied replication headers, administrative status transitions, and explicit object-version deletion. SN-2026-006 through SN-2026-010 are SILO security-note identifiers grouping the pre-release audit findings inherited from the upstream minio/minio codebase.

Summary

ID	Required attacker position	Security failure	Released behavior
`SN-2026-006`	Read access to a zero-byte SSE-C object	A wrong customer key was accepted because no data block was decrypted	The object key is authenticated; wrong keys return `403 AccessDenied`
`SN-2026-007`	Read access to an SSE-C object, or a client-supplied replication marker	`GetObjectAttributes` returned protected metadata without authenticating the customer key	Ordinary requests need the correct key; only an authorized replication peer uses the replica exception
`SN-2026-008`	Any authenticated principal able to invoke the affected read/write/delete operation	Internal-looking headers granted replication-only effects without replication authorization	Exact marker plus `s3:ReplicateObject` or `s3:ReplicateDelete` is required
`SN-2026-009`	Authenticated admin API principal holding only one status action	The enable action authorized disable, and vice versa	The requested target state selects the required admin action
`SN-2026-010`	Authenticated S3 principal with `s3:DeleteObject` but not `s3:DeleteObjectVersion`	A caller could permanently delete an explicit version without the AWS-required action	Explicit version deletion requires `s3:DeleteObjectVersion`

SN-2026-006: zero-byte SSE-C key authentication

Affected operations: GetObject, HeadObject, CopyObject source processing, and GetObjectAttributes for zero-byte objects encrypted with SSE-C.
Tracking: issue #82.
Fixes: b73581b05 and c4fd97d0b.

Explicit Version Deletes Now Require DeleteObjectVersion

Wed, 02 Sep 2026 00:00:00 +0800

Starting in Server 20260903 (pgsty/silo#104, tracking issue #58), SILO maps object-delete authorization to the operation the request actually performs:

Request	Required action
No `versionId`	`s3:DeleteObject`
Version UUID	`s3:DeleteObjectVersion`
Explicit `versionId=null`	`s3:DeleteObjectVersion`
`DeleteObjects`	Applied independently to each XML entry

Previously, SILO required s3:DeleteObject for every delete operation and evaluated s3:DeleteObjectVersion only as an explicit-deny check. A principal holding only DeleteObject could permanently remove a specific historical version, whereas a least-privilege purge principal holding only DeleteObjectVersion was denied.

No I/O Before Auth, No Privilege From Headers

Tue, 01 Sep 2026 00:00:00 +0000

A pre-authentication CORS lookup turned arbitrary URL path segments into metadata I/O and cache entries, while a client-controlled replication marker acquired privileges across SSE-C reads, source timestamps, checksums, Object Lock, events, and deletes. This note defines SILO’s resident-only CORS hot path, two-level replication trust model, and post-signature sanitization boundary.

ListMultipartUploads Behavior and Design Trade-Offs

Sun, 30 Aug 2026 00:00:00 +0000

Why public ListMultipartUploads returned to MinIO-compatible behavior in Server 20261018, what on-disk scanning cost on 16-drive erasure sets, and which multipart repairs were kept.

silo-pkg 3.13.0 Released

Sun, 30 Aug 2026 00:00:00 +0000

Release date: 2026-08-30 · Version: v3.13.0 · Commit: 215f116 · Repository: pgsty/silo-pkg

Version 3.13.0 is a breaking release: the module adopts github.com/pgsty/silo-pkg/v3 as its own import path and retires the pgsty/silo-go fork in favour of upstream minio-go. All maintained SILO components (silo, silo-console, and mcli) migrated to this module path in the 2026-09-03 / v2.4.0 release wave; see the component matrix.

Release at a Glance

Published: the silo-pkg v3.13.0 tag and GitHub Release, declaring module github.com/pgsty/silo-pkg/v3.
Retired: the github.com/minio/pkg/v3 module identity and the replace directive every consumer had to repeat.
Retired: the github.com/pgsty/silo-go/v7 fork; this release requires upstream minio-go directly.
Unchanged: every package, symbol, and behaviour. Only the path they are imported from moved.
Downstream adoption: completed across SILO 20260903, Console v2.4.0, and mcli 20260903.

Why the Path Moved

The fork kept upstream’s github.com/minio/pkg/v3 path so it stayed a drop-in replacement, selectable with one replace directive. Go does not inherit replace directives from dependency modules, and three costs came due while preparing the next SILO server release.

Read-Only Checksum Audit and Reliable CLI Output

Sat, 29 Aug 2026 00:00:00 +0000

MCLI can audit stored S3 checksums against logical object bytes without mutating data. Shipped in mcli 20260903 (PR #8, PR #13, #5), this record defines candidate selection, classification, report and exit semantics, and the non-TTY output contract required by pipelines and CI.

Two SSE-C Keys, One CopyObject Response

Fri, 28 Aug 2026 00:00:00 +0000

CopyObject can carry one SSE-C key for the source and another for the destination. SILO stored the destination checksum under the destination key but tried to decrypt it for the response with the source key, silently omitting checksum fields.

Config Environment Files Are Not Shell Scripts

Fri, 28 Aug 2026 00:00:00 +0000

MINIO_CONFIG_ENV_FILE is parsed directly by SILO, not sourced by a shell. A shell-identifier check rejected valid named configuration targets such as my-hook. This note defines the key grammar, whitespace and quoting rules, failure behavior, and the #65 restart trap.

BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

Thu, 27 Aug 2026 00:00:00 +0000

CompleteMultipartUpload validates stored checksum types and returns operation-specific S3 error codes. CRC64NVME plus COMPOSITE is rejected in Server 20260903, and streaming-checksum validation shipped in Server 20260916.

A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

Wed, 26 Aug 2026 00:00:00 +0000

Three ListObjects shortcuts return EOF before touching storage, causing a missing bucket to appear as an empty listing. This record explains the SILO #32 / PR #37 regression, S3 compatibility value, minimal shortcut-only existence check, cluster fan-out cost, derived risks, and acceptance decision.

One Endpoint, Two Privileges: Separating User and Group Status

Wed, 26 Aug 2026 00:00:00 +0000

Shared user and group status endpoints historically checked their Enable action even for disable requests. This record explains the least-privilege defect, SILO’s strict target-state authorization design, the user repair merged through PR #73, the group follow-up, four-way IAM tests, and migration guidance.

Conditional DELETE: One Condition, One Logical Object

Wed, 26 Aug 2026 00:00:00 +0000

Single-object If-Match DELETE evaluates the addressed version once under the outer multi-pool lock before mutating storage. Batch DeleteObjects ETags, extra GetObject checks, and recursive prefix guards remain outside this contract.

Silo Console 2.2.0 Release Notes

Wed, 26 Aug 2026 00:00:00 +0000

Published: 2026-08-26 · Version: v2.2.0 (7dc4258a6) · Repository: pgsty/silo-console

SILO Console 2.2.0 adds a bounded text preview for logs and structured text, tightens download error handling so truncated archives cannot pass as complete, fixes table-action permission gating, splits user status updates from group membership edits, and validates database notification DSNs and IAM policy documents before writing them to the server.

Underneath, the dependency stack moves to Go 1.27.0 and onto the maintained SILO packages: pgsty/silo-pkg 3.12.1 replaces upstream minio/pkg, pgsty/mc replaces upstream mc as a library, minio-go moves to 7.3.0, and the etcd client line moves to 3.7.1, closing CVE-2026-73500.

Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

Tue, 25 Aug 2026 00:00:00 +0000

CompleteMultipartUpload now returns the stored ChecksumType in its XML response body. Included in Server 20260903 alongside UploadPart and completion validation repairs.

Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

Mon, 24 Aug 2026 00:00:00 +0000

SILO required every part in a checksum-enabled multipart upload to carry a per-part checksum. That rejected ordinary UploadPart requests that omitted an optional header and made UploadPartCopy unusable. This record covers discovery, AWS and AIStor research, rejected designs, the one-pass plaintext solution, the compatibility-baseline blocker, design review, and the consistency contract for follow-up repairs.

silo-pkg 3.12.0 Released

Mon, 24 Aug 2026 00:00:00 +0000

Release date: 2026-08-24 · Version: v3.12.0 · Commit: 2b087a1 · Repository: pgsty/silo-pkg

Version 3.12.0 is a main-line minor release with two themes: a policy-write guard for ARN prefixes that name no resource, and the maintained Go 1.27 / etcd 3.7 dependency baseline. It adds two exported inspection/validation methods, raises the verified consumer floor to Go 1.26, and is the first silo-pkg release whose strict validation path is enabled by the SILO server (eee05a17c, SN-2026-005, shipped in SILO 20260903) for named-policy and service-account policy writes.

When the Total Is Unknown: Folder Download Progress

Sun, 23 Aug 2026 00:00:00 +0000

Design for replacing NaN% with truthful indeterminate progress when SILO Console downloads a streamed folder ZIP, without changing the server API or ordinary file downloads.

Preview Text, Never Execute It: SILO Console Text Preview Design

Sun, 23 Aug 2026 00:00:00 +0000

Design for previewing small log, text, JSON, and XML objects in SILO Console as bounded, strict UTF-8 text—never as a same-origin executable document.

DSN-Only Database Notifications: A Compatibility Boundary for #53

Sun, 23 Aug 2026 00:00:00 +0000

SILO retains PostgreSQL and MySQL notification targets while standardizing their configuration on complete connection strings. Pre-KV discrete database fields are an unsupported migration input and abort server startup with an explicit error instead of silently disabling every bucket notification.

Silo 20260806 Released

Thu, 06 Aug 2026 00:00:00 +0000

Version: RELEASE.2026-08-06T00-00-00Z · Commit: 3be10fcc1a44f6620ded0bd303461f9d688cca23

SILO 20260806 is the first release published under the Silo name. The previous release, 20260804, was the last one delivered as pgsty/minio; this release completes the cutover to github.com/pgsty/silo and renames every delivery surface — binary, packages, container images, systemd unit, Helm chart — while deliberately preserving every wire and configuration surface a MinIO deployment depends on. On top of the rename it adds native health checking (silo healthcheck), a single-binary distroless container image pilot, complete license-compliance materials in every artifact, and a release pipeline gated on compatibility snapshots and build provenance.

mcli 20260806 Released

Thu, 06 Aug 2026 00:00:00 +0000

Published: 2026-08-06 · Version: RELEASE.2026-08-06T00-00-00Z

Two days after mcli 20260804, this release completes the client’s transition to the Silo identity. It is deliberately a pure rebranding and lockdown release: --version and --help now present the Silo client, every remaining path to MinIO’s SUBNET service is disabled at build time, the embedded vendor encryption key is removed from the diagnostics tooling, and the contribution policy moves to no-CLA with a mandatory DCO sign-off. There are no dependency changes and no protocol changes in this cycle — go.mod is byte-for-byte identical to 20260804 — so the regression surface is confined to text, command gating, and CI.

Silo Console 2.1.0 Released

Thu, 06 Aug 2026 00:00:00 +0000

Published: 2026-08-06 · Version: v2.1.0 · Repository: pgsty/silo-console

SILO Console 2.1.0 is the first feature release after the independent 2.0.0. It delivers three main changes:

Bilingual interface — every console screen, help topic, and documentation link now renders in English or Chinese behind a toggle on every page, with zero new runtime dependencies;
Metrics V3 dashboard — the dashboard moves from MinIO Metrics V2 names onto V3, with explicit handling for the semantics V3 changed underneath it;
Edge-case correctness fixes — a select-all that matches what a bulk action will delete, placeholders that handle object names containing $&, timestamps with an explicit timezone, and empty metrics that display “no data” rather than a fabricated 0.

This is a minor release. No environment variable, module path, API contract, binary name, or data layout changes. Upgrading is a binary or image swap.

Silo 20260804 Released

Wed, 05 Aug 2026 00:00:00 +0000

Version: RELEASE.2026-08-04T00-00-00Z · Commit: d88f46ccee345a9c2fabe2d221d9a9e56bc11aec

SILO 20260804 is a security, correctness, and release-engineering update to the pgsty/minio community fork. It completes the internode storage-containment work begun with CVE-2026-42600, prevents request-controlled values from impersonating server-calculated S3/IAM policy conditions, restores streaming flush behavior, fixes several multipart and versioning edge cases, hardens notification configuration migration, moves the build baseline to Go 1.26.5, and connects the server to the SILO-maintained Console, shared package, and mcli releases. The release pipeline was rebuilt to produce reproducible binaries and GPG-signed packages.

SN-2026-019: Notification Keyspace Registration and Validation Redaction

Tue, 04 Aug 2026 00:00:00 +0000

SN-2026-019 covers a class of notification configuration defects fixed in Server 20260804 (162ded343 and 672c07a0f, pgsty/silo#39): notification parser and legacy-migration paths read or wrote KVS configuration keys that were missing from Default*KVS, while CheckValidKeys echoed raw key values in validation errors and FetchEnabledTargets aborted all active notification targets on the first validation failure. In Server 20260903 (f1ba68358), the discrete PostgreSQL and MySQL host/credential keys uncovered by our AST audit were retired in favor of connection_string and dsn_string.

SN-2026-018: Client Source Address Trust, Forwarded Headers, and aws:SourceIp

Tue, 04 Aug 2026 00:00:00 +0000

SN-2026-018 addresses client source-IP spoofing across aws:SourceIp IAM conditions, audit logs, bucket notification events, and admin HTTP traces in silo-pkg v3.12.0 (62f326d) and Server 20260804 (00a8171cb, pgsty/silo#41): handlers.GetSourceIP previously trusted X-Forwarded-For, X-Real-IP, and RFC 7239 Forwarded from any TCP peer by default, and setting _MINIO_API_XFF_HEADER=off only disabled X-Forwarded-For while continuing to trust client-supplied X-Real-IP and Forwarded headers.

Conclusions first

_MINIO_API_XFF_HEADER=off left two headers wide open: Setting _MINIO_API_XFF_HEADER=off skipped X-Forwarded-For, but handlers.GetSourceIP immediately fell through to X-Real-IP and Forwarded. Any direct client could forge X-Real-IP: 10.0.0.1 to satisfy aws:SourceIp policies.
“Put a reverse proxy in front” is often insufficient: Even behind an ingress proxy, if the proxy appends to X-Forwarded-For (proxy_add_x_forwarded_for) while the server reads the left-most IP, or if internal pods can reach the server’s ClusterIP directly, an attacker can still spoof aws:SourceIp.
MINIO_API_TRUSTED_PROXIES provides explicit right-to-left chain verification: Server 20260804 introduces MINIO_API_TRUSTED_PROXIES (off / none, CIDR/IP list, or all / * for legacy behavior) and walks X-Forwarded-For / Forwarded from right to left, stopping at the first hop not in the trusted proxy set.

Every Consumer of `handlers.GetSourceIP`

In SILO, handlers.GetSourceIP(r) (silo-pkg/handlers/proxy.go) is the single function responsible for extracting the client IP address from an incoming *http.Request. Four security- and observability-sensitive subsystems depend on its return value:

SN-2026-004: Object-Scoped Policy Grants Reaching Bucket Mutations

Tue, 04 Aug 2026 00:00:00 +0000

SN-2026-004 fixes an IAM resource-matching flaw in silo-pkg v3.11.0 (3c24ad1, 1f97549, d8b1fa7) and Server 20260804 (97b7d2804; upstream reference minio/minio#20449): when evaluating bucket-level S3 requests (args.ObjectName == ""), Statement.IsAllowed synthesized "bucket/" as the target resource string, allowing object-scoped wildcard grants such as Allow s3:* on arn:aws:s3:::bucket/* to authorize sensitive bucket-level mutations including s3:PutBucketPolicy and s3:DeleteBucket.

Conclusions first

Root cause: When args.ObjectName was empty, Statement.IsAllowed appended '/' to the bucket name ("bucket/"), which matched the glob "arn:aws:s3:::bucket/*".
Privilege escalation: A tenant principal given Allow s3:* on arn:aws:s3:::tenant/* (a common shorthand for “all object operations inside this bucket”) could call PutBucketPolicy to grant Principal: "*" on the bucket, or call DeleteBucket, PutReplicationConfiguration, PutBucketLifecycle, PutBucketVersioning, or PutBucketObjectLockConfiguration.
Why a targeted fix was required: Simply dropping the trailing '/' for all empty-object checks broke 11 existing STS ListBucket tests and weakened Deny s3:* on arn:aws:s3:::bucket/* policies.
Targeted boundary: For the 12 sensitive bucket-mutation actions on Allow statements (!legacyBucketResourceMatch && statement.Effect == Allow && isSensitiveBucketMutation(args.Action)), the resource pattern must match both "bucket" and "bucket/". Setting MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on restores pre-20260804 matching if a deployment temporarily relies on legacy policies.

Why `arn:aws:s3:::bucket/*` Matched Bucket Requests

In silo-pkg/bucket/policy/statement.go (and iam/policy/statement.go), Statement.IsAllowed(args Args) constructed the resource string to test against Statement.Resources as follows:

SN-2026-003: s3:versionid Condition Evaluation and Request Condition Hardening

Tue, 04 Aug 2026 00:00:00 +0000

SN-2026-003 and SN-2026-005 cover a set of S3 IAM policy evaluation fixes shipped in Server 20260804 (80c2c9d03, 2f55347f7, eee05a17c, and silo-pkg v3.12.0 commit 2b087a1; pgsty/silo#40, pgsty/silo#53):

SN-2026-003 (80c2c9d03): getConditionValues populated args.ConditionValues["versionid"] = []string{""} even when a request carried no versionId, causing IAM Null conditions on s3:versionid to evaluate as if the key were always present; fixing that alone would have opened a DeleteObjects XML <VersionId> bypass without per-entry rebinding in authorizeRequestWithTags.
Condition-source isolation (2f55347f7): Separated query parameters, HTTP headers, internal server keys, and s3:ExistingObjectTag/<key> vs. s3:RequestObjectTag/<key> so untrusted query strings or headers cannot spoof internal condition keys.
SN-2026-005 (2b087a1 / eee05a17c): Added ParseConfigStrict to reject degenerate bare resource prefixes ("arn:aws:s3:::" and "*arn:aws:s3:::") when writing IAM and bucket policies.

Conclusions first

Unconditional empty slice inverted Null checks: In silo-pkg, nullFunc.evaluate tests whether a condition key is absent by checking len(rvalues) == 0. Because getConditionValues unconditionally assigned args.ConditionValues["versionid"] = []string{vid} (producing []string{""} when vid == ""), len(rvalues) was always 1—making Null: {"s3:versionid": "true"} always false and Null: {"s3:versionid": "false"} always true.
Fixing getConditionValues alone breaks DeleteObjects: In multi-object DeleteObjects (POST /?delete), the target <VersionId> is inside each XML <Object> element, not in the URL query string. If getConditionValues simply omits "versionid" when the URL query has no versionId, a policy denying versioned deletes (Deny s3:DeleteObjectVersion or Condition: {"Null": {"s3:versionid": "false"}}) would fail to match DeleteObjects XML entries unless authorizeRequestWithTags rebinds ConditionValues["versionid"] from ReqInfo.VersionID.
Whitespace trimming closes a Deny bypass: Version-reading handlers called strings.TrimSpace(r.URL.Query().Get("versionId")), whereas getConditionValues did not trim whitespace. A request with ?versionId=V%20 bypassed Deny StringEquals {"s3:versionid": "V"} while still deleting or reading version V.

Why `Null` on `s3:versionid` Was Inverted

In silo-pkg/bucket/policy/condition/nullfunc.go, the IAM Null condition operator checks whether a condition key is missing from the request context:

mcli 20260804 Released

Tue, 04 Aug 2026 00:00:00 +0000

Published: 2026-08-04 · Version: RELEASE.2026-08-04T00-00-00Z

This is the first release of the pgsty/mc community fork since 20260417. It fixes a credential leak in debug logging, severs every remaining connection between the client and upstream release channels, moves containers and packages onto artifacts this fork builds itself, and migrates packaging from MinIO’s pkger to standard nFPM — with GPG-signed RPMs for the first time.

Upstream minio/mc was archived in July 2026. Its final commit, 77f82e18, is exactly this fork’s base, and upstream never cut a release containing it — so this build is strictly newer than any official mc binary ever published.

Silo Pkg 3.11.0 Released

Tue, 04 Aug 2026 00:00:00 +0000

Release date: 2026-08-04 · Version: v3.11.0 · Commit: d8b1fa7 · Repository: pgsty/silo-pkg

This is the fork’s first pinned release. It restores the IAM bucket/object resource boundary reported as upstream minio/minio#20449: a policy condition-key bypass fix, three LDAP connection defects, a certificate watcher leak, a seeded-RNG defect, and the module’s real minimum Go version.

Warning

Two things to check before upgrading

This release tightens authorization. Twelve bucket-level write actions are no longer reachable through an object-only resource pattern such as arn:aws:s3:::bucket/*. If you write your own bucket-scoped policies, read The IAM bucket/object boundary — the fix is one line of policy for anyone affected, and MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on restores the previous behaviour in full.
Pair with the server condition-key update. The policy lookup change and the server changes that reserve internal condition-key names each cover one half of the condition-key fix. The companion server work (2f55347f7) ships in SILO 20260804.

What This Repository Is

silo-pkg is a maintained fork of minio/pkg, carrying fixes needed by community MinIO forks that the now commercially driven upstream no longer accepts. The repository was renamed from pgsty/minio-pkg on 2026-08-02.

Silo Console 2.0.0 Released

Tue, 04 Aug 2026 00:00:00 +0000

Published: 2026-08-04 · Version: v2.0.0 · Repository: pgsty/silo-console

SILO Console 2.0.0 is the first major release of this object-storage administration console as an independent project. Continuing from the georgmangold/console v1.9.1 maintenance line, it accomplishes three things:

An independent identity — product name, visual system, documentation entry points, source attribution, and the release pipeline all move into the SILO project, while the Go module path, environment variables, and other compatibility contracts are deliberately retained;
A redesigned interface — the login page, theme system, dashboard, and console details are reworked under one design language, backed by a regenerated brand icon set;
Hardened engineering — the embedded frontend payload shrinks from roughly 10MB to 3.5MB, known dependency vulnerabilities drop to zero, and a batch of inherited defects — including a runtime data race — is fixed.

Warning

Read the compatibility boundary before upgrading

Version 2.0.0 updates public identity and delivery contracts while keeping the object data format and S3 protocol unchanged. Installation scripts that reference the old repository, binary name, or container image must be updated; existing integrations that use CONSOLE_MINIO_SERVER, CONSOLE_MINIO_REGION, github.com/minio/console, or the MinIO-compatible Admin API remain unchanged and must not be search-and-replaced.

Duplicate Part Numbers in CompleteMultipartUpload

Mon, 03 Aug 2026 00:00:00 +0000

In CompleteMultipartUpload, the S3 API requires part numbers in the completion XML to be strictly ascending. Up through Server 20260725, SILO enforced that invariant with sort.SliceIsSorted and a strict < comparator—which accepts non-decreasing sequences such as [1, 1] and duplicates the referenced part in the assembled object. Server 20260804 (pgsty/silo#49) replaces that check with an explicit adjacent-pair comparison (Parts[i-1].PartNumber >= Parts[i].PartNumber) and fixes an adjacent empty-part panic in ReadParts (2602177ef).

Conclusions first

The bug is real and small: CompleteMultipartUpload used sort.SliceIsSorted with <, which tests non-decreasing order (a[0] <= a[1] <= ...) rather than strictly increasing order (a[0] < a[1] < ...). Passing duplicate part numbers such as [1, 1] succeeded and duplicated the underlying part in the final object.
This is a data-integrity defect, not a CVE: Triggering it requires a caller who already holds s3:PutObject permission on the target key and a valid uploadId for an in-progress multipart upload. It does not cross tenant, bucket, or credential boundaries.
The fix stays at the HTTP handler boundary: cmd/object-handlers.go rejects Parts[i-1].PartNumber >= Parts[i].PartNumber with InvalidPartOrder (HTTP 400). Sparse part numbers ([1, 3], [5, 9], [3]) remain valid.

Why `sort.SliceIsSorted` Accepted Duplicates

In cmd/object-handlers.go, CompleteMultipartUploadHandler validated the parsed <CompleteMultipartUpload> part list with:

SN-2026-002: Internode Path Containment Audit — Paying Off What CVE-2026-42600 Left Owing

Sun, 02 Aug 2026 00:00:00 +0000

Status: Released in Server 20260804 (release notes)
Identifier: SN-2026-002 (Security Advisories)
Fix commits: ca7baa670, b6f70ab08, 80e8eaa42, 1af351a70, a36fd8fff
Affected scope: Distributed erasure deployments only; cluster-root / internode JWT required
Prerequisite reading: CVE-2026-42600 · ReadMultiple

Following the removal of /rmpl (ReadMultiple) in CVE-2026-42600, SN-2026-002 audits every remaining internode endpoint carrying filesystem paths inside msgpack request bodies or Grid RPC frames. This advisory records that audit across all four internode protocol surfaces, the twelve inherited defects it uncovered, and the four regressions we introduced and caught while building the fix.

Silo 20260618 Released

Thu, 18 Jun 2026 00:00:00 +0000

Published: 2026-06-18 · Version: RELEASE.2026-06-18T00-00-00Z

This release is a security and dependency-maintenance update for the pgsty/minio fork. It hardens LDAP STS throttling, completes S3 Select oversized-record enforcement, removes the obsolete ReadMultiple internode storage-REST API, upgrades the Go build baseline to 1.26.4, and refreshes Go module dependencies to pick up additional third-party security fixes.

Note

Note

Known issue: this release — like every earlier community release since RELEASE.2025-12-03T12-00-00Z — carries a silent streaming-flush regression inherited from upstream that breaks mc watch / bucket-notification listeners and S3 Select keep-alives. The fix (PR #34) shipped in SILO 20260804.

CVE-2026-42600: ReadMultiple Storage-REST Path Traversal

Fri, 12 Jun 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-06-18T00-00-00Z
Fix commit: 73ac524
GitHub advisory: GHSA-xh8f-g2qw-gcm7
Affected scope: Distributed erasure deployments only; cluster-root / internode JWT required

The internode storage-REST route /rmpl (ReadMultiple) decoded a msgpack request body carrying Bucket, Prefix, and Files, and joined those fields directly into filesystem paths without a drive-root containment check.

Our initial fix retained the endpoint and added preflight path validation. A subsequent call-chain audit then revealed that ReadMultiple had had zero production callers since September 2024. We therefore discarded the in-place validation patch and deleted the route, handler, client wrapper, StorageAPI method, and generated msgpack types (73ac524)—eliminating roughly a thousand lines of unused privileged RPC surface.

Silo 20260417 Released

Fri, 17 Apr 2026 00:00:00 +0000

Published: 2026-04-17 · Version: RELEASE.2026-04-17T00-00-00Z

This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the Snowball upload path, and multiple dependency- and Go toolchain-related security issues, while also incorporating the LDAP TLS regression fix and a cleanup of community-fork documentation.

Major Changes

Tighten the identity-authentication flow: OIDC / WebIdentity now accepts only asymmetrically signed ID Token values backed by the IdP JWKS; symmetrically signed tokens such as HS256 are no longer accepted. LDAP STS also now hides the distinction between unknown-user and bad-password failures to reduce username-enumeration risk.
Update LDAP STS rate limiting: limits now apply to both source IP and normalized username, and successful requests no longer consume quota incorrectly. By default MinIO now uses only the socket peer address as the source and no longer trusts X-Forwarded-For, X-Real-IP, or Forwarded; to rate-limit by real client IP, configure MINIO_IDENTITY_LDAP_STS_TRUSTED_PROXIES explicitly.
Make upload and write paths stricter: presigned query parameters can no longer be combined with unsigned-trailer PUT or multipart uploads. Snowball auto-extract now also performs full signature validation on the unsigned-trailer path and rejects anonymous or forged-signature requests.
Prevent replication metadata spoofing: internal X-Minio-Replication-* headers attached to ordinary PUT / COPY requests are now rejected or ignored, and only trusted replication flows may write the related internal metadata.
Clarify S3 Select error semantics: oversized CSV and line-delimited JSON records now return OverMaxRecordSize directly instead of the generic InternalError; clients or alerting rules that depend on the old error code should be adjusted.
Upgrade the runtime and dependency baseline: fix the regression where ldaps:// did not correctly apply TLS settings, replace minio/pkg/v3 with pgsty/minio-pkg/v3, and pin several critical dependencies that are prone to breaking changes. The release also upgrades go-jose, go.opentelemetry.io, and Go 1.26.2 to unify the build and release baseline.
Refresh documentation and security guidance: update SECURITY.md, VULNERABILITY_REPORT.md, docs/sts/ldap.md, and related documents, add a security advisory index, and switch upstream minio/minio references in the security guidance over to pgsty/minio.

Fixed CVEs

CVE-2026-34986: upgrade go-jose to v4.1.4 and fix known security issues in the JWT / JOSE dependency chain.
CVE-2026-39883: upgrade the go.opentelemetry.io dependency stack to fix the PATH-hijacking risk.
CVE-2026-33322: restore the strict JWKS-only OIDC JWT verification path to block keyring injection and algorithm-confusion risk.
CVE-2026-33419: systematically harden LDAP STS authentication, rate limiting, source-address identification, and accounting logic across four follow-up fixes.
CVE-2026-34204: reject injection of X-Minio-Replication-* metadata by untrusted requests to prevent objects from being written with invalid replication state.
CVE-2026-39414: reject oversized S3 Select records early to avoid continued buffering and parsing of abnormal inputs.
GHSA-hv4r-mvr4-25vw: close the unsigned-trailer query-auth bypass.
GHSA-9c4q-hq6p-c237: harden unsigned-trailer authentication and signature validation in Snowball auto-extract scenarios.
CVE-2026-32280, CVE-2026-32281, and CVE-2026-32283: upgrade Go to 1.26.2 and absorb the upstream toolchain and stdlib security fixes.

ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
68e0ba9: fix: upgrade go-jose to v4.1.4 to patch CVE-2026-34986
1869bd3: fix: CVE-2026-39883 upgrade go.opentelemetry.io
ff58df9: merge: PR #18 upgrade go-jose to v4.1.4 for CVE-2026-34986
e4fa063: merge: PR #19 upgrade go.opentelemetry.io for CVE-2026-39883
d24f449: fix: CVE-2026-33322 restore JWKS-only OIDC JWT verification
3b950f8: fix: CVE-2026-33419 harden LDAP STS auth
56fa63b: fix: CVE-2026-34204 reject untrusted replication metadata
3252d5b: fix: CVE-2026-39414 reject oversized S3 Select records
f444b6f37: fix: fake CVE-2026-40027 block unsigned-trailer query auth bypass
efb6e5b00: fix: fake CVE-2026-40028 harden snowball unsigned-trailer auth
db4c0fd: fix: CVE-2026-32280/CVE-2026-32281/CVE-2026-32283 upgrade Go to 1.26.2
18b712d: fix: CVE-2026-33419 preserve LDAP STS rate limits on success
9e10f6d: fix: CVE-2026-33419 harden LDAP STS rate-limit source IP
f441108: fix: CVE-2026-33419 tighten LDAP STS rate-limit accounting
f48dbe7: docs: refresh security guidance and fork references

MinIO Fork, Promise Kept

Fri, 17 Apr 2026 00:00:00 +0000

Two months after forking MinIO, pgsty/minio ships patches for four CVEs and related security issues. No new features — just working builds, a restored console, and timely security fixes.

CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Fix commit: f444b6f37
GitHub advisory: GHSA-hv4r-mvr4-25vw

Before f444b6f37, query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER upload while the handlers verified the request signature only when an HTTP Authorization header was present. An attacker who knew a valid access-key identifier could therefore complete an object or multipart write using a forged query-string signature.

The fix moves presigned-credential rejection and SigV4 verification directly into newUnsignedV4ChunkedReader() (cmd/streaming-v4-unsigned.go), ensuring every handler that consumes an unsigned-trailer chunked stream shares a single authentication boundary.

CVE-2026-40344: Snowball Auto-Extract Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Fix commit: efb6e5b00
GitHub advisory: GHSA-9c4q-hq6p-c237

Snowball’s PutObjectExtractHandler (X-Amz-Meta-Snowball-Auto-Extract: true) previously omitted the authTypeStreamingUnsignedTrailer authentication case. A tar archive sent with X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER and a forged signature could enter untar() before authentication completed, allowing a single unauthenticated request to fan out into multiple object writes.

Commit efb6e5b00 initializes newUnsignedV4ChunkedReader(), validates the decoded content length, and completes SigV4 verification before any tar byte reaches the extractor.

Why the commit subject used a temporary identifier

When the fix was committed on 2026-04-16, the official CVE number had not yet been published by GitHub Security Advisories, so the Git commit subject used the temporary placeholder fake CVE-2026-40028. Once GHSA-9c4q-hq6p-c237 was published, the official identifier was assigned as CVE-2026-40344. We kept the immutable Git commit SHA efb6e5b00 intact and mapped it to CVE-2026-40344 in the advisory ledger.

CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released; second-round fix completed in June
Initial fix release: RELEASE.2026-04-17T00-00-00Z
Complete fix release: RELEASE.2026-06-18T00-00-00Z
Fix commits: 3252d5b, 5dc705936 (fd69c89)
GitHub issue: pgsty/silo#25

Our initial April patch (3252d5b) reused the existing 1 MiB maxCharsPerRecord limit for both CSV and standard JSON Lines in S3 Select, stopping unbounded buffering while waiting for a record delimiter and returning the S3 OverMaxRecordSize error code to clients.

A follow-up call-chain audit in June uncovered a hardware-dependent gap: on x86_64 CPUs with AVX2/AVX-512 support where simdjson.SupportedCPU() returned true, JSON Lines took a separate simdjson fast path that bypassed the bounded json.PReader completely. The June fix (5dc705936 / fd69c89) routed JSON Lines through the bounded reader on every CPU architecture, while also correcting streaming error codes, parser error wrapping, and pre-error output queue flushing.

CVE-2026-34204: Replication Metadata Injection

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Fix commit: 56fa63b
GitHub issue: pgsty/silo#24

Before 56fa63b, ordinary PutObject and CopyObject requests could smuggle client-supplied X-Minio-Replication-* headers into internal X-Minio-Internal-* SSE and replication metadata. That mismatch between the stored metadata and the actual write path could leave the resulting object unreadable.

The fix stops accepting replication-only metadata in the default extraction path, restores those fields solely inside flows explicitly authorized for ReplicateObjectAction (s3:ReplicateObject), and sanitizes CopyObject request headers before any downstream header consumer runs.

CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released, followed by two rounds of hardening
First containing release: RELEASE.2026-04-17T00-00-00Z
Complete correction: RELEASE.2026-06-18T00-00-00Z
Fix commits: 3b950f8, 18b712d, 9e10f6d, f441108, 5e40665
GitHub issue: pgsty/silo#23

The original defect in AssumeRoleWithLDAPIdentity was straightforward: LDAP STS returned distinct errors for “user does not exist” and “password is wrong,” creating an unauthenticated username oracle. Our first patch unified the external authentication failure response and added rate-limit buckets keyed by both source IP and username.

Subsequent design reviews uncovered a deeper problem: naive success refunds, spoofable proxy headers, reservation accounting, and the shared username bucket itself turned the rate limiter into a targeted denial-of-service primitive. The final June design (5e40665) removed the shared username bucket that enabled cross-origin account lockouts, retained the per-source-IP bucket, and formalized proxy IP attribution as an explicit deployment contract.

CVE-2026-33322: OIDC JWT Algorithm Confusion

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants
Fix commit: d24f449
GitHub issue: pgsty/silo#22

The previous OIDC implementation in internal/config/identity/openid placed the relying-party client_secret into the JWT verification keyring while also accepting HMAC signing algorithms (HS256, HS384, HS512). An attacker who obtained that client_secret could therefore sign a forged ID token with HMAC and exchange it through STS (AssumeRoleWithWebIdentity or AssumeRoleWithClientGrants) for temporary S3 credentials.

The final fix (d24f449) enforces asymmetric, JWKS-only verification and deliberately drops HS256/HS384/HS512 token support rather than keeping a configuration toggle that would reintroduce ambiguous trust semantics.

CVE-2026-32285: The jsonparser Advisory That Required No Patch

Wed, 15 Apr 2026 00:00:00 +0000

Status: Closed without a code change
GitHub issue: pgsty/silo#26
Referenced upstream commit: c1a49490 (CVE-2025-62506)

The initial assessment of CVE-2026-32285 assumed that the repository might still carry a vulnerable version of github.com/buger/jsonparser, and the team briefly considered replacing the package or maintaining a local fork. Checking the advisory’s referenced upstream commit, the resolved Go module version, and actual symbol reachability changed the conclusion:

Public vulnerability feeds mislabeled CVE-2026-32285 as a jsonparser issue while pointing to upstream commit c1a49490, which is the session-policy privilege-escalation fix for CVE-2025-62506 already included in every SILO release since RELEASE.2025-12-03T12-00-00Z.
For github.com/buger/jsonparser itself, the repository already resolved v1.1.2, which contains the upstream jsonparser fixes, and govulncheck found no reachable vulnerable symbol.

Instead of manufacturing a cosmetic dependency bump, we recorded the verification evidence and closed pgsty/silo#26.

Silo 20260325 Released

Wed, 25 Mar 2026 00:00:00 +0000

Published: 2026-03-25 · Version: RELEASE.2026-03-25T00-00-00Z

This maintenance release bundles mcli/mc into the Docker image, fixes an LDAP TLS configuration regression on ldaps:// connections, and pins security-patched versions of key dependencies.

Major Changes

Bundle mcli (and its mc compatibility alias) into the Docker image with checksum verification so administrative CLI tools are available out of the box.
Fix the LDAP TLS regression affecting ldaps:// deployments so custom root CAs and MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY are properly honored.
Remove inherited upstream CI/CD workflows that are no longer used in the community fork.
Pin key dependencies to isolate upstream breaking changes and incorporate the security fixes below.

Fixed CVEs

CVE-2026-24051: Pin go.opentelemetry.io/otel/sdk v1.42.0 to address the macOS PATH-hijacking arbitrary code execution vulnerability.
CVE-2025-10543: Upgrade to github.com/eclipse/paho.mqtt.golang v1.5.1, fixing incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2025-58181: Upgrade to golang.org/x/crypto v0.49.0, fixing unbounded memory consumption in ssh GSSAPI authentication handling.

f2f9a40: add mcli/mc from pgsty/mc to Docker image
ce1c537: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
ee55e53: remove upstream CI/CD workflows inherited from minio/minio

Silo 20260321 Released

Sat, 21 Mar 2026 00:00:00 +0000

Published: 2026-03-21 · Version: RELEASE.2026-03-21T00-00-00Z

This maintenance release is built around the Go 1.26.1 upgrade and a broad dependency refresh. Beyond stricter compiler and linter compatibility fixes, it also delivers the most substantial security dependency refresh in the current release line.

Major Changes

Upgrade the build environment from Go 1.26.0 to Go 1.26.1.
Refresh direct and indirect dependencies to converge on the newer toolchain.
Fix linter and test issues exposed by the stricter Go 1.26.1 checks.

Fixed CVEs

CVE-2026-27137: Go stdlib 1.26.0 -> 1.26.1 fixes incomplete email-constraint enforcement in crypto/x509.
CVE-2026-27138: Go stdlib 1.26.0 -> 1.26.1 fixes a crypto/x509 panic triggered by malformed certificates.
CVE-2026-25679: Go stdlib 1.26.0 -> 1.26.1 fixes insufficient validation of IPv6 host literals in net/url.
CVE-2026-27139: Go stdlib 1.26.0 -> 1.26.1 fixes FileInfo metadata escaping the Root boundary in os.
CVE-2026-27142: Go stdlib 1.26.0 -> 1.26.1 fixes missing URL escaping in html/template for meta refresh content.
CVE-2026-26958: filippo.io/edwards25519 v1.1.0 -> v1.2.0 fixes incorrect or undefined MultiScalarMult behavior.
CVE-2025-10543: github.com/eclipse/paho.mqtt.golang v1.5.0 -> v1.5.1 fixes incorrect MQTT packet encoding for oversized UTF-8 strings.
CVE-2026-24051: go.opentelemetry.io/otel/sdk v1.38.0 -> v1.42.0 fixes the macOS PATH-hijacking arbitrary code execution issue.
CVE-2026-33186: google.golang.org/grpc v1.77.0 -> v1.79.3 fixes authorization bypass caused by a missing leading slash in the HTTP/2 :path pseudo-header.

5abd9a8: bump golang to 1.26.1 and update deps
377fc61: fix: satisfy stricter Go 1.26.1 linter checks

Silo 20260314 Released

Sat, 14 Mar 2026 00:00:00 +0000

Published: 2026-03-14 · Version: RELEASE.2026-03-14T12-00-00Z

This release switches the project to the community-maintained Console fork and performs a sizeable dependency refresh to establish the base for the later Go 1.26.x maintenance releases.

Major Changes

Switch to the community-maintained georgmangold/console v1.9.1 fork in place of the unmaintainable upstream Console dependency.
Refresh a large portion of the direct and indirect dependency graph so the new Console and toolchain combination builds cleanly.
Fix the go vet format directive issue in grid_test.go and adjust tests for the HTTP behavior changes in Go 1.26.

Fixed CVEs

CVE-2025-47913: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent when handling malformed responses.
CVE-2025-58181: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes unbounded memory consumption in ssh GSSAPI authentication parsing.
CVE-2025-47914: golang.org/x/crypto v0.37.0 -> v0.46.0 fixes a panic in ssh/agent caused by malformed identity messages.
CVE-2025-47911: golang.org/x/net v0.39.0 -> v0.48.0 fixes quadratic parsing complexity in html.Parse for crafted inputs.
CVE-2025-58190: golang.org/x/net v0.39.0 -> v0.48.0 fixes an infinite parsing loop in golang.org/x/net/html.

68521b3: add github ci/cd pipeline
00f3cf7: RELEASE.2026-03-14T12-00-00Z with go 1.26.0

Silo 20260214 Released

Sat, 14 Feb 2026 00:00:00 +0000

Published: 2026-02-14 · Version: RELEASE.2026-02-14T12-00-00Z

This early infrastructure-focused community release restores the embedded Console, introduces GitHub CI/CD, and lifts the Go baseline to 1.26.0, which also absorbs a batch of security fixes from the older toolchain generation.

Major Changes

Restore the embedded Console and refresh the README to clarify the community fork position.
Add GitHub CI/CD workflows as the base for automated builds and multi-platform delivery.
Add quick links for docs, Docker, the GitHub repository, and installation through the pig package manager.

Fixed CVEs

These issues were absorbed as part of the Go 1.25.5 -> 1.26.0 upgrade:

MinIO Is Dead, Long Live MinIO

Sat, 14 Feb 2026 00:00:00 +0000

MinIO’s repo is officially archived and abandoned. And how AI Agents helped bring it back from the dead. This post explains how a community fork restores the admin console and ships binaries via CI/CD pipeline.

Silo 20251203 Released

Mon, 15 Dec 2025 00:00:00 +0000

Published: 2025-12-15 · Version: RELEASE.2025-12-03T12-00-00Z

This is the earliest traceable community release, establishing the community packaging and distribution baseline.

Major Changes

Build the community packaging flow around minio/pkger.
Choose a maintenance-mode upstream MinIO baseline as the starting point for the community-maintained fork.
Produce the first apk, deb, and rpm artifacts for ongoing community releases.

Fixed CVEs

Initial community release baseline; no delta CVE list against an earlier community version applies.

d4cd4b4: RELEASE.2025-12-03T12-00-00Z with go 1.25.5

MinIO Is Dead. Which Next?

Mon, 08 Dec 2025 00:00:00 +0000

MinIO just entered maintenance mode. What replaces it? Can RustFS step in? I tested the contenders so you don’t have to.

MinIO is Dead

Thu, 04 Dec 2025 00:00:00 +0000

MinIO announces it is entering maintenance mode, the dragon-slayer has become the dragon – how MinIO transformed from an open-source S3 alternative to just another commercial software company

CVE-2025-62506: Session-Policy Privilege Escalation

Wed, 15 Oct 2025 00:00:00 +0000

Status: Inherited and released
First SILO community release: RELEASE.2025-12-03T12-00-00Z
Upstream fixed release: RELEASE.2025-10-15T17-29-55Z
GitHub advisory: GHSA-jjjj-jwhf-8rgr
Upstream fix: minio/minio#21642

A service account or STS account constrained by a restricted session policy could invoke an “own account” Admin API operation to create a child service account without the session-policy restriction. Because the policy check set DenyOnly = true for own-account operations, any session policy that lacked an explicit Deny rule allowed the call, and the newly created child service account inherited the broader permissions of the parent user.

PGSTY SILO Blog on SILO

Adding Multilingual Support to SILO

mcli 20261109: Data Safety and Automation Fixes

Removal, moves and downloads

SILO Console 2.7.0: Ten Languages, Usage Worker and Container Fixes

Fixes found before release

silo-pkg 3.16: JOSE Security and Configuration Fixes

Dependency updates

Native Restore in Two Phases

A Partial View Must Not Report an Existing Object as Missing

A Failed Multipart Completion Can Strand the Upload

SILO Console 2.6.0: Usage Scans and Safer Bucket Administration

Folder and bucket usage

Lock Domains of Large Single-Pool Clusters

Restored Copies: Expire the Copy, Not the Object

Failed Writes and Phantom Empty Prefixes

Multi-Pool Lifecycle Expiry: Decide on the Whole Object

Heal Dry Run Must Not Delete Data

Lifecycle Delete-All Must Stay on One Key

Bucket Quota in the Console: List Display and Numeric Validation

Audit Webhooks After a Peer Reload

ILM Expiry and Pool Migration Ordering

Tier Free Versions Are Internal Cleanup Records

Mixed EC Layouts and Migration Listing

Pool Migration Integrity Review: #261, #263, and #265

SILO at One Year: What Actually Changed Since Upstream MinIO?

silo-pkg 3.15: Go 1.27.3 and S3 SDK Fixes

3.15.0: Toolchain and shared dependencies

SILO Console 2.5: Interface and Administration Updates

Navigation, overview, and metrics

SILO 20261026: Server, mcli and KES

Multi-Pool Deletion: Preserve the Latest Copy on Failure

Overwrite Pool Affinity: Why #245 Was Not Adopted

FULL_OBJECT Checksum Replication: Preserve the Type at Upload Initiation

LDAP Long DNs: Restoring Login Without Hiding Revocation Errors

IAM Policy Reloads: Lock Scope, Cancellation, and Time Budgets

Alias regions: a small configuration change with compatibility boundaries

SILO 20261018 Release Notes

Object Lock and IAM security

SILO, KES and OpenBao: Key Ownership and Recovery

October Security Update: Object Lock, Admin Credentials and JWK Parsing

Object Lock: SN-2026-015 and SN-2026-016

silo-pkg 3.14.3 Released

PGSTY KES 20261018 Released

Changes

Deployment and upgrade

SILO Console 2.4.2 Released

Changes

Integration

mcli 20261018 Released

Changes

Upgrade

LIST Recovery: Confirm Only Uncertain Names and Bound the Waiting Cost

IAM Admin API Authorization Boundaries

silo-pkg 3.14.2 Released

Changes

Compatibility and adoption

Clearing Stale Fields in Legacy Metadata and Scanner Responses

SILO 20261015: Superseded Draft Record

Object Lock repairs

Object Lock Retention Bypass and Version-Overwrite Repair Design (SN-2026-015 / SN-2026-016)

SN-2026-015 & SN-2026-016: S3 Object Lock Governance Retention Bypass and Version-Addressed Overwrites

Advisory Scope: SN-2026-015 and SN-2026-016

SN-2026-015: PutObjectRetention Authorization and Governance Bypass (#231)

Pinned TLS Parameters and Handshake Compatibility

SILO Console 2.4.1 Released

Shared downloads

silo-pkg 3.14.1 Released

Dependency changes

Component and migration boundary

A Listing Must Not Drop a Null Version That Still Has Quorum

Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

SSE-C Replica Integrity

Object Lock Replication Ordering

Multi-Pool Object Consistency

Federated CopyObject: Preserve the Destination Contract

Durable IAM Revocations

Advisory Scope: `SN-2026-015` and `SN-2026-016`

SN-2026-015: `PutObjectRetention` Authorization and Governance Bypass (`#231`)

Every Consumer of `handlers.GetSourceIP`

Why `arn:aws:s3:::bucket/*` Matched Bucket Requests

Why `Null` on `s3:versionid` Was Inverted

Why `sort.SliceIsSorted` Accepted Duplicates