RELEASE.2026-10-18T00-00-00Z

PGSTY KES 20261018000000 is the first maintained PGSTY release of the Key Encryption Service for SILO.

Release tag: RELEASE.2026-10-18T00-00-00Z · Package version: 20261018000000.0.0 · Go: 1.27.2

What changed

• Establish PGSTY branding, distribution and maintenance while preserving MinIO's copyright, upstream attribution and third-party licenses. The executable and package remain kes.
• Refresh Go dependencies and migrate AWS Secrets Manager from AWS SDK for Go v1 to v2. Existing YAML fields, explicit credential precedence, configured endpoints and stored key formats remain compatible. KES continues to ignore ~/.aws/config and SDK endpoint environment overrides.
• Preserve the KES HTTP API, MINIO_KMS_KES_* configuration, existing root keys and encrypted objects. No SILO code change or key migration is required for an existing KES integration.
• Add upgrade, rollback and restart acceptance with released SILO servers against OpenBao KV v2 and the Moto Secrets Manager emulator. Each version transition restarts SILO to discard cached keys. Integration tests delete only the keys they create.
• Provide signed release tags, GitHub build attestations, signed RPMs, six platform archives and non-root Docker images. Disable kes update; upgrade with PGSTY artifacts, packages or images.

Downloads and containers

Format	Platforms
kes_20261018000000.0.0_<os>_<arch>.tar.gz	Linux, macOS, Windows; amd64 and arm64
RPM, DEB, APK	Linux; amd64 and arm64
docker.io/pgsty/kes:RELEASE.2026-10-18T00-00-00Z	Linux; amd64 and arm64

All downloads have SHA-256 checksums. Archives, their checksum manifest, DEBs and APKs have GitHub build attestations. RPM signatures use the PGSTY key with fingerprint 9592A7BC7A682E7333376E09E7935D8DB9BD8B20. Linux packages install /usr/local/bin/kes. Containers run as UID/GID 1000:1000.

docker run --rm pgsty/kes:RELEASE.2026-10-18T00-00-00Z --version

Configure TLS, application identities, access policies and a persistent key store before starting a service. Package installation does not create an unconfigured running service. Keep existing root keys and key-store backups, and verify decryption before and after upgrading. Development mode stores keys only in memory.

The maintained integration is SILO + PGSTY KES + OpenBao KV v2. The compatibility matrix covers SILO RELEASE.2026-09-03T13-18-01Z and RELEASE.2026-09-16T00-00-00Z, upstream KES 2025-03-12T09-35-18Z, and a PGSTY KES baseline using AWS SDK v1. Moto tests provide local protocol and storage compatibility coverage; live AWS IAM policies and service behavior have not been accepted in an AWS account. Compatibility with unmodified upstream MinIO is best effort; other inherited key-store backends are not certified by this matrix.

Installation and configuration · Artifact verification and release process · Source changes since upstream

中文说明

这是 PGSTY KES 的首个正式发行版，为 SILO 提供独立的密钥加密服务。采用与 SILO、mcli 一致的时间戳版本规则，保留 MinIO 原作者版权与第三方许可证，明确 PGSTY 的维护和分发渠道。

本版使用 Go 1.27.2，更新依赖，将 AWS Secrets Manager 后端迁移到 AWS SDK for Go v2。KES API、配置字段、环境变量和密钥存储格式保持兼容；已有 SILO/KES 部署无需改造 SILO、重命名密钥或重写加密对象。kes update 已禁用，请通过 PGSTY 制品、软件包或容器升级。

提供 Linux、macOS、Windows 的 amd64/arm64 压缩包，以及 Linux 两种架构的 RPM、DEB、APK。官方镜像为 docker.io/pgsty/kes，提供固定版本与 latest 标签。部署时建议固定 RELEASE.2026-10-18T00-00-00Z，并提前配置 TLS、身份、策略与持久密钥存储；容器默认以 1000:1000 运行。

验收覆盖 SILO 搭配 OpenBao KV v2，以及 Moto 模拟的 Secrets Manager，包含旧对象读取、新密钥与对象、升级、回滚、重启。每次切换都重启 SILO，避免密钥缓存掩盖问题。尚无真实 AWS 环境验收，不将模拟器结果视为真实云服务认证。升级前保留原有密钥并做好备份，升级后验证已有对象可解密。

中文安装说明

Verified release artifacts

All 11 CI checks passed on the tagged master commit 2f7e741db905d7ea755967b29666657d819d7ad0. The Release workflow completed successfully. Independent download verification passed for all 19 asset digests, six binary source/platform stamps, six package payloads, both RPM signatures and all 11 GitHub build attestations. The downloaded macOS ARM64 release binary also passed the SILO RELEASE.2026-09-16T00-00-00Z upgrade/rollback/restart fixtures with both OpenBao and Moto.

验收完成：待发布提交的 11 项 CI 检查全部通过；重新下载并核验了 19 个附件、六个平台二进制、六个软件包、两份 RPM 签名和 11 份构建证明。下载到的 macOS ARM64 正式程序也通过了 SILO 搭配 OpenBao、Moto 的升级、回滚与重启测试。

Published Docker image

Docker publication completed in GitHub Actions. The version tag and latest both resolve to:

docker.io/pgsty/kes@sha256:c2d1a63d15052dfd2854bec9db3fc6846dd74fd6fdf43079f338f36e7a3d5f04

Anonymous registry access and all six release/latest/architecture tags were verified. Both Linux architectures passed the CI runtime checks. The downloaded ARM64 image also passed TLS client authentication, OpenBao AppRole access, data-key generation/decryption, persistence across a KES restart, and rejection of unauthenticated requests. Its binary and attribution files match the release archive byte for byte.

Docker 镜像已正式发布，支持 Linux amd64/arm64。固定版本与 latest 指向上述同一摘要，六个标签均可匿名访问。公开 ARM64 镜像已验证非 root 运行、TLS 身份认证、OpenBao 持久密钥、加解密和重启读取；镜像内二进制及版权文件与发行压缩包逐字节一致。