RELEASE.2026-08-04T00-00-00Z

SILO 20260804 is a security, correctness, and release-engineering update to the pgsty/minio community fork. It completes the internode storage-containment work begun with CVE-2026-42600, stops request-controlled values from impersonating server-calculated S3/IAM policy conditions, restores streaming flush behavior, fixes several multipart and versioning edge cases, hardens notification configuration, moves the baseline to Go 1.26.5, and rebuilds the release pipeline to produce reproducible binaries and GPG-signed packages.

50 commits after the pre-2026-06-18 baseline (155 files, +9,241/-981). Reviewed against this tagged commit and verified on macOS ARM64 and Linux AMD64 with GitHub CI green on the released HEAD.

Full Release Notes

Highlights

• Internode containment completed — validates storage-REST bodies, storage Grid frames, and peer-S3 Grid requests at the storage boundary, closing the remaining path, volume, erasure-metadata, panic, and unbounded-allocation defects left after removing ReadMultiple.
• S3/IAM decisions use effective values — client input can no longer shadow internal condition values; request tags and existing-object tags are separated; s3:signatureAge is confined to verified presigned requests; s3:versionid follows the version the server actually acts on.
• Bucket and object resources separated — twelve sensitive bucket-level writes are no longer authorized through an object-only bucket/* pattern (documented compatibility switch available).
• Multipart correctness — full-object checksum completion works without per-part checksums where the protocol permits; zero-length checksums are preserved; duplicate part numbers are rejected instead of assembling duplicated data.
• Streaming reliability restored — trackingResponseWriter implements Flush correctly and records implicit HTTP 200, repairing mcli watch, bucket-notification listeners, and S3 Select keep-alives.
• Notification hardening — NATS/AMQP parser and migration keys are registered and round-trip; libpq parameters are quoted safely; invalid-key errors no longer echo secrets.
• Reproducible, signed pipeline — binaries drop the build-machine paths, packages install under the canonical systemd path, RPMs are GPG-signed, and the container entrypoint shuts down gracefully on every privilege path.

Security Hardening

Four hardening areas, each with a full advisory:

• Internode storage & Grid containment — SN-2026-002. Path/volume traversal rejection, peer-S3 coverage, erasure-parameter and allocation bounds (ReadFile capped at 5 GiB), panic containment. Distributed-erasure only; single-node S3 unchanged.
• Effective policy-condition values — SN-2026-003. Internal condition names cannot be supplied as client values; s3:versionid is absent when no version is named and rebound per DeleteObjects entry, closing a Multi-Delete fail-open trap.
• Bucket/object resource boundary — SN-2026-004. An object-only bucket/* grant no longer authorizes twelve sensitive bucket writes on Allow statements.
• Trusted client-address boundary — source-address trust. MINIO_API_TRUSTED_PROXIES gives an enforceable, opt-in boundary for aws:SourceIp and audit attribution; unset preserves historical behavior.

Compatibility & Upgrade Notes

1. Keep every node on one release during a rollout — internode validation changed on storage-REST and Grid surfaces; mixed binaries were not production-tested.
2. Audit custom IAM policies — add the bare bucket ARN (arn:aws:s3:::bucket) alongside bucket/* for the twelve protected writes. MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on is a temporary migration control only.
3. Configure client-address trust deliberately — if aws:SourceIp or audit attribution matters, set MINIO_API_TRUSTED_PROXIES and close direct paths around the proxy.
4. Duplicate multipart completion entries now fail — the same part number sent more than once returns InvalidPartOrder instead of a corrupted successful object. Gapped/non-1 part lists remain accepted.
5. Review legacy database notification settings — convert pre-connection-string Postgres/MySQL host/user/password fields before restart; a migrated config can otherwise fail validation, and target loading is fail-fast.
6. Use the matching mcli 20260804 — self-update is disabled; upgrade through packages or GitHub Releases.

Components

Go 1.26.5 · klauspost/compress 1.18.7 · Apache Thrift 0.24.0 · SILO Console 2.0.0 · silo-pkg 3.11.0 · mcli 20260804. go-systemd is held at 22.6.0 (22.7.0 breaks the NetBSD cross-build).

Artifacts

• Checksummed platform archives for Linux, Darwin, and Windows on amd64 and arm64.
• RPM, DEB, and APK packages under the PGSTY identity. RPMs are GPG-signed with the maintainer key (fingerprint 9592A7BC 7A682E73 33376E09 E7935D8D B9BD8B20); import it before enabling gpgcheck. DEB/APK trust is anchored at the repository layer.
• The systemd unit installs at /usr/lib/systemd/system/minio.service with Type=notify.
• docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z and the release-selected latest tag are published on demand from this release.

govulncheck reports no vulnerability reachable from the server code.