RELEASE.2026-08-06T00-00-00Z

SILO 20260806 is the first release published under the Silo name. The previous release, 20260804, was the last one delivered as pgsty/minio; this release completes the cutover to github.com/pgsty/silo and renames every delivery surface — binary, packages, container images, systemd unit, Helm chart — while deliberately preserving every wire and configuration surface a MinIO deployment depends on. On top of the rename it adds native health checking (silo healthcheck), a distroless container image pilot, complete license-compliance materials in every artifact, and a release pipeline gated on compatibility snapshots and build provenance.

25 commits after RELEASE.2026-08-04T00-00-00Z (394 files, +26,895/−19,558). Passed a six-phase pre-release acceptance, including a real four-node TLS cluster migration from MinIO to Silo — byte-verified data integrity, maintenance-gated rolling restarts, fault injection, and a full rollback rehearsal.

Full Release Notes · 中文发布说明

Highlights

• The rebrand is complete, and compatibility is the contract — repository, binary (/usr/bin/silo), packages (silo rpm/deb/apk), images (docker.io/pgsty/silo), and service (silo.service) are renamed; the S3 and admin APIs, /minio/* routes, MINIO_* environment variables, x-minio-* headers, on-disk .minio.sys format, and Go module paths are all preserved and frozen by a CI compatibility guard.
• Native health checking — silo healthcheck [live|ready|cluster|cluster-read] probes the server's own health API with correct exit codes, decoded quorum diagnostics, TLS auto-detection, and a --maintenance pre-drain gate — no shell, curl, or mc required in the container.
• Distroless image pilot — pgsty/silo:RELEASE.2026-08-06T00-00-00Z-distroless ships exactly one program on gcr.io/distroless/static (128 MB vs. the classic 199 MB), with an exec-form HEALTHCHECK baked in and /data created writable in the image layer (fixes #55 in this variant).
• The classic image does not change behavior — same entrypoint, same bundled tools, mc ready local keeps working; it now bundles mcli 20260806 (with the mc compatibility alias), and docker run pgsty/silo minio server /data still works.
• Compliance completed — LICENSE and NOTICE ship in every package and image, CREDITS is regenerated from the actually-linked module set (291 modules) and guarded in CI, and the project adopts a no-CLA, DCO-based contribution policy.
• Components — SILO Console 2.1.1 · silo-pkg 3.11.0 · mcli 20260806 · Go 1.26.5.

Migration

silo.service is built for takeover: it conflicts with and supersedes minio.service, and reads /etc/default/minio before /etc/default/silo, so an existing MinIO configuration is inherited without edits. Keep data ownership stable with the documented legacy-user drop-in.

Warning

Distributed migrations must switch all nodes together. A mixed Silo/MinIO cluster does not form — new nodes wait in activating indefinitely. Stop MinIO on all nodes, then start Silo on all nodes near-simultaneously. Once every node runs Silo, gate each rolling restart with silo healthcheck --maintenance cluster.

See the migration section of the full notes for the verified procedure, TLS/certificate troubleshooting, and the rollback path.

Artifacts

• Checksummed platform archives for Linux, Darwin, and Windows on amd64 and arm64, each with an SPDX SBOM.
• RPM, DEB, and APK packages under the PGSTY identity. RPMs are GPG-signed with the maintainer key (fingerprint 9592A7BC 7A682E73 33376E09 E7935D8D B9BD8B20); verify them via rpmkeys --checksig and their per-file .sha256sum (regenerated after signing). DEB/APK trust is anchored at the repository layer.
• Sigstore-signed checksum manifests and a build-provenance bundle (silo_*_provenance.sigstore.json); release artifacts carry GitHub Attestations — gh attestation verify --repo pgsty/silo <file>.
• docker.io/pgsty/silo:RELEASE.2026-08-06T00-00-00Z and the -distroless variant are built only from this release's checksum- and attestation-verified archives.

govulncheck reports no vulnerability reachable from the server code (VulnCheck CI green on the released commit).

Acknowledgments

A first release under a new name is the right moment to thank everyone who has filed issues against this fork — bug reports, compatibility findings, and proposals alike, resolved and still open: @mosesdd (#1), @Xavier-777 (#2, #17), @jiadzh (#3), @TLINDEN (#4), @AntonOfTheWoods (#5), @zylpsrs (#6), @nsanitate (#7), @makinikm (#9), @magicxor (#10), @spaceg00se-r (#11, #14), @heroes1412 (#13), @vampywiz17 (#15), @davinkevin (#20), @chalukyaj (#30), @cbornet (#31, #32), @jvasile (#33), @Kesavaambati (#35), @redfoxfox (#38), @kuldeep-link11 (#39, #40), @meesudzu (#42), @pmezhuev (#43), @kh0mka (#51).

Several of this release's headline items trace straight back to those reports: the bundled-client guarantee (#4, #9), the LDAP-over-TLS repair (#15), the completed package payload (#33), GPG-signed RPMs (#43), the migration guide (#42), and the distroless /data fix (#55).

Special thanks to @davinkevin, whose distroless image PR (#21) anticipated this release's pilot months in advance — the shipped variant supersedes it with the native health check built in, but the direction was proposed there first. Conformance PRs from @magicxor (#12) and @ycjlin (#37) are queued for review immediately after this release.

RELEASE.2026-08-04T00-00-00Z

SILO 20260804 is a security, correctness, and release-engineering update to the pgsty/minio community fork. It completes the internode storage-containment work begun with CVE-2026-42600, stops request-controlled values from impersonating server-calculated S3/IAM policy conditions, restores streaming flush behavior, fixes several multipart and versioning edge cases, hardens notification configuration, moves the baseline to Go 1.26.5, and rebuilds the release pipeline to produce reproducible binaries and GPG-signed packages.

50 commits after the pre-2026-06-18 baseline (155 files, +9,241/-981). Reviewed against this tagged commit and verified on macOS ARM64 and Linux AMD64 with GitHub CI green on the released HEAD.

Full Release Notes

Highlights

• Internode containment completed — validates storage-REST bodies, storage Grid frames, and peer-S3 Grid requests at the storage boundary, closing the remaining path, volume, erasure-metadata, panic, and unbounded-allocation defects left after removing ReadMultiple.
• S3/IAM decisions use effective values — client input can no longer shadow internal condition values; request tags and existing-object tags are separated; s3:signatureAge is confined to verified presigned requests; s3:versionid follows the version the server actually acts on.
• Bucket and object resources separated — twelve sensitive bucket-level writes are no longer authorized through an object-only bucket/* pattern (documented compatibility switch available).
• Multipart correctness — full-object checksum completion works without per-part checksums where the protocol permits; zero-length checksums are preserved; duplicate part numbers are rejected instead of assembling duplicated data.
• Streaming reliability restored — trackingResponseWriter implements Flush correctly and records implicit HTTP 200, repairing mcli watch, bucket-notification listeners, and S3 Select keep-alives.
• Notification hardening — NATS/AMQP parser and migration keys are registered and round-trip; libpq parameters are quoted safely; invalid-key errors no longer echo secrets.
• Reproducible, signed pipeline — binaries drop the build-machine paths, packages install under the canonical systemd path, RPMs are GPG-signed, and the container entrypoint shuts down gracefully on every privilege path.

Security Hardening

Four hardening areas, each with a full advisory:

• Internode storage & Grid containment — SN-2026-002. Path/volume traversal rejection, peer-S3 coverage, erasure-parameter and allocation bounds (ReadFile capped at 5 GiB), panic containment. Distributed-erasure only; single-node S3 unchanged.
• Effective policy-condition values — SN-2026-003. Internal condition names cannot be supplied as client values; s3:versionid is absent when no version is named and rebound per DeleteObjects entry, closing a Multi-Delete fail-open trap.
• Bucket/object resource boundary — SN-2026-004. An object-only bucket/* grant no longer authorizes twelve sensitive bucket writes on Allow statements.
• Trusted client-address boundary — source-address trust. MINIO_API_TRUSTED_PROXIES gives an enforceable, opt-in boundary for aws:SourceIp and audit attribution; unset preserves historical behavior.

Compatibility & Upgrade Notes

1. Keep every node on one release during a rollout — internode validation changed on storage-REST and Grid surfaces; mixed binaries were not production-tested.
2. Audit custom IAM policies — add the bare bucket ARN (arn:aws:s3:::bucket) alongside bucket/* for the twelve protected writes. MINIO_API_LEGACY_BUCKET_RESOURCE_MATCH=on is a temporary migration control only.
3. Configure client-address trust deliberately — if aws:SourceIp or audit attribution matters, set MINIO_API_TRUSTED_PROXIES and close direct paths around the proxy.
4. Duplicate multipart completion entries now fail — the same part number sent more than once returns InvalidPartOrder instead of a corrupted successful object. Gapped/non-1 part lists remain accepted.
5. Review legacy database notification settings — convert pre-connection-string Postgres/MySQL host/user/password fields before restart; a migrated config can otherwise fail validation, and target loading is fail-fast.
6. Use the matching mcli 20260804 — self-update is disabled; upgrade through packages or GitHub Releases.

Components

Go 1.26.5 · klauspost/compress 1.18.7 · Apache Thrift 0.24.0 · SILO Console 2.0.0 · silo-pkg 3.11.0 · mcli 20260804. go-systemd is held at 22.6.0 (22.7.0 breaks the NetBSD cross-build).

Artifacts

• Checksummed platform archives for Linux, Darwin, and Windows on amd64 and arm64.
• RPM, DEB, and APK packages under the PGSTY identity. RPMs are GPG-signed with the maintainer key (fingerprint 9592A7BC 7A682E73 33376E09 E7935D8D B9BD8B20); import it before enabling gpgcheck. DEB/APK trust is anchored at the repository layer.
• The systemd unit installs at /usr/lib/systemd/system/minio.service with Type=notify.
• docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z and the release-selected latest tag are published on demand from this release.

govulncheck reports no vulnerability reachable from the server code.

RELEASE.2026-06-18T00-00-00Z

RELEASE.2026-06-18T00-00-00Z

2026-06-18: https://github.com/pgsty/minio/releases/tag/RELEASE.2026-06-18T00-00-00Z

This release is a security and dependency-maintenance update for the pgsty/minio fork. It hardens LDAP STS throttling, completes S3 Select oversized-record enforcement, removes the obsolete ReadMultiple internode storage-REST API, upgrades the Go build baseline to 1.26.4, and refreshes Go module dependencies to pick up additional third-party security fixes.

Major Changes

• Remove the obsolete ReadMultiple storage-REST API: the legacy /rmpl internode endpoint is removed rather than patched in place, including its route, handler, client wrapper, storage interfaces, xlStorage methods, generated datatypes, and related metric. No production caller is expected after upstream multipart handling moved to ReadParts, but clusters should still run a consistent release during rolling upgrades.
• Complete S3 Select oversized-record enforcement: JSON Lines input now uses the bounded reader path, so oversized records are rejected consistently instead of bypassing limits on SIMD-capable CPUs. S3 Select stream errors now preserve the intended error code and wrap JSON parser failures as JSONParsingError.
• Harden LDAP STS rate-limit source bucketing: throttling is now keyed only by source IP, avoiding username-shared buckets that could be drained by one client to lock out a legitimate user. Trusted-proxy handling now resolves X-Forwarded-For from right to left, rejects catch-all trusted-proxy CIDRs, ignores RFC 7239 Forwarded, and documents the X-Real-IP deployment contract.
• Refresh the Go runtime and module baseline: release, hotfix, goreleaser, and old-CPU Docker builds now use golang:1.26.4-alpine; go.mod is updated to Go 1.26.4; and dependencies are refreshed across NATS, Prometheus, Azure SDK, Apache Thrift, gRPC, OpenTelemetry, Google API/auth, Go x/*, and related transitive libraries.

Direct Security Fixes

• CVE-2026-42600: remove the obsolete ReadMultiple storage-REST API to close the legacy internode file-read path exposed through /rmpl.
• CVE-2026-39414: complete oversized S3 Select record enforcement for JSON Lines inputs and preserve correct S3 Select error semantics.
• CVE-2026-33419: further harden LDAP STS rate-limit accounting and trusted-proxy source-IP handling.

Dependency Security Updates

• Update github.com/Azure/go-ntlmssp from v0.1.0 to v0.1.1, fixing CVE-2026-32952, where malformed NTLM challenges could panic a Go process.
• Update github.com/apache/thrift from v0.22.0 to v0.23.0, fixing CVE-2026-41602 in the Go TFramedTransport implementation.
• Update github.com/nats-io/nats-server/v2 from v2.11.1 to v2.11.15, absorbing the NATS 2.11.x security patch line. Notable fixes include pre-auth WebSocket and leafnode denial-of-service issues, MQTT authorization issues, JetStream management API authorization hardening, credential exposure fixes, and request identity-spoofing fixes, including CVE-2026-27889, CVE-2026-29785, CVE-2026-33217, CVE-2026-33218, CVE-2026-33222, and CVE-2026-33247.
• Update github.com/prometheus/prometheus from v0.310.0 to v0.311.3, absorbing Prometheus security fixes for remote-read denial of service, stored XSS in UI surfaces, and remote-write configuration secret exposure, including CVE-2026-42154, CVE-2026-44903, CVE-2026-42151, and CVE-2026-40179.
• Upgrade the release build baseline through Go 1.26.4 and refresh supporting Go module families, including golang.org/x/crypto, golang.org/x/net, golang.org/x/sys, golang.org/x/text, google.golang.org/grpc, and OpenTelemetry. These updates keep the fork aligned with patched upstream dependency baselines even where the previously pinned version was already past the specific public advisory range.

Related Commits

• 5e40665: fix: harden LDAP STS rate-limit source bucketing
• fd69c89: fix: complete CVE-2026-39414 S3 Select record limit enforcement
• 73ac524: fix: CVE-2026-42600 remove ReadMultiple storage-REST API
• df627ff: fix: bump Go toolchain to 1.26.4
• 3e61b1d: chore: update Go module dependencies

RELEASE.2026-04-17T00-00-00Z

RELEASE.2026-04-17T00-00-00Z

2026-04-17: https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z

This release focuses on security hardening and compatibility tightening. It bundles fixes across OIDC, LDAP STS, S3 Select, replication metadata handling, unsigned-trailer flows, the Snowball upload path, and multiple dependency- and Go toolchain-related security issues, while also incorporating the LDAP TLS regression fix and a cleanup of community-fork documentation.

Major Changes

• Tighten the identity-authentication flow: OIDC / WebIdentity now accepts only asymmetrically signed ID Token values backed by the IdP JWKS; symmetrically signed tokens such as HS256 are no longer accepted. LDAP STS also now hides the distinction between unknown-user and bad-password failures to reduce username-enumeration risk.
• Update LDAP STS rate limiting: limits now apply to both source IP and normalized username, and successful requests no longer consume quota incorrectly. By default MinIO now uses only the socket peer address as the source and no longer trusts X-Forwarded-For, X-Real-IP, or Forwarded; to rate-limit by real client IP, configure MINIO_IDENTITY_LDAP_STS_TRUSTED_PROXIES explicitly.
• Make upload and write paths stricter: presigned query parameters can no longer be combined with unsigned-trailer PUT or multipart uploads. Snowball auto-extract now also performs full signature validation on the unsigned-trailer path and rejects anonymous or forged-signature requests.
• Prevent replication metadata spoofing: internal X-Minio-Replication-* headers attached to ordinary PUT / COPY requests are now rejected or ignored, and only trusted replication flows may write the related internal metadata.
• Clarify S3 Select error semantics: oversized CSV and line-delimited JSON records now return OverMaxRecordSize directly instead of the generic InternalError; clients or alerting rules that depend on the old error code should be adjusted.
• Upgrade the runtime and dependency baseline: fix the regression where ldaps:// did not correctly apply TLS settings, replace minio/pkg/v3 with pgsty/minio-pkg/v3, and pin several critical dependencies that are prone to breaking changes. The release also upgrades go-jose, go.opentelemetry.io, and Go 1.26.2 to unify the build and release baseline.
• Refresh documentation and security guidance: update SECURITY.md, VULNERABILITY_REPORT.md, docs/sts/ldap.md, and related documents, add a security advisory index, and switch upstream minio/minio references in the security guidance over to pgsty/minio.

Fixed CVEs

• CVE-2026-34986: upgrade go-jose to v4.1.4 and fix known security issues in the JWT / JOSE dependency chain.
• CVE-2026-39883: upgrade the go.opentelemetry.io dependency stack to fix the PATH-hijacking risk.
• CVE-2026-33322: restore the strict JWKS-only OIDC JWT verification path to block keyring injection and algorithm-confusion risk.
• CVE-2026-33419: systematically harden LDAP STS authentication, rate limiting, source-address identification, and accounting logic across four follow-up fixes.
• CVE-2026-34204: reject injection of X-Minio-Replication-* metadata by untrusted requests to prevent objects from being written with invalid replication state.
• CVE-2026-39414: reject oversized S3 Select records early to avoid continued buffering and parsing of abnormal inputs.
• GHSA-hv4r-mvr4-25vw: close the unsigned-trailer query-auth bypass.
• GHSA-9c4q-hq6p-c237: harden unsigned-trailer authentication and signature validation in Snowball auto-extract scenarios.
• CVE-2026-32280, CVE-2026-32281, and CVE-2026-32283: upgrade Go to 1.26.2 and absorb the upstream toolchain and stdlib security fixes.

Related Commits

• c878ca0: fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
• e970ec5: fix: upgrade go-jose to v4.1.4 to patch CVE-2026-34986
• a206510: fix: CVE-2026-39883 upgrade go.opentelemetry.io
• fd65f11: merge: PR #18 upgrade go-jose to v4.1.4 for CVE-2026-34986
• bc087e4: merge: PR #19 upgrade go.opentelemetry.io for CVE-2026-39883
• f1f2239: fix: CVE-2026-33322 restore JWKS-only OIDC JWT verification
• 6619d0c: fix: CVE-2026-33419 harden LDAP STS auth
• fcb8f24: fix: CVE-2026-34204 reject untrusted replication metadata
• c5765dc: fix: CVE-2026-39414 reject oversized S3 Select records
• fa7c579: fix: GHSA-hv4r-mvr4-25vw block unsigned-trailer query auth bypass
• b50ab58: fix: GHSA-9c4q-hq6p-c237 harden Snowball unsigned-trailer auth
• 9a4b3cd: fix: CVE-2026-32280/CVE-2026-32281/CVE-2026-32283 upgrade Go to 1.26.2
• c55b52c: fix: CVE-2026-33419 preserve LDAP STS rate limits on success
• 817a457: fix: CVE-2026-33419 harden LDAP STS rate-limit source IP
• 084a154: fix: CVE-2026-33419 tighten LDAP STS rate-limit accounting
• 16e34f9: docs: refresh security guidance and fork references

RELEASE.2026-03-25T00-00-00Z

This release is mainly a packaging and stability update. It bundles mcli/mc into the Docker image with checksum verification, removes unused upstream CI/CD workflows from the pgsty/minio fork, and fixes an LDAP TLS regression for ldaps:// while pinning several dependencies to avoid compatibility breakage. (#15)

• This release fixes three security vulnerabilities: CVE-2026-24051, CVE-2025-10543, and CVE-2025-58181.
• The fixes are included through dependency updates to go.opentelemetry.io/otel/sdk, github.com/eclipse/paho.mqtt.golang, and golang.org/x/crypto.
• Users should upgrade to this release to receive the patched versions of these components.

Changelog

• f2f9a40 add mcli/mc from pgsty/mc to Docker image
• ce1c537 fix: pin deps with breaking changes and fix LDAP TLS regression (#15)
• ee55e53 remove upstream CI/CD workflows inherited from minio/minio

RELEASE.2026-03-21T00-00-00Z

This release upgrades MinIO to Go 1.26.1, updates dependencies, and includes small compatibility fixes needed for the newer toolchain. No new features are introduced; this is primarily a maintenance and build-environment update.

Changelog

• 5abd9a8 bump golang to 1.26.1 and update deps
• 377fc61 fix: satisfy stricter Go 1.26.1 linter checks

RELEASE.2026-03-14T12-00-00Z

RELEASE.2026-03-14T12-00-00Z with go 1.26.0

Switch to community-maintained console fork (georgmangold/console v1.9.1)
and update dependencies accordingly. Fix go vet format directive in
grid_test.go and adapt test status code for Go 1.26 HTTP semantics.

RELEASE.2026-02-14T12-00-00Z

Docs | Docker | GitHub

Quick apt/dnf instsall with pig the package manager from the pigsty-infra repo

curl https://repo.pigsty.cc/pig | bash
pig repo add infra -u; pig install minio

Changelog

• 8630937 Restore embedded console and update README for community fork
• 5d57938 add github ci/cd pipeline

RELEASE.2025-12-03T12-00-00Z

Build with minio/pkger, based on the latest maintenance mode release.

1f6c050895cbdd63ce2ace487663cdf6  minio_20251203120000.0.0_aarch64.apk
98212a28ced6303f7e9525a8c0e177fd  minio_20251203120000.0.0_amd64.deb
c428933cabf959e1b426cc608e104994  minio_20251203120000.0.0_arm64.deb
d5968dd81766acd5c72f9eca889ba617  minio_20251203120000.0.0_x86_64.apk
79a65646ce1219ee06f0e93cb0f43528  minio-20251203120000.0.0-1.aarch64.rpm
42de8d7eb4e3d2f06cb4f88577a26f8c  minio-20251203120000.0.0-1.x86_64.rpm