RustFS 1.0.0-beta.12 (beta)

Release 1.0.0-beta.12

What's Changed

• fix(oidc): support separate discovery issuer by @overtrue in #5149
• fix(iam): route issuer-relative JWKS through config URL by @overtrue in #5150
• perf(ecstore): add guarded encrypted multipart range seeks by @overtrue in #5145
• chore(deps): update erasure codec and russh by @houseme in #5155
• feat(bench): capture node attribution metadata by @houseme in #5158
• chore(deps): refresh workspace dependencies by @houseme in #5157
• fix(security): pin OIDC discovery/token client to the outbound egress policy by @overtrue in #5159
• fix(runtime): update codec and debug stack headroom by @houseme in #5164
• fix(s3): honor CopyObject tagging directives by @cxymds in #5165
• fix(security): reject federated STS credentials that collide with the root principal by @overtrue in #5161
• fix(s3): honor CopyObject replacement metadata by @cxymds in #5168
• fix(s3): persist multipart upload storage class by @cxymds in #5170
• fix(storage): cover inline reader fallback controls by @houseme in #5169
• feat(ilm): add manual transition run endpoint by @houseme in #5171
• fix(storage): expose truthful storage class capabilities by @cxymds in #5172
• feat(ilm): bound manual transition duration by @houseme in #5174
• fix(s3): complete CopyObject checksum support by @cxymds in #5178
• fix(ecstore): self-verify no-parity bitrot writes by @houseme in #5179
• fix(iam): virtualize OIDC service account parents by @GatewayJ in #5152
• feat(ilm): count already transitioned manual runs by @houseme in #5177
• fix(internode): guard msgpack-only JSON fallback by @houseme in #5180
• feat(ilm): trace manual transition runs by @houseme in #5187
• test(ilm): cover manual transition queue pressure by @houseme in #5189
• test(ilm): deny manual transition for non-admin by @houseme in #5188
• fix(s3): enforce SSE-C copy key validation by @cxymds in #5185
• feat(ilm): gate durable manual transition mode by @houseme in #5190
• perf(protos): cache internode msgpack-only flag by @houseme in #5191
• test(internode): pin msgpack compatibility send sites by @houseme in #5193
• fix(heal): report no-parity bitrot as unrecoverable by @houseme in #5192
• fix(s3): list multipart uploads by bucket prefix by @cxymds in #5195
• fix(admin): restore complete config history snapshots by @cxymds in #5196
• fix(internode): align msgpack benchmark gates by @houseme in #5197
• fix(ecstore): fix wide-prefix listing stalls and decode downstream logging by @houseme in #5198
• fix(replication): persist sanitized resync errors by @cxymds in #5200
• perf(ecstore): avoid redundant leaf object scans by @marshawcoco in #5176
• fix(getobject): enrich stream error context by @houseme in #5201
• feat(ilm): reject overlapping manual transition runs by @houseme in #5202
• test(internode): pin msgpack gate rollback coverage by @houseme in #5203
• fix(kms): validate configured backend cleanup by @cxymds in #5204
• fix(admin): report truthful diagnostic capabilities by @cxymds in #5205
• fix(admin): redact and seal config history by @cxymds in #5206
• feat(admin): add encrypted diagnostic archives by @cxymds in #5207
• feat(replication): structure active check results by @cxymds in #5208
• fix(replication): report authoritative backlog metrics by @cxymds in #5209
• chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 in /fuzz in the cargo group across 1 directory by @dependabot[bot] in #5210
• fix(console): handle apple touch icon paths by @overtrue in #5214
• fix(replication): make resync starts atomic by @cxymds in #5215
• test(rpc): add corrupt-json decode coverage by @houseme in #5216
• feat(site-replication): make repair operations durable by @cxymds in #5217
• test(ilm): cover manual transition e2e gaps by @houseme in #5219
• feat(rpc): add server-side internode v2 signature verification (fail-open, method-path binding groundwork) by @overtrue in #5160
• fix(getobject): distinguish downstream output closure by @houseme in #5220
• feat(ilm): add durable manual transition jobs by @houseme in #5223
• refactor(getobject): scope downstream close tagging by @houseme in #5224
• fix(s3select): enforce query and resource limits by @GatewayJ in #5028
• fix(scanner): make distributed usage convergence authoritative by @marshawcoco in #5151
• fix(tier): handle mutation intent CAS races by @houseme in #5227
• fix(object): make version undo preconditions atomic by @cxymds in #5225
• feat(ilm): add manual transition job route contract by @houseme in #5221
• fix(lock): jitter distributed lock retries by @hkwi in #5113
• test(internode): extend fallback and transition coverage by @houseme in #5232
• test(e2e): cover async transition limit partial by @houseme in #5233
• fix(getobject): avoid duplicate downstream-close metrics by @houseme in #5231
• test(e2e): stabilize tier and storage class checks by @houseme in #5228
• feat(ilm): add durable manual transition job store by @houseme in #5229
• feat(rpc): bind canonical body digest into internode mutating disk RPC signatures by @overtrue in #5234
• fix(tier): reconcile committed mutation replay by @houseme in #5230
• fix(ilm): harden durable transition admission by @houseme in #5235
• fix(tier): converge config after peer recovery by @houseme in #5240
• fix(ilm): preserve lifecycle version groups by @houseme in #5239
• fix(ilm): report manual transition tier failures by @houseme in #5238
• test(rpc): cross-process replay/tamper acceptance for internode RPC signatures by @overtrue in #5236
• feat(kms): introduce KMS unavailability error and enhance data key handling by @reatang in #5184
• fix(s3): return Cache-Control on GET object by @overtrue in #5241
• feat(kms): add static single-key backend by @reatang in #5222
• docs: fix dead TLS configuration doc links by @overtrue in #5242
• fix(kms): do not include secret value in static KMS format error by @overtrue in #5243
• docs: add autonomy and approval boundaries to AGENTS.md by @overtrue in #5246
• chore(security): add guardrails against secret values in error strings by @overtrue in #5244
• test(kms): cover static secret file config by @overtrue in #5245
• test(kms): rename secret-named fixture bindings to satisfy logging guardrails by @overtrue in #5247
• fix(ecstore): fail fast on missing RPC secret in distributed startup by @overtrue in #5248
• feat(ilm): trace lifecycle expiry execution by @houseme in #5250
• test(e2e): assert msgpack decode-error controls by @houseme in #5251
• test(e2e): cover manual transition active cancel by @houseme in #5252
• fix(lifecycle): stop tier free-version recovery walk-timeout loop by @harryhan24 in #5194
• test(ilm): cover manual transition job auth matrix by @houseme in #5254
• fix(ilm): honor explicit object lock metadata by @houseme in #5253
• fix(ilm): normalize cancelled manual job reports by @houseme in #5255
• fix: reject overlapping console listener address by @houseme in #5257
• test(ilm): cover manual job status after restart by @houseme in #5256
• fix(helm): coordinate distributed pod startup by @cxymds in #5258
• test(perf): add pinned paired ABBA benchmark by @houseme in #5259
• test(internode): pin msgpack rollout gates by @houseme in #5261
• test(ilm): cover manual transition queue pressure status by @houseme in #5265
• test(ilm): cover deterministic manual transition cancel by @houseme in #5263
• test(ilm): cover noncurrent version expiry e2e by @houseme in #5264
• feat(ilm): expose lifecycle expiry scanner counters by @houseme in #5262
• fix: normalize console listener address by @houseme in #5266
• test(ilm): cover same-scope async transition conflict by @houseme in #5267
• feat(admin): expose ILM expiry status by @houseme in #5268
• test(perf): add exact 1MiB ABBA benchmark drivers by @houseme in #5260
• test(ilm): cover unknown manual transition worker loss by @houseme in #5269
• test(tier): cover committed prepare replay fanout by @houseme in #5270
• chore(deps): update flake.lock by @houseme in #5271
• test(ilm): cover manual transition worker failure summary by @houseme in #5272
• test(ilm): cover stale transition admission reclaim by @houseme in #5273
• test(perf): preflight GET smoke buckets by @houseme in #5274
• test(perf): tolerate empty paired runner node args by @houseme in #5275
• test(ilm): cover queue terminal partial reports by @houseme in #5277
• fix(ilm): fail closed on unsafe manual recovery by @houseme in #5276
• fix(ilm): deduplicate manual transition worker results by @houseme in #5278
• refactor(storage): resolve staged dead code in store module by @overtrue in #5283
• fix(ilm): retry transient scope admission races by @houseme in #5280
• test(ilm): cover combined manual transition failures by @houseme in #5279
• test(perf): fix GET stage metrics capture by @houseme in #5284
• test(ilm): cover cancelled worker counter persistence by @houseme in #5285
• test(ilm): cover durable transition progress recovery by @houseme in #5286
• test(ilm): cover durable progress checkpoint renewal by @houseme in #5287
• test(ilm): cover admission scope parallelism by @houseme in #5293
• test(ilm): cover durable checkpoint persistence by @houseme in #5288
• test(perf): cover GET fallback metric probes by @houseme in #5291
• test(perf): reject zero-byte paired warp sizes by @houseme in #5289
• test(ilm): cover manual transition endpoint contract by @houseme in #5295
• test(tier): cover reporter committed prepare replay by @houseme in #5297
• feat(ilm): persist manual transition task journals by @houseme in #5296
• test(ilm): cover restart unknown readback by @houseme in #5298
• test(ilm): cover cancelled continuation resume by @houseme in #5294
• test(ilm): cover manual transition journal replay matrix by @houseme in #5300
• test(ilm): cover async partial continuation resume by @houseme in #5301
• test(ilm): cover manual job status cancel matrix by @houseme in #5302
• test(ilm): cover unknown checkpoint counters by @houseme in #5299
• test(ilm): cover heartbeat backpressure status by @houseme in #5303
• test(ilm): cover terminal job status readback by @houseme in #5304
• test(ilm): cover transition budget partial records by @houseme in #5305
• test(admin): expose manual transition job capabilities by @houseme in #5306
• fix(ecstore): never cache fabricated bucket metadata as authoritative by @overtrue in #5307
• feat(internode): track msgpack decode traffic by @houseme in #5309
• test(ilm): cover queue-full terminal job records by @houseme in #5310
• test(admin): cover manual transition capabilities e2e by @houseme in #5311
• test(ilm): cover queue pressure job readback by @houseme in #5313
• test(ilm): cover parallel bucket admission by @houseme in #5314
• fix(ilm): preserve manual transition duration budget by @houseme in #5315
• test(ilm): cover manual transition restart recovery by @houseme in #5318
• test(ilm): cover restart cancel readback by @houseme in #5316
• test(ilm): cover pending worker budget status by @houseme in #5317
• test(e2e): cover distributed manual transition admission by @houseme in #5319
• fix(bench): parse final warp report metrics by @houseme in #5308
• test(ilm): cover manual transition e2e stress by @houseme in #5320
• chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #5321
• fix(bench): formalize paired ABBA corrected artifacts by @houseme in #5322
• feat(ecstore): attribute manual transition worker failures by @houseme in #5324
• feat(scripts): add runbook entrypoints for #1508 #1510 by @houseme in #5326
• fix(iam): align OIDC parent IDs with MinIO by @GatewayJ in #5290
• test(scripts): cover manual transition runbooks by @houseme in #5327
• chore(scripts): add manual transition follow-up monitor by @houseme in #5328
• fix(ecstore): replay manual transition task journal by @houseme in #5329
• test(internode): pin JSON fallback compatibility by @houseme in #5330
• test(scripts): capture manual transition failure samples by @houseme in #5331
• docs: document RUSTFS_OUTBOUND_ALLOW_ORIGINS outbound policy by @yyyCode in #5334
• docs: clarify outbound allowlist scope by @houseme in #5336
• fix: classify manual transition tier failures by @houseme in #5335
• fix(site-replication): keep reverse direction after config broadcast by @abdullahnah92 in #5292
• fix(audit): load env-only targets at startup by @houseme in #5342
• fix(lifecycle): harden manual transition rollout checks by @houseme in #5344
• perf(s3): resolve bucket versioning once per DeleteObjects request by @overtrue in #5340
• fix(scanner): require authoritative usage snapshots by @marshawcoco in #5333
• test(lifecycle): add manual transition rollout harnesses by @houseme in #5346
• fix(sts): return Query API-compatible responses by @GatewayJ in #5282
• chore(build): pin Rust toolchain configs to 1.97.1 by @houseme in #5350
• test(e2e): stabilize inline full gate checks by @houseme in #5351
• fix(s3): reject empty multipart completions by @cxymds in #5352
• fix(kms): unify persisted SSE data key envelopes by @reatang in #5343
• fix(authz): fail closed on policy load errors by @cxymds in #5359
• fix(multipart): list uploads across all sets by @cxymds in #5362
• fix(multipart): preserve retried parts on quorum failure by @cxymds in #5363
• fix(tiering): abort failed multipart restores by @cxymds in #5367
• fix(swift): enforce TempURL IP restrictions by @cxymds in #5377
• fix(swift): enforce cumulative container quotas by @cxymds in #5378
• fix(notify): emit noop event for missing deletes by @cxymds in #5381
• fix(ecstore): handle mutex poisoning explicitly by @cxymds in #5379
• fix(auth): enforce presigned URL expiry limit by @cxymds in #5368
• fix(ecstore): handle pre-epoch disk health clocks by @cxymds in #5383
• fix(bitrot): reject trailing shard data by @cxymds in #5358
• fix(ecstore): use set read quorum for version reads by @cxymds in #5365
• fix(lifecycle): reject invalid modification times by @cxymds in #5370
• fix(lifecycle): recover saturated scanner tasks by @cxymds in #5369
• fix(filemeta): reject positive size without parts by @cxymds in #5354
• fix(ecstore): fence object tagging updates by @cxymds in #5360
• fix(heal): report partial rename failures by @cxymds in #5355
• fix(filemeta): preserve canonical version order by @cxymds in #5353
• feat(tiering): model provider version capabilities by @cxymds in #5372
• fix(auth): compare sensitive tokens in constant time by @cxymds in #5371
• fix(notify): defer disabled bootstrap storage refresh by @houseme in #5373
• test(lifecycle): classify mixed rollout harness results by @houseme in #5384
• test(ci): stabilize lifecycle timeout coverage by @houseme in #5404
• fix(multipart): serialize complete and abort by @cxymds in #5356
• fix(swift): persist container and account metadata writes by @overtrue in #5398
• feat(ecstore): add local data-dir snapshot leases by @cxymds in #5388
• fix(tiering): gate remote version state safely by @cxymds in #5374
• fix(tiering): base restore expiry on completion by @cxymds in #5366
• fix(ecstore): classify peer RPC failures by gRPC status code by @overtrue in #5400
• ci: preserve timeout evidence for workspace tests by @cxymds in #5402
• fix(action): change quay.io image repository name by @majinghe in #5417
• ci(checksums): inherit workspace lint policy by @overtrue in #5415
• fix(filemeta): canonicalize version order after insert by @overtrue in #5413
• test(ilm): make active cancellation deterministic by @cxymds in #5403
• fix(tier): keep converging peers that reject a config reload by @overtrue in #5412
• fix(swift): merge account and container metadata POSTs by @overtrue in #5414
• fix(ecstore): prevent deleted bucket recreation by @cxymds in #5380
• test(ecstore): rendezvous concurrent resend commits by @cxymds in #5411
• fix(heal): fail closed on ambiguous metadata rescue by @cxymds in #5361
• fix(tiering): gate remote version state writes by @cxymds in #5382
• feat(ecstore): add remote snapshot lease RPCs by @cxymds in #5389
• fix(data-usage): preserve nonempty replication stats by @overtrue in #5422
• fix(ecstore): fail peer metadata reloads closed instead of caching fabricated defaults by @overtrue in #5396
• fix(ilm): preserve restore source version mode by @cxymds in #5406
• ci(concurrency): inherit workspace lint policy by @overtrue in #5420
• fix(rpc): authenticate non-disk mutation bodies by @overtrue in #5425
• test(heal): avoid live disk removal race by @overtrue in #5421
• fix(data-usage): make empty checks exhaustive by @overtrue in #5424
• chore(heal): enforce workspace lint policy by @overtrue in #5426
• feat(kms): support safe local KMS evaluation workflows by @reatang in #5418
• refactor(deps): replace md5 crate with md-5 by @houseme in #5432
• test(ecstore): remove invalid transition version drift case by @cxymds in #5392
• feat(ecstore): protect streaming GETs with snapshot leases by @cxymds in #5391
• fix(tiering): use exact GCS generations by @cxymds in #5376
• ci(keystone): inherit workspace lint policy by @overtrue in #5429
• fix(ecstore): defer delete cleanup for snapshot reads by @cxymds in #5408
• perf(utils): reduce highway hash key setup by @houseme in #5434
• test(entrypoint): preserve cargo toolchain environment by @cxymds in #5385
• ci: sample runner state during the nextest step by @overtrue in #5440
• fix(scanner): report active first-cycle status by @marshawcoco in #5397
• fix(ecstore): fence bucket metadata generations by @cxymds in #5427
• ci(protocols): inherit workspace lint policy by @overtrue in #5436
• test(ecstore): fix two cluster::rpc flakes from process-global test state by @overtrue in #5438
• fix(notify): reconcile persisted bucket rules by @houseme in #5437
• fix(tier): reconcile paginated remote versions by @cxymds in #5405
• ci(s3select-api): inherit workspace lint policy by @overtrue in #5441
• ci(s3select-query): inherit workspace lint policy by @overtrue in #5443
• fix(s3): correlate server-owned request IDs by @GatewayJ in #5433
• fix(ecstore): serialize every bucket config write under the transaction lock by @overtrue in #5445
• fix(tiering): bind recovery to transaction metadata by @cxymds in #5409
• fix(ecstore): prevent recursive delete after empty bucket scan by @overtrue in #5453
• test(ecstore): stabilize multipart lock ordering test by @overtrue in #5454
• feat(rpc): add replay-scoped internode authentication by @overtrue in #5455
• fix(scanner): persist portable usage cache keys by @marshawcoco in #5444
• fix(server): preserve non-S3 trace context by @overtrue in #5450
• fix(data-usage): classify 1024-byte objects correctly by @overtrue in #5451
• fix(admin): fail closed for empty server context slots by @overtrue in #5452
• test(ecstore): fix rename_all WARN flake from callsite-interest poisoning by @overtrue in #5448
• test(ecstore): stabilize late snapshot lease cleanup by @overtrue in #5456
• ci: model server as a composition root by @overtrue in #5459
• refactor(ecstore): correct bucket config static names by @overtrue in #5458
• fix(iam): add correctly named policy APIs by @overtrue in #5457
• chore(release): prepare 1.0.0-beta.12 by @overtrue in #5461

New Contributors

• @harryhan24 made their first contribution in #5194
• @yyyCode made their first contribution in #5334

Full Changelog: 1.0.0-beta.11...1.0.0-beta.12