Skip to content

PGSTY SILO Blog

  • SILO Console 2.4.1 Released

    In Release

    ReleaseConsole

    Featured Image for SILO Console 2.4.1 Released

    SILO Console v2.4.1 was released on September 16, 2026 from 1360e26d976d. It integrates pkg v3.14.1 and mcli 20260916, restricts the anonymous sharing proxy, streams multi-object ZIP downloads and adds signed, traceable release artifacts. Shared …

    SILO Console v2.4.1 was released on September 16, 2026 from 1360e26d976d. It integrates pkg v3.14.1 and mcli 20260916, restricts the anonymous sharing proxy, streams multi-object ZIP downloads and adds signed, traceable release artifacts. Shared …

  • Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    In Design

    DesignTLSOIDCOperations

    Featured Image for Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …

    After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …

  • Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    In Design

    DesignHTTPS3Review

    Featured Image for Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    This page records the repair of Server’s HTTP read deadlines, merged into main as part of PR #196 (fix 055030ea5). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the published Server 20260903. Evidence class: synthetic — a …

    This page records the repair of Server’s HTTP read deadlines, merged into main as part of PR #196 (fix 055030ea5). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the published Server 20260903. Evidence class: synthetic — a …

  • Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    In Design

    DesignReplicationS3Review

    Featured Image for Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …

    This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …

  • Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    In Design

    DesignReplicationS3Review

    Featured Image for Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …

    This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …

  • mcli 20260916 Released

    In Release

    Releasemcli

    Featured Image for mcli 20260916 Released

    Release: RELEASE.2026-09-16T00-00-00Z · Package: 20260916000000.0.0 · Source: e952aa78f10a. Changes since 20260913 Adopt silo-pkg v3.14.1, upstream minio-go v7.3.1-0.20260915093545-32e1f32cb176, and JWX v3.3.0. CopyObject retries and propagates S3 …

    Release: RELEASE.2026-09-16T00-00-00Z · Package: 20260916000000.0.0 · Source: e952aa78f10a. Changes since 20260913 Adopt silo-pkg v3.14.1, upstream minio-go v7.3.1-0.20260915093545-32e1f32cb176, and JWX v3.3.0. CopyObject retries and propagates S3 …

  • mcli 20260913 Released

    In Release

    Releasemcli

    Featured Image for mcli 20260913 Released

    Release: RELEASE.2026-09-13T00-00-00Z · Package: 20260913000000.0.0 · Source: 4f609a4d. Changes since 20260903 Preserve historical destination versions under mirror --remove --watch. Keep service-restart dry runs from executing a restart and make …

    Release: RELEASE.2026-09-13T00-00-00Z · Package: 20260913000000.0.0 · Source: 4f609a4d. Changes since 20260903 Preserve historical destination versions under mirror --remove --watch. Keep service-restart dry runs from executing a restart and make …

  • silo-pkg 3.14.0 Released

    In Release

    Releasepkg

    Featured Image for silo-pkg 3.14.0 Released

    v3.14.0 was published on 2026-09-13 from 827f8109. It is consumed directly as github.com/pgsty/silo-pkg/v3. Password-policy migration This release changes authorization semantics. The public Policy.IsAllowedActions method now reports …

    v3.14.0 was published on 2026-09-13 from 827f8109. It is consumed directly as github.com/pgsty/silo-pkg/v3. Password-policy migration This release changes authorization semantics. The public Policy.IsAllowedActions method now reports …

  • SN-2026-011: Fix and Release Status

    In Security

    Securitysilo

    Featured Image for SN-2026-011: Fix and Release Status

    Status on 2026-09-13: SN-2026-011 is fixed on Server main, starting with 123325430. The latest published Server, RELEASE.2026-09-03T13-18-01Z, and earlier public Server releases are affected. No new fixed Server release is established by the pkg …

    Status on 2026-09-13: SN-2026-011 is fixed on Server main, starting with 123325430. The latest published Server, RELEASE.2026-09-03T13-18-01Z, and earlier public Server releases are affected. No new fixed Server release is established by the pkg …

  • Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    In Design

    DesignReplicationS3Review

    Featured Image for Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    #77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …

    #77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …

  • Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    In Design

    DesignReplicationS3Review

    Featured Image for Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …

    This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …

  • An Unsigned Header Is Not Part of the Request

    In Design

    DesignSecuritySigV4CopyObjectPresignedCompatibility

    Featured Image for An Unsigned Header Is Not Part of the Request

    This record describes the unsigned-header coverage repair committed to SILO as 123325430 and merged through PR #173, tracked as SN-2026-011. It was reported by Oren Yomtov against a released build and reproduced locally on both signature paths. …

    This record describes the unsigned-header coverage repair committed to SILO as 123325430 and merged through PR #173, tracked as SN-2026-011. It was reported by Oren Yomtov against a released build and reproduced locally on both signature paths. …

  • SILO Console 2.4.0 Released

    In Release

    ReleaseConsole

    Featured Image for SILO Console 2.4.0 Released

    v2.4.0 was published on 2026-09-08 from c103d08e. September 16 follow-up: Console v2.4.1 is the current release. This article records the v2.4.0 behavior and dependencies. Released behavior Object-browser directories load 100 entries per page by …

    v2.4.0 was published on 2026-09-08 from c103d08e. September 16 follow-up: Console v2.4.1 is the current release. This article records the v2.4.0 behavior and dependencies. Released behavior Object-browser directories load 100 entries per page by …

  • mcli 20260903 Released

    In Release

    Releasemcli

    Featured Image for mcli 20260903 Released

    Published: 2026-09-03 · Version: RELEASE.2026-09-03T07-13-05Z · Source: a2ef95c0 Twenty-eight days after mcli 20260806, this release carries everything the client accumulated since. The toolchain moves to Go 1.27.1 and the shared dependency stack is …

    Published: 2026-09-03 · Version: RELEASE.2026-09-03T07-13-05Z · Source: a2ef95c0 Twenty-eight days after mcli 20260806, this release carries everything the client accumulated since. The toolchain moves to Go 1.27.1 and the shared dependency stack is …

  • Silo 20260903 Released

    In Release

    Releasesilo

    Featured Image for Silo 20260903 Released

    Status on 2026-09-13: this remains the latest published Server; its dependencies have not changed. Later security, storage and dependency fixes are on main, including the unreleased SN-2026-011 fix. New standalone mcli/pkg releases do not replace …

    Status on 2026-09-13: this remains the latest published Server; its dependencies have not changed. Later security, storage and dependency fixes are on main, including the unreleased SN-2026-011 fix. New standalone mcli/pkg releases do not replace …

  • SILO Server 20260903 Pre-release Review

    In Design

    DesignReviewSecurityCompatibilityRelease

    Featured Image for SILO Server 20260903 Pre-release Review

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

  • SILO 20260903 Security Notes: SN-2026-006 through 010

    In Security

    SecurityS3SSE-CReplicationIAM

    Featured Image for SILO 20260903 Security Notes: SN-2026-006 through 010

    Released in SILO 20260903. These fixes are part of RELEASE.2026-09-03T13-18-01Z. See the complete release notes for the 20260806-to-20260903 upgrade boundary, components, verification evidence, and known deferrals. This bulletin collects five …

    Released in SILO 20260903. These fixes are part of RELEASE.2026-09-03T13-18-01Z. See the complete release notes for the 20260806-to-20260903 upgrade boundary, components, verification evidence, and known deferrals. This bulletin collects five …

  • Explicit Version Deletes Now Require DeleteObjectVersion

    In Release

    ReleaseSecurityIAMS3Compatibility

    Featured Image for Explicit Version Deletes Now Require DeleteObjectVersion

    Release status: this change is implemented in pgsty/silo#104, tracking issue #58. Publishing this note does not by itself mean that a server release, package, image, or deployment contains the change. SILO now maps object-delete authorization to the …

    Release status: this change is implemented in pgsty/silo#104, tracking issue #58. Publishing this note does not by itself mean that a server release, package, image, or deployment contains the change. SILO now maps object-delete authorization to the …

  • No I/O Before Auth, No Privilege From Headers

    In Design

    DesignSecurityCORSReplicationSSE-CCompatibility

    Featured Image for No I/O Before Auth, No Privilege From Headers

    This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …

    This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …

  • Should SILO Fix ListMultipartUploads? Design Review of Issue #79

    In Design

    DesignS3CompatibilityMultipart

    Featured Image for Should SILO Fix ListMultipartUploads? Design Review of Issue #79

    This is the problem, design, and decision record for SILO issue #79. September 16 implementation and upgrade contract PR #198 retains mr javad seydi’s original metadata-and-scan contribution and adds maintainer fixes for disappearing markers, …

    This is the problem, design, and decision record for SILO issue #79. September 16 implementation and upgrade contract PR #198 retains mr javad seydi’s original metadata-and-scan contribution and adds maintainer fixes for disappearing markers, …