From 6fddfb3a37cf6b91372ba6d70b80a28116a7c314 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 16 Sep 2026 17:38:49 +0800 Subject: [PATCH 1/2] docs: prepare bilingual SILO 20260916 release notes Signed-off-by: Feng Ruohang --- content/blog/release/silo-20260916.md | 120 +++++++++++++++++++++++ content/blog/release/silo-20260916.zh.md | 72 ++++++++++++++ content/compatibility/versions.md | 2 +- content/compatibility/versions.zh.md | 2 +- 4 files changed, 194 insertions(+), 2 deletions(-) create mode 100644 content/blog/release/silo-20260916.md create mode 100644 content/blog/release/silo-20260916.zh.md diff --git a/content/blog/release/silo-20260916.md b/content/blog/release/silo-20260916.md new file mode 100644 index 00000000..4144470f --- /dev/null +++ b/content/blog/release/silo-20260916.md @@ -0,0 +1,120 @@ +--- +title: "SILO 20260916 Release Candidate" +linkTitle: "SILO 20260916 Release Candidate" +date: 2026-09-16 +summary: "Preparation for the September 16 server release: current components, correctness repairs, and coordinated upgrade requirements." +description: "Unpublished SILO 20260916000000 candidate and its component and upgrade contracts." +author: "Vonng" +tags: [Release] +url: "/blog/release/silo-20260916/" +draft: true +--- + +**Release preparation; not published.** The intended tag is +`RELEASE.2026-09-16T00-00-00Z`, with package version `20260916000000.0.0`. +The latest published Server remains [20260903](/blog/release/silo-20260903/). +This draft does not announce a new binary, package, image, chart, or deployment. + +## Components {#components} + +| Component | Candidate selection | +| --- | --- | +| Server | `RELEASE.2026-09-16T00-00-00Z` (planned) | +| Embedded Console | [v2.4.1](/blog/release/console-2.4.1/), source `1360e26d976d82eda395b0b2e449df8c9d49f39c` | +| MC module and bundled mcli | [20260916](/blog/release/mcli-20260916/), source `e952aa78f10a2b77dd525a2b7e3143bcda0cd377` | +| Shared package | `github.com/pgsty/silo-pkg/v3 v3.14.1` | +| Upstream S3 SDK | `github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176` | +| JWX / strfmt / LZ4 | v3.3.0 / v0.27.2 / v4.1.30 | +| Build toolchain | Go 1.27.1; GoReleaser 2.18.1 | +| Helm chart | 7.0.3 (prepared; publish after the Server image) | + +Console and MC retain their historical Go module paths. The Server selects +PGSTY source through immutable pseudo-versions +`v0.0.0-20260916075814-1360e26d976d` and +`v0.0.0-20260916070421-e952aa78f10a`, respectively. The maintained release +combination is SILO + Console + mcli + silo-pkg. Upstream MinIO/MC compatibility +remains best effort. Installing a standalone component does not update an +existing Server binary or its bundled client. + +## Changes since Server 20260903 {#changes} + +- **Authorization and request validation:** restrict the anonymous Console + download proxy to object-content GETs on the configured S3 origin and reject + redirects. Close unsigned-header paths described by + [SN-2026-011](/blog/security/20260913-signed-header-status/). Split + `admin:ChangeMyPassword` from `admin:CreateUser`; saved policies are not + rewritten. See the [password migration guide](/compatibility/password-permissions/). +- **IAM replication:** persist deletion revisions and parent revocation + boundaries, reload committed storage on peer notifications, and reject stale + replay of deleted identities, policies, or older grants. +- **Conditional writes and version deletion:** evaluate ordinary multi-pool + PUT and multipart-completion conditions against the logical current object + under the object lock. Ordinary single-object version deletion reconciles + copies across pools. If another pool cannot verify the relevant metadata, + these operations can fail even while GET/HEAD succeeds elsewhere. +- **Replication and existing metadata:** preserve object tags and their ordered + deletions, including SSE-KMS/SSE-C metadata paths; keep delete-marker identity + through MRF retries; prevent transport-only `aws-chunked` from becoming stored + Content-Encoding. Existing damaged replicas are not automatically repaired. +- **Multipart listing:** retain `legacy` as the default. The opt-in + `MINIO_API_MULTIPART_LISTING=strict` scans durable state and applies global + S3 pagination. Upgrade all writers, drain legacy uploads, run read-only + `multipart-preflight`, and assess scan capacity before enabling it. Strict + cancellation requires majority acknowledgements; default cancellation keeps + released quorum behavior. See the [compatibility contract](/blog/design/list-multipart-uploads/#implementation). +- **Reliability:** enforce an absolute HTTP/1 header-read deadline while keeping + progressing bodies under the existing idle timeout. Synchronize CPU metrics + reads to prevent concurrent map access from terminating the process during + Prometheus collection ([#210](https://github.com/pgsty/silo/issues/210)). +- **Other accumulated storage fixes:** preserve SSE-C plaintext sizes and key + rotation checksums; correct encrypted/federated copies and attributes + pagination; retain independent Object Lock, conditional DELETE, CORS, quota, + resync and bucket-metadata convergence repairs. Remove the experimental + access-frequency pool-tiering feature while keeping ordinary lifecycle, + remote tiering, rebalance and decommission. +- **Dependencies and packaging:** handle CopyObject errors embedded in HTTP 200, + escape JWX JSON field names, update strfmt hostname validation and LZ4 reader + handling, select the released Console frontend and client archives, and use + the same fixed GoReleaser/action in snapshot and release builds. Dependency + PRs run the packaging gate. + +The [Server changelog](https://github.com/pgsty/silo/blob/main/CHANGELOG.md) and +[component matrix](/compatibility/versions/) provide the detailed source and +operator boundaries. Console v2.4.1's standalone binary/package release is +available; public image delivery is a separate gate tracked in +[Console #34](https://github.com/pgsty/silo-console/issues/34). + +## Upgrade requirements {#upgrade} + +1. Read the [IAM upgrade and restore runbook](/operations/replication/iam-upgrade/). + Coordinate every participating server and site. Mixed old/new nodes sharing + an IAM backend and rolling downgrade are unsupported. +2. Back up complete IAM storage and the required encryption material. A live + admin export omits deletion history. Reissue credentials for recreated + parents and reconcile pre-upgrade revocations whose history has been lost. +3. Audit historical replicas using the + [metadata procedure](/operations/replication/replica-metadata-audit/). + Installing the candidate does not recover lost tags, undo accepted + overwrites, or prove historical purge convergence. +4. Keep multipart listing in its default legacy mode unless strict-mode + prerequisites are satisfied. Historical persisted `multipart_listing` keys + are ignored and can be removed with a targeted + `mcli admin config reset ALIAS api multipart_listing` before rollback. +5. For builds that used experimental access-frequency pool tiering, follow its + [migration notes](/compatibility/access-tiering-removal/). The feature was not + part of the published Server 20260903. + +A successful cancellation response does not prove that every drive has removed +the upload; delayed creation writes can still restore it. Replica repairs do +not add arbitrary clock-skew tolerance. A shorter header timeout also affects +TLS handshake reads; it is not a total upload/download duration limit. + +## Acceptance boundary {#acceptance} + +This remains a draft until the exact candidate source and its packaged +artifacts pass the [final integration gate](https://github.com/pgsty/silo/issues/203). +That gate covers unit/race/build checks, both supported Linux architectures, +embedded and standalone Console, mcli operations, real multi-process +replication and coordinated upgrade/restore. Signed packages, checksums, +provenance, public images, chart publication and production deployment remain +separate deliverables. No production upgrade is performed by this preparation. diff --git a/content/blog/release/silo-20260916.zh.md b/content/blog/release/silo-20260916.zh.md new file mode 100644 index 00000000..b3936f98 --- /dev/null +++ b/content/blog/release/silo-20260916.zh.md @@ -0,0 +1,72 @@ +--- +title: "SILO 20260916 发布候选" +linkTitle: "SILO 20260916 发布候选" +date: 2026-09-16 +summary: "9 月 16 日服务端发布准备：最新组件、正确性修复与协调升级要求。" +description: "尚未发布的 SILO 20260916000000 候选版本、组件组合与升级契约。" +author: "Vonng" +tags: [Release] +url: "/zh/blog/release/silo-20260916/" +draft: true +--- + +**发布准备中，尚未正式发布。** 计划标签为 `RELEASE.2026-09-16T00-00-00Z`， +系统包版本为 `20260916000000.0.0`。最新正式 Server 仍是 +[20260903](/zh/blog/release/silo-20260903/)。本文草稿不表示二进制、软件包、镜像、Chart 或部署已经交付。 + +## 组件版本 {#components} + +| 组件 | 候选版本选择 | +| --- | --- | +| Server | `RELEASE.2026-09-16T00-00-00Z`（计划） | +| 内嵌 Console | [v2.4.1](/zh/blog/release/console-2.4.1/)，源码 `1360e26d976d82eda395b0b2e449df8c9d49f39c` | +| MC 模块与内置 mcli | [20260916](/zh/blog/release/mcli-20260916/)，源码 `e952aa78f10a2b77dd525a2b7e3143bcda0cd377` | +| 共享包 | `github.com/pgsty/silo-pkg/v3 v3.14.1` | +| 上游 S3 SDK | `github.com/minio/minio-go/v7 v7.3.1-0.20260915093545-32e1f32cb176` | +| JWX / strfmt / LZ4 | v3.3.0 / v0.27.2 / v4.1.30 | +| 构建工具 | Go 1.27.1；GoReleaser 2.18.1 | +| Helm Chart | 7.0.3（已准备，等待 Server 镜像后发布） | + +Console 与 MC 保留历史 Go 模块路径。Server 通过不可变伪版本 +`v0.0.0-20260916075814-1360e26d976d` 与 +`v0.0.0-20260916070421-e952aa78f10a` 选择 PGSTY 源码。 +正式维护与验收组合是 SILO + Console + mcli + silo-pkg；对原厂 MinIO/MC 的兼容仍为尽最大努力。 +单独升级某个组件不会替换现有 Server 二进制或镜像中的客户端。 + +## 相对 Server 20260903 的变化 {#changes} + +- **授权与请求校验：** Console 匿名下载代理仅接受配置 S3 origin 上的对象内容 GET，并拒绝跳转。 + 修复 [SN-2026-011](/zh/blog/security/20260913-signed-header-status/) 中的未签名请求头路径。 + `admin:ChangeMyPassword` 与 `admin:CreateUser` 分离，已有策略不会自动改写；见[密码权限迁移](/zh/compatibility/password-permissions/)。 +- **IAM 复制：** 持久化删除版本与父身份撤销边界；收到节点通知后重新加载已提交存储，防止旧事件重放恢复已删身份、策略与旧授权。 +- **条件写入与版本删除：** 普通多池 PUT、分片完成在现有对象锁内使用逻辑当前对象判断条件；普通单对象版本删除协调所有池中的副本。 + 其他池无法验证相关元数据时，这些操作可能失败，即使另一个池仍能提供 GET/HEAD。 +- **复制与历史元数据：** 保留对象标签与有序删除，包括 SSE-KMS/SSE-C 元数据路径；MRF 重试保留删除标记身份；阻止传输用的 `aws-chunked` 写入对象 Content-Encoding。 + 已损坏的历史副本不会自动修复。 +- **分片列举：** 默认仍为 `legacy`。显式启用 `MINIO_API_MULTIPART_LISTING=strict` 后，扫描持久化状态并执行全局 S3 分页。 + 启用前必须升级所有 writer、排空旧上传、运行只读 `multipart-preflight` 并评估扫描容量。严格取消需要多数盘确认，默认取消保留已发布版本的 quorum 行为；见[兼容契约](/zh/blog/design/list-multipart-uploads/#implementation)。 +- **可靠性：** HTTP/1 请求头使用绝对读取期限，持续进行的正文传输保留既有空闲超时。 + CPU 指标读取增加同步，避免 Prometheus 抓取时并发访问 map 导致整个进程退出（[#210](https://github.com/pgsty/silo/issues/210)）。 +- **其他累计存储修复：** 保留 SSE-C 明文分片大小与密钥轮换校验和，修复加密/联邦复制与属性分页；保留独立的 Object Lock、条件 DELETE、CORS、配额、resync 与桶元数据收敛修复。 + 移除实验性的访问频率池间分层，普通生命周期、远端分层、再平衡和退役功能保持可用。 +- **依赖与打包：** 正确处理 HTTP 200 中嵌入的 CopyObject 错误，转义 JWX JSON 字段名，更新 strfmt 主机名校验与 LZ4 读取行为；引用已发布的 Console 前端与客户端归档；快照和正式发布使用相同的固定 GoReleaser 与 Action，仅修改依赖的 PR 也执行打包门禁。 + +详细源码与运维边界见 [Server changelog](https://github.com/pgsty/silo/blob/main/CHANGELOG.md) 和[组件矩阵](/zh/compatibility/versions/)。 +独立 Console v2.4.1 的二进制和软件包已发布；公共镜像交付是单独的门禁，由 [Console #34](https://github.com/pgsty/silo-console/issues/34) 跟踪。 + +## 升级要求 {#upgrade} + +1. 阅读 [IAM 升级与恢复手册](/zh/operations/replication/iam-upgrade/)，协调升级所有参与节点与站点。不支持共享 IAM 后端的新旧版本混跑，也不支持滚动降级。 +2. 备份完整 IAM 存储及所需加密材料。普通管理导出不包含删除历史。同名父身份重建后重新签发凭据，并核对升级前已经丢失历史的撤销记录。 +3. 按[元数据审计流程](/zh/operations/replication/replica-metadata-audit/)核对历史副本。安装候选版本不会恢复已丢标签、撤销曾经接受的覆盖写，也不能证明历史清除任务已经收敛。 +4. 满足严格模式前置条件之前，分片列举保留默认 legacy 模式。历史持久化 `multipart_listing` 配置键会被忽略；回滚前可用 `mcli admin config reset ALIAS api multipart_listing` 定向清理。 +5. 使用过实验性访问频率池间分层的构建，应遵循其[迁移说明](/zh/compatibility/access-tiering-removal/)。已发布 Server 20260903 不包含该功能。 + +成功取消上传不代表每块盘都已完成物理清理；延迟到达的创建写入仍可能恢复上传。 +复制修复不增加任意站点时钟偏差的容忍保证。缩短请求头超时也会约束 TLS 握手读取，但它不是上传下载总时长限制。 + +## 验收边界 {#acceptance} + +精确候选源码及其制品通过[最终集成门禁](https://github.com/pgsty/silo/issues/203)之前，本文保持草稿。 +验收范围包括单元/竞态/构建、Linux 双架构、内嵌与独立 Console、mcli 操作、真实多进程复制，以及协调升级与恢复。 +软件包签名、校验和、来源证明、公共镜像、Chart 发布与生产部署分别交付。本次准备不执行生产升级。 diff --git a/content/compatibility/versions.md b/content/compatibility/versions.md index 9bc4c7f3..0df18ee8 100644 --- a/content/compatibility/versions.md +++ b/content/compatibility/versions.md @@ -63,7 +63,7 @@ a build containing them. | --- | --- | --- | | Multi-pool storage | [#188](https://github.com/pgsty/silo/pull/188)
[#189](https://github.com/pgsty/silo/pull/189) | Ordinary single-object version DELETE reconciles copies across pools; reconciliation preserves tag state. The opt-in GET-frequency pool-tiering feature was removed. | | Conditional multipart completion | [#190](https://github.com/pgsty/silo/pull/190) | Preconditions use the logical current object across all pools, preventing an older pool copy from accepting a stale ETag or rejecting the current one. | -| Multipart discovery and cancellation | [#198](https://github.com/pgsty/silo/pull/198) | Discover persistent uploads across pools and sets, continue after native marker uploads disappear, and require majority cancellation confirmations. Strict mode requires a coordinated writer upgrade and legacy drain; see the [upgrade contract](/blog/design/list-multipart-uploads/#implementation). | +| Multipart discovery and cancellation | [#198](https://github.com/pgsty/silo/pull/198) | Default legacy listing and cancellation retain released behavior. Opt-in strict mode discovers durable uploads across pools/sets, continues after marker uploads disappear, and requires majority cancellation acknowledgements ([#213](https://github.com/pgsty/silo/pull/213)). Strict mode requires a coordinated writer upgrade and legacy drain; see the [upgrade contract](/blog/design/list-multipart-uploads/#implementation). | | Ordinary conditional PUT | [#207](https://github.com/pgsty/silo/pull/207) | Public write conditions use the logical current object across all pools, including draining pools. Readability and destination-version changes are detailed [below](#conditional-put). | | IAM revocations | [#191](https://github.com/pgsty/silo/pull/191)
[#192](https://github.com/pgsty/silo/pull/192) | Peer deletion notifications reload committed state. Durable deletion versions and retained revocation boundaries prevent stale site replay from restoring revoked identities or their older grants. | | Replicated tags and delete markers | [#193](https://github.com/pgsty/silo/pull/193)
[#196](https://github.com/pgsty/silo/pull/196) | SSE-KMS copies preserve tag revision times; tag deletion advances its revision and resists delayed events. Delete-marker purges retain their identity and retry state through MRF recovery. | diff --git a/content/compatibility/versions.zh.md b/content/compatibility/versions.zh.md index 8bac65ef..a158b845 100644 --- a/content/compatibility/versions.zh.md +++ b/content/compatibility/versions.zh.md @@ -56,7 +56,7 @@ Console 嵌入前端已按此依赖图重新构建。历史 Go 模块路径没 | --- | --- | --- | | 多池存储 | [#188](https://github.com/pgsty/silo/pull/188)
[#189](https://github.com/pgsty/silo/pull/189) | 普通单对象版本 DELETE 协调各池副本，副本协调保留标签状态；移除可选的 GET 访问频率池间分层功能。 | | 分片完成条件 | [#190](https://github.com/pgsty/silo/pull/190) | 前置条件使用所有池中的逻辑最新对象，避免旧副本接受过期 ETag，或拒绝当前 ETag。 | -| 分片发现与取消 | [#198](https://github.com/pgsty/silo/pull/198) | 跨 pool/set 发现持久上传，原生 marker 对应上传消失后仍能续页，取消需要多数盘确认。严格模式要求所有 writer 升级并排空旧上传，见[升级契约](/zh/blog/design/list-multipart-uploads/#implementation)。 | +| 分片发现与取消 | [#198](https://github.com/pgsty/silo/pull/198) | 默认 legacy 列举与取消保留已发布行为。显式启用严格模式后，跨 pool/set 发现持久上传、在 marker 上传消失后继续分页，并要求多数盘确认取消（[#213](https://github.com/pgsty/silo/pull/213)）。严格模式要求所有 writer 升级并排空旧上传，见[升级契约](/zh/blog/design/list-multipart-uploads/#implementation)。 | | 普通条件 PUT | [#207](https://github.com/pgsty/silo/pull/207) | 公开写入条件使用所有池中的逻辑当前对象，包括正在退役或再平衡的池；可读性及目标版本行为变化见[下文](#conditional-put)。 | | IAM 撤销 | [#191](https://github.com/pgsty/silo/pull/191)
[#192](https://github.com/pgsty/silo/pull/192) | 节点间删除通知重新加载已提交状态；持久化删除版本与撤销边界，防止旧站点事件重放恢复已撤销身份或旧授权。 | | 标签与删除标记 | [#193](https://github.com/pgsty/silo/pull/193)
[#196](https://github.com/pgsty/silo/pull/196) | SSE-KMS 复制保留标签修订时间；删除标签推进修订并抵御延迟事件；删除标记清除在 MRF 恢复时保留标记身份和重试状态。 | From 8e245c7cb5ce1a31adc9f9ac95100e43387b0fac Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 16 Sep 2026 18:05:55 +0800 Subject: [PATCH 2/2] docs: reconcile credentials at every restored site Signed-off-by: Feng Ruohang --- content/operations/replication/iam-upgrade.md | 9 ++++++++- content/operations/replication/iam-upgrade.zh.md | 6 +++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/content/operations/replication/iam-upgrade.md b/content/operations/replication/iam-upgrade.md index a6c28c9d..d90f9a02 100644 --- a/content/operations/replication/iam-upgrade.md +++ b/content/operations/replication/iam-upgrade.md @@ -171,7 +171,14 @@ The isolated object-store and etcd rehearsals passed this policy with the credential checks below. Apply the same checks to the actual recovery group before approving access. -The following shows the operations against a protected recovery alias. Replace +Check and apply reconciliation at **every restored site**. A successful command +at one site does not prove that the others applied it. After restoring an old +object-store snapshot with its old binaries, do not rely on site replication +alone to propagate revocations. Confirm already-removed service keys are absent, +keep replacement identities and credentials consistent across the recovery +group, and require the per-process credential checks below before opening access. + +The following shows the operations against one protected recovery alias. Replace the uppercase names with reviewed entries. User creation prompts for a secret; service-account creation prints credentials, which belong in the approved secret store rather than the rehearsal log. diff --git a/content/operations/replication/iam-upgrade.zh.md b/content/operations/replication/iam-upgrade.zh.md index 3a9c9f50..1075c3ff 100644 --- a/content/operations/replication/iam-upgrade.zh.md +++ b/content/operations/replication/iam-upgrade.zh.md @@ -117,7 +117,11 @@ etcdutl snapshot status iam-upgrade-evidence/etcd.db --write-out=json 按经过核对的变更清单选择用户、密钥和策略；所有已知站点均须在隔离恢复组内在线，陈旧或状态不明的节点保持隔离。 对象存储与 etcd 隔离演练均已在通过下面的凭据检查后验证这一策略；实际恢复组仍须通过同样检查才能开放访问。 -以下命令使用已安全配置的恢复别名，将大写名称替换为清单中核实的条目。 +对**每个恢复站点**分别核对并应用调和操作。一个站点的命令成功，不代表其他站点已经生效。 +使用旧二进制恢复对象存储旧快照后，不应仅依赖站点复制传播撤销。 +已删除的服务密钥须确认为缺失，替代身份与凭据须在恢复组内保持一致，再通过下述逐进程凭据检查，才能开放访问。 + +以下命令以一个已安全配置的恢复别名为例，将大写名称替换为清单中核实的条目。 创建用户时会提示输入密钥，创建服务账户会输出凭据；这些凭据应进入指定密钥存储，不应写入演练日志。 ```bash