SILO 20261015: Superseded Draft Record

Status: Superseded by Server 20261018. RELEASE.2026-10-15T00-00-00Z was briefly published at 2026-10-15 13:52:28 (UTC+8), then reverted to Draft and superseded by Server 20261018, which includes the complete October repair and component stack. This page archives the candidate source scope and acceptance test results; use 20261018 for all deployments and upgrades.

• Historical tag: RELEASE.2026-10-15T00-00-00Z
• Package version: 20261015000000.0.0
• Candidate source: 7a3ca0f82100cce06289a465f54139da2639f642 (full diff against Server 20260916)

Object Lock repairs

• SN-2026-015 — Retention authorization (#234): every PutObjectRetention request requires s3:PutObjectRetention, evaluated with request-body Object Lock condition keys before reading object state. Shortening, clearing, or changing the mode of active GOVERNANCE retention additionally requires the explicit bypass header and s3:BypassGovernanceRetention (which does not override a Deny on s3:PutObjectRetention). Clearing retention evaluates remaining days as 0, and distant future dates no longer saturate duration arithmetic.
• SN-2026-016 — Protected version writes (#235): caller-selected write versionId parameters require trusted replication credentials (s3:ReplicateObject). Directory null versions and persisted multipart targets are checked under the destination write lock before overwrite (including uploads initiated before upgrading or recovered from legacy staging state), enforcing active GOVERNANCE, COMPLIANCE, and legal-hold protections; unreadable lock metadata fails closed.
• Release gate (#237): the release workflow runs the Object Lock race regression suite as a build prerequisite, covering slow-body directory overwrites, preflight read failures, legacy multipart completions against COMPLIANCE, and recovered-upload UUID collisions.

See the security advisory and repair design for full details.

Other changes since 20260916

Component identities

Upgrade requirements

1. Upgrade all writers and replication peers: upgrade every Server node and all replication sites accepting S3 writes so unpatched peers cannot accept unauthorized retention changes or in-place overwrites.
2. Review retention policies: policies granting s3:BypassGovernanceRetention without s3:PutObjectRetention, or relying on bypass to evade retention condition keys, now receive 403 AccessDenied.
3. Caller-selected versionId restriction: ordinary S3 writes (including root-signed requests) cannot specify a target versionId; trusted replication preserves version IDs, and mcli batch replicate into SILO requires s3:ReplicateObject on the destination credentials.
4. Fail-closed lock checks: locked directory objects and locked multipart targets cannot be overwritten; if lock metadata is unreadable, restore drive health before retrying.
5. Audit historical state: review prior audit logs for unexpected retention changes before the upgrade (when upgrading from releases prior to 20260916, also follow the September upgrade requirements).

Candidate artifact acceptance

The following CI workflows and verification checks passed against 7a3ca0f82100cce06289a465f54139da2639f642:

• Static artifact verification: verified all 36 release assets, 34 build provenance attestations, static version/commit identities across all 6 Linux/macOS/Windows amd64/arm64 binaries, payloads across all 6 RPM/DEB/APK packages, and both RPM signatures (see historical archive checksums and package checksums).
• macOS arm64 runtime acceptance (110/110 passed):

(Across those runs, all 65 rejected operations left the complete target object state unchanged; Windows and macOS amd64 binaries were verified statically.)

Docker images

Docker publication run 38689158028 built and attested the multi-platform (linux/amd64 and linux/arm64) images from the same release commit:

All four platform-specific images (whose /usr/bin/silo binaries matched the official Linux archive binaries byte for byte) passed /minio/health/ready probes and the full Object Lock API suite (196/196 passed, with all 120 rejected operations preserving object content, version identity, ETag, retention, legal hold, and version listings):

Combined with the native macOS arm64 installation and upgrade suite, candidate runtime acceptance passed 306/306 checks.