From 0079723d35d29a0134d81a7d8d502b1040cec64f Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 2 Sep 2026 14:51:10 +0800 Subject: [PATCH] deps: return to upstream minio-go and embed Console 43f8447fd The silo-go fork is retired: silo-pkg v3.13.0, Console v2.3.0, and mcli 20260901 all require upstream github.com/minio/minio-go/v7 again. Drop the replacement and require the same upstream pre-release they use (v7.3.1-0.20260828014306-0e78d3f18efe, one commit past the fork's base). Console moves from e07ef01 (v2.2.1 plus pins) to 43f8447fd, the last commit of the v2.3.0 line before Console adopted the github.com/pgsty/silo-pkg/v3 module path. It carries the six v2.3.0 security fixes (forwarding-header trust, outbound TLS verification, credential redaction, WebSocket session and connection caps), the IAM wildcard and session-identity fixes, and their regenerated assets, while still consuming silo-pkg through the existing replacement. mc stays on the last commit before its own path migration; silo-pkg stays on the last commit that declares the github.com/minio/pkg/v3 path, which differs from v3.13.0 only by that path change. CREDITS follows the module set. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q Signed-off-by: Feng Ruohang --- CREDITS | 73 ++++++++++++++++++++++++++++++------- docs/security/advisories.md | 2 +- go.mod | 17 +++------ go.sum | 8 ++-- 4 files changed, 71 insertions(+), 29 deletions(-) diff --git a/CREDITS b/CREDITS index bc847b4a9..cae12f82a 100644 --- a/CREDITS +++ b/CREDITS @@ -17599,20 +17599,67 @@ For more information on this, and how to apply and follow the GNU AGPL, see Bundled NOTICE file: -This file is part of Console Server +SILO Console +============ -This program is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as published by -the Free Software Foundation, either version 3 of the License, or -(at your option) any later version. +This product includes software developed at MinIO, Inc. (https://min.io/): +MinIO Console, Copyright (c) 2015-2026 MinIO, Inc. -This program is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. +SILO Console (this distribution, published from https://github.com/pgsty/silo-console +and shipped as `silo-console`) is a community-maintained fork of MinIO Console. +The code was carried forward through two earlier community maintenance lines +before this one: -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . + - Alevsk/console https://github.com/Alevsk/console + - georgmangold/console https://github.com/georgmangold/console + Console portions Copyright (c) Georg Mangold and contributors + +Copyright in inherited code remains with MinIO, Inc. and the respective +contributors. Modifications authored for SILO by PGSTY are +Copyright (c) 2025-2026 PGSTY (Ruohang Feng) and the SILO contributors; other +modifications remain the copyright of their respective authors. All existing +copyright, license and attribution notices are kept intact. + +SILO and SILO Console are independent community projects and are not +affiliated with, endorsed by, or sponsored by MinIO, Inc. MinIO(R) is a +registered trademark of MinIO, Inc. Amazon S3 is a trademark of Amazon.com, +Inc. or its affiliates; references to S3 describe protocol compatibility only. + +License +------- + +This program is free software: you can redistribute it and/or modify it under +the terms of the GNU Affero General Public License as published by the Free +Software Foundation, either version 3 of the License, or (at your option) any +later version. + +This program is distributed in the hope that it will be useful, but WITHOUT +ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS +FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more +details. + +You should have received a copy of the GNU Affero General Public License along +with this program (the LICENSE file next to this notice). If not, see +. + +Corresponding source +-------------------- + +Under section 13 of the AGPL, every user who interacts with this program over a +network is offered its corresponding source. A release build reports the exact +source revision it was built from: `console version` prints it, the HTTP server +serves it in the page metadata used by the License, Login and anonymous pages, +and the container image carries it in the `io.pgsty.silo-console.source` +label. A build that cannot prove its exact revision says so instead of +guessing; operators of such builds must publish their modified source and may +point users at it with CONSOLE_CORRESPONDING_SOURCE_URL. + +Third-party notices +------------------- + +The licenses and notices of every third-party component linked into the binary +or bundled into the web application are collected in the CREDITS file next to +this notice (`console credits`, or /legal/CREDITS on a running server). ================================================================ @@ -21707,8 +21754,8 @@ https://github.com/minio/md5-simd ================================================================ -github.com/minio/minio-go/v7 (replaced by github.com/pgsty/silo-go/v7) -https://github.com/pgsty/silo-go/v7 +github.com/minio/minio-go/v7 +https://github.com/minio/minio-go/v7 ---------------------------------------------------------------- Apache License diff --git a/docs/security/advisories.md b/docs/security/advisories.md index 0f5986d39..d980ac265 100644 --- a/docs/security/advisories.md +++ b/docs/security/advisories.md @@ -41,7 +41,7 @@ The first Silo community release was cut from upstream history that already cont | `CVE-2026-34986` | `68e0ba997` | Upgrades `go-jose` to `v4.1.4`. | | `CVE-2026-39883` | `1869bd30b`, `e4fa06394` | Updates OpenTelemetry dependencies. | | Upstream Go security fixes | [Go 1.26.5](https://go.dev/doc/devel/release#go1.26.5) | Bumps the required toolchain to Go 1.26.5, which includes security fixes to `crypto/tls` and `os`. | -| Toolchain and dependency refresh | [Go 1.27.0](https://go.dev/doc/devel/release#go1.27) via [`43f4bb7ed`](https://github.com/pgsty/silo/commit/43f4bb7ed), [`edc8be6ed`](https://github.com/pgsty/silo/commit/edc8be6ed), [`4d6e1ea8e`](https://github.com/pgsty/silo/commit/4d6e1ea8e) | Moves the toolchain to Go 1.27.0 and refreshes the dependency stack (Silo Go v7.3.1, etcd client v3.7.1, `jwx` v3.0.13, `klauspost/compress` v1.19.2). `govulncheck` reports no reachable vulnerability at `6586fbfd0`. | +| Toolchain and dependency refresh | [Go 1.27.0](https://go.dev/doc/devel/release#go1.27) via [`43f4bb7ed`](https://github.com/pgsty/silo/commit/43f4bb7ed), [`edc8be6ed`](https://github.com/pgsty/silo/commit/edc8be6ed), [`4d6e1ea8e`](https://github.com/pgsty/silo/commit/4d6e1ea8e) | Moves the toolchain to Go 1.27.0 and refreshes the dependency stack (upstream `minio-go` v7.3.1 pre-release, etcd client v3.7.1, `jwx` v3.0.13, `klauspost/compress` v1.19.2; the `silo-go` fork is no longer used). `govulncheck` reports no reachable vulnerability at `6586fbfd0`. | | [GO-2026-6061](https://pkg.go.dev/vuln/GO-2026-6061) / [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf) | gRPC `v1.82.1` | Updates gRPC to the first fixed version for vulnerabilities in the xDS RBAC authorization engine and HTTP/2 transport server. | | [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) / `CVE-2026-56852` | `x/text` `v0.39.0` | Updates `x/text` to the first fixed version for an infinite loop on invalid input. | diff --git a/go.mod b/go.mod index 8b7e79a1e..ee2ee4a10 100644 --- a/go.mod +++ b/go.mod @@ -2,16 +2,11 @@ module github.com/minio/minio go 1.27.0 -// Use PGSTY's maintained Silo Go SDK while preserving upstream import paths. -// Keep the required version on a real upstream tag because replace directives -// are ignored when this module is consumed as a dependency. -replace github.com/minio/minio-go/v7 => github.com/pgsty/silo-go/v7 v7.3.1 - // Use Pigsty's SILO Console while preserving upstream import paths. The -// pseudo-version pins v2.2.1 plus its dependency pins: the last Console commit -// that still consumes silo-pkg through the github.com/minio/pkg/v3 replacement -// below. Console v2.3.0 and later require github.com/pgsty/silo-pkg/v3 directly. -replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260829111139-e07ef01ab8bf +// pseudo-version pins the last commit of the v2.3.0 line before Console moved +// to the github.com/pgsty/silo-pkg/v3 module path: it carries the v2.3.0 +// security fixes and still consumes silo-pkg through the replacement below. +replace github.com/minio/console => github.com/pgsty/silo-console v0.0.0-20260901090952-43f8447fda38 // Use Pigsty's maintained mc fork for Console's embedded client code. replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260829103737-5ed037ef4ec1 @@ -19,7 +14,7 @@ replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260829103737-5ed037e // Use Pigsty's maintained SILO package fork while preserving upstream import paths. // This retains the LDAP TLS fix tracked in https://github.com/pgsty/silo/issues/15, // the minio/minio#20449 bucket-write boundary hardening, bare ARN rejection on -// strict policy-write paths, and Silo Go v7.3.1. It is the last silo-pkg commit +// strict policy-write paths. It is the last silo-pkg commit // that declares the github.com/minio/pkg/v3 module path; v3.13.0 moved to // github.com/pgsty/silo-pkg/v3 and cannot be selected through this replace. replace github.com/minio/pkg/v3 => github.com/pgsty/silo-pkg/v3 v3.12.3-0.20260829103855-748c94bf8ab7 @@ -84,7 +79,7 @@ require ( github.com/minio/kms-go/kes v0.3.1 github.com/minio/kms-go/kms v0.6.0 github.com/minio/madmin-go/v3 v3.0.110 - github.com/minio/minio-go/v7 v7.3.0 + github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe github.com/minio/mux v1.9.2 github.com/minio/pkg/v3 v3.6.1 github.com/minio/selfupdate v0.6.0 diff --git a/go.sum b/go.sum index 8eeac07fc..1bd597f81 100644 --- a/go.sum +++ b/go.sum @@ -474,6 +474,8 @@ github.com/minio/madmin-go/v3 v3.0.110 h1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJ github.com/minio/madmin-go/v3 v3.0.110/go.mod h1:WOe2kYmYl1OIlY2DSRHVQ8j1v4OItARQ6jGyQqcCud8= github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34= github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM= +github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe h1:By2FKNSOUGLOeb0x4D7xJMHr8x/X1ZW8PG780SpKUwQ= +github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk= github.com/minio/mux v1.9.2 h1:dQchne49BUBgOlxIHjx5wVe1gl5VXF2sxd4YCXkikTw= github.com/minio/mux v1.9.2/go.mod h1:OuHAsZsux+e562bcO2P3Zv/P0LMo6fPQ310SmoyG7mQ= github.com/minio/selfupdate v0.6.0 h1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU= @@ -543,10 +545,8 @@ github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwp github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/pgsty/mc v0.0.0-20260829103737-5ed037ef4ec1 h1:CotSAPr11rZy3VK46j5rJQYQ2LHT2mjrd9vf0Ak12bA= github.com/pgsty/mc v0.0.0-20260829103737-5ed037ef4ec1/go.mod h1:pwkfUxTikOkKc+yvEWqFg7CAPZDj5Yl0YHFcZoPKmU8= -github.com/pgsty/silo-console v0.0.0-20260829111139-e07ef01ab8bf h1:BwUlE3Qr5+/JWkdNYnpSFin7RW1Uiaf7ddGlR87Y9YQ= -github.com/pgsty/silo-console v0.0.0-20260829111139-e07ef01ab8bf/go.mod h1:Zqpx0h9NB5WzXI+OE/VVFcrXD6fKtSqqfCurmtxyKPo= -github.com/pgsty/silo-go/v7 v7.3.1 h1:CchXB5hdv1KGUCGBzR5Tz8hSE+3P9sGJFPY+ku8tC04= -github.com/pgsty/silo-go/v7 v7.3.1/go.mod h1:3uUcXVLE1xLBTy+A/js/hHKkvcYQ/zMbj8rbtNQavxE= +github.com/pgsty/silo-console v0.0.0-20260901090952-43f8447fda38 h1:PObL76LBUBKq+y9TPAmc8wlKD8C/BNyrXGjfUrWtUvk= +github.com/pgsty/silo-console v0.0.0-20260901090952-43f8447fda38/go.mod h1:NHgq4XTLPa+Zt9lAIouHzgiFMULcyYjC3VwcMSuZf8U= github.com/pgsty/silo-pkg/v3 v3.12.3-0.20260829103855-748c94bf8ab7 h1:YSCnSqNjU2ddU84dA8ybJXOoWYx8VDu2qAzXMVweisc= github.com/pgsty/silo-pkg/v3 v3.12.3-0.20260829103855-748c94bf8ab7/go.mod h1:hSvfIz9FWTvEZqTsGEWQ8P/gD81pDee9W4j5oIvHZMY= github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=