From 2b722b7e922a8a122ea3da1cf56617dd986ba13a Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 16 Sep 2026 07:51:11 +0800 Subject: [PATCH] docs: complete September correctness and upgrade notes Signed-off-by: Feng Ruohang --- CHANGELOG.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8dad9a0c4..8c05d4ab5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,25 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0 ### Authorization and security +- Persist IAM deletion revisions and parent revocation boundaries so stale site + events cannot restore deleted identities, policies or their older grants + (#191, #192). Peer deletion notifications reload committed storage; deliberate + recreation requires a newer revision, and credentials issued before the + parent's revocation remain invalid. + **Coordinated upgrade required:** upgrade every participating node and site. + Mixed old/new nodes sharing an IAM backend and rolling downgrade are + unsupported. Back up complete IAM storage and encryption material; an admin + export of live records omits deletion history. Reissue credentials for + recreated parents and explicitly reconcile pre-upgrade revocations whose + history is already lost. Restoring an older backup can lose later revocations; + keep affected sites isolated until reconciliation/rekeying is complete. See + [the operator runbook](https://silo.pgsty.com/operations/replication/iam-upgrade/). +- Enforce an absolute HTTP/1 request-header deadline through the connection + wrapper (#196). Repeated small reads no longer extend that deadline, and + `--read-header-timeout` / `MINIO_READ_HEADER_TIMEOUT` now reaches the HTTP + server. HTTP/1 request bodies retain the rolling idle timeout; this does not + impose a total upload/download duration. A shorter setting also constrains + TLS handshake reads. The wrapper's strict header mode is not applied to HTTP/2. - Reject unsigned `x-amz-*` request headers that could turn a signed PUT into a copy of another object accessible to the signer (SN-2026-011). The latest public Server is affected; the fix is on main. See [the advisory ledger](docs/security/advisories.md). @@ -22,16 +41,44 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0 ### Object storage and replication +- Preserve object tags during multi-pool metadata reconciliation by reading the + resolved tag field together with its revision (#189). Previously, reconciliation + could replace existing tags with an empty value. +- Preserve the tag revision on SSE-KMS metadata replication (#193), and advance + tag revisions monotonically on local PUT/DELETE tagging (#196). Empty tags + participate in reconciliation as an ordered deletion, preventing older + events from restoring removed tags. SSE-C key rotation also retains the tag + revision. Malformed historical revisions can fail and retry; their missing + history is not reconstructed by the upgrade. +- Complete delete-marker version purges and preserve their identity and retry + state through MRF recovery (#196). Recovery accepts a 405 marker response only + when its version, bucket, object name and modification time match the task. + Purge audit status is normalized from `COMPLETE` to `COMPLETED`. + Thanks to Julien Laurenceau (@julienlau) for the investigation and proposed + fix in #184 that helped shape this follow-up. +- Restore only the six replication-specific metadata fields after ordinary + request metadata extraction (#194). This prevents transport-only `aws-chunked` + from being stored as Content-Encoding while preserving the signed-header + protections. Trusted Snowball entries no longer inherit the outer archive's + ordinary metadata. Thanks to Mikhail Khadarenka (@chodorenko) for the fix in #187. + **Existing data:** these repairs prevent new errors; they do not scan or rewrite + historical object metadata, recover lost tags or prove that old purge work has + converged. Follow the [read-only audit procedure](https://silo.pgsty.com/operations/replication/replica-metadata-audit/) + before planning any repair of stored state. + - Evaluate conditional multipart completion against the logical current object across all pools while holding the existing object lock. A stale `If-Match` can no longer replace newer data in another pool, and the current ETag is no longer rejected because the upload resides next to an older copy. Conditions are evaluated once; a current delete marker counts as an absent object. - **Availability change:** if metadata cannot be read from any pool, conditional + **Availability change:** if any pool's metadata cannot be read, conditional completion fails even when another pool can still serve GET/HEAD. This also applies when the unreadable pool may not hold the object: absence cannot be verified. Retry after the pool recovers. Unconditional completion and the single-pool path retain their existing behavior. + Ordinary conditional PUT has a separate cross-pool precondition gap tracked + in [#199](https://github.com/pgsty/silo/issues/199); the multipart repair does + not resolve it. - Reconcile ordinary single-object version DELETE across all pools, including null versions, delete markers and unqualified directory-marker DELETE. This @@ -61,7 +108,7 @@ and [complete commit range](https://github.com/pgsty/silo/compare/RELEASE.2026-0 - Repair federated CopyObject checksums, destination timestamps, reserved metadata, encrypted-object forwarding, legal hold and KMS context. - Make resync counters, target selection, cancellation and worker lifetimes - reflect actual work; complete delete-marker purges and report bounded MRF drops. + reflect actual work, and report bounded MRF drops. - Converge bucket metadata with deterministic source state, deletion tombstones, creation time recovery and diagnostics. The mixed-version export gate requires coordinated upgrades before tombstones are exported. See [the #77 record](docs/investigations/issue-77-current.md).