mirror of
https://github.com/pgsty/minio.git
synced 2026-09-13 05:54:04 +03:00
docs: align release notes and current component status
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
@@ -1,5 +1,11 @@
|
||||
# Password and user-management permissions
|
||||
|
||||
> **Release boundary, 2026-09-13:** this guide describes Server main, paired with
|
||||
> silo-pkg v3.14.0 and Console source `417559bb2c97` or its accepted successor.
|
||||
> The latest published Server 20260903 and Console v2.4.0 do not contain this
|
||||
> split. The pkg v3.14.0 and mcli 20260913 releases alone do not change an old
|
||||
> Server's authorization. See [the component matrix](https://silo.pgsty.com/compatibility/versions/).
|
||||
|
||||
**Breaking change: the password-permission split changes the meaning of
|
||||
existing IAM policies.** The same stored policy can authorize a request after
|
||||
this update that it denied before, or deny a request it previously authorized.
|
||||
|
||||
@@ -1,5 +1,11 @@
|
||||
# SILO stack: Go 1.27 compatibility audit
|
||||
|
||||
> This is a dated investigation, with the source and runtime boundaries recorded
|
||||
> below. It does not establish the current dependency pins or a later release.
|
||||
> See [the current changelog](../../CHANGELOG.md) and
|
||||
> [component matrix](https://silo.pgsty.com/compatibility/versions/).
|
||||
|
||||
|
||||
2026-09-09. Scope: the maintained Server, silo-pkg, mcli, and Console. This extends
|
||||
the [OIDC #154 investigation](issue-154.md) to other paths using the same TLS
|
||||
configuration and to adjacent standard-library changes. It records local
|
||||
|
||||
@@ -1,5 +1,11 @@
|
||||
# SILO #154：OIDC discovery 连接重置调查
|
||||
|
||||
> This is a dated investigation, with the source and runtime boundaries recorded
|
||||
> below. It does not establish the current dependency pins or a later release.
|
||||
> See [the current changelog](../../CHANGELOG.md) and
|
||||
> [component matrix](https://silo.pgsty.com/compatibility/versions/).
|
||||
|
||||
|
||||
前两轮调查时间：2026-09-09；公开 issue 最后核对于 07:53 UTC。第二轮补充同源码、同依赖、不同 Go 工具链的 Linux 完整 Server 对照和候选补丁认证链路验证。
|
||||
|
||||
**后续更新：用户已授权扩展至整个 SILO 技术栈并修复。现已确认 Server 其他 TLS 路径也存在同类覆盖问题，并在产品工作区完成统一使用 Go 默认曲线的修复。当前实现、验证和交付状态见 [全栈调查](go127-stack.md)。下文保留前两轮的诊断与当时的 OIDC 局部候选；“未修改产品”和“不要扩大范围”等表述仅适用于当时的调查阶段，局部候选已被后续全路径修复取代。**
|
||||
|
||||
@@ -1,5 +1,11 @@
|
||||
# Remaining release correctness work, 2026-09-11
|
||||
|
||||
> This is a dated investigation, with the source and runtime boundaries recorded
|
||||
> below. It does not establish the current dependency pins or a later release.
|
||||
> See [the current changelog](../../CHANGELOG.md) and
|
||||
> [component matrix](https://silo.pgsty.com/compatibility/versions/).
|
||||
|
||||
|
||||
This records the three work items agreed after the branch/PR consolidation:
|
||||
OIDC #154, Linux restart/readback #116, and the related multi-pool defects
|
||||
#133/#144. The maintained target is SILO with the PGSTY Console, mcli and
|
||||
|
||||
@@ -12,6 +12,14 @@ The first Silo community release was cut from upstream history that already cont
|
||||
| :-- | :-- | :-- | :-- | :-- |
|
||||
| [CVE-2025-62506](https://github.com/advisories/GHSA-jjjj-jwhf-8rgr) | [minio/minio#21642](https://github.com/minio/minio/pull/21642), merged as [`c1a49490`](https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190) | The same commit object is present as [`pgsty/silo@c1a49490`](https://github.com/pgsty/silo/commit/c1a49490c78e9c3ebcad86ba0662319138ace190) | The inherited [service-account](https://github.com/pgsty/silo/blob/c1a49490c78e9c3ebcad86ba0662319138ace190/cmd/admin-handlers-users_test.go#L211-L212) and [STS](https://github.com/pgsty/silo/blob/c1a49490c78e9c3ebcad86ba0662319138ace190/cmd/sts-handlers_test.go#L45-L46) regression groups run for root and non-root parents through `go test ./cmd` | Resets `DenyOnly` while evaluating a restricted session policy so service or STS accounts cannot mint an unrestricted child service account. Upstream first fixed this in [`RELEASE.2025-10-15T17-29-55Z`](https://github.com/minio/minio/releases/tag/RELEASE.2025-10-15T17-29-55Z); every Silo community release, beginning with [`RELEASE.2025-12-03T12-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2025-12-03T12-00-00Z), contains it. Operators migrating from an older upstream build should upgrade and audit service accounts created by restricted service or STS identities. |
|
||||
|
||||
## Current release boundary (2026-09-13)
|
||||
|
||||
The latest published Server is `RELEASE.2026-09-03T13-18-01Z`.
|
||||
SN-2026-011 is fixed on main but remains present in that release and all earlier
|
||||
public Server releases. A newer mcli, pkg or standalone Console does not patch
|
||||
an installed Server. See [CHANGELOG.md](../../CHANGELOG.md) and the
|
||||
[component matrix](https://silo.pgsty.com/compatibility/versions/) for source pins.
|
||||
|
||||
## Advisories since `RELEASE.2026-03-21T00-00-00Z`
|
||||
|
||||
| ID | Fixed by | Affected area | Remote exploitability | Summary | Upgrade / workaround notes |
|
||||
|
||||
Reference in New Issue
Block a user