Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/crypto/sse-kms.go

@@ -24,6 +24,7 @@ import (
 	"net/http"
 	"path"
 	"strings"
+	"unicode/utf8"
 
 	jsoniter "github.com/json-iterator/go"
 	xhttp "github.com/minio/minio/internal/http"
@@ -79,6 +80,15 @@ func (ssekms) ParseHTTP(h http.Header) (string, kms.Context, error) {
 		if err != nil {
 			return "", nil, err
 		}
+		// Persisting invalid UTF-8 replaces bytes and can collapse distinct
+		// keys, changing the associated data needed to decrypt the object.
+		if !utf8.Valid(b) {
+			return "", nil, kms.Error{
+				Code:    http.StatusBadRequest,
+				APICode: "InvalidArgument",
+				Err:     "KMS context must be valid UTF-8",
+			}
+		}
 
 		json := jsoniter.ConfigCompatibleWithStandardLibrary
 		if err := json.Unmarshal(b, &ctx); err != nil {

internal/crypto/sse-kms_test.go

@@ -0,0 +1,66 @@
+// Copyright (c) 2026 Feng Ruohang
+//
+// This file is part of Silo Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+package crypto
+
+import (
+	"encoding/base64"
+	"errors"
+	"maps"
+	"net/http"
+	"testing"
+
+	xhttp "github.com/minio/minio/internal/http"
+	"github.com/minio/minio/internal/kms"
+)
+
+func TestKMSParseHTTPContext(t *testing.T) {
+	for _, tc := range []struct {
+		name, raw string
+		want      kms.Context
+		invalid   bool
+	}{
+		{name: "absent"},
+		{name: "empty", raw: `{}`, want: kms.Context{}},
+		{name: "null", raw: `null`},
+		{name: "unicode", raw: `{"区域":"杭州","emoji":"🔑","�":"replacement"}`, want: kms.Context{"区域": "杭州", "emoji": "🔑", "�": "replacement"}},
+		{name: "invalid-key", raw: "{\"\xff\":\"value\"}", invalid: true},
+		{name: "invalid-value", raw: "{\"tenant\":\"\xff\"}", invalid: true},
+		{name: "colliding-keys", raw: "{\"\xff\":\"a\",\"\xfe\":\"b\"}", invalid: true},
+		{name: "replacement-key", raw: "{\"\xff\":\"a\",\"�\":\"b\"}", invalid: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			header := http.Header{}
+			header.Set(xhttp.AmzServerSideEncryption, xhttp.AmzEncryptionKMS)
+			header.Set(xhttp.AmzServerSideEncryptionKmsID, "context-key")
+			if tc.raw != "" {
+				header.Set(xhttp.AmzServerSideEncryptionKmsContext, base64.StdEncoding.EncodeToString([]byte(tc.raw)))
+			}
+			key, context, err := S3KMS.ParseHTTP(header)
+			if tc.invalid {
+				var apiErr kms.Error
+				if !errors.As(err, &apiErr) || apiErr.Code != http.StatusBadRequest || apiErr.APICode != "InvalidArgument" {
+					t.Fatalf("invalid UTF-8: got %v, want 400 InvalidArgument", err)
+				}
+				return
+			}
+			if err != nil || key != "context-key" || !maps.Equal(context, tc.want) {
+				t.Fatalf("key=%q context=%v error=%v; want context=%v", key, context, err, tc.want)
+			}
+		})
+	}
+}