diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
new file mode 100644
index 000000000..4367c581b
--- /dev/null
+++ b/CONTRIBUTORS.md
@@ -0,0 +1,77 @@
+# Contributors
+
+Silo is maintained by the Pigsty community. This file records the people who have contributed to
+this fork since it was established in 2026 — merged code, proposed changes, and the bug reports and
+compatibility findings that shaped the releases.
+
+It is maintained by hand and updated at each release. GitHub's own contributor graph is unavailable
+here because `pgsty/silo` is a fork, so this file — not that page — is the project's attribution
+record. Contributors are listed by GitHub handle. Authorship of every merged commit is preserved in
+the Git history and can be verified with `git log --format='%an <%ae>'`.
+
+Upstream MinIO authorship is recorded separately: this fork derives from
+[`minio/minio`](https://github.com/minio/minio), [`NOTICE`](NOTICE) retains the upstream product
+notice, and the Git history carries the full upstream commit record.
+
+## Code
+
+Contributors whose changes are merged into `main`.
+
+| Contributor | Change | Pull request | Commit |
+| :-- | :-- | :-- | :-- |
+| [@ZouhairCharef](https://github.com/ZouhairCharef) | Upgraded `go-jose` to v4.1.4 to patch CVE-2026-34986 | [#18](https://github.com/pgsty/silo/pull/18) | [`68e0ba9`](https://github.com/pgsty/silo/commit/68e0ba997) |
+| [@mfredenhagen](https://github.com/mfredenhagen) | Bumped `go.opentelemetry.io` to address CVE-2026-39883 | [#19](https://github.com/pgsty/silo/pull/19) | [`1869bd3`](https://github.com/pgsty/silo/commit/1869bd30b) |
+| [@pinginfo](https://github.com/pinginfo) | Implemented `Flush` on `trackingResponseWriter`, repairing bucket notification streaming | [#34](https://github.com/pgsty/silo/pull/34) | [`65795ee`](https://github.com/pgsty/silo/commit/65795ee1f) |
+| [@waterkip](https://github.com/waterkip) | Repointed documentation links from the upstream domain to the Silo portal | [#41](https://github.com/pgsty/silo/pull/41) | [`d495d30`](https://github.com/pgsty/silo/commit/d495d30d5) |
+
+## Proposed changes
+
+Pull requests that are open for review, or that were closed after informing work that shipped
+differently.
+
+| Contributor | Change | Pull request | Status |
+| :-- | :-- | :-- | :-- |
+| [@magicxor](https://github.com/magicxor) | `DELETE` precondition checks for the `If-Match` header | [#12](https://github.com/pgsty/silo/pull/12) | Open, queued for review |
+| [@ycjlin](https://github.com/ycjlin) | `ListObjects` should return `NoSuchBucket` for a prefix on a missing bucket | [#37](https://github.com/pgsty/silo/pull/37) | Open, queued for review |
+| [@davinkevin](https://github.com/davinkevin) | Distroless-based Docker image variant | [#21](https://github.com/pgsty/silo/pull/21) | Superseded by the distroless variant shipped in RELEASE.2026-08-06, which the PR anticipated by four months |
+| [@lem21h](https://github.com/lem21h) | Assorted fixes and improvements | [#36](https://github.com/pgsty/silo/pull/36) | Closed |
+| [@sulin37392](https://github.com/sulin37392) | Dependency updates against the fork | [#8](https://github.com/pgsty/silo/pull/8) | Closed |
+
+## Reports
+
+Bug reports, compatibility findings, and proposals filed against this fork. Several shipped fixes
+trace directly back to these: the bundled-client guarantee (#4, #9), the LDAP-over-TLS repair (#15),
+the completed native package payload (#33), GPG-signed RPMs (#43), and the upstream migration guide
+(#42).
+
+| Contributor | Reported |
+| :-- | :-- |
+| [@mosesdd](https://github.com/mosesdd) | [#1](https://github.com/pgsty/silo/issues/1) Helm chart availability |
+| [@Xavier-777](https://github.com/Xavier-777) | [#2](https://github.com/pgsty/silo/issues/2) Console bucket lifecycle management · [#17](https://github.com/pgsty/silo/issues/17) Log and XML file preview |
+| [@jiadzh](https://github.com/jiadzh) | [#3](https://github.com/pgsty/silo/issues/3) Windows build guidance |
+| [@TLINDEN](https://github.com/TLINDEN) | [#4](https://github.com/pgsty/silo/issues/4) `mc` missing from released tarballs |
+| [@AntonOfTheWoods](https://github.com/AntonOfTheWoods) | [#5](https://github.com/pgsty/silo/issues/5) Upstream Helm chart and operator options |
+| [@zylpsrs](https://github.com/zylpsrs) | [#6](https://github.com/pgsty/silo/issues/6) Console missing Tiering and Site Replication |
+| [@nsanitate](https://github.com/nsanitate) | [#7](https://github.com/pgsty/silo/issues/7) CNCF Sandbox governance proposal |
+| [@makinikm](https://github.com/makinikm) | [#9](https://github.com/pgsty/silo/issues/9) `mc` missing from the Docker image |
+| [@magicxor](https://github.com/magicxor) | [#10](https://github.com/pgsty/silo/issues/10) `DeleteObject` ignores the `If-Match` header |
+| [@spaceg00se-r](https://github.com/spaceg00se-r) | [#11](https://github.com/pgsty/silo/issues/11) `cpuv1` support · [#14](https://github.com/pgsty/silo/issues/14) Project workflow token failure |
+| [@heroes1412](https://github.com/heroes1412) | [#13](https://github.com/pgsty/silo/issues/13) Profile option unusable |
+| [@vampywiz17](https://github.com/vampywiz17) | [#15](https://github.com/pgsty/silo/issues/15) LDAP TLS regression breaking Console login on Kubernetes |
+| [@davinkevin](https://github.com/davinkevin) | [#20](https://github.com/pgsty/silo/issues/20) Renovate for automated dependency updates |
+| [@chalukyaj](https://github.com/chalukyaj) | [#30](https://github.com/pgsty/silo/issues/30) Silo Operator discoverability |
+| [@cbornet](https://github.com/cbornet) | [#31](https://github.com/pgsty/silo/issues/31) Multipart uploads with `FULL_OBJECT` CRC32 · [#32](https://github.com/pgsty/silo/issues/32) `ListObjects` bucket-existence semantics |
+| [@jvasile](https://github.com/jvasile) | [#33](https://github.com/pgsty/silo/issues/33) `.deb` missing user, group, and default files |
+| [@Kesavaambati](https://github.com/Kesavaambati) | [#35](https://github.com/pgsty/silo/issues/35) Community support for the Docker images |
+| [@redfoxfox](https://github.com/redfoxfox) | [#38](https://github.com/pgsty/silo/issues/38) Chinese documentation site unreachable |
+| [@kuldeep-link11](https://github.com/kuldeep-link11) | [#39](https://github.com/pgsty/silo/issues/39) `notify_nats` rejects JWT credentials files · [#40](https://github.com/pgsty/silo/issues/40) `notify_nats` target changes require a restart |
+| [@meesudzu](https://github.com/meesudzu) | [#42](https://github.com/pgsty/silo/issues/42) Migration guide from upstream MinIO |
+| [@pmezhuev](https://github.com/pmezhuev) | [#43](https://github.com/pgsty/silo/issues/43) RPM package missing its GPG signature |
+| [@kh0mka](https://github.com/kh0mka) | [#51](https://github.com/pgsty/silo/issues/51) Inter-node I/O timeout in `ReadFileStreamHandler` |
+
+## Adding yourself
+
+Contributions are accepted inbound=outbound under AGPL-3.0-or-later with no CLA; see
+[`CONTRIBUTING.md`](CONTRIBUTING.md). Merged pull requests are added here at the next release. If a
+contribution is missing or recorded incorrectly, open an issue or say so on the pull request and it
+will be fixed.
diff --git a/README.md b/README.md
index 392c6de83..bde9874e9 100644
--- a/README.md
+++ b/README.md
@@ -6,15 +6,17 @@
- S3-compatible object storage — a MinIO fork maintained by PIGSTY
+ S3-compatible object storage — a MinIO fork maintained by PGSTY
+
Website ·
Documentation ·
Download ·
Release Notes ·
Compatibility ·
+ Manifesto ·
Security ·
中文
@@ -28,239 +30,132 @@
> [!IMPORTANT]
-> Silo is an independent, community-maintained fork of the open-source MinIO server, published by [Pigsty](https://pigsty.io) from [`pgsty/silo`](https://github.com/pgsty/silo). It is not affiliated with, endorsed by, or sponsored by MinIO, Inc. “MinIO” is used only to identify the upstream project and compatibility lineage.
+> **PGSTY Silo** (hereinafter “Silo”) is an independent, community-maintained fork of the open-source MinIO server, published by [Pigsty](https://pigsty.io) from [`pgsty/silo`](https://github.com/pgsty/silo). It is not affiliated with, endorsed by, or sponsored by MinIO, Inc. “MinIO” is used only to identify the upstream project and compatibility lineage.
> [!NOTE]
-> This repository was renamed from `pgsty/minio` to `pgsty/silo`, and its default branch from `master` to `main`, on 2026-08-06. If you need the artifacts maintained under the original MinIO identity, they are on the archived [`minio`](https://github.com/pgsty/silo/tree/minio) branch and in the releases up to [`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z); those assets and the `docker.io/pgsty/minio` image stay published and unmodified. The rename changed product and artifact names only — `MINIO_*` variables, `minio_*` metrics, `x-minio-*` headers, `/minio/*` routes, and the on-disk format are unchanged.
+> Renamed from `pgsty/minio` to `pgsty/silo`, default branch `master` → `main`, on 2026-08-06. Artifacts under the original MinIO identity stay published on the archived [`minio`](https://github.com/pgsty/silo/tree/minio) branch and in releases up to [`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z).
## Overview
-Silo maintains one downstream release line derived from the open-source MinIO server. It provides maintained builds and release artifacts for existing MinIO-compatible deployments after upstream community distribution ended. Pigsty uses Silo for object storage, including as an optional PostgreSQL backup repository.
+PGSTY SILO keeps one maintained release line of the open-source MinIO server alive after upstream ended community distribution: builds, packages, multi-arch images, security fixes, and the full web console. Pigsty runs it in production as its PostgreSQL backup repository.
-The fork follows one rule: **the product and its delivery surfaces are renamed; the protocol and your data are not.** The `silo` executable, packages, service, and container image carry the new name, while the S3 API, `MINIO_*` variables, `minio_*` metrics, `x-minio-*` headers, reserved routes, and the on-disk format stay unchanged. The differences are recorded in the [compatibility notes](https://silo.pgsty.com/compatibility/server/).
+It follows one rule — **the product and its delivery surfaces are renamed; the protocol and your data are not.** Everything else lives on [silo.pgsty.com](https://silo.pgsty.com/).
-The official project portal is [silo.pgsty.com](https://silo.pgsty.com/). It brings documentation, downloads, release and security notes, and project background together.
+**Related:** [`pgsty/mc`](https://github.com/pgsty/mc) client (shipped as `mcli`) · [`pgsty/silo-console`](https://github.com/pgsty/silo-console) · [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) · [`pgsty/pigsty`](https://github.com/pgsty/pigsty)
-## Find the Right Resource
-
-| Looking for | Canonical location |
-| :-- | :-- |
-| Project overview and navigation | [Silo Website](https://silo.pgsty.com/) |
-| Installation methods and downloads | [Download & Install](https://silo.pgsty.com/download/) |
-| Operations, administration, development, and reference | [Documentation](https://silo.pgsty.com/docs/) |
-| Release notes for this server | [Silo release notes](https://silo.pgsty.com/tags/silo/) |
-| Differences from upstream MinIO | [Silo vs. MinIO compatibility notes](https://silo.pgsty.com/compatibility/server/) |
-| Project news and security advisories | [Blog](https://silo.pgsty.com/blog/) · [release](https://silo.pgsty.com/blog/release/) and [security](https://silo.pgsty.com/blog/security/) notes |
-| Versioned binaries, checksums, and source archives | [GitHub Releases](https://github.com/pgsty/silo/releases) |
-| Bug reports and feature discussions | [GitHub Issues](https://github.com/pgsty/silo/issues) |
-| Vulnerability reporting | [`SECURITY.md`](SECURITY.md) and [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) |
-| License, attribution, and trademark information | [`LICENSE`](LICENSE) · [`NOTICE`](NOTICE) · [`CREDITS`](CREDITS) · portal [license](https://silo.pgsty.com/about/license/), [attribution](https://silo.pgsty.com/about/attribution/), and [trademark](https://silo.pgsty.com/about/trademark/) pages |
-
-## Related Projects
-
-| Repository | Description |
-| :-- | :-- |
-| [`pgsty/silo`](https://github.com/pgsty/silo) | This repository — the Silo object storage server, an S3-compatible MinIO fork |
-| [`pgsty/mc`](https://github.com/pgsty/mc) | The Silo command-line client, shipped as `mcli` with the `mc` command name |
-| [`pgsty/silo-console`](https://github.com/pgsty/silo-console) | Admin web console, embedded in the server build |
-| [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) | Shared Go packages maintained for the Silo forks |
-| [`pgsty/pigsty`](https://github.com/pgsty/pigsty) | Pigsty — the PostgreSQL distribution that ships Silo as its object storage |
-
-## Maintenance Policy
-
-The active release line covers:
-
-- build and dependency maintenance;
-- applicable security fixes and advisories;
-- focused fixes for reproducible defects;
-- versioned binaries, packages, checksums, and multi-architecture images;
-- the web console, client, documentation, and Pigsty integration.
-
-Changes are kept narrow and tested where practical. Maintenance is best effort; no response, remediation, or release schedule is guaranteed.
-
-### Out of scope
-
-- a separate product roadmap, new storage engine, or speculative S3 features;
-- broad rewrites or changes that materially expand the downstream delta;
-- historical releases or multiple support branches;
-- commercial support, SLAs, 24×7 coverage, or SUBNET access;
-- deployment design, access control, monitoring, backup, or recovery.
-
-## Governance
-
-The server, client, console, and shared packages are maintained under one release process: DCO-signed commits, reviewed pull requests, and versioned `RELEASE.YYYY-MM-DDTHH-MM-SSZ` tags whose artifacts ship with checksums, SPDX SBOMs, Sigstore-signed manifests, and GitHub build attestations. Each release is announced with a [release note](https://silo.pgsty.com/tags/silo/) on the portal; security handling follows [`SECURITY.md`](SECURITY.md) and the [advisory log](docs/security/advisories.md). Upstream copyright, license, and third-party notices are preserved in [`LICENSE`](LICENSE), [`NOTICE`](NOTICE), and [`CREDITS`](CREDITS).
-
-## Compatibility
-
-Silo aims to preserve:
-
-- the `github.com/minio/minio` module path and `github.com/minio/*` import paths;
-- MinIO-compatible S3 APIs, wire behavior, `MINIO_*` environment variables, metrics, protocol headers, reserved routes, and storage metadata;
-- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` tags and legacy `minio …` container argv translation.
-
-Silo-owned delivery surfaces use the `silo` executable, package, service, Helm chart, and `pgsty/silo` container image. Native artifacts intentionally do not install a `minio` binary alias.
-
-Compatibility is the default constraint. Silo preserves existing wire, client, configuration, and operational behavior whenever doing so remains safe. Compatibility is broken only when necessary to close a major security issue, and the release notes must identify the affected behavior and migration path. Treat each release as a downstream upgrade: pin versions, review the [release notes](https://silo.pgsty.com/tags/silo/), [compatibility notes](https://silo.pgsty.com/compatibility/server/), and [security advisories](docs/security/advisories.md), keep a rollback path, and test before production use.
-
-## Downloads and Release Artifacts
-
-Use [Download & Install](https://silo.pgsty.com/download/) to choose an installation method. GitHub Releases remains the source for versioned server binaries, checksums, and source archives.
-
-| Artifact | Location |
-| :-- | :-- |
-| Source | [`github.com/pgsty/silo`](https://github.com/pgsty/silo) |
-| Container image | [`pgsty/silo`](https://hub.docker.com/r/pgsty/silo), multi-arch for `linux/amd64` and `linux/arm64` |
-| Server binaries and checksums | [GitHub Releases](https://github.com/pgsty/silo/releases) for Linux, macOS, and Windows on `amd64` and `arm64` |
-| Linux packages | RPM, DEB, and APK artifacts, also distributed through the [Pigsty repository](https://pigsty.io/docs/repo/) |
-| Client | [`pgsty/mc`](https://github.com/pgsty/mc), bundled in the container as `mcli` with an `mc` compatibility alias |
-| Console | [`pgsty/silo-console`](https://github.com/pgsty/silo-console), embedded through the compatibility import path `github.com/minio/console` |
-| Shared library | [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) v3.11.0, consumed through a `replace` directive while preserving the `github.com/minio/pkg/v3` import path |
-
-Each new release publishes per-archive and per-package SPDX JSON SBOMs. The archive and package checksum manifests have detached keyless Sigstore bundles, while GitHub artifact attestations record signed provenance for every downloadable artifact and the multi-architecture container image.
-
-After downloading an archive and its release files, verify integrity, the
-published SBOM, the signed manifest, and build provenance independently:
-
-```bash
-# Integrity: choose the line for the artifact you downloaded.
-grep -F ' silo__linux_amd64.tar.gz' \
- silo__checksums.txt | sha256sum --check
-
-# The archive SBOM is a separate checksummed release artifact.
-grep -F ' silo__linux_amd64.tar.gz.sbom.json' \
- silo__checksums.txt | sha256sum --check
-
-# Signature over the archive/SBOM checksum manifest.
-cosign verify-blob \
- --bundle silo__checksums.txt.sigstore.json \
- --certificate-identity-regexp \
- '^https://github.com/pgsty/(minio|silo)/\.github/workflows/release\.yml@refs/(tags/RELEASE\..+|heads/(master|main))$' \
- --certificate-oidc-issuer https://token.actions.githubusercontent.com \
- silo__checksums.txt
-
-# Signed build provenance (online verification against this repository).
-gh attestation verify silo__linux_amd64.tar.gz \
- --repo pgsty/silo
-```
-
-For packages, use `silo__packages_checksums.txt` and its adjacent
-Sigstore bundle with the same identity and issuer constraints. Inspect the
-verified SPDX JSON SBOM with your preferred SPDX tooling. Verify the
-multi-architecture container provenance by digest:
-
-```bash
-gh attestation verify \
- oci://index.docker.io/pgsty/silo@sha256: \
- --repo pgsty/silo
-```
-
-The platform SBOM attestations are attached to the `amd64` and `arm64` image
-digests rather than the multi-architecture manifest. Verify each one explicitly:
-
-```bash
-gh attestation verify \
- oci://index.docker.io/pgsty/silo@sha256: \
- --repo pgsty/silo \
- --predicate-type https://spdx.dev/Document/v2.3
-```
-
-Verification by digest avoids trusting a mutable image tag.
-
-### Native package migration
-
-The `silo` RPM, DEB, and APK do not declare `Provides`, `Obsoletes`,
-`Replaces`, or package-level `Conflicts` against `minio`. They can therefore be
-installed beside an existing MinIO package without silently replacing it. The
-two systemd units conflict at runtime, so switch them explicitly rather than
-starting both.
-
-Before switching, record the old unit's enabled/active state and `User`/`Group`,
-and back up `/etc/default/minio`. Silo reads that legacy defaults file first and
-then `/etc/default/silo`; administrator-set values in the latter take
-precedence. If the existing data must continue to run under its original
-UID/GID, create `/etc/systemd/system/silo.service.d/10-legacy-user.conf`:
-
-```ini
-[Service]
-User=
-Group=
-```
-
-Run `systemctl daemon-reload`, then disable and stop `minio.service` before
-enabling and starting `silo.service`. Verify health, S3, Admin API, metrics, and
-logs before masking or uninstalling the old service. Do not recursively change
-data ownership as part of the package migration; keep the old package and unit
-available during the rollback window.
+
+ 
+
## Quick Start
-For local evaluation:
-
```bash
-mkdir -p data
-
-export MINIO_ROOT_USER=minioadmin
-export MINIO_ROOT_PASSWORD=change-me-long-password
-
-docker run -d --name silo \
- -p 9000:9000 \
- -p 9001:9001 \
- -e MINIO_ROOT_USER \
- -e MINIO_ROOT_PASSWORD \
+docker run -d --name silo -p 9000:9000 -p 9001:9001 \
+ -e MINIO_ROOT_USER=minioadmin \
+ -e MINIO_ROOT_PASSWORD=change-me-long-password \
-v "$PWD/data:/data" \
docker.io/pgsty/silo:latest server /data --console-address ":9001"
```
-Open the console at ; the S3 API listens on .
+
+ 
+
-The image includes the compatible client as `mcli`:
+Console on , S3 API on . The image bundles the client as `mcli`:
```bash
-docker exec silo mcli alias set local http://127.0.0.1:9000 \
- "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
-docker exec silo mcli mb local/demo
-docker exec silo mcli ls local
+docker exec silo mcli alias set local http://127.0.0.1:9000 minioadmin change-me-long-password
+docker exec silo mcli mb local/demo && docker exec silo mcli ls local
```
> [!WARNING]
-> For production, pin a release, use unique credentials and TLS, monitor the service, keep independent backups, and test recovery.
+> For production, pin a release, use unique credentials and TLS, monitor the service, keep independent backups, and test recovery. Start from the [documentation](https://silo.pgsty.com/docs/).
-Build the server from source:
+## Install
-```bash
-go build -o silo .
-./silo --version
-```
+| Method | Where |
+| :-- | :-- |
+| Container | [`pgsty/silo`](https://hub.docker.com/r/pgsty/silo), multi-arch for `linux/amd64` and `linux/arm64` |
+| Binaries | [GitHub Releases](https://github.com/pgsty/silo/releases) — Linux, macOS, Windows on `amd64` and `arm64` |
+| Packages | RPM, DEB, and APK, also via the [Pigsty repository](https://pigsty.io/docs/repo/) |
+| Kubernetes | Helm chart, see [Download & Install](https://silo.pgsty.com/download/) |
+| Source | `go build -o silo . && ./silo --version` |
-For other installation paths—including native packages, binaries, Podman, Kubernetes, source, and Pigsty Ansible—use [Download & Install](https://silo.pgsty.com/download/). For production deployment and administration, start with the [Silo documentation](https://silo.pgsty.com/docs/). Pigsty users can also use the [Pigsty MinIO module](https://pigsty.io/docs/minio/).
+Every release ships checksums, SPDX SBOMs, Sigstore-signed manifests, and GitHub build attestations. Installation methods and verification commands are documented at [Download & Install](https://silo.pgsty.com/download/); migrating from upstream MinIO — including taking over an existing `minio.service` and its `/etc/default/minio` — is covered by the [migration guide](https://silo.pgsty.com/compatibility/migration/) and the [binary & service notes](https://silo.pgsty.com/compatibility/binary/).
-## Security
+## Compatibility
-Security fixes target the active development branch and are recorded in the [advisory log](docs/security/advisories.md) and the portal's [security notes](https://silo.pgsty.com/blog/security/). Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md) and [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md). Report issues that also affect upstream MinIO there as well.
+The S3 API, `MINIO_*` variables, `minio_*` metrics, `x-minio-*` headers, `/minio/*` routes, the `github.com/minio/*` import paths, and the on-disk format (including `.minio.sys`) are preserved and held in place by a CI compatibility check. Only Silo-owned delivery surfaces change: the `silo` executable, package, service, Helm chart, and container image — no `minio` binary alias is installed.
-## Contributing
+Every divergence from upstream is listed in the code-verified [compatibility audit](https://silo.pgsty.com/compatibility/server/). Treat each release as a downstream upgrade: pin versions, read the [release notes](https://silo.pgsty.com/tags/silo/), and keep a rollback path.
-Useful contributions include security and dependency updates, reproducible bug fixes, tests, release automation, packaging, and documentation.
+## Security & Contributing
-Issues and pull requests should include the affected version, reproduction steps, impact, expected behavior, tests, and compatibility notes. Discuss large changes in an issue first.
+Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md); every fix ships with a public [advisory](https://silo.pgsty.com/blog/security/). Contributions are accepted inbound=outbound under AGPL-3.0-or-later with no CLA — only DCO sign-off (`git commit -s`) is required; see [`CONTRIBUTING.md`](CONTRIBUTING.md).
-There is no CLA: contributions are accepted inbound=outbound under the project license (AGPL-3.0-or-later) and contributors keep their copyright. Every commit must be signed off (`git commit -s`) per the [Developer Certificate of Origin](https://developercertificate.org/); see [`CONTRIBUTING.md`](CONTRIBUTING.md).
+## Contributors
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+GitHub does not generate a contributor graph for forks, so [`CONTRIBUTORS.md`](CONTRIBUTORS.md) — not the Insights page — is this project's attribution record. It names everyone alongside the change or report they contributed.
## Background
-This project was created in response to changes in the upstream community distribution and maintenance model. The maintainer’s analysis, alternatives considered, and early maintenance record are documented below:
+Upstream wound down its community edition: the web console was cut back to a stub, prebuilt community binaries stopped, and the community repository was archived. Silo exists to keep those deployments running. The fork is a means, not an identity — if upstream restores its community edition, we will narrow our scope and offer the fixes back.
-| Essay | Subject |
-| :-- | :-- |
-| [MinIO Is Dead](https://silo.pgsty.com/blog/post/minio-is-dead/) | Changes to the upstream project and distribution model |
-| [MinIO Is Dead, Who Takes Over?](https://silo.pgsty.com/blog/post/minio-alternative/) | Alternatives considered |
-| [MinIO Is Dead, Long Live MinIO](https://silo.pgsty.com/blog/post/minio-resurrect/) | Establishing the fork and its release pipeline |
-| [Two months into maintaining a MinIO fork](https://silo.pgsty.com/blog/post/minio-promise-kept/) | Initial security and maintenance work |
+The [**Manifesto**](https://silo.pgsty.com/about/manifesto/) is the project's public commitment in eleven articles, under one discipline: every article is either something already done with public evidence, or something explicitly refused. In short:
-## License and Trademark
+- **Compatibility contract** — the protocol and your data do not change, and every release documents its tested rollback target and path.
+- **The license cannot change** — AGPLv3, no CLA, no copyright aggregation; nobody here, ourselves included, holds enough copyright to relicense on everyone else's behalf.
+- **The never list**, append-only — no paywalling existing features, no registration wall on downloads, no telemetry (upstream's phone-home paths are removed outright), no CLA, no license change, no trademark enforcement against normal use.
+- **Security and release discipline** — a public advisory for every fix, and a release every one to two months, at most a quarter apart. Judge both against the public record.
-The server source is distributed under the [GNU Affero General Public License v3.0 or later](LICENSE). This fork derives from [`minio/minio`](https://github.com/minio/minio): [`NOTICE`](NOTICE) retains the upstream product notice, [`CREDITS`](CREDITS) records licenses and notices for included third-party components, and the Git history records downstream modifications.
+Essays: [MinIO Is Dead](https://silo.pgsty.com/blog/post/minio-is-dead/) · [Who Takes Over?](https://silo.pgsty.com/blog/post/minio-alternative/) · [Long Live MinIO](https://silo.pgsty.com/blog/post/minio-resurrect/) · [Promise Kept](https://silo.pgsty.com/blog/post/minio-promise-kept/)
-MinIO is a trademark of MinIO, Inc. The name is used here only to identify the upstream project and compatibility lineage. Pigsty, Silo, and `pgsty/silo` are independent community efforts and are not affiliated with, endorsed by, or sponsored by MinIO, Inc.
+## License & Trademark
-The portal separately publishes the project [license summary](https://silo.pgsty.com/about/license/), [documentation attribution](https://silo.pgsty.com/about/attribution/), and [trademark notice](https://silo.pgsty.com/about/trademark/).
+Silo is [AGPL-3.0-or-later](LICENSE), derived from [`minio/minio`](https://github.com/minio/minio) with upstream copyright and third-party notices preserved in [`NOTICE`](NOTICE) and [`CREDITS`](CREDITS). MinIO is a trademark of MinIO, Inc.; the name is used here only to identify the upstream project and compatibility lineage.
+
+Details: [license](https://silo.pgsty.com/about/license/) · [attribution](https://silo.pgsty.com/about/attribution/) · [trademark](https://silo.pgsty.com/about/trademark/)
diff --git a/README_ZH.md b/README_ZH.md
index 5d77636bd..15132cdbb 100644
--- a/README_ZH.md
+++ b/README_ZH.md
@@ -1,20 +1,22 @@
- S3 兼容对象存储 —— 由 PIGSTY 维护的 MinIO 社区分支
+ S3 兼容对象存储 —— 由 PGSTY 维护的 MinIO 社区分支
+
官网 ·
文档 ·
下载 ·
版本说明 ·
兼容性 ·
+ 宣言 ·
安全策略 ·
English
@@ -28,234 +30,132 @@
> [!IMPORTANT]
-> Silo 是由 [Pigsty](https://pigsty.cc) 独立维护、从 [`pgsty/silo`](https://github.com/pgsty/silo) 发布的开源 MinIO 社区分支。本项目与 MinIO, Inc. 不存在隶属、背书或赞助关系；文中使用 “MinIO” 仅用于说明上游项目及兼容谱系。
+> **PGSTY Silo**（以下简称 Silo）是由 [Pigsty](https://pigsty.cc) 独立维护、从 [`pgsty/silo`](https://github.com/pgsty/silo) 发布的开源 MinIO 社区分支。本项目与 MinIO, Inc. 不存在隶属、背书或赞助关系；文中使用 “MinIO” 仅用于说明上游项目及兼容谱系。
> [!NOTE]
-> 2026-08-06，本仓库由 `pgsty/minio` 更名为 `pgsty/silo`，默认分支由 `master` 更名为 `main`。如果你需要以原本 MinIO 形态维持的归档构件，它们位于归档的 [`minio`](https://github.com/pgsty/silo/tree/minio) 分支，以及截止到 [`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z) 的历次发布中；这些资产与 `docker.io/pgsty/minio` 镜像保持已发布状态且不做改动。本次更名只改变产品与交付物名称 —— `MINIO_*` 变量、`minio_*` 指标、`x-minio-*` 头、`/minio/*` 路由与磁盘格式均保持不变。
+> 2026-08-06，本仓库由 `pgsty/minio` 更名为 `pgsty/silo`，默认分支由 `master` 更名为 `main`。以原 MinIO 形态维持的归档构件仍位于归档的 [`minio`](https://github.com/pgsty/silo/tree/minio) 分支，以及截止 [`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z) 的历次发布中。
## 概述
-Silo 维护一条源自开源 MinIO 服务端的下游版本线，为上游停止社区发行后仍在运行 MinIO 兼容部署的用户提供持续构建与发行产物。Pigsty 使用 Silo 提供对象存储，包括作为可选的 PostgreSQL 备份仓库。
+上游停止社区发行后，Silo 为开源 MinIO 服务端维护一条持续可用的版本线：构建、软件包、多架构镜像、安全修复与完整 Web 控制台。Pigsty 在生产环境中用它承载 PostgreSQL 备份存储。
-本分支遵循一条原则：**改名的是产品与交付物，不是协议与你的数据。** `silo` 可执行文件、软件包、服务与容器镜像使用新名称，而 S3 API、`MINIO_*` 变量、`minio_*` 指标、`x-minio-*` 头、保留路由与磁盘格式保持不变。具体差异记录在[兼容性说明](https://silo.pgsty.com/zh/compatibility/server/)中。
+它只遵循一条原则：**改名的是产品与交付物，不是协议与你的数据。** 其余内容都在 [silo.pgsty.com](https://silo.pgsty.com/zh/)。
-项目统一门户为 [silo.pgsty.com](https://silo.pgsty.com/zh/)，集中提供文档、下载安装、版本与安全动态及项目背景。
+**相关项目：**[`pgsty/mc`](https://github.com/pgsty/mc) 客户端（以 `mcli` 发行） · [`pgsty/silo-console`](https://github.com/pgsty/silo-console) · [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) · [`pgsty/pigsty`](https://github.com/pgsty/pigsty)
-## 按需求选择入口
+
+
+
-| 需求 | 权威入口 |
-| :-- | :-- |
-| 项目概览与全站导航 | [Silo 官网](https://silo.pgsty.com/zh/) |
-| 安装方式与软件下载 | [下载与安装](https://silo.pgsty.com/zh/download/) |
-| 运维、管理、开发与参考指南 | [文档](https://silo.pgsty.com/zh/docs/) |
-| 本服务端的版本说明 | [Silo 版本说明](https://silo.pgsty.com/zh/tags/silo/) |
-| 与上游 MinIO 的差异 | [Silo vs. MinIO 兼容性说明](https://silo.pgsty.com/zh/compatibility/server/) |
-| 项目动态与安全通告 | [博客](https://silo.pgsty.com/zh/blog/) · [版本发布](https://silo.pgsty.com/zh/blog/release/)与[安全通告](https://silo.pgsty.com/zh/blog/security/) |
-| 带版本的二进制、校验和与源码归档 | [GitHub Releases](https://github.com/pgsty/silo/releases) |
-| 缺陷报告与功能讨论 | [GitHub Issues](https://github.com/pgsty/silo/issues) |
-| 私密漏洞报告 | [`SECURITY.md`](SECURITY.md) 与 [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) |
-| 许可证、署名与商标信息 | [`LICENSE`](LICENSE) · [`NOTICE`](NOTICE) · [`CREDITS`](CREDITS) · 门户的[许可证](https://silo.pgsty.com/zh/about/license/)、[署名归属](https://silo.pgsty.com/zh/about/attribution/)与[商标政策](https://silo.pgsty.com/zh/about/trademark/)页面 |
-
-## 相关项目
-
-| 仓库 | 说明 |
-| :-- | :-- |
-| [`pgsty/silo`](https://github.com/pgsty/silo) | 本仓库 —— Silo 对象存储服务器，S3 兼容的 MinIO fork |
-| [`pgsty/mc`](https://github.com/pgsty/mc) | Silo 命令行客户端，以 `mcli` 发行、保留 `mc` 命令名 |
-| [`pgsty/silo-console`](https://github.com/pgsty/silo-console) | Web 管理控制台，内嵌于服务端构建 |
-| [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) | 为 Silo 系 fork 维护的共享 Go 包 |
-| [`pgsty/pigsty`](https://github.com/pgsty/pigsty) | Pigsty —— 内置 Silo 作为对象存储的 PostgreSQL 发行版 |
-
-## 维护政策
-
-活跃版本线的维护范围包括：
-
-- 构建与依赖项维护；
-- 适用的安全修复与公告；
-- 针对可复现缺陷的范围明确的修复；
-- 带版本的二进制、软件包、校验和与多架构镜像；
-- Web Console、客户端、文档与 Pigsty 集成。
-
-改动保持克制，并在可行时提供测试。所有维护均为尽力而为，不承诺固定的响应、修复或发布时间。
-
-### 范围之外
-
-- 独立产品路线图、新存储引擎或假设性的 S3 新特性；
-- 大规模重写或显著扩大下游差异的改动；
-- 历史版本或多条支持分支；
-- 商业支持、SLA、7×24 服务或 SUBNET 服务；
-- 部署设计、访问控制、监控、备份与恢复。
-
-## 治理
-
-服务端、客户端、控制台与共享包在同一套发布流程下共同维护：提交必须签署 DCO、Pull Request 经过评审、以 `RELEASE.YYYY-MM-DDTHH-MM-SSZ` 标签发布，产物附带校验和、SPDX SBOM、Sigstore 签名清单与 GitHub 构建证明。每个版本都会在门户发布[版本说明](https://silo.pgsty.com/zh/tags/silo/)；安全问题按照 [`SECURITY.md`](SECURITY.md) 与仓库[安全公告](docs/security/advisories.md)处理。上游版权、许可证与第三方声明完整保留于 [`LICENSE`](LICENSE)、[`NOTICE`](NOTICE) 与 [`CREDITS`](CREDITS)。
-
-## 兼容策略
-
-Silo 尽量保留：
-
-- `github.com/minio/minio` module path 与 `github.com/minio/*` 导入路径；
-- MinIO 兼容的 S3 API、线协议、`MINIO_*` 环境变量、指标、协议头、保留路由与存储元数据；
-- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` 标签，以及容器入口对旧式 `minio …` 参数的转换。
-
-Silo 自有交付面统一使用 `silo` 可执行文件、软件包、服务、Helm Chart 与 `pgsty/silo` 容器镜像；原生交付物不会安装 `minio` 二进制别名。
-
-兼容性是默认约束。只要不会留下安全问题，Silo 就保留既有的协议、客户端、配置与运维行为；只有在修复重大安全问题确有必要时才会打破兼容，并在版本说明中明确受影响行为与迁移方式。每个版本仍应视为下游升级：锁定版本，阅读[版本说明](https://silo.pgsty.com/zh/tags/silo/)、[兼容性说明](https://silo.pgsty.com/zh/compatibility/server/)与[安全公告](docs/security/advisories.md)，保留回滚路径，并在生产使用前完成测试。
-
-## 下载与发行产物
-
-请先在[下载与安装](https://silo.pgsty.com/zh/download/)页面选择合适的安装方式；GitHub Releases 仍是带版本服务端二进制、校验和与源码归档的获取位置。
-
-| 产物 | 位置 |
-| :-- | :-- |
-| 源码 | [`github.com/pgsty/silo`](https://github.com/pgsty/silo) |
-| 容器镜像 | [`pgsty/silo`](https://hub.docker.com/r/pgsty/silo)，支持 `linux/amd64` 与 `linux/arm64` 多架构清单 |
-| 服务端二进制与校验和 | [GitHub Releases](https://github.com/pgsty/silo/releases)，覆盖 Linux、macOS、Windows 的 `amd64` 与 `arm64` |
-| Linux 软件包 | RPM、DEB、APK，并通过 [Pigsty 软件仓库](https://pigsty.cc/docs/repo/) 分发 |
-| 客户端 | [`pgsty/mc`](https://github.com/pgsty/mc)，容器内以 `mcli` 提供，并保留 `mc` 兼容别名 |
-| 管理控制台 | [`pgsty/silo-console`](https://github.com/pgsty/silo-console)，通过兼容导入路径 `github.com/minio/console` 嵌入服务端构建 |
-| 共享库 | [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) v3.11.0，通过 `replace` 指令使用，同时保留 `github.com/minio/pkg/v3` 导入路径 |
-
-每个新版本都会为各平台归档和软件包发布 SPDX JSON SBOM。归档与软件包的校验和清单分别带有无长期密钥的 Sigstore 签名包；GitHub 制品证明则为全部可下载产物及多架构容器镜像记录已签名的构建来源。
-
-下载归档及配套文件后，请分别验证完整性、已发布 SBOM、签名清单与构建来源：
+## 快速上手
```bash
-# 完整性：选择与你下载产物相符的一行。
-grep -F ' silo__linux_amd64.tar.gz' \
- silo__checksums.txt | sha256sum --check
-
-# 归档 SBOM 是另一个独立校验的 Release 产物。
-grep -F ' silo__linux_amd64.tar.gz.sbom.json' \
- silo__checksums.txt | sha256sum --check
-
-# 验证归档/SBOM 校验和清单的签名。
-cosign verify-blob \
- --bundle silo__checksums.txt.sigstore.json \
- --certificate-identity-regexp \
- '^https://github.com/pgsty/(minio|silo)/\.github/workflows/release\.yml@refs/(tags/RELEASE\..+|heads/(master|main))$' \
- --certificate-oidc-issuer https://token.actions.githubusercontent.com \
- silo__checksums.txt
-
-# 在线验证本仓库签发的构建来源。
-gh attestation verify silo__linux_amd64.tar.gz \
- --repo pgsty/silo
-```
-
-软件包使用 `silo__packages_checksums.txt` 及其相邻的 Sigstore
-签名包，并使用相同的 identity 与 issuer 约束；请用 SPDX 工具检查已验证的
-SPDX JSON SBOM。按 digest 验证多架构容器清单的构建来源：
-
-```bash
-gh attestation verify \
- oci://index.docker.io/pgsty/silo@sha256: \
- --repo pgsty/silo
-```
-
-分架构 SBOM 证明附在 `amd64` 与 `arm64` 平台镜像的 digest 上，而非多架构
-清单上，需要分别显式验证：
-
-```bash
-gh attestation verify \
- oci://index.docker.io/pgsty/silo@sha256: \
- --repo pgsty/silo \
- --predicate-type https://spdx.dev/Document/v2.3
-```
-
-按 digest 验证可避免信任可变镜像标签。
-
-### 原生软件包迁移
-
-`silo` RPM、DEB 与 APK 不针对 `minio` 声明 `Provides`、`Obsoletes`、
-`Replaces` 或包级 `Conflicts`，因此可以与已有 MinIO 软件包并存安装，
-不会被普通升级静默替换。两个 systemd unit 在运行时互斥，应由管理员显式
-切换，不能同时启动。
-
-切换前请记录旧 unit 的 enabled/active 状态与 `User`/`Group`，并备份
-`/etc/default/minio`。Silo 先读取该旧配置，再读取 `/etc/default/silo`；后者
-中由管理员设置的同名变量优先。如现有数据必须继续使用原 UID/GID，请创建
-`/etc/systemd/system/silo.service.d/10-legacy-user.conf`：
-
-```ini
-[Service]
-User=
-Group=
-```
-
-执行 `systemctl daemon-reload`，先停用并停止 `minio.service`，再启用并启动
-`silo.service`。确认健康检查、S3、Admin API、指标与日志后，才 mask 或卸载
-旧服务。软件包迁移期间不要递归修改数据属主；在回滚观察窗口内保留旧包与
-旧 unit。
-
-## 快速开始
-
-本地体验：
-
-```bash
-mkdir -p data
-
-export MINIO_ROOT_USER=minioadmin
-export MINIO_ROOT_PASSWORD=change-me-long-password
-
-docker run -d --name silo \
- -p 9000:9000 \
- -p 9001:9001 \
- -e MINIO_ROOT_USER \
- -e MINIO_ROOT_PASSWORD \
+docker run -d --name silo -p 9000:9000 -p 9001:9001 \
+ -e MINIO_ROOT_USER=minioadmin \
+ -e MINIO_ROOT_PASSWORD=change-me-long-password \
-v "$PWD/data:/data" \
docker.io/pgsty/silo:latest server /data --console-address ":9001"
```
-管理控制台位于 ，S3 API 位于 。
+
+
+
-镜像内置兼容客户端 `mcli`：
+控制台位于 ，S3 API 位于 。镜像内置客户端 `mcli`：
```bash
-docker exec silo mcli alias set local http://127.0.0.1:9000 \
- "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
-docker exec silo mcli mb local/demo
-docker exec silo mcli ls local
+docker exec silo mcli alias set local http://127.0.0.1:9000 minioadmin change-me-long-password
+docker exec silo mcli mb local/demo && docker exec silo mcli ls local
```
> [!WARNING]
-> 生产环境应锁定版本，使用独立凭据与 TLS，配置监控，保留独立备份，并验证恢复流程。
+> 生产环境应锁定版本，使用独立凭据与 TLS，配置监控，保留独立备份，并验证恢复流程。请从[文档](https://silo.pgsty.com/zh/docs/)开始。
-从源码构建服务端：
+## 安装
-```bash
-go build -o silo .
-./silo --version
-```
+| 方式 | 位置 |
+| :-- | :-- |
+| 容器镜像 | [`pgsty/silo`](https://hub.docker.com/r/pgsty/silo)，支持 `linux/amd64` 与 `linux/arm64` |
+| 二进制 | [GitHub Releases](https://github.com/pgsty/silo/releases)，覆盖 Linux、macOS、Windows 的 `amd64` 与 `arm64` |
+| 软件包 | RPM、DEB、APK，也可通过 [Pigsty 软件仓库](https://pigsty.cc/docs/repo/) 安装 |
+| Kubernetes | Helm Chart，参见[下载与安装](https://silo.pgsty.com/zh/download/) |
+| 源码构建 | `go build -o silo . && ./silo --version` |
-其他安装方式（包括原生软件包、二进制、Podman、Kubernetes、源码构建与 Pigsty Ansible）请前往[下载与安装](https://silo.pgsty.com/zh/download/)；生产部署与管理请从 [Silo 文档](https://silo.pgsty.com/zh/docs/)开始。Pigsty 用户也可以直接使用 [Pigsty MinIO 模块](https://pigsty.cc/docs/minio/)。
+每个版本都附带校验和、SPDX SBOM、Sigstore 签名清单与 GitHub 构建证明。完整安装方式与验证命令见[下载与安装](https://silo.pgsty.com/zh/download/)；从上游 MinIO 迁移 —— 包括接管既有 `minio.service` 与 `/etc/default/minio` —— 见[迁移指南](https://silo.pgsty.com/zh/compatibility/migration/)与[二进制与服务说明](https://silo.pgsty.com/zh/compatibility/binary/)。
-## 安全
+## 兼容性
-安全修复面向当前活跃开发分支，并记录在仓库[安全公告](docs/security/advisories.md)与门户[安全通告](https://silo.pgsty.com/zh/blog/security/)中。请按照 [`SECURITY.md`](SECURITY.md) 与 [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) 私密报告漏洞；同时影响上游 MinIO 的问题也应向上游报告。
+S3 API、`MINIO_*` 环境变量、`minio_*` 指标、`x-minio-*` 头、`/minio/*` 路由、`github.com/minio/*` 导入路径与磁盘格式（含 `.minio.sys`）原样保留，并由 CI 兼容性门禁冻结。只有 Silo 自有交付面改名：`silo` 可执行文件、软件包、服务、Helm Chart 与容器镜像 —— 原生交付物不会安装 `minio` 二进制别名。
-## 贡献
+与上游的全部分歧，以逐项核验代码的[兼容性审计](https://silo.pgsty.com/zh/compatibility/server/)形式维护。每个版本仍应视为下游升级：锁定版本，阅读[版本说明](https://silo.pgsty.com/zh/tags/silo/)，并保留回滚路径。
-欢迎安全与依赖项更新、可复现缺陷修复、测试、发布自动化、打包与文档改进。
+## 安全与贡献
-Issue 与 Pull Request 应说明受影响版本、复现步骤、影响、预期行为、测试与兼容性说明。大型改动请先提交 Issue 讨论。
+请按照 [`SECURITY.md`](SECURITY.md) 私密报告漏洞；每项修复都会发布公开[安全公告](https://silo.pgsty.com/zh/blog/security/)。本项目不要求签署 CLA：贡献按 AGPL-3.0-or-later（inbound=outbound）接收，只需 DCO 签署（`git commit -s`），详见 [`CONTRIBUTING.md`](CONTRIBUTING.md)。
-本项目不要求签署 CLA：贡献按项目许可证（AGPL-3.0-or-later，inbound=outbound）接收，贡献者保留自己的版权。每个提交都必须按照 [DCO](https://developercertificate.org/) 签署（`git commit -s`），详见 [`CONTRIBUTING.md`](CONTRIBUTING.md)。
+## 贡献者
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+GitHub 不为 fork 仓库生成贡献者图表，因此 [`CONTRIBUTORS.md`](CONTRIBUTORS.md)（而非 Insights 页面）才是本项目的署名记录，其中逐一记录了每个人对应的改动或报告。
## 背景
-本项目源于上游社区发行与维护模式的变化。维护者对相关变化的分析、替代方案评估与早期维护记录见以下文章：
+本项目因上游收缩社区版而生：Web 控制台被削减为残桩、社区预编译制品停发、社区仓库被归档。Silo 的存在就是让这些部署继续跑下去。Fork 是手段，不是身份 —— 若上游恢复社区版承诺，我们乐意收缩范围，并把修复回馈上游。
-| 文章 | 主题 |
-| :-- | :-- |
-| [MinIO已死](https://silo.pgsty.com/zh/blog/post/minio-is-dead/) | 上游项目与发行模式的变化 |
-| [MinIO已死，谁能接盘？](https://silo.pgsty.com/zh/blog/post/minio-alternative/) | 可选替代方案评估 |
-| [MinIO 已死，MinIO 复生](https://silo.pgsty.com/zh/blog/post/minio-resurrect/) | 建立分支及其发行流水线 |
-| [续命 MinIO：承诺兑现](https://silo.pgsty.com/zh/blog/post/minio-promise-kept/) | 初期安全与维护工作 |
+[**宣言**](https://silo.pgsty.com/zh/about/manifesto/)是项目的公开承诺，共十一条，通篇遵循一项纪律：**每一条，要么是已经在做且有公开证据的事实，要么是刻意拒绝的承诺。** 摘要：
+
+- **兼容性合同** —— 协议与数据不改，每个版本都标注经过测试的回滚目标与路径。
+- **许可证无法变更** —— AGPLv3、无 CLA、不做版权聚合；包括我们自己在内，没有人握有足够版权代表所有贡献者重新授权。
+- **永不清单**（只增不减）—— 永不将既有功能移入付费墙、永不给下载设注册墙、永不加入遥测（上游回连路径已整体移除）、永不引入 CLA、永不变更许可证、永不以商标追究正常使用。
+- **安全与发布纪律** —— 每项安全修复配一篇公开公告；通常每一到两个月发布一版，最长不超过一个季度。请拿公开记录检验这两条。
+
+延伸阅读：[MinIO已死](https://silo.pgsty.com/zh/blog/post/minio-is-dead/) · [谁能接盘？](https://silo.pgsty.com/zh/blog/post/minio-alternative/) · [MinIO 复生](https://silo.pgsty.com/zh/blog/post/minio-resurrect/) · [承诺兑现](https://silo.pgsty.com/zh/blog/post/minio-promise-kept/)
## 许可证与商标
-服务端源码依据 [GNU Affero 通用公共许可证第 3 版或任何后续版本](LICENSE)分发。本分支衍生自 [`minio/minio`](https://github.com/minio/minio)：[`NOTICE`](NOTICE) 保留上游产品声明，[`CREDITS`](CREDITS) 记录所含第三方组件的许可证与声明，Git 历史记录下游修改。
+Silo 采用 [AGPL-3.0-or-later](LICENSE)，衍生自 [`minio/minio`](https://github.com/minio/minio)，上游版权与第三方声明完整保留于 [`NOTICE`](NOTICE) 与 [`CREDITS`](CREDITS)。MinIO 是 MinIO, Inc. 的商标，此处使用仅为标识上游项目与兼容谱系。
-MinIO 是 MinIO, Inc. 的商标；本文仅为标识上游项目与兼容谱系而使用该名称。Pigsty、Silo 与 `pgsty/silo` 均为独立社区项目，与 MinIO, Inc. 不存在隶属、背书或赞助关系。
-
-门户另行发布项目的[许可证摘要](https://silo.pgsty.com/zh/about/license/)、[文档署名归属](https://silo.pgsty.com/zh/about/attribution/)与[商标声明](https://silo.pgsty.com/zh/about/trademark/)。
+详见：[许可证](https://silo.pgsty.com/zh/about/license/) · [署名归属](https://silo.pgsty.com/zh/about/attribution/) · [商标声明](https://silo.pgsty.com/zh/about/trademark/)
