docs: align release, TLS, healthcheck, and contributor docs with 20261109

Signed-off-by: Feng Ruohang <rh@vonng.com>

CHANGELOG.md

@@ -33,11 +33,13 @@
 
 ## RELEASE.2026-11-09T00-00-00Z
 
-Package version: `20261109000000.0.0`. Publication status and artifacts are
+Package version: `20261109000000.0.0`; published from source `d998292387cc`.
-listed in [GitHub Releases](https://github.com/pgsty/silo/releases). This
+Artifacts are listed in the [GitHub release](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z).
-section covers the changes after the published 20261026 source `c3ad836aed0d`.
+The coordinated [English release notes](https://silo.pgsty.com/blog/release/silo-20261109/)
-Most fixes come from reports and patches by
+and [Chinese release notes](https://silo.pgsty.com/zh/blog/release/silo-20261109/)
-[@botdeniska](https://github.com/botdeniska); see [CONTRIBUTORS.md](CONTRIBUTORS.md).
+cover all components, upgrade guidance, and validation scope since the
+published 20261026 source `c3ad836aed0d`. Most fixes come from reports and
+patches by [@botdeniska](https://github.com/botdeniska); see [CONTRIBUTORS.md](CONTRIBUTORS.md).
 
 Lifecycle, multi-pool and tiering:
 
@@ -52,7 +54,8 @@ Lifecycle, multi-pool and tiering:
   `retainVersions: 0`) on the expired key instead of the keys below it; a key
   with a tiered or Object Lock protected version is refused
   ([#297](https://github.com/pgsty/silo/issues/297)).
-- Stop taking the free version of a deleted tiered version for a version
+- Exclude the internal free-version marker of a deleted tiered version from
+  visible version history and lifecycle decisions
   ([#263](https://github.com/pgsty/silo/issues/263)), apply rules whose only
   action is `DelMarkerExpiration` ([#268](https://github.com/pgsty/silo/issues/268)),
   and report and account only the removals that happened

CONTRIBUTING.md

@@ -165,8 +165,11 @@ license grant to SILO or upstream MinIO maintainers is required.
 
 ### How does Silo manage dependencies?
 
-Silo uses Go modules. Preserve the compatibility module and import paths in
+Silo uses Go modules. Shared packages in `github.com/pgsty/silo-pkg/v3` are
-`go.mod`; downstream forks are selected with explicit `replace` directives.
+required and imported directly under their own module path, upstream
+`github.com/minio/minio-go/v7` is pinned to a verified commit, and Console
+(`github.com/minio/console`) and MC (`github.com/minio/mc`) are selected with
+explicit `replace` directives in `go.mod`.
 
 - Run `go get foo/bar` in the source folder to add the dependency to `go.mod` file.
 

PULL_REQUESTS_ETIQUETTE.md

@@ -42,7 +42,8 @@ PRs must flow smoothly through review to reach production. Large PRs should be s
    - Document testing steps in the PR summary if manual testing was performed.
 
 4. **Before Submitting**:
-   - Run `make verify` to check formatting, linting, and tests.
+   - Sign off every commit under the Developer Certificate of Origin (`git commit -s`).
+   - Run `make verifiers` to check formatting, linting, code generation, and `rebrand-guard`.
    - Reference related issues (e.g., “Closes #1234”).
    - Notify team members via GitHub `@mentions` if urgent or complex.
 

README.md

@@ -36,7 +36,7 @@
 
 PGSTY SILO keeps one maintained release line of the open-source MinIO server alive after upstream ended community distribution: builds, packages, multi-arch images, security fixes, and the full web console. Pigsty runs it in production as its PostgreSQL backup repository.
 
-It follows one rule — **the product and its delivery surfaces are renamed; the protocol and your data are not.** Everything else lives on [silo.pgsty.com](https://silo.pgsty.com/).
+It follows one rule: **the product and its delivery surfaces are renamed; the protocol and your data are not.** Full documentation is published at [silo.pgsty.com](https://silo.pgsty.com/).
 
 **Related:** [`pgsty/mc`](https://github.com/pgsty/mc) · [`pgsty/silo-console`](https://github.com/pgsty/silo-console) · [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) · [`pgsty/kes`](https://github.com/pgsty/kes) · [`pgsty/pigsty`](https://github.com/pgsty/pigsty)
 
@@ -44,10 +44,10 @@ It follows one rule — **the product and its delivery surfaces are renamed; the
   <img src="https://silo.pgsty.com/images/silo-console/console-metrics-simple.webp" alt="Silo Console">
 </p>
 
-#### SILO 20261109
+### SILO 20261109
 
 > [!WARNING]
-> [SILO 20261109](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z) fixes bugs and security vulnerabilities. We strongly recommend scheduling an upgrade to reduce security risks.
+> [SILO 20261109](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z) (`20261109000000.0.0`, source `d998292387cc`) fixes storage, lifecycle, native restore, Object Lock, batch authorization, and IAM defects, embedding Console `v2.7.0` with `mcli 20261109`, `silo-pkg v3.16.0`, and Go `1.27.3`. Review the [release notes and upgrade requirements](https://silo.pgsty.com/blog/release/silo-20261109/) before upgrading.
 
 > [!NOTE]
 > On 2026-08-06, `pgsty/minio` became `pgsty/silo`, and the default branch changed from `master` to `main`. The last MinIO-branded release is [`20260804`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z) on the [`minio`](https://github.com/pgsty/silo/tree/minio) branch.
@@ -86,7 +86,7 @@ docker exec silo mcli mb local/demo && docker exec silo mcli ls local
 | Kubernetes | Helm chart, see [Download & Install](https://silo.pgsty.com/download/) |
 | Source | `go build -o silo . && ./silo --version` |
 
-Every release ships checksums, SPDX SBOMs, Sigstore-signed manifests, and GitHub build attestations. Installation methods and verification commands are documented at [Download & Install](https://silo.pgsty.com/download/); migrating from upstream MinIO — taking over an existing `minio.service` and its `/etc/default/minio`, and keeping data ownership stable with a `/etc/systemd/system/silo.service.d/10-legacy-user.conf` drop-in — is covered by the [migration guide](https://silo.pgsty.com/compatibility/migration/) and the [binary & service notes](https://silo.pgsty.com/compatibility/binary/).
+Every release ships checksums, SPDX SBOMs, Sigstore-signed manifests, and GitHub build attestations. Installation methods and verification commands are documented at [Download & Install](https://silo.pgsty.com/download/). To migrate from upstream MinIO, take over `minio.service` and `/etc/default/minio`, and preserve data ownership with a `/etc/systemd/system/silo.service.d/10-legacy-user.conf` drop-in. See the [migration guide](https://silo.pgsty.com/compatibility/migration/) and [binary & service notes](https://silo.pgsty.com/compatibility/binary/).
 
 ## Compatibility
 
@@ -98,7 +98,7 @@ Every divergence from upstream is listed in the code-verified [compatibility aud
 
 ### TLS and Go upgrades
 
-Server 20260916 restored Go's default key exchange; Server 20261018 retains it with Go 1.27.2.
+Server 20260916 restored Go's default key exchange; Server 20261109 retains it with Go 1.27.3.
 TLS key exchange follows Go's defaults across the S3 listener, node links,
 replication, identity providers, etcd, and external HTTP services. If an endpoint
 cannot accept ML-KEM, `GODEBUG=tlsmlkem=0` disables the default hybrid exchanges

README_ZH.md

@@ -36,7 +36,7 @@
 
 上游停止社区发行后，Silo 为开源 MinIO 服务端维护一条持续可用的版本线：构建、软件包、多架构镜像、安全修复与完整 Web 控制台。Pigsty 在生产环境中用它承载 PostgreSQL 备份存储。
 
-它只遵循一条原则：**改名的是产品与交付物，不是协议与你的数据。** 其余内容都在 [silo.pgsty.com](https://silo.pgsty.com/zh/)。
+它只遵循一条原则：**改名的是产品与交付物，不是协议与你的数据。** 完整文档发布在 [silo.pgsty.com](https://silo.pgsty.com/zh/)。
 
 **相关项目：**[`pgsty/mc`](https://github.com/pgsty/mc) · [`pgsty/silo-console`](https://github.com/pgsty/silo-console) · [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) · [`pgsty/kes`](https://github.com/pgsty/kes) · [`pgsty/pigsty`](https://github.com/pgsty/pigsty)
 
@@ -44,10 +44,10 @@
   <img src="https://silo.pgsty.com/images/silo-console/console-metrics-simple.webp" alt="Silo 控制台">
 </p>
 
-#### SILO 20261109
+### SILO 20261109
 
 > [!WARNING]
-> [SILO 20261109](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z) 修复了缺陷与安全漏洞，强烈建议尽快安排升级，以降低安全风险。
+> [SILO 20261109](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-11-09T00-00-00Z)（包版本 `20261109000000.0.0`，源码 `d998292387cc`）修复了多池生命周期、原生恢复、Object Lock、批处理授权与 IAM 等缺陷，内嵌 Console `v2.7.0` 并配套 `mcli 20261109`、`silo-pkg v3.16.0` 与 Go `1.27.3`。升级前请阅读[发布说明与升级要求](https://silo.pgsty.com/zh/blog/release/silo-20261109/)。
 
 > [!NOTE]
 > 2026-08-06，`pgsty/minio` 更名为 `pgsty/silo`，默认分支由 `master` 改为 `main`。最后一个 MinIO 品牌发布是 [`minio`](https://github.com/pgsty/silo/tree/minio) 分支上的 [`20260804`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z)。
@@ -98,9 +98,9 @@ Silo 保留 S3 与存储格式兼容性，包括既有 `MINIO_*` 环境变量、
 
 ### TLS 与 Go 升级
 
-Server 20260916 已恢复 Go 默认密钥交换策略，20261018 在 Go 1.27.2 下保留该行为。
+Server 20260916 恢复了 Go 默认密钥交换策略，Server 20261109 在 Go 1.27.3 下保留该行为。S3 监听端口、节点间连接、站点与桶复制、身份提供方、etcd 及外部 HTTP 服务均使用 Go 默认 TLS 密钥交换。若对端无法接受 ML-KEM，设置 `GODEBUG=tlsmlkem=0` 可在当前进程禁用默认混合密钥交换（证书校验保持开启）；该选项不会禁用 ML-DSA 签名，也不能解决所有 TLS 连接重置问题，建议在升级不兼容对端后移除该临时配置。若仅新增的 SecP 混合组引发问题，可设置 `GODEBUG=tlssecpmlkem=0` 仅禁用这些组并保留 `X25519MLKEM768`。
-`GODEBUG=tlsmlkem=0`、`tlssecpmlkem=0` 的适用范围、macOS 根证书来源变化，
+
-以及 OIDC discovery 的诊断方法见 [Go 1.27 TLS 与 OIDC 指南](https://silo.pgsty.com/zh/blog/design/go127-tls-oidc-discovery/)。
+在 Go 1.27 构建中，macOS 上设置 `SSL_CERT_FILE` 或 `SSL_CERT_DIR` 会以磁盘根证书和 Go 验证器替代系统钥匙串信任；陈旧或不完整的 CA 路径可能导致原先受信任的连接失败，清除继承的环境变量即可恢复钥匙串信任。配置的 `CAs` 目录中的显式证书仍会叠加加入所选根证书池。Go 1.27 二进制要求 macOS 13 或更高版本。详见 [Go 1.27 发行说明](https://go.dev/doc/go1.27)与 [Go 1.27 TLS 与 OIDC 发现指南](https://silo.pgsty.com/zh/blog/design/go127-tls-oidc-discovery/)。
 
 ## 文档归属
 

SECURITY.md

@@ -38,7 +38,7 @@ For vulnerabilities in this fork:
 
 1. Follow the fork-specific expectations in [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md).
 2. Prefer this repository's [private GitHub security advisory](https://github.com/pgsty/silo/security/advisories/new) workflow.
-3. If you cannot use GitHub private reporting, email [ron@pgsty.com](mailto:ron@pgsty.com) or rh@vonng.com
+3. If you cannot use GitHub private reporting, email [ron@pgsty.com](mailto:ron@pgsty.com) or [rh@vonng.com](mailto:rh@vonng.com)
    directly. Do not publish vulnerability details or exploit code in public
    issues or pull requests.
 4. If you confirm the issue also affects upstream `minio/minio`, report it upstream separately.

docs/metrics/healthcheck/README.md

@@ -1,6 +1,6 @@
 # Silo Healthcheck
 
-Silo server exposes three un-authenticated, healthcheck endpoints liveness probe and a cluster probe at `/minio/health/live` and `/minio/health/cluster` respectively.
+Silo server exposes four unauthenticated healthcheck endpoints: `/minio/health/live`, `/minio/health/ready`, `/minio/health/cluster`, and `/minio/health/cluster/read`.
 
 ## Native CLI probe
 
@@ -76,7 +76,7 @@ readinessProbe:
 The reply is '200 OK' if cluster has write quorum if not it returns '503 Service Unavailable'.
 
 ```
-curl http://silo1:9001/minio/health/cluster
+curl http://silo1:9000/minio/health/cluster
 HTTP/1.1 503 Service Unavailable
 Accept-Ranges: bytes
 Content-Length: 0
@@ -94,7 +94,7 @@ Date: Tue, 21 Jul 2020 00:36:14 GMT
 The reply is '200 OK' if cluster has read quorum if not it returns '503 Service Unavailable'.
 
 ```
-curl http://silo1:9001/minio/health/cluster/read
+curl http://silo1:9000/minio/health/cluster/read
 HTTP/1.1 503 Service Unavailable
 Accept-Ranges: bytes
 Content-Length: 0
@@ -112,7 +112,7 @@ Date: Tue, 21 Jul 2020 00:36:14 GMT
 You may query the cluster probe endpoint to check if the node which received the request can be taken down for maintenance, if the server replies back '412 Precondition Failed' this means you will lose HA. '200 OK' means you are okay to proceed.
 
 ```
-curl http://silo1:9001/minio/health/cluster?maintenance=true
+curl http://silo1:9000/minio/health/cluster?maintenance=true
 HTTP/1.1 412 Precondition Failed
 Accept-Ranges: bytes
 Content-Length: 0