docs: mark this branch as the archived MinIO-identity state

This branch is the last state of the project under the MinIO identity. It is kept so the artifacts released in that form stay traceable to the source that produced them, and so anyone landing here from an old link is not left reading current-looking documentation for a line that has moved. Both READMEs now open with an archive notice: development continues on main as Silo, the repository is pgsty/silo, the last release cut from here is RELEASE.2026-08-04T00-00-00Z, and its assets and container image keep the minio names and are not moved or re-signed. The notice also states what did not change, because that is the question an operator arriving here will actually have: MINIO_* variables, minio_* metrics, x-minio-* headers, /minio/* routes, the .minio.sys layout, IAM and ARN values, and the github.com/minio/minio module path are all preserved on main, and the packages install side by side so migration and rollback stay explicit. Only the two README files change. The tree is otherwise the exact code of RELEASE.2026-08-04T00-00-00Z, which the tag continues to mark. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ci: build the release runtime image and assert graceful shutdown
2026-08-09 07:43:29 +03:00 · 2026-08-06 09:45:23 +08:00 · 2026-08-05 06:29:22 +08:00 · 2026-08-05 01:06:12 +08:00 · 2026-08-05 01:03:43 +08:00 · 2026-08-05 01:00:52 +08:00
607 changed files with 16948 additions and 7308 deletions
@@ -7,9 +7,6 @@ assignees: ''

 ---

-## NOTE
-If this case is urgent, please subscribe to [Subnet](https://min.io/pricing) so that our 24/7 support team may help you faster.
-
 <!--- Provide a general summary of the issue in the Title above -->

 ## Expected Behavior
@@ -2,7 +2,7 @@ blank_issues_enabled: false
 contact_links:
  - name: MinIO Community Support
    url: https://slack.min.io
-    about: Join here for Community Support
-  - name: MinIO SUBNET Support
+    about: Community support via Slack - for questions and discussions
+  - name: MinIO Enterprise Support (SUBNET)
    url: https://min.io/pricing
-    about: Join here for Enterprise Support
+    about: Enterprise support with SLA - for production deployments and feature requests
@@ -0,0 +1,55 @@
+version: 2
+
+env:
+  - CGO_ENABLED=0
+
+builds:
+  - id: minio
+    main: .
+    binary: minio
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    goamd64:
+      - v1
+    flags:
+      - -tags=kqueue
+      - -trimpath
+    ldflags:
+      - "{{ .Env.LDFLAGS }}"
+
+archives:
+  - id: minio
+    ids:
+      - minio
+    name_template: "minio_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "minio_{{ .Env.PKG_VERSION }}_checksums.txt"
+  algorithm: sha256
+
+release:
+  github:
+    owner: pgsty
+    name: minio
+  draft: true
+  prerelease: false
+  mode: append
+  replace_existing_artifacts: false
+  name_template: "{{ .Tag }}"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "Merge pull request"
+      - "Merge branch"
+
+announce:
+  skip: true
@@ -1 +1,6 @@
-<svg data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 162.612 24.465"><path d="M52.751.414h9.108v23.63h-9.108zM41.711.74l-18.488 9.92a.919.919 0 0 1-.856 0L3.879.74A2.808 2.808 0 0 0 2.558.414h-.023A2.4 2.4 0 0 0 0 2.641v21.376h9.1V13.842a.918.918 0 0 1 1.385-.682l10.361 5.568a3.634 3.634 0 0 0 3.336.028l10.933-5.634a.917.917 0 0 1 1.371.69v10.205h9.1V2.641A2.4 2.4 0 0 0 43.055.414h-.023a2.808 2.808 0 0 0-1.321.326zm65.564-.326h-9.237v10.755a.913.913 0 0 1-1.338.706L72.762.675a2.824 2.824 0 0 0-1.191-.261h-.016a2.4 2.4 0 0 0-2.535 2.227v21.377h9.163V13.275a.914.914 0 0 1 1.337-.707l24.032 11.2a2.813 2.813 0 0 0 1.188.26 2.4 2.4 0 0 0 2.535-2.227zm7.161 23.63V.414h4.191v23.63zm28.856.421c-11.274 0-19.272-4.7-19.272-12.232C124.02 4.741 132.066 0 143.292 0s19.32 4.7 19.32 12.233-7.902 12.232-19.32 12.232zm0-21.333c-8.383 0-14.84 3.217-14.84 9.1 0 5.926 6.457 9.1 14.84 9.1s14.887-3.174 14.887-9.1c0-5.883-6.504-9.1-14.887-9.1z" fill="#c72c48"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="255 293 539 140" fill="none">
+  <path d="M255.222 385.861 304.199 383.375c1.061 6.446 3.22 11.358 6.478 14.734 5.303 5.465 12.879 8.197 22.728 8.197 7.348 0 13.011-1.397 16.988-4.19 3.977-2.794 5.966-6.032 5.966-9.716 0-3.5-1.894-6.631-5.682-9.394-3.788-2.763-12.576-5.372-26.364-7.828-22.576-4.113-38.674-9.577-48.295-16.392-9.697-6.815-14.546-15.502-14.546-26.062 0-6.938 2.481-13.491 7.443-19.662 4.962-6.17 12.424-11.02 22.386-14.55 9.962-3.53 23.617-5.295 40.966-5.295 21.288 0 37.519 3.208 48.693 9.624 11.174 6.416 17.822 16.622 19.943 30.621l-48.523 2.302c-1.288-6.078-3.996-10.498-8.125-13.261-4.129-2.763-9.83-4.144-17.103-4.144-5.984 0-10.492 1.028-13.522 3.085-3.03 2.056-4.545 4.558-4.545 7.505 0 2.149 1.25 4.083 3.75 5.802 2.424 1.78 8.182 3.438 17.273 4.973 22.5 3.93 38.617 7.905 48.352 11.926 9.735 4.022 16.818 9.01 21.25 14.965 4.432 5.956 6.648 12.617 6.648 19.984 0 8.657-2.954 16.638-8.863 23.944-5.909 7.306-14.167 12.847-24.773 16.623-10.606 3.776-23.977 5.664-40.113 5.664-28.333 0-47.954-4.42-58.863-13.261-10.909-8.841-17.083-20.076-18.522-33.706Z" fill="#287CAB"/>
+  <path d="M434.578 295.519h43.304v135.007h-43.304z" fill="#287CAB"/>
+  <path d="M517.881 295.519h43.209v101.762h67.436v33.245H517.881Z" fill="#287CAB"/>
+  <path d="M639.4 363.115c0-22.041 6.359-39.201 19.077-51.48 12.718-12.28 30.427-18.419 53.129-18.419 23.274 0 41.206 6.032 53.796 18.096 12.591 12.064 18.886 28.963 18.886 50.697 0 15.778-2.75 28.717-8.251 38.817-5.5 10.099-13.449 17.958-23.846 23.575-10.397 5.618-23.353 8.427-38.869 8.427-15.77 0-28.822-2.425-39.155-7.275-10.333-4.85-18.711-12.525-25.133-23.023-6.423-10.499-9.634-23.637-9.634-39.416Zm43.209.184c0 13.63 2.623 23.422 7.869 29.377 5.246 5.956 12.384 8.934 21.413 8.934 9.284 0 16.47-2.916 21.557-8.749 5.087-5.833 7.631-16.301 7.631-31.403 0-12.709-2.655-21.995-7.965-27.858-5.31-5.863-12.511-8.795-21.604-8.795-8.712 0-15.707 2.978-20.985 8.933-5.278 5.956-7.916 15.81-7.916 29.561Z" fill="#287CAB"/>
+</svg>
@@ -0,0 +1,38 @@
+name: minio
+arch: ${NFPM_ARCH}
+platform: linux
+version: ${PKG_VERSION}
+version_schema: none
+release: ${NFPM_RELEASE}
+section: utils
+priority: optional
+maintainer: "Ruohang Feng (@Vonng) <rh@vonng.com>"
+description: S3-Interface Libre Object Storage, Community-maintained MinIO server fork.
+vendor: PGSTY
+homepage: https://silo.pgsty.com
+license: AGPL-3.0-or-later
+
+contents:
+  - src: ${NFPM_SOURCE}
+    dst: /usr/local/bin/minio
+    expand: true
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: ${NFPM_UNIT}
+    dst: /usr/lib/systemd/system/minio.service
+    expand: true
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+
+rpm:
+  group: Applications/File
+  compression: gzip:9
+
+deb:
+  compression: gzip
+  fields:
+    License: AGPL-3.0-or-later
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="1624" height="570" viewBox="0 0 1994 700"
+     preserveAspectRatio="xMidYMid meet"
+     role="img" aria-labelledby="title desc"
+     shape-rendering="geometricPrecision">
+  <title id="title">SILO wordmark</title>
+  <desc id="desc">The SILO wordmark set in Chakra Petch Bold, outlined, with the blue-to-copper brand gradient.</desc>
+
+  <defs>
+    <linearGradient id="silo-wordmark-color" x1="44.0" y1="-94.4" x2="1950.0" y2="794.4" gradientUnits="userSpaceOnUse">
+      <stop class="wm-a" offset="0.06" stop-color="#1d588c"/>
+      <stop class="wm-b" offset="0.94" stop-color="#b4762e"/>
+    </linearGradient>
+    <style>
+      /* Light theme values of --pg-strong / --copper; dark theme swaps in its own pair. */
+      @media (prefers-color-scheme: dark) {
+        .wm-a { stop-color: #7fb8e8; }
+        .wm-b { stop-color: #e0a35c; }
+      }
+    </style>
+  </defs>
+
+  <g fill="url(#silo-wordmark-color)" fill-rule="nonzero">
+    <path id="silo-s" d="M0 592V492H134V551L167 584H374L408 550V434L375 401H110L2 293V108L110 0H426L534 108V209H400V149L367 116H169L136 149V252L169 285H434L542 393V590L432 700H108Z"/>
+    <path id="silo-i" d="M637 0H773V700H637Z"/>
+    <path id="silo-l" d="M888 0H1024V585H1374V700H888Z"/>
+    <path id="silo-o" d="M1404 585V115L1519 0H1879L1994 115V585L1879 700H1519ZM1807 584 1858 533V167L1807 116H1591L1540 167V533L1591 584Z"/>
+  </g>
+</svg>
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="570" height="570" viewBox="230 213 570 570"
+     preserveAspectRatio="xMidYMid meet"
+     role="img" aria-labelledby="title desc"
+     shape-rendering="geometricPrecision">
+  <title id="title">SILO emblem</title>
+  <desc id="desc">A smooth circular SILO mark with a peaked roof, flowing left wall, columns, and a curved base.</desc>
+
+  <defs>
+    <linearGradient id="silo-color" x1="276" y1="720" x2="742" y2="286" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#064A83"/>
+      <stop offset="0.5" stop-color="#007FA8"/>
+      <stop offset="1" stop-color="#22C7C9"/>
+    </linearGradient>
+  </defs>
+
+  <g fill="url(#silo-color)">
+    <!-- Outer circular band, intentionally opened at the lower-right plinth. -->
+    <path d="
+      M 734 676
+      A 283.5 278.5 0 1 0 310 692
+      L 359 692
+      A 247 248.5 0 1 1 688 676
+      Z"/>
+
+    <!-- Flowing left wall; its upper tangent matches the inner ellipse. -->
+    <path d="
+      M 300.57 375
+      C 292 390 300 430 328 450
+      C 343 461 357 472 374 481
+      C 410 501 426 517 426 544
+      L 426 676
+      L 336 676
+      C 308 647 286 608 274 565
+      C 262 522 263 479 272 439
+      C 278 413 286 389 300.57 375
+      Z"/>
+
+    <!-- Right column with tangent-continuous upper shoulder. -->
+    <path d="
+      M 602 373
+      Q 602 368 607 370
+      C 619 374 634 381 634 389
+      L 634 647
+      Q 634 649 636 649
+      L 708 649
+      L 734 676
+      L 602 676
+      Z"/>
+
+    <!-- Lower circular cap. -->
+    <path d="
+      M 310 692
+      L 714 692
+      C 668 743 596 774 512 774
+      C 428 774 355 743 310 692
+      Z"/>
+
+    <!-- Main silo body, with a tangent-continuous right shoulder. -->
+    <path d="
+      M 389 389
+      C 389 374 447 351 512 351
+      C 540 351 565 354 580 359
+      Q 583 360 583 364
+      L 583 676
+      L 443 676
+      L 443 541
+      C 443 509 426 490 389 470
+      Z"/>
+
+    <!-- Peaked roof with softly tapered, burr-free tips. -->
+    <path d="
+      M 512 274
+      L 647 365
+      Q 649 370 647 376
+      C 609 350 563 337 512 337
+      C 460 337 414 350 377 376
+      Q 375 370 377 365
+      Z"/>
+  </g>
+</svg>
@@ -1,14 +0,0 @@
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v4
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
@@ -0,0 +1,170 @@
+name: Publish Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Published RELEASE.* tag to package as pgsty/minio"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-release
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      # Images are built from a published release rather than from the build
+      # that produced it, so an abandoned draft can never leave :latest
+      # pointing at something nobody shipped.
+      - name: Validate published release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          TAG="${INPUT_TAG}"
+          VERSION_HYPHEN="${TAG#RELEASE.}"
+          PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
+          if [ "${PKG_VERSION}" = "${VERSION_HYPHEN}" ]; then
+            echo "Invalid release tag: ${TAG}"
+            exit 1
+          fi
+
+          IS_DRAFT="$(gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" --json isDraft --jq .isDraft)"
+          IS_PRERELEASE="$(gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" --json isPrerelease --jq .isPrerelease)"
+          PUBLISHED_AT="$(gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" --json publishedAt --jq .publishedAt)"
+          LATEST_TAG="$(gh release view --repo "${GITHUB_REPOSITORY}" --json tagName --jq .tagName)"
+
+          if [ "${IS_DRAFT}" != false ] || [ "${IS_PRERELEASE}" != false ] || [ -z "${PUBLISHED_AT}" ]; then
+            echo "${TAG} must be a published, non-prerelease GitHub Release"
+            exit 1
+          fi
+          # This workflow moves :latest, so it must not run for an older tag.
+          if [ "${TAG}" != "${LATEST_TAG}" ]; then
+            echo "Refusing to replace Docker latest with non-latest release ${TAG} (latest is ${LATEST_TAG})"
+            exit 1
+          fi
+
+          {
+            echo "RELEASE_TAG=${TAG}"
+            echo "PKG_VERSION=${PKG_VERSION}"
+            echo "PUBLISHED_AT=${PUBLISHED_AT}"
+          } >> "${GITHUB_ENV}"
+
+      - name: Validate Docker Hub credentials
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
+            echo "Missing Docker Hub credentials. Set DOCKERHUB_USERNAME and DOCKERHUB_TOKEN repository secrets."
+            exit 1
+          fi
+
+      - name: Checkout release tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+
+      - name: Prepare verified Docker contexts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          assets_dir="docker-release/assets"
+          mkdir -p "${assets_dir}"
+
+          amd64_archive="minio_${PKG_VERSION}_linux_amd64.tar.gz"
+          arm64_archive="minio_${PKG_VERSION}_linux_arm64.tar.gz"
+          checksums="minio_${PKG_VERSION}_checksums.txt"
+          gh release download "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" \
+            --dir "${assets_dir}" \
+            --pattern "${amd64_archive}" \
+            --pattern "${arm64_archive}" \
+            --pattern "${checksums}"
+
+          # The binaries going into the images are the published ones, checked
+          # against the published checksums, not a rebuild that merely ought to
+          # match them.
+          cd "${assets_dir}"
+          grep -F "  ${amd64_archive}" "${checksums}" | sha256sum --check
+          grep -F "  ${arm64_archive}" "${checksums}" | sha256sum --check
+          cd "${GITHUB_WORKSPACE}"
+
+          # Dockerfile.goreleaser expects the binary at the context root and
+          # the entrypoint scripts under dockerscripts/, which is the layout
+          # GoReleaser used to assemble via extra_files.
+          for arch in amd64 arm64; do
+            context="docker-release/${arch}"
+            archive="${assets_dir}/minio_${PKG_VERSION}_linux_${arch}.tar.gz"
+            mkdir -p "${context}/dockerscripts"
+            tar -xzf "${archive}" -C "${context}" minio
+            cp Dockerfile.goreleaser LICENSE CREDITS "${context}/"
+            cp dockerscripts/docker-entrypoint.sh dockerscripts/download-static-curl.sh \
+              "${context}/dockerscripts/"
+          done
+
+          echo "RELEASE_REVISION=$(git rev-parse HEAD)" >> "${GITHUB_ENV}"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push amd64 image
+        uses: docker/build-push-action@v6
+        with:
+          context: docker-release/amd64
+          file: docker-release/amd64/Dockerfile.goreleaser
+          platforms: linux/amd64
+          push: true
+          tags: |
+            pgsty/minio:${{ env.RELEASE_TAG }}-amd64
+            pgsty/minio:latest-amd64
+          labels: |
+            org.opencontainers.image.version=${{ env.RELEASE_TAG }}
+            org.opencontainers.image.created=${{ env.PUBLISHED_AT }}
+            org.opencontainers.image.revision=${{ env.RELEASE_REVISION }}
+
+      - name: Build and push arm64 image
+        uses: docker/build-push-action@v6
+        with:
+          context: docker-release/arm64
+          file: docker-release/arm64/Dockerfile.goreleaser
+          platforms: linux/arm64
+          push: true
+          tags: |
+            pgsty/minio:${{ env.RELEASE_TAG }}-arm64
+            pgsty/minio:latest-arm64
+          labels: |
+            org.opencontainers.image.version=${{ env.RELEASE_TAG }}
+            org.opencontainers.image.created=${{ env.PUBLISHED_AT }}
+            org.opencontainers.image.revision=${{ env.RELEASE_REVISION }}
+
+      - name: Publish multi-architecture manifests
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create \
+            --tag "pgsty/minio:${RELEASE_TAG}" \
+            "pgsty/minio:${RELEASE_TAG}-amd64" \
+            "pgsty/minio:${RELEASE_TAG}-arm64"
+          docker buildx imagetools create \
+            --tag "pgsty/minio:latest" \
+            "pgsty/minio:latest-amd64" \
+            "pgsty/minio:latest-arm64"
+          docker buildx imagetools inspect "pgsty/minio:${RELEASE_TAG}"
+          docker buildx imagetools inspect "pgsty/minio:latest"
@@ -1,39 +0,0 @@
-name: Crosscompile
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build Tests with Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Build on ${{ matrix.os }}
-        if: matrix.os == 'ubuntu-latest'
-        env:
-          CGO_ENABLED: 0
-          GO111MODULE: on
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make crosscompile
@@ -1,44 +0,0 @@
-name: Healing Functional Tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Build on ${{ matrix.os }}
-        if: matrix.os == 'ubuntu-latest'
-        env:
-          CGO_ENABLED: 0
-          GO111MODULE: on
-          MINIO_KMS_SECRET_KEY: "my-minio-key:oyArl7zlPECEduNbB1KXgdzDn2Bdpvvw0l8VO51HQnY="
-          MINIO_KMS_AUTO_ENCRYPTION: on
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make verify-healing
-          make verify-healing-inconsistent-versions
-          make verify-healing-with-root-disks
-          make verify-healing-with-rewrite
@@ -1,42 +0,0 @@
-name: Linters and Tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Build on ${{ matrix.os }}
-        if: matrix.os == 'ubuntu-latest'
-        env:
-          CGO_ENABLED: 0
-          GO111MODULE: on
-        run: |
-          sudo apt install jq -y
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make
-          make test
-          make test-race
@@ -1,39 +0,0 @@
-name: Resiliency Functional Tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Build on ${{ matrix.os }}
-        if: matrix.os == 'ubuntu-latest'
-        env:
-          CGO_ENABLED: 0
-          GO111MODULE: on
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-resiliency
@@ -1,42 +1,149 @@
-name: Functional Tests
+name: Go CI

 on:
  pull_request:
    branches:
      - master
+  push:
+    branches:
+      - master
+  workflow_dispatch:

-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
+# Cancel superseded runs for the same PR; never cancel master push runs.
+# Keyed on PR number (not head_ref) so fork PRs sharing a branch name
+# do not collide.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

 permissions:
  contents: read

 jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }} - healing
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
+  verify:
+    name: Format, Build, Vet
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
+
      - uses: actions/setup-go@v5
        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Build on ${{ matrix.os }}
-        if: matrix.os == 'ubuntu-latest'
+          go-version-file: go.mod
+          cache: true
+
+      - name: Check gofmt
+        run: |
+          unformatted=$(gofmt -l main.go cmd internal)
+          if [ -n "${unformatted}" ]; then
+            echo "The following files are not gofmt-formatted:"
+            echo "${unformatted}"
+            gofmt -d ${unformatted}
+            exit 1
+          fi
+
+      - name: Build
        env:
          CGO_ENABLED: 0
-          GO111MODULE: on
-          MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
-          MINIO_KMS_AUTO_ENCRYPTION: on
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+  quality:
+    name: Lint, Generated Files
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Lint
+        run: make lint
+
+      - name: Check generated files
+        run: make check-gen
+
+  race-s3select:
+    name: Race, S3 Select
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run S3 Select tests under race detector
+        run: go test -race ./internal/s3select/... -count=1
+
+  crosscompile:
+    name: Cross Compile
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build supported targets
+        run: make crosscompile
+
+  test-internal:
+    name: Test internal/
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # internal/http listener tests bind [::1]; runners disable IPv6 by default.
+      - name: Enable IPv6
        run: |
          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make verify
-          make test-timeout
+
+      - name: Run internal tests
+        env:
+          CGO_ENABLED: 0
+          MINIO_API_REQUESTS_MAX: "10000"
+        run: go test ./internal/... -count=1
+
+  test-cmd:
+    name: Test cmd/
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # Some server tests bind IPv6 listeners; runners disable IPv6 by default.
+      - name: Enable IPv6
+        run: |
+          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
+          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
+
+      - name: Run cmd tests
+        env:
+          CGO_ENABLED: 0
+          MINIO_API_REQUESTS_MAX: "10000"
+        # cmd/ is one large package; raise go test's default 10m per-package
+        # timeout so slower runners fail on the job timeout, not a panic.
+        run: go test ./cmd/ -count=1 -timeout 30m
@@ -1,30 +0,0 @@
-name: Helm Chart linting
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-
-      - name: Run helm lint
-        run: |
-          cd helm/minio
-          helm lint .
@@ -1,161 +0,0 @@
-name: IAM integration
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  iam-matrix-test:
-    name: "[Go=${{ matrix.go-version }}|ldap=${{ matrix.ldap }}|etcd=${{ matrix.etcd }}|openid=${{ matrix.openid }}]"
-    runs-on: ubuntu-latest
-
-    services:
-      openldap:
-        image: quay.io/minio/openldap
-        ports:
-          - "389:389"
-          - "636:636"
-        env:
-          LDAP_ORGANIZATION: "MinIO Inc"
-          LDAP_DOMAIN: "min.io"
-          LDAP_ADMIN_PASSWORD: "admin"
-      etcd:
-        image: "quay.io/coreos/etcd:v3.5.1"
-        env:
-          ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379"
-          ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379"
-        ports:
-          - "2379:2379"
-        options: >-
-          --health-cmd "etcdctl endpoint health"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      openid:
-        image: quay.io/minio/dex
-        ports:
-          - "5556:5556"
-        env:
-          DEX_LDAP_SERVER: "openldap:389"
-      openid2:
-        image: quay.io/minio/dex
-        ports:
-          - "5557:5557"
-        env:
-          DEX_LDAP_SERVER: "openldap:389"
-          DEX_ISSUER: "http://127.0.0.1:5557/dex"
-          DEX_WEB_HTTP: "0.0.0.0:5557"
-
-    strategy:
-      # When ldap, etcd or openid vars are empty below, those external servers
-      # are turned off - i.e. if ldap="", then ldap server is not enabled for
-      # the tests.
-      matrix:
-        go-version: [1.24.x]
-        ldap: ["", "localhost:389"]
-        etcd: ["", "http://localhost:2379"]
-        openid: ["", "http://127.0.0.1:5556/dex"]
-        exclude:
-          # exclude combos where all are empty.
-          - ldap: ""
-            etcd: ""
-            openid: ""
-          # exclude combos where both ldap and openid IDPs are specified.
-          - ldap: "localhost:389"
-            openid: "http://127.0.0.1:5556/dex"
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Test LDAP/OpenID/Etcd combo
-        env:
-          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-iam
-      - name: Test with multiple OpenID providers
-        if: matrix.openid == 'http://127.0.0.1:5556/dex'
-        env:
-          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
-          _MINIO_OPENID_TEST_SERVER_2: "http://127.0.0.1:5557/dex"
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-iam
-      - name: Test with Access Management Plugin enabled
-        env:
-          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-          _MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
-          _MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
-          _MINIO_POLICY_PLUGIN_TEST_ENDPOINT: "http://127.0.0.1:8080"
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          go run docs/iam/access-manager-plugin.go &
-          make test-iam
-      - name: Test MinIO Old Version data to IAM import current version
-        if: matrix.ldap == 'ldaphost:389'
-        env:
-          _MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
-        run: |
-          make test-iam-ldap-upgrade-import
-      - name: Test LDAP for automatic site replication
-        if: matrix.ldap == 'localhost:389'
-        run: |
-          make test-site-replication-ldap
-      - name: Test OIDC for automatic site replication
-        if: matrix.openid == 'http://127.0.0.1:5556/dex'
-        run: |
-          make test-site-replication-oidc
-  iam-import-with-missing-entities:
-    name: Test IAM import in new cluster with missing entities
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Checkout minio-iam-testing
-        uses: actions/checkout@v4
-        with:
-          repository: minio/minio-iam-testing
-          path: minio-iam-testing
-      - name: Test import of IAM artifacts when in fresh cluster there are missing groups etc
-        run: |
-          make test-iam-import-with-missing-entities
-  iam-import-with-openid:
-    name: Test IAM import in new cluster with opendid configurations
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Checkout minio-iam-testing
-        uses: actions/checkout@v4
-        with:
-          repository: minio/minio-iam-testing
-          path: minio-iam-testing
-      - name: Test import of IAM artifacts when in fresh cluster with openid configurations
-        run: |
-          make test-iam-import-with-openid
@@ -1,18 +0,0 @@
-# @format
-
-name: Issue Workflow
-
-on:
-  issues:
-    types:
-      - opened
-
-jobs:
-  add-to-project:
-    name: Add issue to project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/add-to-project@v0.5.0
-        with:
-          project-url: https://github.com/orgs/miniohq/projects/2
-          github-token: ${{ secrets.BOT_PAT }}
@@ -1,24 +0,0 @@
-name: 'Lock Threads'
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-permissions:
-  issues: write
-
-concurrency:
-  group: lock
-
-jobs:
-  action:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v3
-        with:
-          github-token: ${{ github.token }}
-          issue-inactive-days: '365'
-          exclude-any-issue-labels: 'do-not-close'
-          issue-lock-reason: 'resolved'
-          log-output: true
@@ -1,81 +0,0 @@
-name: Mint Tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  mint-test:
-    runs-on: mint
-    timeout-minutes: 120
-    steps:
-      - name: cleanup #https://github.com/actions/checkout/issues/273
-        run: |
-          sudo -S rm -rf ${GITHUB_WORKSPACE}
-          mkdir ${GITHUB_WORKSPACE}
-      - name: checkout-step
-        uses: actions/checkout@v4
-
-      - name: setup-go-step
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.24.x
-
-      - name: github sha short
-        id: vars
-        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: build-minio
-        run: |
-          TAG="quay.io/minio/minio:${{ steps.vars.outputs.sha_short }}" make docker
-
-      - name: multipart uploads test
-        run: |
-          ${GITHUB_WORKSPACE}/.github/workflows/multipart/migrate.sh "${{ steps.vars.outputs.sha_short }}"
-
-      - name: compress and encrypt
-        run: |
-          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "compress-encrypt" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
-
-      - name: multiple pools
-        run: |
-          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "pools" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
-
-      - name: standalone erasure
-        run: |
-          ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "erasure" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
-
-      # FIXME: renable this back when we have a valid way to add deadlines for PUT()s (internode CreateFile)
-      # - name: resiliency
-      #   run: |
-      #     ${GITHUB_WORKSPACE}/.github/workflows/run-mint.sh "resiliency" "minio" "minio123" "${{ steps.vars.outputs.sha_short }}"
-
-      - name: The job must cleanup
-        if: ${{ always() }}
-        run: |
-          export JOB_NAME=${{ steps.vars.outputs.sha_short }}
-          for mode in $(echo compress-encrypt pools erasure); do
-             docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/mint/minio-${mode}.yaml down || true
-             docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/mint/minio-${mode}.yaml rm || true
-          done
-
-          docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/multipart/docker-compose-site1.yaml rm -s -f || true
-          docker-compose -f ${GITHUB_WORKSPACE}/.github/workflows/multipart/docker-compose-site2.yaml rm -s -f || true
-          for volume in $(docker volume ls -q | grep minio); do
-            docker volume rm ${volume} || true
-          done
-
-          docker rmi -f quay.io/minio/minio:${{ steps.vars.outputs.sha_short }}
-          docker system prune -f || true
-          docker volume prune -f || true
-          docker volume rm $(docker volume ls -q -f dangling=true) || true
@@ -1,80 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${JOB_NAME}
-  command: server --console-address ":9001" http://minio{1...4}/cdata{1...2}
-  expose:
-    - "9000"
-    - "9001"
-  environment:
-    MINIO_CI_CD: "on"
-    MINIO_ROOT_USER: "minio"
-    MINIO_ROOT_PASSWORD: "minio123"
-    MINIO_COMPRESSION_ENABLE: "on"
-    MINIO_COMPRESSION_MIME_TYPES: "*"
-    MINIO_COMPRESSION_ALLOW_ENCRYPTION: "on"
-    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
-  healthcheck:
-    test: ["CMD", "mc", "ready", "local"]
-    interval: 5s
-    timeout: 5s
-    retries: 5
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  minio1:
-    <<: *minio-common
-    hostname: minio1
-    volumes:
-      - cdata1-1:/cdata1
-      - cdata1-2:/cdata2
-
-  minio2:
-    <<: *minio-common
-    hostname: minio2
-    volumes:
-      - cdata2-1:/cdata1
-      - cdata2-2:/cdata2
-
-  minio3:
-    <<: *minio-common
-    hostname: minio3
-    volumes:
-      - cdata3-1:/cdata1
-      - cdata3-2:/cdata2
-
-  minio4:
-    <<: *minio-common
-    hostname: minio4
-    volumes:
-      - cdata4-1:/cdata1
-      - cdata4-2:/cdata2
-
-  nginx:
-    image: nginx:1.19.2-alpine
-    hostname: nginx
-    volumes:
-      - ./nginx-4-node.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9000:9000"
-      - "9001:9001"
-    depends_on:
-      - minio1
-      - minio2
-      - minio3
-      - minio4
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  cdata1-1:
-  cdata1-2:
-  cdata2-1:
-  cdata2-2:
-  cdata3-1:
-  cdata3-2:
-  cdata4-1:
-  cdata4-2:
@@ -1,51 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${JOB_NAME}
-  command: server --console-address ":9001" edata{1...4}
-  expose:
-    - "9000"
-    - "9001"
-  environment:
-    MINIO_CI_CD: "on"
-    MINIO_ROOT_USER: "minio"
-    MINIO_ROOT_PASSWORD: "minio123"
-    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
-  healthcheck:
-    test: ["CMD", "mc", "ready", "local"]
-    interval: 5s
-    timeout: 5s
-    retries: 5
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  minio1:
-    <<: *minio-common
-    hostname: minio1
-    volumes:
-      - edata1-1:/edata1
-      - edata1-2:/edata2
-      - edata1-3:/edata3
-      - edata1-4:/edata4
-
-  nginx:
-    image: nginx:1.19.2-alpine
-    hostname: nginx
-    volumes:
-      - ./nginx-1-node.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9000:9000"
-      - "9001:9001"
-    depends_on:
-      - minio1
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  edata1-1:
-  edata1-2:
-  edata1-3:
-  edata1-4:
@@ -1,117 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${JOB_NAME}
-  command: server --console-address ":9001" http://minio{1...4}/pdata{1...2} http://minio{5...8}/pdata{1...2}
-  expose:
-    - "9000"
-    - "9001"
-  environment:
-    MINIO_CI_CD: "on"
-    MINIO_ROOT_USER: "minio"
-    MINIO_ROOT_PASSWORD: "minio123"
-    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
-  healthcheck:
-    test: ["CMD", "mc", "ready", "local"]
-    interval: 5s
-    timeout: 5s
-    retries: 5
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  minio1:
-    <<: *minio-common
-    hostname: minio1
-    volumes:
-      - pdata1-1:/pdata1
-      - pdata1-2:/pdata2
-
-  minio2:
-    <<: *minio-common
-    hostname: minio2
-    volumes:
-      - pdata2-1:/pdata1
-      - pdata2-2:/pdata2
-
-  minio3:
-    <<: *minio-common
-    hostname: minio3
-    volumes:
-      - pdata3-1:/pdata1
-      - pdata3-2:/pdata2
-
-  minio4:
-    <<: *minio-common
-    hostname: minio4
-    volumes:
-      - pdata4-1:/pdata1
-      - pdata4-2:/pdata2
-
-  minio5:
-    <<: *minio-common
-    hostname: minio5
-    volumes:
-      - pdata5-1:/pdata1
-      - pdata5-2:/pdata2
-
-  minio6:
-    <<: *minio-common
-    hostname: minio6
-    volumes:
-      - pdata6-1:/pdata1
-      - pdata6-2:/pdata2
-
-  minio7:
-    <<: *minio-common
-    hostname: minio7
-    volumes:
-      - pdata7-1:/pdata1
-      - pdata7-2:/pdata2
-
-  minio8:
-    <<: *minio-common
-    hostname: minio8
-    volumes:
-      - pdata8-1:/pdata1
-      - pdata8-2:/pdata2
-      
-  nginx:
-    image: nginx:1.19.2-alpine
-    hostname: nginx
-    volumes:
-      - ./nginx-8-node.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9000:9000"
-      - "9001:9001"
-    depends_on:
-      - minio1
-      - minio2
-      - minio3
-      - minio4
-      - minio5
-      - minio6
-      - minio7
-      - minio8
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  pdata1-1:
-  pdata1-2:
-  pdata2-1:
-  pdata2-2:
-  pdata3-1:
-  pdata3-2:
-  pdata4-1:
-  pdata4-2:
-  pdata5-1:
-  pdata5-2:
-  pdata6-1:
-  pdata6-2:
-  pdata7-1:
-  pdata7-2:
-  pdata8-1:
-  pdata8-2:
@@ -1,78 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${JOB_NAME}
-  command: server --console-address ":9001" http://minio{1...4}/rdata{1...2}
-  expose:
-    - "9000"
-    - "9001"
-  environment:
-    MINIO_CI_CD: "on"
-    MINIO_ROOT_USER: "minio"
-    MINIO_ROOT_PASSWORD: "minio123"
-    MINIO_KMS_SECRET_KEY: "my-minio-key:OSMM+vkKUTCvQs9YL/CVMIMt43HFhkUpqJxTmGl6rYw="
-    MINIO_DRIVE_MAX_TIMEOUT: "5s"
-  healthcheck:
-    test: ["CMD", "mc", "ready", "local"]
-    interval: 5s
-    timeout: 5s
-    retries: 5
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  minio1:
-    <<: *minio-common
-    hostname: minio1
-    volumes:
-      - rdata1-1:/rdata1
-      - rdata1-2:/rdata2
-
-  minio2:
-    <<: *minio-common
-    hostname: minio2
-    volumes:
-      - rdata2-1:/rdata1
-      - rdata2-2:/rdata2
-
-  minio3:
-    <<: *minio-common
-    hostname: minio3
-    volumes:
-      - rdata3-1:/rdata1
-      - rdata3-2:/rdata2
-
-  minio4:
-    <<: *minio-common
-    hostname: minio4
-    volumes:
-      - rdata4-1:/rdata1
-      - rdata4-2:/rdata2
-
-  nginx:
-    image: nginx:1.19.2-alpine
-    hostname: nginx
-    volumes:
-      - ./nginx-4-node.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9000:9000"
-      - "9001:9001"
-    depends_on:
-      - minio1
-      - minio2
-      - minio3
-      - minio4
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  rdata1-1:
-  rdata1-2:
-  rdata2-1:
-  rdata2-2:
-  rdata3-1:
-  rdata3-2:
-  rdata4-1:
-  rdata4-2:
@@ -1,100 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server minio1:9000;
-    }
-
-    upstream console {
-        ip_hash;
-        server minio1:9001;
-    }
-
-    server {
-        listen       9000;
-        listen  [::]:9000;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-
-    server {
-        listen       9001;
-        listen  [::]:9001;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-NginX-Proxy true;
-
-            # This is necessary to pass the correct IP to be hashed
-            real_ip_header X-Real-IP;
-
-            proxy_connect_timeout 300;
-            
-            # To support websocket
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            
-            chunked_transfer_encoding off;
-
-            proxy_pass http://console;
-        }
-    }
-}
@@ -1,105 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server minio1:9000 max_fails=1 fail_timeout=10s;
-        server minio2:9000 max_fails=1 fail_timeout=10s;
-        server minio3:9000 max_fails=1 fail_timeout=10s;
-    }
-
-    upstream console {
-        ip_hash;
-        server minio1:9001;
-        server minio2:9001;
-        server minio3:9001;
-        server minio4:9001;
-    }
-
-    server {
-        listen       9000;
-        listen  [::]:9000;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-
-    server {
-        listen       9001;
-        listen  [::]:9001;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-NginX-Proxy true;
-
-            # This is necessary to pass the correct IP to be hashed
-            real_ip_header X-Real-IP;
-
-            proxy_connect_timeout 300;
-            
-            # To support websocket
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            
-            chunked_transfer_encoding off;
-
-            proxy_pass http://console;
-        }
-    }
-}
@@ -1,114 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server minio1:9000 max_fails=1 fail_timeout=10s;
-        server minio2:9000 max_fails=1 fail_timeout=10s;
-        server minio3:9000 max_fails=1 fail_timeout=10s;
-        server minio4:9000 max_fails=1 fail_timeout=10s;
-        server minio5:9000 max_fails=1 fail_timeout=10s;
-        server minio6:9000 max_fails=1 fail_timeout=10s;
-        server minio7:9000 max_fails=1 fail_timeout=10s;
-        server minio8:9000 max_fails=1 fail_timeout=10s;
-    }
-
-    upstream console {
-        ip_hash;
-        server minio1:9001;
-        server minio2:9001;
-        server minio3:9001;
-        server minio4:9001;
-        server minio5:9001;
-        server minio6:9001;
-        server minio7:9001;
-        server minio8:9001;
-    }
-
-    server {
-        listen       9000;
-        listen  [::]:9000;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-
-    server {
-        listen       9001;
-        listen  [::]:9001;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-NginX-Proxy true;
-
-            # This is necessary to pass the correct IP to be hashed
-            real_ip_header X-Real-IP;
-
-            proxy_connect_timeout 300;
-            
-            # To support websocket
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            
-            chunked_transfer_encoding off;
-
-            proxy_pass http://console;
-        }
-    }
-}
@@ -1,106 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server minio1:9000 max_fails=1 fail_timeout=10s;
-        server minio2:9000 max_fails=1 fail_timeout=10s;
-        server minio3:9000 max_fails=1 fail_timeout=10s;
-        server minio4:9000 max_fails=1 fail_timeout=10s;
-    }
-
-    upstream console {
-        ip_hash;
-        server minio1:9001;
-        server minio2:9001;
-        server minio3:9001;
-        server minio4:9001;
-    }
-
-    server {
-        listen       9000;
-        listen  [::]:9000;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-
-    server {
-        listen       9001;
-        listen  [::]:9001;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-NginX-Proxy true;
-
-            # This is necessary to pass the correct IP to be hashed
-            real_ip_header X-Real-IP;
-
-            proxy_connect_timeout 300;
-            
-            # To support websocket
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            
-            chunked_transfer_encoding off;
-
-            proxy_pass http://console;
-        }
-    }
-}
@@ -1,66 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${RELEASE}
-  command: server http://site1-minio{1...4}/data{1...2}
-  environment:
-    - MINIO_PROMETHEUS_AUTH_TYPE=public
-    - CI=true
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  site1-minio1:
-    <<: *minio-common
-    hostname: site1-minio1
-    volumes:
-      - site1-data1-1:/data1
-      - site1-data1-2:/data2
-
-  site1-minio2:
-    <<: *minio-common
-    hostname: site1-minio2
-    volumes:
-      - site1-data2-1:/data1
-      - site1-data2-2:/data2
-
-  site1-minio3:
-    <<: *minio-common
-    hostname: site1-minio3
-    volumes:
-      - site1-data3-1:/data1
-      - site1-data3-2:/data2
-
-  site1-minio4:
-    <<: *minio-common
-    hostname: site1-minio4
-    volumes:
-      - site1-data4-1:/data1
-      - site1-data4-2:/data2
-
-  site1-nginx:
-    image: nginx:1.19.2-alpine
-    hostname: site1-nginx
-    volumes:
-      - ./nginx-site1.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9001:9001"
-    depends_on:
-      - site1-minio1
-      - site1-minio2
-      - site1-minio3
-      - site1-minio4
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  site1-data1-1:
-  site1-data1-2:
-  site1-data2-1:
-  site1-data2-2:
-  site1-data3-1:
-  site1-data3-2:
-  site1-data4-1:
-  site1-data4-2:
@@ -1,66 +0,0 @@
-version: '3.7'
-
-# Settings and configurations that are common for all containers
-x-minio-common: &minio-common
-  image: quay.io/minio/minio:${RELEASE}
-  command: server http://site2-minio{1...4}/data{1...2}
-  environment:
-    - MINIO_PROMETHEUS_AUTH_TYPE=public
-    - CI=true
-
-# starts 4 docker containers running minio server instances.
-# using nginx reverse proxy, load balancing, you can access
-# it through port 9000.
-services:
-  site2-minio1:
-    <<: *minio-common
-    hostname: site2-minio1
-    volumes:
-      - site2-data1-1:/data1
-      - site2-data1-2:/data2
-
-  site2-minio2:
-    <<: *minio-common
-    hostname: site2-minio2
-    volumes:
-      - site2-data2-1:/data1
-      - site2-data2-2:/data2
-
-  site2-minio3:
-    <<: *minio-common
-    hostname: site2-minio3
-    volumes:
-      - site2-data3-1:/data1
-      - site2-data3-2:/data2
-
-  site2-minio4:
-    <<: *minio-common
-    hostname: site2-minio4
-    volumes:
-      - site2-data4-1:/data1
-      - site2-data4-2:/data2
-
-  site2-nginx:
-    image: nginx:1.19.2-alpine
-    hostname: site2-nginx
-    volumes:
-      - ./nginx-site2.conf:/etc/nginx/nginx.conf:ro
-    ports:
-      - "9002:9002"
-    depends_on:
-      - site2-minio1
-      - site2-minio2
-      - site2-minio3
-      - site2-minio4
-
-## By default this config uses default local driver,
-## For custom volumes replace with volume driver configuration.
-volumes:
-  site2-data1-1:
-  site2-data1-2:
-  site2-data2-1:
-  site2-data2-2:
-  site2-data3-1:
-  site2-data3-2:
-  site2-data4-1:
-  site2-data4-2:
@@ -1,147 +0,0 @@
-#!/bin/bash
-
-set -x
-
-## change working directory
-cd .github/workflows/multipart/
-
-function cleanup() {
-	docker-compose -f docker-compose-site1.yaml rm -s -f || true
-	docker-compose -f docker-compose-site2.yaml rm -s -f || true
-	for volume in $(docker volume ls -q | grep minio); do
-		docker volume rm ${volume} || true
-	done
-
-	docker system prune -f || true
-	docker volume prune -f || true
-	docker volume rm $(docker volume ls -q -f dangling=true) || true
-}
-
-cleanup
-
-if [ ! -f ./mc ]; then
-	wget --quiet -O mc https://dl.minio.io/client/mc/release/linux-amd64/mc &&
-		chmod +x mc
-fi
-
-export RELEASE=RELEASE.2023-08-29T23-07-35Z
-
-docker-compose -f docker-compose-site1.yaml up -d
-docker-compose -f docker-compose-site2.yaml up -d
-
-sleep 30s
-
-./mc alias set site1 http://site1-nginx:9001 minioadmin minioadmin --api s3v4
-./mc alias set site2 http://site2-nginx:9002 minioadmin minioadmin --api s3v4
-
-./mc ready site1/
-./mc ready site2/
-
-./mc admin replicate add site1 site2
-./mc mb site1/testbucket/
-./mc cp -r --quiet /usr/bin site1/testbucket/
-
-sleep 5
-
-./s3-check-md5 -h
-
-failed_count_site1=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-failed_count_site2=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-
-if [ $failed_count_site1 -ne 0 ]; then
-	echo "failed with multipart on site1 uploads"
-	exit 1
-fi
-
-if [ $failed_count_site2 -ne 0 ]; then
-	echo "failed with multipart on site2 uploads"
-	exit 1
-fi
-
-./mc cp -r --quiet /usr/bin site1/testbucket/
-
-sleep 5
-
-failed_count_site1=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-failed_count_site2=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-
-## we do not need to fail here, since we are going to test
-## upgrading to master, healing and being able to recover
-## the last version.
-if [ $failed_count_site1 -ne 0 ]; then
-	echo "failed with multipart on site1 uploads ${failed_count_site1}"
-fi
-
-if [ $failed_count_site2 -ne 0 ]; then
-	echo "failed with multipart on site2 uploads ${failed_count_site2}"
-fi
-
-export RELEASE=${1}
-
-docker-compose -f docker-compose-site1.yaml up -d
-docker-compose -f docker-compose-site2.yaml up -d
-
-./mc ready site1/
-./mc ready site2/
-
-for i in $(seq 1 10); do
-	# mc admin heal -r --remove when used against a LB endpoint
-	# behaves flaky, let this run 10 times before giving up
-	./mc admin heal -r --remove --json site1/ 2>&1 >/dev/null
-	./mc admin heal -r --remove --json site2/ 2>&1 >/dev/null
-done
-
-failed_count_site1=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site1-nginx:9001 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-failed_count_site2=$(./s3-check-md5 -versions -access-key minioadmin -secret-key minioadmin -endpoint http://site2-nginx:9002 -bucket testbucket 2>&1 | grep FAILED | wc -l)
-
-if [ $failed_count_site1 -ne 0 ]; then
-	echo "failed with multipart on site1 uploads"
-	exit 1
-fi
-
-if [ $failed_count_site2 -ne 0 ]; then
-	echo "failed with multipart on site2 uploads"
-	exit 1
-fi
-
-# Add user group test
-./mc admin user add site1 site-replication-issue-user site-replication-issue-password
-./mc admin group add site1 site-replication-issue-group site-replication-issue-user
-
-max_wait_attempts=30
-wait_interval=5
-
-attempt=1
-while true; do
-	diff <(./mc admin group info site1 site-replication-issue-group) <(./mc admin group info site2 site-replication-issue-group)
-
-	if [[ $? -eq 0 ]]; then
-		echo "Outputs are consistent."
-		break
-	fi
-
-	remaining_attempts=$((max_wait_attempts - attempt))
-	if ((attempt >= max_wait_attempts)); then
-		echo "Outputs remain inconsistent after $max_wait_attempts attempts. Exiting with error."
-		exit 1
-	else
-		echo "Outputs are inconsistent. Waiting for $wait_interval seconds (attempt $attempt/$max_wait_attempts)."
-		sleep $wait_interval
-	fi
-
-	((attempt++))
-done
-
-status=$(./mc admin group info site1 site-replication-issue-group --json | jq .groupStatus | tr -d '"')
-
-if [[ $status == "enabled" ]]; then
-	echo "Success"
-else
-	echo "Expected status: enabled, actual status: $status"
-	exit 1
-fi
-
-cleanup
-
-## change working directory
-cd ../../../
@@ -1,61 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server site1-minio1:9000;
-        server site1-minio2:9000;
-        server site1-minio3:9000;
-        server site1-minio4:9000;
-    }
-
-    server {
-        listen       9001;
-        listen  [::]:9001;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-}
@@ -1,61 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  4096;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-    sendfile        on;
-    keepalive_timeout  65;
-
-    # include /etc/nginx/conf.d/*.conf;
-
-    upstream minio {
-        server site2-minio1:9000;
-        server site2-minio2:9000;
-        server site2-minio3:9000;
-        server site2-minio4:9000;
-    }
-
-    server {
-        listen       9002;
-        listen  [::]:9002;
-        server_name  localhost;
-
-        # To allow special characters in headers
-        ignore_invalid_headers off;
-        # Allow any size file to be uploaded.
-        # Set to a value such as 1000m; to restrict file size to a specific value
-        client_max_body_size 0;
-        # To disable buffering
-        proxy_buffering off;
-        proxy_request_buffering off;
-
-        location / {
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_connect_timeout 300;
-            # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            chunked_transfer_encoding off;
-
-            proxy_pass http://minio;
-        }
-    }
-}
@@ -0,0 +1,121 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "RELEASE.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. RELEASE.2026-03-24T12-00-00Z)"
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # Build the code at the tag being released, not whatever branch the
+          # dispatch ran from. On a tag push this is the tag ref already; on
+          # workflow_dispatch it pins the checkout to the requested tag so the
+          # artifacts cannot be built from one ref and published under another.
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Verify clean checkout
+        run: |
+          set -euo pipefail
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Refusing to release from a dirty working tree:" >&2
+            git status --porcelain >&2
+            exit 1
+          fi
+
+      - name: Compute release variables
+        env:
+          # Passed through the environment, never interpolated into the script
+          # body: a dispatch input reaches bash as data, so it cannot inject
+          # commands the way a `${{ ... }}` splice into the source would.
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+        run: |
+          set -euo pipefail
+          TAG="${INPUT_TAG:-${GITHUB_REF_NAME}}"
+          # Whitelist the exact tag shape before the value is used anywhere. bash
+          # =~ anchors ^...$ to the whole string (not per line, as sed would), so
+          # a tag carrying a newline cannot pass and then smuggle extra lines into
+          # $GITHUB_ENV below.
+          if [[ ! "${TAG}" =~ ^RELEASE\.[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}-[0-9]{2}-[0-9]{2}Z$ ]]; then
+            echo "Invalid release tag format: ${TAG}" >&2
+            exit 1
+          fi
+          VERSION_HYPHEN="${TAG#RELEASE.}"
+          PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
+          VERSION_COLON="$(echo "${VERSION_HYPHEN}" | sed -E 's/T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/T\1:\2:\3Z/')"
+          LDFLAGS="$(MINIO_RELEASE=RELEASE go run buildscripts/gen-ldflags.go "${VERSION_COLON}")"
+
+          {
+            echo "RELEASE_TAG=${TAG}"
+            echo "PKG_VERSION=${PKG_VERSION}"
+            echo "LDFLAGS=${LDFLAGS}"
+          } >> "${GITHUB_ENV}"
+
+          echo "Release tag: ${TAG}"
+          echo "Package version: ${PKG_VERSION}"
+          echo "LDFLAGS: ${LDFLAGS}"
+
+      - name: Build Draft release with GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --clean --skip=validate --config .github/goreleaser.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LDFLAGS: ${{ env.LDFLAGS }}
+          PKG_VERSION: ${{ env.PKG_VERSION }}
+
+      - name: Verify binary provenance stamps
+        run: |
+          set -euo pipefail
+          buildscripts/verify-build-provenance.sh
+
+      - name: Install nFPM
+        run: |
+          set -euo pipefail
+          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.47.0
+          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
+
+      - name: Build nFPM packages
+        run: |
+          set -euo pipefail
+          buildscripts/package-release.sh
+
+      - name: Upload nFPM packages to Draft release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(find dist/packages -maxdepth 1 -type f \
+            \( -name '*.rpm' -o -name '*.deb' -o -name '*.apk' -o -name '*.sha256sum' \) | sort)
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No packages were generated."
+            exit 1
+          fi
+          gh release upload "${RELEASE_TAG}" "${files[@]}"
+
+      - name: Upload dist artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
@@ -1,79 +0,0 @@
-name: MinIO advanced tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  replication-test:
-    name: Advanced Tests with Go ${{ matrix.go-version }}
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Test Decom
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-decom
-
-      - name: Test ILM
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-ilm
-          make test-ilm-transition
-
-      - name: Test PBAC
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-pbac
-
-      - name: Test Config File
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-configfile
-
-      - name: Test Replication
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-replication
-
-      - name: Test MinIO IDP for automatic site replication
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-site-replication-minio
-
-      - name: Test Versioning
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-versioning
-
-      - name: Test Multipart upload with failures
-        run: |
-          sudo sysctl net.ipv6.conf.all.disable_ipv6=0
-          sudo sysctl net.ipv6.conf.default.disable_ipv6=0
-          make test-multipart
@@ -1,34 +0,0 @@
-name: Root lockdown tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Start root lockdown tests
-        run: |
-          make test-root-disable
@@ -1,9 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIBKDCB26ADAgECAhB6vebGMUfKnmBKyqoApRSOMAUGAytlcDAbMRkwFwYDVQQD
-DBByb290QHBsYXkubWluLmlvMB4XDTIwMDQzMDE1MjIyNVoXDTI1MDQyOTE1MjIy
-NVowGzEZMBcGA1UEAwwQcm9vdEBwbGF5Lm1pbi5pbzAqMAUGAytlcAMhALzn735W
-fmSH/ghKs+4iPWziZMmWdiWr/sqvqeW+WwSxozUwMzAOBgNVHQ8BAf8EBAMCB4Aw
-EwYDVR0lBAwwCgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAFBgMrZXADQQDZOrGK
-b2ATkDlu2pTcP3LyhSBDpYh7V4TvjRkBTRgjkacCzwFLm+mh+7US8V4dBpIDsJ4u
-uWoF0y6vbLVGIlkG
-----END CERTIFICATE-----
@@ -1,3 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MC4CAQAwBQYDK2VwBCIEID9E7FSYWrMD+VjhI6q545cYT9YOyFxZb7UnjEepYDRc
-----END PRIVATE KEY-----
@@ -1,64 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-export MODE="$1"
-export ACCESS_KEY="$2"
-export SECRET_KEY="$3"
-export JOB_NAME="$4"
-export MINT_MODE="full"
-
-docker system prune -f || true
-docker volume prune -f || true
-docker volume rm $(docker volume ls -f dangling=true) || true
-
-## change working directory
-cd .github/workflows/mint
-
-## always pull latest
-docker pull docker.io/minio/mint:edge
-
-docker-compose -f minio-${MODE}.yaml up -d
-sleep 1m
-
-docker system prune -f || true
-docker volume prune -f || true
-docker volume rm $(docker volume ls -q -f dangling=true) || true
-
-# Stop two nodes, one of each pool, to check that all S3 calls work while quorum is still there
-[ "${MODE}" == "pools" ] && docker-compose -f minio-${MODE}.yaml stop minio2
-[ "${MODE}" == "pools" ] && docker-compose -f minio-${MODE}.yaml stop minio6
-
-# Pause one node, to check that all S3 calls work while one node goes wrong
-[ "${MODE}" == "resiliency" ] && docker-compose -f minio-${MODE}.yaml pause minio4
-
-docker run --rm --net=mint_default \
-	--name="mint-${MODE}-${JOB_NAME}" \
-	-e SERVER_ENDPOINT="nginx:9000" \
-	-e ACCESS_KEY="${ACCESS_KEY}" \
-	-e SECRET_KEY="${SECRET_KEY}" \
-	-e ENABLE_HTTPS=0 \
-	-e MINT_MODE="${MINT_MODE}" \
-	docker.io/minio/mint:edge
-
-# FIXME: enable this after fixing aws-sdk-java-v2 tests
-# # unpause the node, to check that all S3 calls work while one node goes wrong
-# [ "${MODE}" == "resiliency" ] && docker-compose -f minio-${MODE}.yaml unpause minio4
-# [ "${MODE}" == "resiliency" ] && docker run --rm --net=mint_default \
-# 	--name="mint-${MODE}-${JOB_NAME}" \
-# 	-e SERVER_ENDPOINT="nginx:9000" \
-# 	-e ACCESS_KEY="${ACCESS_KEY}" \
-# 	-e SECRET_KEY="${SECRET_KEY}" \
-# 	-e ENABLE_HTTPS=0 \
-# 	-e MINT_MODE="${MINT_MODE}" \
-# 	docker.io/minio/mint:edge
-
-docker-compose -f minio-${MODE}.yaml down || true
-sleep 10s
-
-docker system prune -f || true
-docker volume prune -f || true
-docker volume rm $(docker volume ls -q -f dangling=true) || true
-
-## change working directory
-cd ../../../
@@ -1,22 +0,0 @@
-name: Shell formatting checks
-
-on:
-  pull_request:
-    branches:
-      - master
-
-permissions:
-  contents: read
-    
-jobs:
-  build:
-    name: runner / shfmt
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: luizm/action-sh-checker@master
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SHFMT_OPTS: "-s"
-        with:
-          sh_checker_shellcheck_disable: true # disable for now
@@ -0,0 +1,277 @@
+name: Test Release Pipeline
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/goreleaser.yml"
+      - ".github/nfpm.yml"
+      - "Dockerfile.goreleaser"
+      - "dockerscripts/docker-entrypoint.sh"
+      - "minio.service"
+      - "buildscripts/package-release.sh"
+      - "buildscripts/sign-release-rpms.sh"
+      - "buildscripts/verify-build-provenance.sh"
+      - "buildscripts/gen-ldflags.go"
+      - ".github/workflows/release.yml"
+      - ".github/workflows/test-release.yml"
+      - ".gitignore"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Compute test variables
+        run: |
+          set -euo pipefail
+          RELEASE_TAG="RELEASE.2026-02-14T12-00-00Z"
+          VERSION_COLON="2026-02-14T12:00:00Z"
+          PKG_VERSION="20260214120000.0.0"
+          LDFLAGS="$(MINIO_RELEASE=RELEASE go run buildscripts/gen-ldflags.go "${VERSION_COLON}")"
+          {
+            echo "RELEASE_TAG=${RELEASE_TAG}"
+            echo "PKG_VERSION=${PKG_VERSION}"
+            echo "LDFLAGS=${LDFLAGS}"
+          } >> "${GITHUB_ENV}"
+          echo "PKG_VERSION: ${PKG_VERSION}"
+          echo "LDFLAGS: ${LDFLAGS}"
+
+      - name: GoReleaser config check
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: check --config .github/goreleaser.yml
+
+      - name: Build snapshot artifacts
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --snapshot --clean --skip=publish,docker --config .github/goreleaser.yml
+        env:
+          LDFLAGS: ${{ env.LDFLAGS }}
+          PKG_VERSION: ${{ env.PKG_VERSION }}
+
+      - name: Verify binary provenance stamps
+        run: |
+          set -euo pipefail
+          buildscripts/verify-build-provenance.sh
+
+      - name: Install package validation tools
+        run: |
+          set -euo pipefail
+          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.47.0
+          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
+          sudo apt-get update
+          sudo apt-get install --yes rpm binutils
+
+      - name: Package snapshot binaries with nFPM
+        run: |
+          set -euo pipefail
+          buildscripts/package-release.sh
+
+      - name: Validate package names, checksums, metadata, and payload
+        run: |
+          set -euo pipefail
+          cd dist/packages
+
+          # These are the public download names; a drift here breaks every
+          # script that fetches packages by URL.
+          expected=(
+            "minio-${PKG_VERSION}-1.aarch64.rpm"
+            "minio-${PKG_VERSION}-1.x86_64.rpm"
+            "minio_${PKG_VERSION}_aarch64.apk"
+            "minio_${PKG_VERSION}_amd64.deb"
+            "minio_${PKG_VERSION}_arm64.deb"
+            "minio_${PKG_VERSION}_x86_64.apk"
+          )
+
+          for package in "${expected[@]}"; do
+            test -s "${package}"
+            test -s "${package}.sha256sum"
+            sha256sum --check "${package}.sha256sum"
+          done
+
+          test "$(find . -maxdepth 1 -type f \( -name '*.rpm' -o -name '*.deb' -o -name '*.apk' \) | wc -l)" -eq 6
+
+          # The signing script asserts these same values, but it runs on the
+          # maintainer's machine after the release workflow has already built
+          # and uploaded. Take its expectations as the single source of truth
+          # so nfpm.yml and the signing script cannot drift apart without
+          # failing here first, while a fix is still cheap.
+          #
+          # This grep is deliberately limited to the seven identity variables,
+          # all of which are single-line. That is what makes the eval safe:
+          # should one ever become multi-line, the grep captures an
+          # unterminated quote and the eval aborts on a syntax error under
+          # set -e rather than quietly binding an empty value and comparing
+          # against nothing. expected_payload is multi-line by design and must
+          # stay out of this set for the same reason.
+          eval "$(grep -E '^expected_(vendor|packager|url|summary|description|license|group)=' \
+            ../../buildscripts/sign-release-rpms.sh)"
+          for value in "${expected_vendor}" "${expected_packager}" "${expected_url}" \
+                       "${expected_summary}" "${expected_description}" \
+                       "${expected_license}" "${expected_group}"; do
+            test -n "${value}"
+          done
+
+          service_sha="$(sha256sum ../../minio.service | awk '{print $1}')"
+
+          rpm_file="minio-${PKG_VERSION}-1.x86_64.rpm"
+          test "$(rpm -qp --queryformat '%{VENDOR}' "${rpm_file}")" = "${expected_vendor}"
+          test "$(rpm -qp --queryformat '%{PACKAGER}' "${rpm_file}")" = "${expected_packager}"
+          test "$(rpm -qp --queryformat '%{URL}' "${rpm_file}")" = "${expected_url}"
+          test "$(rpm -qp --queryformat '%{SUMMARY}' "${rpm_file}")" = "${expected_summary}"
+          test "$(rpm -qp --queryformat '%{DESCRIPTION}' "${rpm_file}")" = "${expected_description}"
+          test "$(rpm -qp --queryformat '%{LICENSE}' "${rpm_file}")" = "${expected_license}"
+          test "$(rpm -qp --queryformat '%{GROUP}' "${rpm_file}")" = "${expected_group}"
+          # Both payload entries: the unit file is as much a part of the
+          # package as the binary, and losing it would install a server with
+          # nothing to start it.
+          rpm -qpl "${rpm_file}" | grep -Fx '/usr/local/bin/minio'
+          rpm -qpl "${rpm_file}" | grep -Fx '/usr/lib/systemd/system/minio.service'
+          test "$(rpm -qpl "${rpm_file}" | wc -l)" -eq 2
+
+          deb_file="minio_${PKG_VERSION}_amd64.deb"
+          test "$(dpkg-deb --field "${deb_file}" Maintainer)" = "${expected_packager}"
+          test "$(dpkg-deb --field "${deb_file}" Version)" = "${PKG_VERSION}"
+          test "$(dpkg-deb --field "${deb_file}" License)" = "${expected_license}"
+          test "$(dpkg-deb --field "${deb_file}" Section)" = "utils"
+          test "$(dpkg-deb --field "${deb_file}" Homepage)" = "${expected_url}"
+          test "$(dpkg-deb --field "${deb_file}" Description)" = "${expected_description}"
+          dpkg-deb --contents "${deb_file}" | grep -E 'usr/local/bin/minio$'
+          dpkg-deb --contents "${deb_file}" | grep -E 'usr/lib/systemd/system/minio\.service$'
+
+          apk_info="$(tar -xOzf "minio_${PKG_VERSION}_x86_64.apk" .PKGINFO)"
+          grep -Fx "pkgver = ${PKG_VERSION}" <<< "${apk_info}"
+          grep -Fx "url = ${expected_url}" <<< "${apk_info}"
+          grep -Fx "maintainer = ${expected_packager}" <<< "${apk_info}"
+          grep -Fx "license = ${expected_license}" <<< "${apk_info}"
+          grep -Fx "pkgdesc = ${expected_description}" <<< "${apk_info}"
+          tar -tzf "minio_${PKG_VERSION}_x86_64.apk" | grep -Fx 'usr/local/bin/minio'
+          tar -tzf "minio_${PKG_VERSION}_x86_64.apk" | grep -Fx 'usr/lib/systemd/system/minio.service'
+
+          for arch in amd64 arm64; do
+            if [ "${arch}" = amd64 ]; then
+              rpm_arch=x86_64
+              deb_arch=amd64
+              apk_arch=x86_64
+            else
+              rpm_arch=aarch64
+              deb_arch=arm64
+              apk_arch=aarch64
+            fi
+
+            test "$(rpm -qp --queryformat '%{ARCH}' "minio-${PKG_VERSION}-1.${rpm_arch}.rpm")" = "${rpm_arch}"
+            test "$(dpkg-deb --field "minio_${PKG_VERSION}_${deb_arch}.deb" Architecture)" = "${deb_arch}"
+            grep -Fx "arch = ${apk_arch}" <<< "$(tar -xOzf "minio_${PKG_VERSION}_${apk_arch}.apk" .PKGINFO)"
+
+            # Accepted weakness: this takes the first match, unsorted, where
+            # find_binary in package-release.sh demands exactly one. It cannot
+            # be reached with an ambiguous match today, because packaging runs
+            # earlier in this same job and hard-fails on one. Revisit if
+            # goamd64 gains a second level, or if find_binary's exactly-one
+            # contract is ever relaxed -- at that point this weak copy would be
+            # the only one left choosing silently.
+            source_binary="$(find .. -maxdepth 2 -type f -path "../minio_linux_${arch}*/minio" | head -n 1)"
+            source_sha="$(sha256sum "${source_binary}" | awk '{print $1}')"
+
+            # Do not pipe rpm2cpio here: Debian's build exits non-zero even when
+            # it writes a correct payload, which trips `set -o pipefail`. Use
+            # rpm's own digests instead -- -K checks the payload against the
+            # header, and FILEDIGESTS is the sha256 rpm itself verifies on
+            # install.
+            rpm -K "minio-${PKG_VERSION}-1.${rpm_arch}.rpm"
+            rpm_sha="$(rpm -qp --queryformat '[%{FILENAMES} %{FILEDIGESTS}\n]' \
+              "minio-${PKG_VERSION}-1.${rpm_arch}.rpm" | awk '$1 == "/usr/local/bin/minio" { print $2 }')"
+            rpm_service_sha="$(rpm -qp --queryformat '[%{FILENAMES} %{FILEDIGESTS}\n]' \
+              "minio-${PKG_VERSION}-1.${rpm_arch}.rpm" | awk '$1 == "/usr/lib/systemd/system/minio.service" { print $2 }')"
+            deb_sha="$(ar p "minio_${PKG_VERSION}_${deb_arch}.deb" data.tar.gz | tar -xzOf - ./usr/local/bin/minio | sha256sum | awk '{print $1}')"
+            deb_service_sha="$(ar p "minio_${PKG_VERSION}_${deb_arch}.deb" data.tar.gz | tar -xzOf - ./usr/lib/systemd/system/minio.service | sha256sum | awk '{print $1}')"
+            apk_sha="$(tar -xzOf "minio_${PKG_VERSION}_${apk_arch}.apk" usr/local/bin/minio | sha256sum | awk '{print $1}')"
+            apk_service_sha="$(tar -xzOf "minio_${PKG_VERSION}_${apk_arch}.apk" usr/lib/systemd/system/minio.service | sha256sum | awk '{print $1}')"
+
+            test "${source_sha}" = "${rpm_sha}"
+            test "${source_sha}" = "${deb_sha}"
+            test "${source_sha}" = "${apk_sha}"
+            test "${service_sha}" = "${rpm_service_sha}"
+            test "${service_sha}" = "${deb_service_sha}"
+            test "${service_sha}" = "${apk_service_sha}"
+          done
+
+          find . -maxdepth 1 -type f | sort
+
+      - name: Build release runtime image and verify graceful shutdown
+        run: |
+          set -euo pipefail
+          # docker-release.yml is workflow_dispatch only, so this is the only
+          # automated build of the release runtime layer and entrypoint before a
+          # real publish. Assemble a minimal image from the linux/amd64 binary
+          # goreleaser already produced; the mcli-download build stage is skipped
+          # on purpose to keep this gate offline and deterministic.
+          ctx="$(mktemp -d)"
+          tar -xzf "dist/minio_${PKG_VERSION}_linux_amd64.tar.gz" -C "${ctx}" minio
+          cp dockerscripts/docker-entrypoint.sh "${ctx}/docker-entrypoint.sh"
+          {
+            echo "FROM registry.access.redhat.com/ubi9/ubi-micro:latest"
+            echo "COPY minio /usr/bin/minio"
+            echo "COPY docker-entrypoint.sh /usr/bin/docker-entrypoint.sh"
+            echo "RUN mkdir -p /data && chmod 0777 /data && chmod +x /usr/bin/minio /usr/bin/docker-entrypoint.sh"
+            echo 'ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]'
+            echo 'CMD ["minio"]'
+          } > "${ctx}/Dockerfile"
+          docker build -t minio-runtime-test:snapshot "${ctx}"
+
+          # PID 1 must be minio, not the entry shell, on every privilege path, so
+          # a SIGTERM from docker stop reaches the server and it exits gracefully
+          # instead of being killed at the stop timeout. Regression guard for the
+          # exec-into-chroot entrypoint fix.
+          assert_graceful() {
+            name="$1"; shift
+            docker rm -f "${name}" >/dev/null 2>&1 || true
+            docker run -d --name "${name}" \
+              -e MINIO_CI_CD=1 -e MINIO_ROOT_USER=ciadmin -e MINIO_ROOT_PASSWORD=ciadmin-secret-123 \
+              "$@" minio-runtime-test:snapshot minio server /data --address :9000 >/dev/null
+            up=""
+            for _ in $(seq 1 60); do
+              if docker logs "${name}" 2>&1 | grep -q "API:"; then up=1; break; fi
+              if [ "$(docker inspect -f '{{.State.Running}}' "${name}")" != "true" ]; then break; fi
+              sleep 1
+            done
+            if [ -z "${up}" ]; then echo "server did not start (${name}):"; docker logs "${name}" | tail -5; exit 1; fi
+            pid1="$(docker exec "${name}" cat /proc/1/comm 2>/dev/null || echo '?')"
+            start="$(date +%s)"; docker stop -t 15 "${name}" >/dev/null; end="$(date +%s)"
+            code="$(docker inspect -f '{{.State.ExitCode}}' "${name}")"
+            elapsed=$((end - start))
+            echo "${name}: pid1=${pid1} stop=${elapsed}s exit=${code}"
+            graceful=0; docker logs "${name}" 2>&1 | grep -q "Exiting on signal" && graceful=1
+            docker rm -f "${name}" >/dev/null 2>&1 || true
+            [ "${graceful}" = "1" ] || { echo "no graceful-shutdown log (${name}) - signal not forwarded"; exit 1; }
+            [ "${code}" = "0" ] || { echo "non-zero exit (${name}): ${code}"; exit 1; }
+            [ "${elapsed}" -lt 10 ] || { echo "shutdown too slow (${name}): ${elapsed}s - signal not forwarded"; exit 1; }
+          }
+          assert_graceful minio-rt-default
+          assert_graceful minio-rt-dropuser -e MINIO_USERNAME=minio-user -e MINIO_GROUPNAME=minio-group
+
+      - name: Validate release scripts
+        run: |
+          set -euo pipefail
+          bash -n buildscripts/package-release.sh
+          bash -n buildscripts/sign-release-rpms.sh
+          bash -n buildscripts/verify-build-provenance.sh
+          test -x buildscripts/package-release.sh
+          test -x buildscripts/sign-release-rpms.sh
+          test -x buildscripts/verify-build-provenance.sh
@@ -1,15 +0,0 @@
---
-name: Spelling
-on: [pull_request]
-
-jobs:
-  run:
-    name: Spell Check with Typos
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Actions Repository
-      uses: actions/checkout@v4
-
-    - name: Check spelling of repo
-      uses: crate-ci/typos@master
-
@@ -1,34 +0,0 @@
-name: Upgrade old version tests
-
-on:
-  pull_request:
-    branches:
-      - master
-
-# This ensures that previous jobs for the PR are canceled when the PR is
-# updated.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        go-version: [1.24.x]
-        os: [ubuntu-latest]
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-      - name: Start upgrade tests
-        run: |
-          make test-upgrade
@@ -1,31 +1,36 @@
 name: VulnCheck
+
 on:
  pull_request:
    branches:
      - master
-
  push:
    branches:
      - master
+  workflow_dispatch:

 permissions:
-  contents: read # to fetch code (actions/checkout)
+  contents: read

 jobs:
  vulncheck:
    name: Analysis
    runs-on: ubuntu-latest
+    timeout-minutes: 20
    steps:
-      - name: Check out code into the Go module directory
+      - name: Check out code
        uses: actions/checkout@v4
+
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
-          go-version: 1.24.x
-          cached: false
-      - name: Get official govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-        shell: bash
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
+
      - name: Run govulncheck
        run: govulncheck -show verbose ./...
-        shell: bash
@@ -53,3 +53,16 @@ s3-check-md5
 s3-verify
 xattr
 xl-meta
+
+.gitignore
+
+dist/
+
+
+.claude/
+.codex/
+AGENTS.md
+CLAUDE.md
+_bmad/
+_bmad-output/
+docs/security/
@@ -1,8 +1,14 @@
 FROM minio/minio:latest

+ARG TARGETARCH
+ARG RELEASE
+
 RUN chmod -R 777 /usr/bin

-COPY ./minio /usr/bin/minio
+COPY ./minio-${TARGETARCH}.${RELEASE} /usr/bin/minio
+COPY ./minio-${TARGETARCH}.${RELEASE}.minisig /usr/bin/minio.minisig
+COPY ./minio-${TARGETARCH}.${RELEASE}.sha256sum /usr/bin/minio.sha256sum
+
 COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh

 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
@@ -0,0 +1,96 @@
+FROM golang:1.26.5-alpine AS build
+
+ARG TARGETARCH
+
+ENV GOPATH=/go
+ENV CGO_ENABLED=0
+
+ARG MC_REPO=pgsty/mc
+ARG MC_VERSION=latest
+
+RUN apk add -U --no-cache \
+    ca-certificates \
+    bash \
+    curl \
+    jq && \
+    case "${TARGETARCH}" in \
+      amd64) MC_ARCH=amd64 ;; \
+      arm64) MC_ARCH=arm64 ;; \
+      *) echo "Unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
+    esac && \
+    if [ "${MC_VERSION}" = "latest" ]; then \
+      MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/latest"; \
+    else \
+      MC_RELEASE_URL="https://api.github.com/repos/${MC_REPO}/releases/tags/${MC_VERSION}"; \
+    fi && \
+    curl -fsSL "${MC_RELEASE_URL}" -o /tmp/mc-release.json && \
+    MC_ARCHIVE_URL=$(jq -r --arg arch "${MC_ARCH}" \
+      '.assets[] | select(.name | endswith("_linux_" + $arch + ".tar.gz")) | .browser_download_url' \
+      /tmp/mc-release.json | head -n 1) && \
+    MC_CHECKSUM_URL=$(jq -r \
+      '.assets[] | select(.name | endswith("_checksums.txt")) | .browser_download_url' \
+      /tmp/mc-release.json | head -n 1) && \
+    [ -n "${MC_ARCHIVE_URL}" ] || { echo "Cannot find mcli archive for linux/${MC_ARCH}"; exit 1; } && \
+    [ -n "${MC_CHECKSUM_URL}" ] || { echo "Cannot find mcli checksums file"; exit 1; } && \
+    ARCHIVE_NAME=$(basename "${MC_ARCHIVE_URL}") && \
+    echo "Downloading ${ARCHIVE_NAME} ..." && \
+    curl -fsSL "${MC_ARCHIVE_URL}" -o /tmp/mcli.tar.gz && \
+    curl -fsSL "${MC_CHECKSUM_URL}" -o /tmp/mcli_checksums.txt && \
+    EXPECTED=$(grep "  ${ARCHIVE_NAME}$" /tmp/mcli_checksums.txt | awk '{print $1}') && \
+    ACTUAL=$(sha256sum /tmp/mcli.tar.gz | awk '{print $1}') && \
+    [ -n "${EXPECTED}" ] || { echo "Checksum entry not found for ${ARCHIVE_NAME}"; exit 1; } && \
+    [ "${EXPECTED}" = "${ACTUAL}" ] || { echo "Checksum mismatch: expected ${EXPECTED}, got ${ACTUAL}"; exit 1; } && \
+    echo "Checksum OK: ${ACTUAL}" && \
+    mkdir -p /tmp/mcli-extract && \
+    tar -xzf /tmp/mcli.tar.gz -C /tmp/mcli-extract/ && \
+    if [ -f /tmp/mcli-extract/mcli ]; then \
+      cp /tmp/mcli-extract/mcli /go/bin/mcli; \
+    elif [ -f /tmp/mcli-extract/mc ]; then \
+      cp /tmp/mcli-extract/mc /go/bin/mcli; \
+    else \
+      echo "No mc or mcli binary found in archive:"; ls -la /tmp/mcli-extract/; exit 1; \
+    fi && \
+    chmod +x /go/bin/mcli && \
+    ln -sf mcli /go/bin/mc
+
+COPY dockerscripts/download-static-curl.sh /build/download-static-curl
+RUN chmod +x /build/download-static-curl && \
+    /build/download-static-curl
+
+FROM registry.access.redhat.com/ubi9/ubi:latest AS certs
+RUN dnf -y install ca-certificates && \
+    update-ca-trust && \
+    cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf
+
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest
+
+LABEL maintainer="pgsty <https://github.com/pgsty/minio>" \
+      description="MinIO community fork, build by pgsty"
+
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key \
+    MINIO_ROOT_USER_FILE=access_key \
+    MINIO_ROOT_PASSWORD_FILE=secret_key \
+    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
+    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
+    MINIO_CONFIG_ENV_FILE=config.env \
+    MC_CONFIG_DIR=/tmp/.mc
+
+COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY minio /usr/bin/minio
+COPY --from=build /go/bin/mcli /usr/bin/mcli
+COPY --from=build /go/bin/curl* /usr/bin/
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
+COPY LICENSE /licenses/LICENSE
+COPY CREDITS /licenses/CREDITS
+
+RUN chmod +x /usr/bin/minio /usr/bin/mcli /usr/bin/docker-entrypoint.sh && \
+    ln -sf mcli /usr/bin/mc
+
+EXPOSE 9000
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+CMD ["minio"]
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine as build
+FROM golang:1.26.5-alpine as build

 ARG TARGETARCH
 ARG RELEASE
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS build
+FROM golang:1.26.5-alpine AS build

 ARG TARGETARCH
 ARG RELEASE
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS build
+FROM golang:1.26.5-alpine AS build

 ARG TARGETARCH
 ARG RELEASE
@@ -4,6 +4,7 @@ LDFLAGS := $(shell go run buildscripts/gen-ldflags.go)

 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
+GOLANGCI_VERSION ?= v2.11.3

 VERSION ?= $(shell git describe --tags)
 REPO ?= quay.io/minio
@@ -23,7 +24,14 @@ help: ## print this help

 getdeps: ## fetch necessary dependencies
 	@mkdir -p ${GOPATH}/bin
-	@echo "Installing golangci-lint" && curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOLANGCI_DIR)
+	@if [ ! -x "$(GOLANGCI)" ]; then \
+		set -e; \
+		echo "Installing golangci-lint $(GOLANGCI_VERSION)"; \
+		script=$$(mktemp); \
+		trap 'rm -f "$$script"' EXIT; \
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh -o "$$script"; \
+		sh "$$script" -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
+	fi

 crosscompile: ## cross compile minio
 	@(env bash $(PWD)/buildscripts/cross-compile.sh)
@@ -32,14 +40,24 @@ verifiers: lint check-gen

 check-gen: ## check for updated autogenerated files
 	@go generate ./... >/dev/null
-	@go mod tidy -compat=1.21
-	@(! git diff --name-only | grep '_gen.go$$') || (echo "Non-committed changes in auto-generated code is detected, please commit them to proceed." && false)
-	@(! git diff --name-only | grep 'go.sum') || (echo "Non-committed changes in auto-generated go.sum is detected, please commit them to proceed." && false)
+	@go mod tidy -compat=1.26
+	@changed=$$(git diff --name-only -- '*_gen.go' '*_gen_test.go' '*_msgp_test.go' '*_string.go' go.mod go.sum); \
+		if [ -n "$$changed" ]; then \
+			echo "Non-committed generated changes detected:"; \
+			echo "$$changed"; \
+			exit 1; \
+		fi
+	@untracked=$$(git ls-files --others --exclude-standard -- '*_gen.go' '*_gen_test.go' '*_msgp_test.go' '*_string.go'); \
+		if [ -n "$$untracked" ]; then \
+			echo "Untracked generated files detected:"; \
+			echo "$$untracked"; \
+			exit 1; \
+		fi

 lint: getdeps ## runs golangci-lint suite of linters
 	@echo "Running $@ check"
 	@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml
-	@command typos && typos ./ || echo "typos binary is not found.. skipping.."
+	@if command -v typos >/dev/null 2>&1; then typos ./; else echo "typos binary is not found.. skipping.."; fi

 lint-fix: getdeps ## runs golangci-lint suite of linters with automatic fixes
 	@echo "Running $@ check"
@@ -0,0 +1,93 @@
+# MinIO Pull Request Guidelines
+
+These guidelines ensure high-quality commits in MinIO’s GitHub repositories, maintaining 
+a clear, valuable commit history for our open-source projects. They apply to all contributors, 
+fostering efficient reviews and robust code.
+
+## Why Pull Requests?
+
+Pull Requests (PRs) drive quality in MinIO’s codebase by:
+- Enabling peer review without pair programming.
+- Documenting changes for future reference.
+- Ensuring commits tell a clear story of development.
+
+**A poor commit lasts forever, even if code is refactored.**
+
+## Crafting a Quality PR
+
+A strong MinIO PR:
+- Delivers a complete, valuable change (feature, bug fix, or improvement).
+- Has a concise title (e.g., `[S3] Fix bucket policy parsing #1234`) and a summary with context, referencing issues (e.g., `#1234`).
+- Contains well-written, logical commits explaining *why* changes were made (e.g., “Add S3 bucket tagging support so that users can organize resources efficiently”).
+- Is small, focused, and easy to review—ideally one commit, unless multiple commits better narrate complex work.
+- Adheres to MinIO’s coding standards (e.g., Go style, error handling, testing).
+
+PRs must flow smoothly through review to reach production. Large PRs should be split into smaller, manageable ones.
+
+## Submitting PRs
+
+1. **Title and Summary**:
+   - Use a scannable title: `[Subsystem] Action Description #Issue` (e.g., `[IAM] Add role-based access control #567`).
+   - Include context in the summary: what changed, why, and any issue references.
+   - Use `[WIP]` for in-progress PRs to avoid premature merging or choose GitHub draft PRs.
+
+2. **Commits**:
+   - Write clear messages: what changed and why (e.g., “Refactor S3 API handler to reduce latency so that requests process 20% faster”).
+   - Rebase to tidy commits before submitting (e.g., `git rebase -i main` to squash typos or reword messages), unless multiple contributors worked on the branch.
+   - Keep PRs focused—one feature or fix. Split large changes into multiple PRs.
+
+3. **Testing**:
+   - Include unit tests for new functionality or bug fixes.
+   - Ensure existing tests pass (`make test`).
+   - Document testing steps in the PR summary if manual testing was performed.
+
+4. **Before Submitting**:
+   - Run `make verify` to check formatting, linting, and tests.
+   - Reference related issues (e.g., “Closes #1234”).
+   - Notify team members via GitHub `@mentions` if urgent or complex.
+
+## Reviewing PRs
+
+Reviewers ensure MinIO’s commit history remains a clear, reliable record. Responsibilities include:
+
+1. **Commit Quality**:
+   - Verify each commit explains *why* the change was made (e.g., “So that…”).
+   - Request rebasing if commits are unclear, redundant, or lack context (e.g., “Please squash typo fixes into the parent commit”).
+
+2. **Code Quality**:
+   - Check adherence to MinIO’s Go standards (e.g., error handling, documentation).
+   - Ensure tests cover new code and pass CI.
+   - Flag bugs or critical issues for immediate fixes; suggest non-blocking improvements as follow-up issues.
+
+3. **Flow**:
+   - Review promptly to avoid blocking progress.
+   - Balance quality and speed—minor issues can be addressed later via issues, not PR blocks.
+   - If unable to complete the review, tag another reviewer (e.g., `@username please take over`).
+
+4. **Shared Responsibility**:
+   - All MinIO contributors are reviewers. The first commenter on a PR owns the review unless they delegate.
+   - Multiple reviewers are encouraged for complex PRs.
+
+5. **No Self-Edits**:
+   - Don’t modify the PR directly (e.g., fixing bugs). Request changes from the submitter or create a follow-up PR.
+   - If you edit, you’re a collaborator, not a reviewer, and cannot merge.
+
+6. **Testing**:
+   - Assume the submitter tested the code. If testing is unclear, ask for details (e.g., “How was this tested?”).
+   - Reject untested PRs unless testing is infeasible, then assist with test setup.
+
+## Tips for Success
+
+- **Small PRs**: Easier to review, faster to merge. Split large changes logically.
+- **Clear Commits**: Use `git rebase -i` to refine history before submitting.
+- **Engage Early**: Discuss complex changes in issues or Slack (https://slack.min.io) before coding.
+- **Be Responsive**: Address reviewer feedback promptly to keep PRs moving.
+- **Learn from Reviews**: Use feedback to improve future contributions.
+
+## Resources
+
+- [MinIO Coding Standards](https://github.com/minio/minio/blob/master/CONTRIBUTING.md)
+- [Effective Commit Messages](https://mislav.net/2014/02/hidden-documentation/)
+- [GitHub PR Tips](https://github.com/blog/1943-how-to-write-the-perfect-pull-request)
+
+By following these guidelines, we ensure MinIO’s codebase remains high-quality, maintainable, and a joy to contribute to. Happy coding!
@@ -1,268 +1,165 @@
-# MinIO Quickstart Guide
+> [!WARNING]
+> **This branch is archived and receives no further changes.**
+>
+> `minio` holds the final state of this project under the MinIO identity. Development continues on **[`main`](https://github.com/pgsty/silo/tree/main)**, where the project is named **Silo** and the binary, packages, systemd unit, container image, and Helm chart are all named `silo`. On 2026-08-06 the repository was renamed `pgsty/minio` → **[`pgsty/silo`](https://github.com/pgsty/silo)** and its default branch `master` → `main`.
+>
+> The last release cut from this branch is **[`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z)** (2026-08-04). Its 19 assets carry the `minio` artifact names, and the matching container image is `docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z`. Those artifacts stay published and unmodified — no tag is moved, re-signed, or removed. If you need the artifacts maintained under the original MinIO identity, this branch and the releases up to that tag are where they live. Later releases carry the `silo` names.
+>
+> **Nothing on the wire changed with the rename.** `MINIO_*` environment variables, `minio_*` Prometheus metrics, `x-minio-*` headers, `/minio/*` routes, the `.minio.sys` on-disk layout, IAM and ARN values, and the `github.com/minio/minio` Go module path are all preserved on `main`. A Silo server reads data written by this release, and the packages install side by side, so migrating or rolling back stays an explicit administrator action.

-[![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io) [![Docker Pulls](https://img.shields.io/docker/pulls/minio/minio.svg?maxAge=604800)](https://hub.docker.com/r/minio/minio/) [![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/minio/minio/blob/master/LICENSE)
+<h1 align="center">
+  <img src=".github/silo-word.svg" alt="SILO" height="80">
+</h1>

-[![MinIO](https://raw.githubusercontent.com/minio/minio/master/.github/logo.svg?sanitize=true)](https://min.io)

-MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. To learn more about what MinIO is doing for AI storage, go to [AI storage documentation](https://min.io/solutions/object-storage-for-ai).
+<p align="center">
+  <strong>A conservatively maintained MinIO fork</strong><br>
+  Security maintenance, versioned release artifacts, and operational continuity for existing deployments.
+</p>

-This README provides quickstart instructions on running MinIO on bare metal hardware, including container-based installations. For Kubernetes environments, use the [MinIO Kubernetes Operator](https://github.com/minio/operator/blob/master/README.md).
+<p align="center">
+  <a href="https://silo.pgsty.com/">Website</a> ·
+  <a href="https://silo.pgsty.com/docs/">Documentation</a> ·
+  <a href="https://silo.pgsty.com/download/">Download</a> ·
+  <a href="https://silo.pgsty.com/blog/">Blog</a> ·
+  <a href="https://github.com/pgsty/minio/releases">Releases</a> ·
+  <a href="SECURITY.md">Security</a> ·
+  <a href="README_ZH.md">中文</a>
+</p>

-## Container Installation
+<p align="center">
+  <a href="https://github.com/pgsty/minio/releases"><img alt="GitHub Release" src="https://img.shields.io/github/v/release/pgsty/minio?include_prereleases&label=release&logo=github"></a>
+  <a href="https://hub.docker.com/r/pgsty/minio"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/pgsty/minio?logo=docker"></a>
+  <a href="go.mod"><img alt="Go Version" src="https://img.shields.io/github/go-mod/go-version/pgsty/minio?logo=go"></a>
+  <a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPLv3-blue"></a>
+</p>

-Use the following commands to run a standalone MinIO server as a container.
+> [!IMPORTANT]
+> Silo is an independent, community-maintained fork of the open-source MinIO server, published by [Pigsty](https://pigsty.io) from [`pgsty/minio`](https://github.com/pgsty/minio). It is not affiliated with, endorsed by, or sponsored by MinIO, Inc. “MinIO” is used only to identify the upstream project and compatibility lineage.

-Standalone MinIO servers are best suited for early development and evaluation. Certain features such as versioning, object locking, and bucket replication
-require distributed deploying MinIO with Erasure Coding. For extended development and production, deploy MinIO with Erasure Coding enabled - specifically,
-with a *minimum* of 4 drives per MinIO server. See [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html)
-for more complete documentation.
+## Overview

-### Stable
+Silo maintains one downstream release line based on MinIO [`RELEASE.2025-12-03T12-00-00Z`](https://github.com/minio/minio/releases/tag/RELEASE.2025-12-03T12-00-00Z). It provides maintained builds and release artifacts for existing MinIO-compatible deployments after upstream community distribution ended. Pigsty uses this fork for object storage as an optional PG backup repo.

-Run the following command to run the latest stable image of MinIO as a container using an ephemeral data volume:
+The official project portal is [silo.pgsty.com](https://silo.pgsty.com/). It brings documentation, downloads, release and security notes, and project background together. English is served at the site root; Chinese is available under [/zh/](https://silo.pgsty.com/zh/).

-```sh
-podman run -p 9000:9000 -p 9001:9001 \
-  quay.io/minio/minio server /data --console-address ":9001"
+## Find the Right Resource
+
+| Looking for | Canonical location |
+| :-- | :-- |
+| Project overview and navigation | [Silo Website](https://silo.pgsty.com/) ([中文](https://silo.pgsty.com/zh/)) |
+| Installation methods and downloads | [Download & Install](https://silo.pgsty.com/download/) ([中文](https://silo.pgsty.com/zh/download/)) |
+| Operations, administration, development, and reference | [Documentation](https://silo.pgsty.com/docs/) ([中文](https://silo.pgsty.com/zh/docs/)) |
+| Project news, release notes, and security notes | [Blog](https://silo.pgsty.com/blog/), including [releases](https://silo.pgsty.com/blog/release/) and [security](https://silo.pgsty.com/blog/security/) |
+| Versioned binaries, checksums, and source archives | [GitHub Releases](https://github.com/pgsty/minio/releases) |
+| Bug reports and feature discussions | [GitHub Issues](https://github.com/pgsty/minio/issues) |
+| License, attribution, and trademark information | [License](https://silo.pgsty.com/about/license/), [Attribution](https://silo.pgsty.com/about/attribution/), and [Trademark](https://silo.pgsty.com/about/trademark/) |
+
+## Maintenance Policy
+
+The active release line covers:
+
+- build and dependency maintenance;
+- applicable security fixes and advisories;
+- focused fixes for reproducible defects;
+- versioned binaries, packages, checksums, and multi-architecture images;
+- the web console, client, documentation, and Pigsty integration.
+
+Changes are kept narrow and tested where practical. Maintenance is best effort; no response, remediation, or release schedule is guaranteed.
+
+### Out of scope
+
+- a separate product roadmap, new storage engine, or speculative S3 features;
+- broad rewrites or changes that materially expand the downstream delta;
+- historical releases or multiple support branches;
+- commercial support, SLAs, 24×7 coverage, or SUBNET access;
+- deployment design, access control, monitoring, backup, or recovery.
+
+## Compatibility
+
+Silo aims to preserve:
+
+- MinIO-compatible S3 APIs, configuration, environment variables, and CLI conventions;
+- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` tags, container entrypoints, and common deployment workflows.
+
+Compatibility is the default constraint. Silo preserves existing wire, client, configuration, and operational behavior whenever doing so remains safe. Compatibility is broken only when necessary to close a major security issue, and the release notes must identify the affected behavior and migration path. Treat each release as a downstream upgrade: pin versions, review [release notes](https://silo.pgsty.com/blog/release/) and [security advisories](docs/security/advisories.md), keep a rollback path, and test before production use.
+
+## Downloads and Release Artifacts
+
+Use [Download & Install](https://silo.pgsty.com/download/) to choose an installation method. GitHub Releases remains the source for versioned server binaries, checksums, and source archives.
+
+| Artifact | Location |
+| :-- | :-- |
+| Source | [`github.com/pgsty/minio`](https://github.com/pgsty/minio) |
+| Container image | [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio), multi-arch for `linux/amd64` and `linux/arm64` |
+| Server binaries and checksums | [GitHub Releases](https://github.com/pgsty/minio/releases) for Linux, macOS, and Windows on `amd64` and `arm64` |
+| Linux packages | RPM, DEB, and APK artifacts, also distributed through the [Pigsty repository](https://pigsty.io/docs/repo/) |
+| Client | [`pgsty/mc`](https://github.com/pgsty/mc), bundled in the container as `mcli` with an `mc` compatibility alias |
+| Console | Maintained [`georgmangold/console`](https://github.com/georgmangold/console) fork, embedded in the server build |
+| Shared library | [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) v3.7.0, consumed through a `replace` directive while preserving `github.com/minio/pkg/v3` import paths ([release notes](https://silo.pgsty.com/blog/release/pkg-3.7.0/)) |
+
+## Quick Start
+
+For local evaluation:
+
+```bash
+mkdir -p data
+
+export MINIO_ROOT_USER=minioadmin
+export MINIO_ROOT_PASSWORD=change-me-long-password
+
+docker run -d --name silo \
+  -p 9000:9000 \
+  -p 9001:9001 \
+  -e MINIO_ROOT_USER \
+  -e MINIO_ROOT_PASSWORD \
+  -v "$PWD/data:/data" \
+  pgsty/minio:latest server /data --console-address ":9001"
 ```

-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded
-object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the
-root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
+Open the console at <http://localhost:9001>; the S3 API listens on <http://localhost:9000>.

-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See
-[Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers,
-see <https://min.io/docs/minio/linux/developers/minio-drivers.html> to view MinIO SDKs for supported languages.
+The image includes the compatible client as `mcli`:

-> [!NOTE]
-> To deploy MinIO on with persistent storage, you must map local persistent directories from the host OS to the container using the `podman -v` option.
-> For example, `-v /mnt/data:/data` maps the host OS drive at `/mnt/data` to `/data` on the container.
-
-## macOS
-
-Use the following commands to run a standalone MinIO server on macOS.
-
-Standalone MinIO servers are best suited for early development and evaluation. Certain features such as versioning, object locking, and bucket replication require distributed deploying MinIO with Erasure Coding. For extended development and production, deploy MinIO with Erasure Coding enabled - specifically, with a *minimum* of 4 drives per MinIO server. See [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html) for more complete documentation.
-
-### Homebrew (recommended)
-
-Run the following command to install the latest stable MinIO package using [Homebrew](https://brew.sh/). Replace ``/data`` with the path to the drive or directory in which you want MinIO to store data.
-
-```sh
-brew install minio/stable/minio
-minio server /data
+```bash
+docker exec silo mcli alias set local http://127.0.0.1:9000 \
+  "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
+docker exec silo mcli mb local/demo
+docker exec silo mcli ls local
 ```

-> [!NOTE]
-> If you previously installed minio using `brew install minio` then it is recommended that you reinstall minio from `minio/stable/minio` official repo instead.
+> [!WARNING]
+> For production, pin a release, use unique credentials and TLS, monitor the service, keep independent backups, and test recovery.

-```sh
-brew uninstall minio
-brew install minio/stable/minio
+Build the server from source:
+
+```bash
+go build -o minio .
+./minio --version
 ```

-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded web-based object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
+For other installation paths—including native packages, binaries, Podman, Kubernetes, source, and Pigsty Ansible—use [Download & Install](https://silo.pgsty.com/download/). For production deployment and administration, start with the [Silo documentation](https://silo.pgsty.com/docs/). Pigsty users can also use the [Pigsty MinIO module](https://pigsty.io/docs/minio/).

-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See [Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers, see <https://min.io/docs/minio/linux/developers/minio-drivers.html/> to view MinIO SDKs for supported languages.
+## Security

-### Binary Download
+Security fixes target the active `master` branch and are recorded in the [advisory log](docs/security/advisories.md) and the portal's [security notes](https://silo.pgsty.com/blog/security/). Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md) and [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md). Report issues that also affect upstream MinIO there as well.

-Use the following command to download and run a standalone MinIO server on macOS. Replace ``/data`` with the path to the drive or directory in which you want MinIO to store data.
+## Contributing

-```sh
-wget https://dl.min.io/server/minio/release/darwin-amd64/minio
-chmod +x minio
-./minio server /data
-```
+Useful contributions include security and dependency updates, reproducible bug fixes, tests, release automation, packaging, and documentation.

-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded web-based object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
+Issues and pull requests should include the affected version, reproduction steps, impact, expected behavior, tests, and compatibility notes. Discuss large changes in an issue first.

-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See [Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers, see <https://min.io/docs/minio/linux/developers/minio-drivers.html> to view MinIO SDKs for supported languages.
+## Background

-## GNU/Linux
+This project was created in response to changes in the upstream community distribution and maintenance model. The maintainer’s analysis, alternatives considered, and early maintenance record are documented below:

-Use the following command to run a standalone MinIO server on Linux hosts running 64-bit Intel/AMD architectures. Replace ``/data`` with the path to the drive or directory in which you want MinIO to store data.
+| Essay | Subject |
+| :-- | :-- |
+| [MinIO Is Dead](https://silo.pgsty.com/blog/post/minio-is-dead/) | Changes to the upstream project and distribution model |
+| [MinIO Is Dead, Long Live MinIO](https://silo.pgsty.com/blog/post/minio-resurrect/) | Establishing the fork and its release pipeline |
+| [Two months into maintaining a MinIO fork](https://silo.pgsty.com/blog/post/minio-promise-kept/) | Initial security and maintenance work |

-```sh
-wget https://dl.min.io/server/minio/release/linux-amd64/minio
-chmod +x minio
-./minio server /data
-```
+## License and Trademark

-The following table lists supported architectures. Replace the `wget` URL with the architecture for your Linux host.
-
-| Architecture                   | URL                                                        |
-| --------                       | ------                                                     |
-| 64-bit Intel/AMD               | <https://dl.min.io/server/minio/release/linux-amd64/minio>   |
-| 64-bit ARM                     | <https://dl.min.io/server/minio/release/linux-arm64/minio>   |
-| 64-bit PowerPC LE (ppc64le)    | <https://dl.min.io/server/minio/release/linux-ppc64le/minio> |
-
-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded web-based object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
-
-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See [Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers, see <https://min.io/docs/minio/linux/developers/minio-drivers.html> to view MinIO SDKs for supported languages.
-
-> [!NOTE]
-> Standalone MinIO servers are best suited for early development and evaluation. Certain features such as versioning, object locking, and bucket replication require distributed deploying MinIO with Erasure Coding. For extended development and production, deploy MinIO with Erasure Coding enabled - specifically, with a *minimum* of 4 drives per MinIO server. See [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html#) for more complete documentation.
-
-## Microsoft Windows
-
-To run MinIO on 64-bit Windows hosts, download the MinIO executable from the following URL:
-
-```sh
-https://dl.min.io/server/minio/release/windows-amd64/minio.exe
-```
-
-Use the following command to run a standalone MinIO server on the Windows host. Replace ``D:\`` with the path to the drive or directory in which you want MinIO to store data. You must change the terminal or powershell directory to the location of the ``minio.exe`` executable, *or* add the path to that directory to the system ``$PATH``:
-
-```sh
-minio.exe server D:\
-```
-
-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded web-based object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
-
-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See [Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers, see <https://min.io/docs/minio/linux/developers/minio-drivers.html> to view MinIO SDKs for supported languages.
-
-> [!NOTE]
-> Standalone MinIO servers are best suited for early development and evaluation. Certain features such as versioning, object locking, and bucket replication require distributed deploying MinIO with Erasure Coding. For extended development and production, deploy MinIO with Erasure Coding enabled - specifically, with a *minimum* of 4 drives per MinIO server. See [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html#) for more complete documentation.
-
-## Install from Source
-
-Use the following commands to compile and run a standalone MinIO server from source. Source installation is only intended for developers and advanced users. If you do not have a working Golang environment, please follow [How to install Golang](https://golang.org/doc/install). Minimum version required is [go1.24](https://golang.org/dl/#stable)
-
-```sh
-go install github.com/minio/minio@latest
-```
-
-The MinIO deployment starts using default root credentials `minioadmin:minioadmin`. You can test the deployment using the MinIO Console, an embedded web-based object browser built into MinIO Server. Point a web browser running on the host machine to <http://127.0.0.1:9000> and log in with the root credentials. You can use the Browser to create buckets, upload objects, and browse the contents of the MinIO server.
-
-You can also connect using any S3-compatible tool, such as the MinIO Client `mc` commandline tool. See [Test using MinIO Client `mc`](#test-using-minio-client-mc) for more information on using the `mc` commandline tool. For application developers, see <https://min.io/docs/minio/linux/developers/minio-drivers.html> to view MinIO SDKs for supported languages.
-
-> [!NOTE]
-> Standalone MinIO servers are best suited for early development and evaluation. Certain features such as versioning, object locking, and bucket replication require distributed deploying MinIO with Erasure Coding. For extended development and production, deploy MinIO with Erasure Coding enabled - specifically, with a *minimum* of 4 drives per MinIO server. See [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html) for more complete documentation.
-
-MinIO strongly recommends *against* using compiled-from-source MinIO servers for production environments.
-
-## Deployment Recommendations
-
-### Allow port access for Firewalls
-
-By default MinIO uses the port 9000 to listen for incoming connections. If your platform blocks the port by default, you may need to enable access to the port.
-
-### ufw
-
-For hosts with ufw enabled (Debian based distros), you can use `ufw` command to allow traffic to specific ports. Use below command to allow access to port 9000
-
-```sh
-ufw allow 9000
-```
-
-Below command enables all incoming traffic to ports ranging from 9000 to 9010.
-
-```sh
-ufw allow 9000:9010/tcp
-```
-
-### firewall-cmd
-
-For hosts with firewall-cmd enabled (CentOS), you can use `firewall-cmd` command to allow traffic to specific ports. Use below commands to allow access to port 9000
-
-```sh
-firewall-cmd --get-active-zones
-```
-
-This command gets the active zone(s). Now, apply port rules to the relevant zones returned above. For example if the zone is `public`, use
-
-```sh
-firewall-cmd --zone=public --add-port=9000/tcp --permanent
-```
-
-> [!NOTE]
-> `permanent` makes sure the rules are persistent across firewall start, restart or reload. Finally reload the firewall for changes to take effect.
-
-```sh
-firewall-cmd --reload
-```
-
-### iptables
-
-For hosts with iptables enabled (RHEL, CentOS, etc), you can use `iptables` command to enable all traffic coming to specific ports. Use below command to allow
-access to port 9000
-
-```sh
-iptables -A INPUT -p tcp --dport 9000 -j ACCEPT
-service iptables restart
-```
-
-Below command enables all incoming traffic to ports ranging from 9000 to 9010.
-
-```sh
-iptables -A INPUT -p tcp --dport 9000:9010 -j ACCEPT
-service iptables restart
-```
-
-## Test MinIO Connectivity
-
-### Test using MinIO Console
-
-MinIO Server comes with an embedded web based object browser. Point your web browser to <http://127.0.0.1:9000> to ensure your server has started successfully.
-
-> [!NOTE]
-> MinIO runs console on random port by default, if you wish to choose a specific port use `--console-address` to pick a specific interface and port.
-
-### Things to consider
-
-MinIO redirects browser access requests to the configured server port (i.e. `127.0.0.1:9000`) to the configured Console port. MinIO uses the hostname or IP address specified in the request when building the redirect URL. The URL and port *must* be accessible by the client for the redirection to work.
-
-For deployments behind a load balancer, proxy, or ingress rule where the MinIO host IP address or port is not public, use the `MINIO_BROWSER_REDIRECT_URL` environment variable to specify the external hostname for the redirect. The LB/Proxy must have rules for directing traffic to the Console port specifically.
-
-For example, consider a MinIO deployment behind a proxy `https://minio.example.net`, `https://console.minio.example.net` with rules for forwarding traffic on port :9000 and :9001 to MinIO and the MinIO Console respectively on the internal network. Set `MINIO_BROWSER_REDIRECT_URL` to `https://console.minio.example.net` to ensure the browser receives a valid reachable URL.
-
-| Dashboard                                                                                   | Creating a bucket                                                                           |
-| -------------                                                                               | -------------                                                                               |
-| ![Dashboard](https://github.com/minio/minio/blob/master/docs/screenshots/pic1.png?raw=true) | ![Dashboard](https://github.com/minio/minio/blob/master/docs/screenshots/pic2.png?raw=true) |
-
-## Test using MinIO Client `mc`
-
-`mc` provides a modern alternative to UNIX commands like ls, cat, cp, mirror, diff etc. It supports filesystems and Amazon S3 compatible cloud storage services. Follow the MinIO Client [Quickstart Guide](https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart) for further instructions.
-
-## Upgrading MinIO
-
-Upgrades require zero downtime in MinIO, all upgrades are non-disruptive, all transactions on MinIO are atomic. So upgrading all the servers simultaneously is the recommended way to upgrade MinIO.
-
-> [!NOTE]
-> requires internet access to update directly from <https://dl.min.io>, optionally you can host any mirrors at <https://my-artifactory.example.com/minio/>
-
- For deployments that installed the MinIO server binary by hand, use [`mc admin update`](https://min.io/docs/minio/linux/reference/minio-mc-admin/mc-admin-update.html)
-
-```sh
-mc admin update <minio alias, e.g., myminio>
-```
-
- For deployments without external internet access (e.g. airgapped environments), download the binary from <https://dl.min.io> and replace the existing MinIO binary let's say for example `/opt/bin/minio`, apply executable permissions `chmod +x /opt/bin/minio` and proceed to perform `mc admin service restart alias/`.
-
- For installations using Systemd MinIO service, upgrade via RPM/DEB packages **parallelly** on all servers or replace the binary lets say `/opt/bin/minio` on all nodes, apply executable permissions `chmod +x /opt/bin/minio` and process to perform `mc admin service restart alias/`.
-
-### Upgrade Checklist
-
- Test all upgrades in a lower environment (DEV, QA, UAT) before applying to production. Performing blind upgrades in production environments carries significant risk.
- Read the release notes for MinIO *before* performing any upgrade, there is no forced requirement to upgrade to latest release upon every release. Some release may not be relevant to your setup, avoid upgrading production environments unnecessarily.
- If you plan to use `mc admin update`, MinIO process must have write access to the parent directory where the binary is present on the host system.
- `mc admin update` is not supported and should be avoided in kubernetes/container environments, please upgrade containers by upgrading relevant container images.
- **We do not recommend upgrading one MinIO server at a time, the product is designed to support parallel upgrades please follow our recommended guidelines.**
-
-## Explore Further
-
- [MinIO Erasure Code Overview](https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html)
- [Use `mc` with MinIO Server](https://min.io/docs/minio/linux/reference/minio-mc.html)
- [Use `minio-go` SDK with MinIO Server](https://min.io/docs/minio/linux/developers/go/minio-go.html)
- [The MinIO documentation website](https://min.io/docs/minio/linux/index.html)
-
-## Contribute to MinIO Project
-
-Please follow MinIO [Contributor's Guide](https://github.com/minio/minio/blob/master/CONTRIBUTING.md)
-
-## License
-
- MinIO source is licensed under the [GNU AGPLv3](https://github.com/minio/minio/blob/master/LICENSE).
- MinIO [documentation](https://github.com/minio/minio/tree/master/docs) is licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
- [License Compliance](https://github.com/minio/minio/blob/master/COMPLIANCE.md)
+The server remains licensed under the [GNU Affero General Public License v3.0](LICENSE). See [`CREDITS`](CREDITS) for upstream authorship and attribution. MinIO is a trademark of MinIO, Inc. Silo and `pgsty/minio` are independent community efforts and are not affiliated with or endorsed by MinIO, Inc.
@@ -0,0 +1,172 @@
+> [!WARNING]
+> **本分支已归档，不再接受任何修改。**
+>
+> `minio` 分支保留本项目以 MinIO 身份存在的最后状态。开发已迁移到 **[`main`](https://github.com/pgsty/silo/tree/main)** 分支，项目在那里以 **Silo** 的身份继续维护，二进制、软件包、systemd unit、容器镜像与 Helm chart 全部更名为 `silo`。2026-08-06，仓库由 `pgsty/minio` 更名为 **[`pgsty/silo`](https://github.com/pgsty/silo)**，默认分支由 `master` 更名为 `main`。
+>
+> 本分支上切出的最后一个版本是 **[`RELEASE.2026-08-04T00-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2026-08-04T00-00-00Z)**（2026-08-04）。它的 19 个资产使用 `minio` 命名，对应容器镜像为 `docker.io/pgsty/minio:RELEASE.2026-08-04T00-00-00Z`。这些产物保持已发布状态且不做改动 —— 不移动、不重新签名、不删除任何 tag。如果你需要以原本 MinIO 形态维持的归档构件，就在本分支以及截止到该 tag 的历次发布中。此后的版本使用 `silo` 命名。
+>
+> **更名没有改变任何对外接口。** `MINIO_*` 环境变量、`minio_*` 指标、`x-minio-*` 头、`/minio/*` 路由、`.minio.sys` 磁盘布局、IAM 与 ARN 取值，以及 Go 模块路径 `github.com/minio/minio`，在 `main` 上全部原样保留。Silo 服务端可直接读取本版本写入的数据；新旧软件包并存安装，因此迁移与回滚始终是管理员显式触发的动作。
+
+<h1 align="center">
+  <img src=".github/silo.svg" alt="" height="80">
+  <img src=".github/silo-word.svg" alt="SILO" height="80">
+</h1>
+
+<p align="center">
+  <strong>审慎维护的 MinIO 社区分支</strong><br>
+  为现有部署提供安全维护、带版本的发行产物与持续运维支持。
+</p>
+
+<p align="center">
+  <a href="https://silo.pgsty.com/zh/">官网</a> ·
+  <a href="https://silo.pgsty.com/zh/docs/">文档</a> ·
+  <a href="https://silo.pgsty.com/zh/download/">下载</a> ·
+  <a href="https://silo.pgsty.com/zh/blog/">博客</a> ·
+  <a href="https://github.com/pgsty/minio/releases">版本发布</a> ·
+  <a href="SECURITY.md">安全策略</a> ·
+  <a href="README.md">English</a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/pgsty/minio/releases"><img alt="GitHub Release" src="https://img.shields.io/github/v/release/pgsty/minio?include_prereleases&label=release&logo=github"></a>
+  <a href="https://hub.docker.com/r/pgsty/minio"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/pgsty/minio?logo=docker"></a>
+  <a href="go.mod"><img alt="Go Version" src="https://img.shields.io/github/go-mod/go-version/pgsty/minio?logo=go"></a>
+  <a href="LICENSE"><img alt="License" src="https://img.shields.io/badge/license-AGPLv3-blue"></a>
+</p>
+
+> [!IMPORTANT]
+> Silo 是由 [Pigsty](https://pigsty.cc) 独立维护、从 [`pgsty/minio`](https://github.com/pgsty/minio) 发布的开源 MinIO 社区分支。本项目与 MinIO, Inc. 不存在隶属、背书或赞助关系；文中使用 “MinIO” 仅用于说明上游项目及兼容谱系。
+
+## 概述
+
+Silo 维护一条基于 MinIO [`RELEASE.2025-12-03T12-00-00Z`](https://github.com/minio/minio/releases/tag/RELEASE.2025-12-03T12-00-00Z) 的下游版本线，为上游停止社区发行后仍在运行 MinIO 兼容部署的用户提供持续构建与发行产物。
+
+Pigsty 使用本分支提供对象存储，包括 PostgreSQL 备份存储。
+
+项目统一门户为 [silo.pgsty.com](https://silo.pgsty.com/zh/)，集中提供文档、下载安装、版本与安全动态及项目背景。中文内容位于 `/zh/`，英文内容位于站点根路径。
+
+## 按需求选择入口
+
+| 需求 | 权威入口 |
+| :-- | :-- |
+| 项目概览与全站导航 | [Silo 中文门户](https://silo.pgsty.com/zh/)（[English](https://silo.pgsty.com/)） |
+| 安装方式与软件下载 | [下载与安装](https://silo.pgsty.com/zh/download/)（[English](https://silo.pgsty.com/download/)） |
+| 运维、管理、开发与参考指南 | [中文文档](https://silo.pgsty.com/zh/docs/)（[English](https://silo.pgsty.com/docs/)） |
+| 项目动态、版本说明与安全通告 | [博客](https://silo.pgsty.com/zh/blog/)，包括[版本发布](https://silo.pgsty.com/zh/blog/release/)与[安全通告](https://silo.pgsty.com/zh/blog/security/) |
+| 带版本的二进制、校验和与源码归档 | [GitHub Releases](https://github.com/pgsty/minio/releases) |
+| 缺陷报告与功能讨论 | [GitHub Issues](https://github.com/pgsty/minio/issues) |
+| 私密漏洞报告 | [`SECURITY.md`](SECURITY.md) 与 [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) |
+| 许可证、署名与商标信息 | [许可证](https://silo.pgsty.com/zh/about/license/)、[署名归属](https://silo.pgsty.com/zh/about/attribution/)与[商标政策](https://silo.pgsty.com/zh/about/trademark/) |
+
+## 维护政策
+
+活跃版本线的维护范围包括：
+
+- 构建与依赖项维护；
+- 适用的安全修复与公告；
+- 针对可复现缺陷的范围明确的修复；
+- 带版本的二进制、软件包、校验和与多架构镜像；
+- Web Console、客户端、文档与 Pigsty 集成。
+
+改动保持克制，并在可行时提供测试。所有维护均为尽力而为，不承诺固定的响应、修复或发布时间。
+
+### 范围之外
+
+- 独立产品路线图、新存储引擎或假设性的 S3 新特性；
+- 大规模重写或显著扩大下游差异的改动；
+- 历史版本或多条支持分支；
+- 商业支持、SLA、7×24 服务或 SUBNET 服务；
+- 部署设计、访问控制、监控、备份与恢复。
+
+## 兼容策略
+
+Silo 尽量保留：
+
+- `minio` 可执行文件与 `github.com/minio/minio` module path；
+- MinIO 兼容的 S3 API、配置、环境变量与命令行约定；
+- `RELEASE.YYYY-MM-DDTHH-MM-SSZ` 标签、容器入口与常见部署方式。
+
+兼容性是默认约束。只要不会留下安全问题，Silo 就保留既有的协议、客户端、配置与运维行为；只有在修复重大安全问题确有必要时才会打破兼容，并在版本说明中明确受影响行为与迁移方式。每个版本仍应视为下游升级：锁定版本，阅读[版本说明](https://silo.pgsty.com/zh/blog/release/)与[安全公告](docs/security/advisories.md)，保留回滚路径，并在生产使用前完成测试。
+
+## 下载与发行产物
+
+请先在[下载与安装](https://silo.pgsty.com/zh/download/)页面选择合适的安装方式；GitHub Releases 仍是带版本服务端二进制、校验和与源码归档的获取位置。
+
+| 产物 | 位置 |
+| :-- | :-- |
+| 源码 | [`github.com/pgsty/minio`](https://github.com/pgsty/minio) |
+| 容器镜像 | [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio)，支持 `linux/amd64` 与 `linux/arm64` 多架构清单 |
+| 服务端二进制与校验和 | [GitHub Releases](https://github.com/pgsty/minio/releases)，覆盖 Linux、macOS、Windows 的 `amd64` 与 `arm64` |
+| Linux 软件包 | RPM、DEB、APK，并通过 [Pigsty 软件仓库](https://pigsty.cc/docs/repo/) 分发 |
+| 客户端 | [`pgsty/mc`](https://github.com/pgsty/mc)，容器内以 `mcli` 提供，并保留 `mc` 兼容别名 |
+| 管理控制台 | 社区维护的 [`georgmangold/console`](https://github.com/georgmangold/console)，嵌入服务端构建 |
+| 共享库 | [`pgsty/silo-pkg`](https://github.com/pgsty/silo-pkg) v3.7.0，通过 `replace` 指令使用，同时保留 `github.com/minio/pkg/v3` 导入路径（[版本说明](https://silo.pgsty.com/zh/blog/release/pkg-3.7.0/)） |
+
+## 快速开始
+
+本地体验：
+
+```bash
+mkdir -p data
+
+export MINIO_ROOT_USER=minioadmin
+export MINIO_ROOT_PASSWORD=change-me-long-password
+
+docker run -d --name silo \
+  -p 9000:9000 \
+  -p 9001:9001 \
+  -e MINIO_ROOT_USER \
+  -e MINIO_ROOT_PASSWORD \
+  -v "$PWD/data:/data" \
+  pgsty/minio:latest server /data --console-address ":9001"
+```
+
+管理控制台位于 <http://localhost:9001>，S3 API 位于 <http://localhost:9000>。
+
+镜像内置兼容客户端 `mcli`：
+
+```bash
+docker exec silo mcli alias set local http://127.0.0.1:9000 \
+  "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
+docker exec silo mcli mb local/demo
+docker exec silo mcli ls local
+```
+
+> [!WARNING]
+> 生产环境应锁定版本，使用独立凭据与 TLS，配置监控，保留独立备份，并验证恢复流程。
+
+从源码构建服务端：
+
+```bash
+go build -o minio .
+./minio --version
+```
+
+其他安装方式（包括原生软件包、二进制、Podman、Kubernetes、源码构建与 Pigsty Ansible）请前往[下载与安装](https://silo.pgsty.com/zh/download/)；生产部署与管理请从 [Silo 中文文档](https://silo.pgsty.com/zh/docs/)开始。Pigsty 用户也可以直接使用 [Pigsty MinIO 模块](https://pigsty.cc/docs/minio/)。
+
+## 安全
+
+安全修复面向活跃的 `master` 分支，并记录在仓库[安全公告](docs/security/advisories.md)与门户[安全通告](https://silo.pgsty.com/zh/blog/security/)中。请按照 [`SECURITY.md`](SECURITY.md) 与 [`VULNERABILITY_REPORT.md`](VULNERABILITY_REPORT.md) 私密报告漏洞；同时影响上游 MinIO 的问题也应向上游报告。
+
+## 参与贡献
+
+欢迎安全与依赖项更新、可复现缺陷修复、测试、发布自动化、打包与文档改进。
+
+Issue 与 Pull Request 应说明受影响版本、复现步骤、影响、预期行为、测试与兼容性说明。大型改动请先提交 Issue 讨论。
+
+## 背景
+
+本项目源于上游社区发行与维护模式的变化。维护者对相关变化的分析、替代方案评估与早期维护记录见以下文章：
+
+| 文章 | 主题 |
+| :-- | :-- |
+| [MinIO已死](https://silo.pgsty.com/zh/blog/post/minio-is-dead/) | 上游项目与发行模式的变化 |
+| [MinIO已死，谁能接盘？](https://silo.pgsty.com/zh/blog/post/minio-alternative/) | 可选替代方案评估 |
+| [MinIO 已死，MinIO 复生](https://silo.pgsty.com/zh/blog/post/minio-resurrect/) | 建立分支及其发行流水线 |
+| [续命 MinIO：承诺兑现](https://silo.pgsty.com/zh/blog/post/minio-promise-kept/) | 初期安全与维护工作 |
+
+## 许可证与商标
+
+服务端继续采用 [GNU Affero General Public License v3.0](LICENSE) 发布。上游作者与署名信息见 [`CREDITS`](CREDITS)。
+
+MinIO 是 MinIO, Inc. 的商标。Silo、Pigsty 与 `pgsty/minio` 均为独立社区项目，与 MinIO, Inc. 不存在隶属或背书关系。
@@ -1,42 +1,20 @@
 # Security Policy

+This repository is the `pgsty/minio` community fork of `minio/minio`. Upstream MinIO security contacts do not handle fork-specific fixes or release notes for this repository.
+
 ## Supported Versions

-We always provide security updates for the [latest release](https://github.com/minio/minio/releases/latest).
-Whenever there is a security update you just need to upgrade to the latest version.
+Security fixes are tracked on the active `master` branch and summarized in [docs/security/advisories.md](docs/security/advisories.md).

 ## Reporting a Vulnerability

-All security bugs in [minio/minio](https://github,com/minio/minio) (or other minio/* repositories)
-should be reported by email to security@min.io. Your email will be acknowledged within 48 hours,
-and you'll receive a more detailed response to your email within 72 hours indicating the next steps
-in handling your report.
+For vulnerabilities in this fork:

-Please, provide a detailed explanation of the issue. In particular, outline the type of the security
-issue (DoS, authentication bypass, information disclose, ...) and the assumptions you're making (e.g. do
-you need access credentials for a successful exploit).
+1. Follow the fork-specific expectations in [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md).
+2. Prefer the `pgsty/minio` repository's GitHub security reporting workflow when it is available.
+3. If private reporting is not available, contact the maintainers through the `pgsty/minio` repository before publishing detailed exploit information.
+4. If you confirm the issue also affects upstream `minio/minio`, report it upstream separately.

-If you have not received a reply to your email within 48 hours or you have not heard from the security team
-for the past five days please contact the security team directly:
+## Disclosure Process

- Primary security coordinator: aead@min.io
- Secondary coordinator: harsha@min.io
- If you receive no response: dev@min.io
-
-### Disclosure Process
-
-MinIO uses the following disclosure process:
-
-1. Once the security report is received one member of the security team tries to verify and reproduce
-   the issue and determines the impact it has.
-2. A member of the security team will respond and either confirm or reject the security report.
-   If the report is rejected the response explains why.
-3. Code is audited to find any potential similar problems.
-4. Fixes are prepared for the latest release.
-5. On the date that the fixes are applied a security advisory will be published on <https://blog.min.io>.
-   Please inform us in your report email whether MinIO should mention your contribution w.r.t. fixing
-   the security issue. By default MinIO will **not** publish this information to protect your privacy.
-
-This process can take some time, especially when coordination is required with maintainers of other projects.
-Every effort will be made to handle the bug in as timely a manner as possible, however it's important that we
-follow the process described above to ensure that disclosures are handled consistently.
+Fork-specific fixes and user-visible upgrade notes are published in [docs/security/advisories.md](docs/security/advisories.md). The fork-specific triage and remediation process is described in [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md).
@@ -1,38 +1,37 @@
 # Vulnerability Management Policy

-This document formally describes the process of addressing and managing a
-reported vulnerability that has been found in the MinIO server code base,
-any directly connected ecosystem component or a direct / indirect dependency
-of the code base.
+This document describes how the `pgsty/minio` maintainers investigate,
+assess, and remediate reported vulnerabilities affecting this fork, any
+directly shipped component, or a direct / indirect dependency used by this
+repository.

 ## Scope

-The vulnerability management policy described in this document covers the
-process of investigating, assessing and resolving a vulnerability report
-opened by a MinIO employee or an external third party.
+This policy covers vulnerability reports opened by repository maintainers or
+external third parties against `pgsty/minio` itself, its release artifacts, or
+dependencies that materially affect this fork.

-Therefore, it lists pre-conditions and actions that should be performed to
-resolve and fix a reported vulnerability.
+It defines the information needed for triage and the expected remediation
+workflow for supported fixes.

 ## Vulnerability Management Process

-The vulnerability management process requires that the vulnerability report
-contains the following information:
+A useful vulnerability report should contain the following information:

 - The project / component that contains the reported vulnerability.
 - A description of the vulnerability. In particular, the type of the
-   reported vulnerability and how it might be exploited. Alternatively,
-   a well-established vulnerability identifier, e.g. CVE number, can be
-   used instead.
+  reported vulnerability and how it might be exploited. Alternatively,
+  a well-established vulnerability identifier, such as a CVE or GHSA ID, can
+  be used instead.

-Based on the description mentioned above, a MinIO engineer or security team
-member investigates:
+Based on the report, the `pgsty/minio` maintainers investigate:

 - Whether the reported vulnerability exists.
 - The conditions that are required such that the vulnerability can be exploited.
+- Which releases, branches, or deployment paths are affected.
 - The steps required to fix the vulnerability.

-In general, if the vulnerability exists in one of the MinIO code bases
-itself - not in a code dependency - then MinIO will, if possible, fix
-the vulnerability or implement reasonable countermeasures such that the
-vulnerability cannot be exploited anymore.
+If the vulnerability exists in this fork itself, the maintainers will, when
+feasible, fix the issue or implement reasonable countermeasures such that the
+vulnerability can no longer be exploited. Fork-specific upgrade notes and
+security advisories are published in `docs/security/advisories.md`.
@@ -74,11 +74,11 @@ check_minimum_version() {

 assert_is_supported_arch() {
 	case "${ARCH}" in
-	x86_64 | amd64 | aarch64 | ppc64le | arm* | s390x | loong64 | loongarch64)
+	x86_64 | amd64 | aarch64 | ppc64le | arm* | s390x | loong64 | loongarch64 | riscv64)
 		return
 		;;
 	*)
-		echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*, s390x, loong64, loongarch64]"
+		echo "Arch '${ARCH}' is not supported. Supported Arch: [x86_64, amd64, aarch64, ppc64le, arm*, s390x, loong64, loongarch64, riscv64]"
 		exit 1
 		;;
 	esac
@@ -8,8 +8,11 @@ function _init() {
 	## All binaries are static make sure to disable CGO.
 	export CGO_ENABLED=0

-	## List of architectures and OS to test coss compilation.
-	SUPPORTED_OSARCH="linux/ppc64le linux/mips64 linux/amd64 linux/arm64 linux/s390x darwin/arm64 darwin/amd64 freebsd/amd64 windows/amd64 linux/arm linux/386 netbsd/amd64 linux/mips openbsd/amd64"
+	## Cross-compile only the OS/arch combinations we actually publish, kept in
+	## sync with the goos/goarch matrix in .github/goreleaser.yml. Compile-checking
+	## targets we never ship (ppc64le, s390x, mips*, riscv64, 386, arm, the BSDs)
+	## spent CI minutes on unshipped code and timed the gate out on a cold cache.
+	SUPPORTED_OSARCH="linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64"
 }

 function _build() {
@@ -38,8 +38,12 @@ func genLDFlags(version string) string {
 	ldflagsStr += " -X github.com/minio/minio/cmd.ReleaseTag=" + releaseTag
 	ldflagsStr += " -X github.com/minio/minio/cmd.CommitID=" + commitID()
 	ldflagsStr += " -X github.com/minio/minio/cmd.ShortCommitID=" + commitID()[:12]
-	ldflagsStr += " -X github.com/minio/minio/cmd.GOPATH=" + os.Getenv("GOPATH")
-	ldflagsStr += " -X github.com/minio/minio/cmd.GOROOT=" + os.Getenv("GOROOT")
+	// GOPATH/GOROOT are deliberately not stamped in. They only seed the logger's
+	// source-path trim list, which -trimpath already makes moot (paths are
+	// relative in the binary, so there is no build-machine prefix left to trim),
+	// and stamping them baked the builder's absolute paths into the released
+	// binary - defeating -trimpath and reproducible builds. cmd.GOPATH/GOROOT
+	// keep their empty defaults, exactly as a plain `go build` leaves them.
 	return ldflagsStr
 }

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_dir="$(cd "${script_dir}/.." && pwd)"
+dist_dir="${DIST_DIR:-${repo_dir}/dist}"
+nfpm_config="${NFPM_CONFIG:-${repo_dir}/.github/nfpm.yml}"
+
+if [ -z "${PKG_VERSION:-}" ]; then
+  echo "PKG_VERSION is required" >&2
+  exit 1
+fi
+
+# Re-validate the shape release.yml derived from the tag. The packages are
+# named from this, so a malformed value would ship under a name no repository
+# can order against.
+if ! [[ "${PKG_VERSION}" =~ ^[0-9]{14}\.0\.0$ ]]; then
+  echo "Invalid PKG_VERSION: ${PKG_VERSION}" >&2
+  exit 1
+fi
+
+if ! command -v nfpm >/dev/null 2>&1; then
+  echo "nfpm is required" >&2
+  exit 1
+fi
+
+if [ ! -f "${nfpm_config}" ]; then
+  echo "Missing nFPM config: ${nfpm_config}" >&2
+  exit 1
+fi
+
+# nfpm resolves a relative content src against the current directory, not
+# against the config file, so the unit path is passed in absolute. Otherwise
+# this only works when invoked from the repository root and fails elsewhere on
+# a message that names the file rather than the cause.
+unit_file="${repo_dir}/minio.service"
+if [ ! -f "${unit_file}" ]; then
+  echo "Missing systemd unit: ${unit_file}" >&2
+  exit 1
+fi
+
+packages_dir="${dist_dir}/packages"
+mkdir -p "${packages_dir}"
+
+# Two spaces, no trailing newline: sign-release-rpms.sh parses these files to
+# check download integrity before it signs, and regenerates them afterwards in
+# the same shape.
+sha256_file() {
+  local file="$1"
+  local digest
+
+  if command -v sha256sum >/dev/null 2>&1; then
+    digest="$(sha256sum "${file}" | awk '{print $1}')"
+  else
+    digest="$(shasum -a 256 "${file}" | awk '{print $1}')"
+  fi
+
+  printf '%s  %s' "${digest}" "$(basename "${file}")" > "${file}.sha256sum"
+}
+
+find_binary() {
+  local goarch="$1"
+  local matches
+  local count
+
+  # Must resolve to exactly one binary. Picking the first of several build
+  # variants (an added goamd64 level, a stale dist entry) would silently ship a
+  # package whose contents do not match its name.
+  matches="$(find "${dist_dir}" -maxdepth 2 -type f \
+    -path "${dist_dir}/minio_linux_${goarch}*/minio" | sort)"
+  count="$(printf '%s' "${matches}" | grep -c . || true)"
+
+  if [ "${count}" -eq 0 ]; then
+    echo "Missing GoReleaser binary for linux/${goarch}" >&2
+    exit 1
+  fi
+  if [ "${count}" -ne 1 ]; then
+    echo "Expected exactly one GoReleaser binary for linux/${goarch}, found ${count}:" >&2
+    printf '%s\n' "${matches}" >&2
+    exit 1
+  fi
+
+  printf '%s\n' "${matches}"
+}
+
+build_arch() {
+  local goarch="$1"
+  local rpm_arch="$2"
+  local deb_arch="$3"
+  local apk_arch="$4"
+  local source
+  local rpm_file
+  local deb_file
+  local apk_file
+
+  source="$(find_binary "${goarch}")"
+
+  # These names are the public download names and must not drift; RPM carries a
+  # release number, DEB and APK do not, matching what pkger produced.
+  rpm_file="${packages_dir}/minio-${PKG_VERSION}-1.${rpm_arch}.rpm"
+  deb_file="${packages_dir}/minio_${PKG_VERSION}_${deb_arch}.deb"
+  apk_file="${packages_dir}/minio_${PKG_VERSION}_${apk_arch}.apk"
+
+  PKG_VERSION="${PKG_VERSION}" NFPM_RELEASE=1 NFPM_ARCH="${goarch}" NFPM_SOURCE="${source}" NFPM_UNIT="${unit_file}" \
+    nfpm package --config "${nfpm_config}" --packager rpm --target "${rpm_file}"
+  PKG_VERSION="${PKG_VERSION}" NFPM_RELEASE='' NFPM_ARCH="${goarch}" NFPM_SOURCE="${source}" NFPM_UNIT="${unit_file}" \
+    nfpm package --config "${nfpm_config}" --packager deb --target "${deb_file}"
+  PKG_VERSION="${PKG_VERSION}" NFPM_RELEASE='' NFPM_ARCH="${goarch}" NFPM_SOURCE="${source}" NFPM_UNIT="${unit_file}" \
+    nfpm package --config "${nfpm_config}" --packager apk --target "${apk_file}"
+
+  sha256_file "${rpm_file}"
+  sha256_file "${deb_file}"
+  sha256_file "${apk_file}"
+}
+
+build_arch amd64 x86_64 amd64 x86_64
+build_arch arm64 aarch64 arm64 aarch64
+
+find "${packages_dir}" -maxdepth 1 -type f | sort
@@ -0,0 +1,282 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# These are the single source of truth for the package identity: .github/nfpm.yml
+# must agree with them, and test-release.yml asserts that it does. Drift the
+# other way round would only surface here, on the maintainer's machine, after
+# the build has already run and uploaded.
+expected_fingerprint="9592A7BC7A682E7333376E09E7935D8DB9BD8B20"
+expected_vendor="PGSTY"
+expected_packager="Ruohang Feng (@Vonng) <rh@vonng.com>"
+expected_url="https://silo.pgsty.com"
+expected_summary="S3-Interface Libre Object Storage, Community-maintained MinIO server fork."
+expected_description="S3-Interface Libre Object Storage, Community-maintained MinIO server fork."
+expected_license="AGPL-3.0-or-later"
+expected_group="Applications/File"
+expected_payload="/usr/lib/systemd/system/minio.service
+/usr/local/bin/minio"
+repository="${GH_REPO:-pgsty/minio}"
+container="${DNFUPDATE_CONTAINER:-dnfupdate}"
+upload=false
+release_tag=""
+
+usage() {
+  cat <<'EOF'
+Usage: buildscripts/sign-release-rpms.sh RELEASE.TAG [--upload] [--repo OWNER/REPO] [--container NAME]
+
+Downloads the two unsigned RPMs from a Draft GitHub Release, signs them with
+the expected Pigsty key in the local dnfupdate container, verifies the result,
+and regenerates their .sha256sum files. Nothing is uploaded unless --upload is
+provided.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --upload)
+      upload=true
+      ;;
+    --repo)
+      shift
+      if [ "$#" -eq 0 ]; then
+        echo "--repo requires OWNER/REPO" >&2
+        exit 1
+      fi
+      repository="$1"
+      ;;
+    --container)
+      shift
+      if [ "$#" -eq 0 ]; then
+        echo "--container requires a name" >&2
+        exit 1
+      fi
+      container="$1"
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    -*)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+    *)
+      if [ -n "${release_tag}" ]; then
+        echo "Only one release tag may be specified" >&2
+        exit 1
+      fi
+      release_tag="$1"
+      ;;
+  esac
+  shift
+done
+
+if [ -z "${release_tag}" ]; then
+  usage >&2
+  exit 1
+fi
+
+for command in docker gh; do
+  if ! command -v "${command}" >/dev/null 2>&1; then
+    echo "${command} is required" >&2
+    exit 1
+  fi
+done
+
+version_hyphen="${release_tag#RELEASE.}"
+package_version="$(printf '%s\n' "${version_hyphen}" | sed -E \
+  's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
+if [ "${package_version}" = "${version_hyphen}" ]; then
+  echo "Invalid release tag: ${release_tag}" >&2
+  exit 1
+fi
+
+if [ "$(gh release view "${release_tag}" --repo "${repository}" --json isDraft --jq .isDraft)" != "true" ]; then
+  echo "Refusing to sign: ${release_tag} is not a Draft release" >&2
+  exit 1
+fi
+
+if [ "$(docker inspect --format '{{.State.Running}}' "${container}" 2>/dev/null || true)" != "true" ]; then
+  echo "Signing container is not running: ${container}" >&2
+  exit 1
+fi
+
+secret_fingerprints="$(docker exec "${container}" \
+  gpg --batch --with-colons --list-secret-keys 2>/dev/null |
+  awk -F: '$1 == "fpr" { print toupper($10) }')"
+if ! printf '%s\n' "${secret_fingerprints}" | grep -Fxq "${expected_fingerprint}"; then
+  echo "Expected signing key is not available in ${container}: ${expected_fingerprint}" >&2
+  exit 1
+fi
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_dir="$(cd "${script_dir}/.." && pwd)"
+work_root="${SIGN_WORKDIR:-${repo_dir}/.release-sign}"
+mkdir -p "${work_root}"
+work_dir="$(mktemp -d "${work_root}/${release_tag}.XXXXXX")"
+unsigned_dir="${work_dir}/unsigned"
+signed_dir="${work_dir}/signed"
+mkdir -p "${unsigned_dir}" "${signed_dir}"
+chmod 700 "${work_dir}" "${unsigned_dir}" "${signed_dir}"
+
+rpm_files=(
+  "minio-${package_version}-1.x86_64.rpm"
+  "minio-${package_version}-1.aarch64.rpm"
+)
+
+download_patterns=()
+for rpm_file in "${rpm_files[@]}"; do
+  download_patterns+=(--pattern "${rpm_file}" --pattern "${rpm_file}.sha256sum")
+done
+
+echo "Downloading RPMs from Draft release ${repository}@${release_tag}"
+gh release download "${release_tag}" --repo "${repository}" \
+  --dir "${unsigned_dir}" "${download_patterns[@]}"
+
+sha256_digest() {
+  local file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "${file}" | awk '{print $1}'
+  else
+    shasum -a 256 "${file}" | awk '{print $1}'
+  fi
+}
+
+for rpm_file in "${rpm_files[@]}"; do
+  rpm_path="${unsigned_dir}/${rpm_file}"
+  checksum_path="${rpm_path}.sha256sum"
+  test -s "${rpm_path}"
+  test -s "${checksum_path}"
+
+  actual_line="$(sha256_digest "${rpm_path}")  ${rpm_file}"
+  published_line="$(tr -d '\n' < "${checksum_path}")"
+  if [ "${actual_line}" != "${published_line}" ]; then
+    echo "Checksum mismatch for ${rpm_file}" >&2
+    exit 1
+  fi
+done
+
+safe_tag="$(printf '%s' "${release_tag}" | tr -c 'A-Za-z0-9._-' '_')"
+container_dir="/tmp/minio-sign-${safe_tag}-$$"
+docker exec "${container}" mkdir -p "${container_dir}"
+
+cleanup_container() {
+  local rpm_file
+  for rpm_file in "${rpm_files[@]}"; do
+    docker exec "${container}" rm -f "${container_dir}/${rpm_file}" >/dev/null 2>&1 || true
+  done
+  docker exec "${container}" rmdir "${container_dir}" >/dev/null 2>&1 || true
+}
+trap cleanup_container EXIT
+
+assert_rpm_tag() {
+  local rpm_path="$1"
+  local tag="$2"
+  local expected="$3"
+  local actual
+
+  actual="$(docker exec "${container}" rpm -qp --queryformat "%{${tag}}" "${rpm_path}")"
+  if [ "${actual}" != "${expected}" ]; then
+    echo "Unexpected RPM ${tag}: ${actual}" >&2
+    echo "Expected RPM ${tag}: ${expected}" >&2
+    exit 1
+  fi
+}
+
+for rpm_file in "${rpm_files[@]}"; do
+  case "${rpm_file}" in
+    *.x86_64.rpm)
+      expected_arch="x86_64"
+      ;;
+    *.aarch64.rpm)
+      expected_arch="aarch64"
+      ;;
+    *)
+      echo "Unexpected RPM filename: ${rpm_file}" >&2
+      exit 1
+      ;;
+  esac
+
+  echo "Signing ${rpm_file} with ${expected_fingerprint}"
+  docker cp "${unsigned_dir}/${rpm_file}" "${container}:${container_dir}/${rpm_file}" >/dev/null
+  container_rpm="${container_dir}/${rpm_file}"
+
+  assert_rpm_tag "${container_rpm}" NAME minio
+  assert_rpm_tag "${container_rpm}" VERSION "${package_version}"
+  assert_rpm_tag "${container_rpm}" RELEASE 1
+  assert_rpm_tag "${container_rpm}" ARCH "${expected_arch}"
+  assert_rpm_tag "${container_rpm}" VENDOR "${expected_vendor}"
+  assert_rpm_tag "${container_rpm}" PACKAGER "${expected_packager}"
+  assert_rpm_tag "${container_rpm}" URL "${expected_url}"
+  assert_rpm_tag "${container_rpm}" LICENSE "${expected_license}"
+  assert_rpm_tag "${container_rpm}" GROUP "${expected_group}"
+  assert_rpm_tag "${container_rpm}" SUMMARY "${expected_summary}"
+  assert_rpm_tag "${container_rpm}" DESCRIPTION "${expected_description}"
+
+  rpm_payload="$(docker exec "${container}" rpm -qpl "${container_rpm}")"
+  if [ "${rpm_payload}" != "${expected_payload}" ]; then
+    echo "Unexpected RPM payload for ${rpm_file}:" >&2
+    printf '%s\n' "${rpm_payload}" >&2
+    exit 1
+  fi
+
+  docker exec "${container}" rpmsign \
+    --define "_gpg_name ${expected_fingerprint}" \
+    --addsign "${container_rpm}"
+
+  signature_output="$(docker exec "${container}" rpmkeys --checksig --verbose "${container_rpm}")"
+  printf '%s\n' "${signature_output}"
+  if ! printf '%s\n' "${signature_output}" | tr '[:upper:]' '[:lower:]' | grep -q 'key id b9bd8b20: ok'; then
+    echo "Signature verification failed for ${rpm_file}" >&2
+    exit 1
+  fi
+
+  docker cp "${container}:${container_dir}/${rpm_file}" "${signed_dir}/${rpm_file}" >/dev/null
+  signed_digest="$(sha256_digest "${signed_dir}/${rpm_file}")"
+  printf '%s  %s' "${signed_digest}" "${rpm_file}" > "${signed_dir}/${rpm_file}.sha256sum"
+
+  docker exec "${container}" rpm -qp --queryformat \
+    $'Name: %{NAME}\nVersion: %{VERSION}-%{RELEASE}\nArch: %{ARCH}\nVendor: %{VENDOR}\nPackager: %{PACKAGER}\nURL: %{URL}\n' \
+    "${container_rpm}"
+  echo "SHA256: ${signed_digest}"
+done
+
+if [ "${upload}" = true ]; then
+  upload_files=()
+  for rpm_file in "${rpm_files[@]}"; do
+    upload_files+=("${signed_dir}/${rpm_file}" "${signed_dir}/${rpm_file}.sha256sum")
+  done
+
+  echo "Replacing RPMs in Draft release ${release_tag}"
+  gh release upload "${release_tag}" --repo "${repository}" --clobber "${upload_files[@]}"
+
+  for rpm_file in "${rpm_files[@]}"; do
+    for asset in "${rpm_file}" "${rpm_file}.sha256sum"; do
+      local_digest="sha256:$(sha256_digest "${signed_dir}/${asset}")"
+      remote_digest=""
+      for attempt in 1 2 3 4 5; do
+        remote_digest="$(gh release view "${release_tag}" --repo "${repository}" --json assets \
+          --jq ".assets[] | select(.name == \"${asset}\") | .digest")"
+        if [ "${local_digest}" = "${remote_digest}" ]; then
+          break
+        fi
+        if [ "${attempt}" -lt 5 ]; then
+          sleep 2
+        fi
+      done
+      if [ "${local_digest}" != "${remote_digest}" ]; then
+        echo "GitHub asset digest mismatch for ${asset}" >&2
+        echo "Local:  ${local_digest}" >&2
+        echo "Remote: ${remote_digest}" >&2
+        exit 1
+      fi
+      echo "Verified GitHub asset: ${asset} ${remote_digest}"
+    done
+  done
+else
+  echo
+  echo "Signed RPMs are ready for review in: ${signed_dir}"
+  echo "Re-run with --upload to replace the RPM assets in the Draft release."
+fi
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Asserts that every binary GoReleaser produced is stamped by the Go toolchain
+# as built from this exact commit with a clean working tree. A stray untracked
+# file (for example an un-ignored dist/) silently turns every release binary
+# into a "+dirty" pseudo-version, which destroys the link between a published
+# artifact and its tag. Catch that here instead of after publishing.
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_dir="$(cd "${script_dir}/.." && pwd)"
+dist_dir="${DIST_DIR:-${repo_dir}/dist}"
+expected_count="${EXPECTED_BINARY_COUNT:-6}"
+
+if ! command -v go >/dev/null 2>&1; then
+  echo "go is required" >&2
+  exit 1
+fi
+
+if [ ! -d "${dist_dir}" ]; then
+  echo "Missing GoReleaser dist directory: ${dist_dir}" >&2
+  exit 1
+fi
+
+revision="$(git -C "${repo_dir}" rev-parse HEAD)"
+
+count=0
+while IFS= read -r binary; do
+  count=$((count + 1))
+  info="$(go version -m "${binary}")"
+
+  if ! grep -qF "vcs.revision=${revision}" <<< "${info}"; then
+    echo "Unexpected vcs.revision in ${binary} (expected ${revision})" >&2
+    grep -F 'vcs.' <<< "${info}" >&2 || true
+    exit 1
+  fi
+
+  if ! grep -qF 'vcs.modified=false' <<< "${info}"; then
+    echo "Binary was built from a dirty working tree: ${binary}" >&2
+    grep -F 'vcs.' <<< "${info}" >&2 || true
+    exit 1
+  fi
+done < <(find "${dist_dir}" -maxdepth 2 -type f \( -name 'minio' -o -name 'minio.exe' \) | sort)
+
+if [ "${count}" -ne "${expected_count}" ]; then
+  echo "Expected ${expected_count} release binaries, found ${count}" >&2
+  exit 1
+fi
+
+echo "Verified ${count} binaries built from ${revision} with a clean tree"
@@ -193,27 +193,27 @@ func (a adminAPIHandlers) SetConfigKVHandler(w http.ResponseWriter, r *http.Requ
 func setConfigKV(ctx context.Context, objectAPI ObjectLayer, kvBytes []byte) (result setConfigResult, err error) {
 	result.Cfg, err = readServerConfig(ctx, objectAPI, nil)
 	if err != nil {
-		return
+		return result, err
 	}

 	result.Dynamic, err = result.Cfg.ReadConfig(bytes.NewReader(kvBytes))
 	if err != nil {
-		return
+		return result, err
 	}

 	result.SubSys, _, _, err = config.GetSubSys(string(kvBytes))
 	if err != nil {
-		return
+		return result, err
 	}

 	tgts, err := config.ParseConfigTargetID(bytes.NewReader(kvBytes))
 	if err != nil {
-		return
+		return result, err
 	}
 	ctx = context.WithValue(ctx, config.ContextKeyForTargetFromConfig, tgts)
 	if verr := validateConfig(ctx, result.Cfg, result.SubSys); verr != nil {
 		err = badConfigErr{Err: verr}
-		return
+		return result, err
 	}

 	// Check if subnet proxy being set and if so set the same value to proxy of subnet
@@ -222,12 +222,12 @@ func setConfigKV(ctx context.Context, objectAPI ObjectLayer, kvBytes []byte) (re

 	// Update the actual server config on disk.
 	if err = saveServerConfig(ctx, objectAPI, result.Cfg); err != nil {
-		return
+		return result, err
 	}

 	// Write the config input KV to history.
 	err = saveServerConfigHistory(ctx, objectAPI, kvBytes)
-	return
+	return result, err
 }

 // GetConfigKVHandler - GET /minio/admin/v3/get-config-kv?key={key}
@@ -267,7 +267,7 @@ func (a adminAPIHandlers) AddServiceAccountLDAP(w http.ResponseWriter, r *http.R
 		lookupResult, targetGroups, err = globalIAMSys.LDAPConfig.LookupUserDN(targetUser)
 		if err != nil {
 			// if not found, check if DN
-			if strings.Contains(err.Error(), "User DN not found for:") {
+			if strings.Contains(strings.ToLower(err.Error()), "user dn not found for:") {
 				if isDN {
 					// warn user that DNs are not allowed
 					writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErrWithErr(ErrAdminLDAPExpectedLoginName, err), r.URL)
@@ -445,8 +445,10 @@ func (a adminAPIHandlers) ListAccessKeysLDAP(w http.ResponseWriter, r *http.Requ
 	for _, svc := range serviceAccounts {
 		expiryTime := svc.Expiration
 		serviceAccountList = append(serviceAccountList, madmin.ServiceAccountInfo{
-			AccessKey:  svc.AccessKey,
-			Expiration: &expiryTime,
+			AccessKey:   svc.AccessKey,
+			Expiration:  &expiryTime,
+			Name:        svc.Name,
+			Description: svc.Description,
 		})
 	}
 	for _, sts := range stsKeys {
@@ -625,8 +627,10 @@ func (a adminAPIHandlers) ListAccessKeysLDAPBulk(w http.ResponseWriter, r *http.
 			}
 			for _, svc := range serviceAccounts {
 				accessKeys.ServiceAccounts = append(accessKeys.ServiceAccounts, madmin.ServiceAccountInfo{
-					AccessKey:  svc.AccessKey,
-					Expiration: &svc.Expiration,
+					AccessKey:   svc.AccessKey,
+					Expiration:  &svc.Expiration,
+					Name:        svc.Name,
+					Description: svc.Description,
 				})
 			}
 			// if only service accounts, skip if user has no service accounts
@@ -173,6 +173,8 @@ func (a adminAPIHandlers) ListAccessKeysOpenIDBulk(w http.ResponseWriter, r *htt
 			if _, ok := accessKey.Claims[iamPolicyClaimNameOpenID()]; !ok {
 				continue // skip if no roleArn and no policy claim
 			}
+			// claim-based provider is in the roleArnMap under dummy ARN
+			arn = dummyRoleARN
 		}
 		matchingCfgName, ok := roleArnMap[arn]
 		if !ok {
@@ -61,7 +61,7 @@ func (a adminAPIHandlers) StartDecommission(w http.ResponseWriter, r *http.Reque
 		return
 	}

-	if z.IsRebalanceStarted() {
+	if z.IsRebalanceStarted(ctx) {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminRebalanceAlreadyStarted), r.URL)
 		return
 	}
@@ -277,7 +277,7 @@ func (a adminAPIHandlers) RebalanceStart(w http.ResponseWriter, r *http.Request)
 		return
 	}

-	if pools.IsRebalanceStarted() {
+	if pools.IsRebalanceStarted(ctx) {
 		writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminRebalanceAlreadyStarted), r.URL)
 		return
 	}
@@ -380,7 +380,7 @@ func (a adminAPIHandlers) RebalanceStop(w http.ResponseWriter, r *http.Request)
 func proxyDecommissionRequest(ctx context.Context, defaultEndPoint Endpoint, w http.ResponseWriter, r *http.Request) (proxy bool) {
 	host := env.Get("_MINIO_DECOM_ENDPOINT_HOST", defaultEndPoint.Host)
 	if host == "" {
-		return
+		return proxy
 	}
 	for nodeIdx, proxyEp := range globalProxyEndpoints {
 		if proxyEp.Host == host && !proxyEp.IsLocal {
@@ -389,5 +389,5 @@ func proxyDecommissionRequest(ctx context.Context, defaultEndPoint Endpoint, w h
 			}
 		}
 	}
-	return
+	return proxy
 }
@@ -70,7 +70,7 @@ func (a adminAPIHandlers) SiteReplicationAdd(w http.ResponseWriter, r *http.Requ

 func getSRAddOptions(r *http.Request) (opts madmin.SRAddOptions) {
 	opts.ReplicateILMExpiry = r.Form.Get("replicateILMExpiry") == "true"
-	return
+	return opts
 }

 // SRPeerJoin - PUT /minio/admin/v3/site-replication/join
@@ -304,7 +304,7 @@ func (a adminAPIHandlers) SRPeerGetIDPSettings(w http.ResponseWriter, r *http.Re
 	}
 }

-func parseJSONBody(ctx context.Context, body io.Reader, v interface{}, encryptionKey string) error {
+func parseJSONBody(ctx context.Context, body io.Reader, v any, encryptionKey string) error {
 	data, err := io.ReadAll(body)
 	if err != nil {
 		return SRError{
@@ -422,7 +422,7 @@ func (a adminAPIHandlers) SiteReplicationEdit(w http.ResponseWriter, r *http.Req
 func getSREditOptions(r *http.Request) (opts madmin.SREditOptions) {
 	opts.DisableILMExpiryReplication = r.Form.Get("disableILMExpiryReplication") == "true"
 	opts.EnableILMExpiryReplication = r.Form.Get("enableILMExpiryReplication") == "true"
-	return
+	return opts
 }

 // SRPeerEdit - PUT /minio/admin/v3/site-replication/peer/edit
@@ -484,7 +484,7 @@ func getSRStatusOptions(r *http.Request) (opts madmin.SRStatusOptions) {
 	opts.EntityValue = q.Get("entityvalue")
 	opts.ShowDeleted = q.Get("showDeleted") == "true"
 	opts.Metrics = q.Get("metrics") == "true"
-	return
+	return opts
 }

 // SiteReplicationRemove - PUT /minio/admin/v3/site-replication/remove
@@ -89,7 +89,7 @@ func (s *TestSuiteIAM) TestDeleteUserRace(c *check) {

 	// Create a policy policy
 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -104,7 +104,7 @@ func (s *TestSuiteIAM) TestDeleteUserRace(c *check) {
   ]
  }
 ]
-}`, bucket))
+}`, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -113,7 +113,7 @@ func (s *TestSuiteIAM) TestDeleteUserRace(c *check) {
 	userCount := 50
 	accessKeys := make([]string, userCount)
 	secretKeys := make([]string, userCount)
-	for i := 0; i < userCount; i++ {
+	for i := range userCount {
 		accessKey, secretKey := mustGenerateCredentials(c)
 		err = s.adm.SetUser(ctx, accessKey, secretKey, madmin.AccountEnabled)
 		if err != nil {
@@ -133,7 +133,7 @@ func (s *TestSuiteIAM) TestDeleteUserRace(c *check) {
 	}

 	g := errgroup.Group{}
-	for i := 0; i < userCount; i++ {
+	for i := range userCount {
 		g.Go(func(i int) func() error {
 			return func() error {
 				uClient := s.getUserClient(c, accessKeys[i], secretKeys[i], "")
@@ -24,6 +24,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
 	"os"
 	"slices"
@@ -157,9 +158,7 @@ func (a adminAPIHandlers) ListUsers(w http.ResponseWriter, r *http.Request) {
 		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 		return
 	}
-	for k, v := range ldapUsers {
-		allCredentials[k] = v
-	}
+	maps.Copy(allCredentials, ldapUsers)

 	// Marshal the response
 	data, err := json.Marshal(allCredentials)
@@ -1827,16 +1826,18 @@ func (a adminAPIHandlers) SetPolicyForUserOrGroup(w http.ResponseWriter, r *http
 				iamLogIf(ctx, err)
 			} else if foundGroupDN == nil || !underBaseDN {
 				err = errNoSuchGroup
+			} else {
+				entityName = foundGroupDN.NormDN
 			}
-			entityName = foundGroupDN.NormDN
 		} else {
 			var foundUserDN *xldap.DNSearchResult
 			if foundUserDN, err = globalIAMSys.LDAPConfig.GetValidatedDNForUsername(entityName); err != nil {
 				iamLogIf(ctx, err)
 			} else if foundUserDN == nil {
 				err = errNoSuchUser
+			} else {
+				entityName = foundUserDN.NormDN
 			}
-			entityName = foundUserDN.NormDN
 		}
 		if err != nil {
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
@@ -2947,7 +2948,7 @@ func commonAddServiceAccount(r *http.Request, ldap bool) (context.Context, auth.
 		name:        createReq.Name,
 		description: description,
 		expiration:  createReq.Expiration,
-		claims:      make(map[string]interface{}),
+		claims:      make(map[string]any),
 	}

 	condValues := getConditionValues(r, "", cred)
@@ -208,6 +208,8 @@ func TestIAMInternalIDPServerSuite(t *testing.T) {
 				suite.TestGroupAddRemove(c)
 				suite.TestServiceAccountOpsByAdmin(c)
 				suite.TestServiceAccountPrivilegeEscalationBug(c)
+				suite.TestServiceAccountPrivilegeEscalationBug2_2025_10_15(c, true)
+				suite.TestServiceAccountPrivilegeEscalationBug2_2025_10_15(c, false)
 				suite.TestServiceAccountOpsByUser(c)
 				suite.TestServiceAccountDurationSecondsCondition(c)
 				suite.TestAddServiceAccountPerms(c)
@@ -332,7 +334,7 @@ func (s *TestSuiteIAM) TestUserPolicyEscalationBug(c *check) {

 	// 2.2 create and associate policy to user
 	policy := "mypolicy-test-user-update"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -355,7 +357,7 @@ func (s *TestSuiteIAM) TestUserPolicyEscalationBug(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -562,7 +564,7 @@ func (s *TestSuiteIAM) TestPolicyCreate(c *check) {

 	// 1. Create a policy
 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -585,7 +587,7 @@ func (s *TestSuiteIAM) TestPolicyCreate(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -680,7 +682,7 @@ func (s *TestSuiteIAM) TestCannedPolicies(c *check) {
 		c.Fatalf("bucket creat error: %v", err)
 	}

-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -703,7 +705,7 @@ func (s *TestSuiteIAM) TestCannedPolicies(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)

 	// Check that default policies can be overwritten.
 	err = s.adm.AddCannedPolicy(ctx, "readwrite", policyBytes)
@@ -739,7 +741,7 @@ func (s *TestSuiteIAM) TestGroupAddRemove(c *check) {
 	}

 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -762,7 +764,7 @@ func (s *TestSuiteIAM) TestGroupAddRemove(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -911,7 +913,7 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByUser(c *check) {

 	// Create policy, user and associate policy
 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -934,7 +936,7 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByUser(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -995,7 +997,7 @@ func (s *TestSuiteIAM) TestServiceAccountDurationSecondsCondition(c *check) {

 	// Create policy, user and associate policy
 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -1026,7 +1028,7 @@ func (s *TestSuiteIAM) TestServiceAccountDurationSecondsCondition(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -1093,7 +1095,7 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByAdmin(c *check) {

 	// Create policy, user and associate policy
 	policy := "mypolicy"
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -1116,7 +1118,7 @@ func (s *TestSuiteIAM) TestServiceAccountOpsByAdmin(c *check) {
   ]
  }
 ]
-}`, bucket, bucket))
+}`, bucket, bucket)
 	err = s.adm.AddCannedPolicy(ctx, policy, policyBytes)
 	if err != nil {
 		c.Fatalf("policy add error: %v", err)
@@ -1249,6 +1251,108 @@ func (s *TestSuiteIAM) TestServiceAccountPrivilegeEscalationBug(c *check) {
 	}
 }

+func (s *TestSuiteIAM) TestServiceAccountPrivilegeEscalationBug2_2025_10_15(c *check, forRoot bool) {
+	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
+	defer cancel()
+
+	for i := range 3 {
+		err := s.client.MakeBucket(ctx, fmt.Sprintf("bucket%d", i+1), minio.MakeBucketOptions{})
+		if err != nil {
+			c.Fatalf("bucket create error: %v", err)
+		}
+		defer func(i int) {
+			_ = s.client.RemoveBucket(ctx, fmt.Sprintf("bucket%d", i+1))
+		}(i)
+	}
+
+	allow2BucketsPolicyBytes := []byte(`{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "ListBucket1AndBucket2",
+            "Effect": "Allow",
+            "Action": ["s3:ListBucket"],
+            "Resource": ["arn:aws:s3:::bucket1", "arn:aws:s3:::bucket2"]
+        },
+        {
+            "Sid": "ReadWriteBucket1AndBucket2Objects",
+            "Effect": "Allow",
+            "Action": [
+                "s3:DeleteObject",
+                "s3:DeleteObjectVersion",
+                "s3:GetObject",
+                "s3:GetObjectVersion",
+                "s3:PutObject"
+            ],
+            "Resource": ["arn:aws:s3:::bucket1/*", "arn:aws:s3:::bucket2/*"]
+        }
+    ]
+}`)
+
+	if forRoot {
+		// Create a service account for the root user.
+		_, err := s.adm.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
+			Policy:    allow2BucketsPolicyBytes,
+			AccessKey: "restricted",
+			SecretKey: "restricted123",
+		})
+		if err != nil {
+			c.Fatalf("could not create service account")
+		}
+		defer func() {
+			_ = s.adm.DeleteServiceAccount(ctx, "restricted")
+		}()
+	} else {
+		// Create a regular user and attach consoleAdmin policy
+		err := s.adm.AddUser(ctx, "foobar", "foobar123")
+		if err != nil {
+			c.Fatalf("could not create user")
+		}
+
+		_, err = s.adm.AttachPolicy(ctx, madmin.PolicyAssociationReq{
+			Policies: []string{"consoleAdmin"},
+			User:     "foobar",
+		})
+		if err != nil {
+			c.Fatalf("could not attach policy")
+		}
+
+		// Create a service account for the regular user.
+		_, err = s.adm.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
+			Policy:     allow2BucketsPolicyBytes,
+			TargetUser: "foobar",
+			AccessKey:  "restricted",
+			SecretKey:  "restricted123",
+		})
+		if err != nil {
+			c.Fatalf("could not create service account: %v", err)
+		}
+		defer func() {
+			_ = s.adm.DeleteServiceAccount(ctx, "restricted")
+			_ = s.adm.RemoveUser(ctx, "foobar")
+		}()
+	}
+	restrictedClient := s.getUserClient(c, "restricted", "restricted123", "")
+
+	buckets, err := restrictedClient.ListBuckets(ctx)
+	if err != nil {
+		c.Fatalf("err fetching buckets %s", err)
+	}
+	if len(buckets) != 2 || buckets[0].Name != "bucket1" || buckets[1].Name != "bucket2" {
+		c.Fatalf("restricted service account should only have access to bucket1 and bucket2")
+	}
+
+	// Try to escalate privileges
+	restrictedAdmClient := s.getAdminClient(c, "restricted", "restricted123", "")
+	_, err = restrictedAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
+		AccessKey: "newroot",
+		SecretKey: "newroot123",
+	})
+	if err == nil {
+		c.Fatalf("restricted service account was able to create service account bypassing sub-policy!")
+	}
+}
+
 func (s *TestSuiteIAM) SetUpAccMgmtPlugin(c *check) {
 	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
 	defer cancel()
@@ -1367,7 +1471,7 @@ func (s *TestSuiteIAM) TestAccMgmtPlugin(c *check) {
 		svcAK, svcSK := mustGenerateCredentials(c)

 		// This policy does not allow listing objects.
-		policyBytes := []byte(fmt.Sprintf(`{
+		policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -1381,7 +1485,7 @@ func (s *TestSuiteIAM) TestAccMgmtPlugin(c *check) {
   ]
  }
 ]
-}`, bucket))
+}`, bucket)
 		cr, err := userAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 			Policy:     policyBytes,
 			TargetUser: accessKey,
@@ -1558,7 +1662,7 @@ func (c *check) mustDownload(ctx context.Context, client *minio.Client, bucket s
 func (c *check) mustUploadReturnVersions(ctx context.Context, client *minio.Client, bucket string) []string {
 	c.Helper()
 	versions := []string{}
-	for i := 0; i < 5; i++ {
+	for range 5 {
 		ui, err := client.PutObject(ctx, bucket, "some-object", bytes.NewBuffer([]byte("stuff")), 5, minio.PutObjectOptions{})
 		if err != nil {
 			c.Fatalf("upload did not succeed got %#v", err)
@@ -1627,7 +1731,7 @@ func (c *check) assertSvcAccSessionPolicyUpdate(ctx context.Context, s *TestSuit
 	svcAK, svcSK := mustGenerateCredentials(c)

 	// This policy does not allow listing objects.
-	policyBytes := []byte(fmt.Sprintf(`{
+	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -1641,7 +1745,7 @@ func (c *check) assertSvcAccSessionPolicyUpdate(ctx context.Context, s *TestSuit
   ]
  }
 ]
-}`, bucket))
+}`, bucket)
 	cr, err := madmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 		Policy:     policyBytes,
 		TargetUser: accessKey,
@@ -1655,7 +1759,7 @@ func (c *check) assertSvcAccSessionPolicyUpdate(ctx context.Context, s *TestSuit
 	c.mustNotListObjects(ctx, svcClient, bucket)

 	// This policy allows listing objects.
-	newPolicyBytes := []byte(fmt.Sprintf(`{
+	newPolicyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
@@ -1668,7 +1772,7 @@ func (c *check) assertSvcAccSessionPolicyUpdate(ctx context.Context, s *TestSuit
   ]
  }
 ]
-}`, bucket))
+}`, bucket)
 	err = madmClient.UpdateServiceAccount(ctx, svcAK, madmin.UpdateServiceAccountReq{
 		NewPolicy: newPolicyBytes,
 	})
@@ -954,7 +954,7 @@ func (a adminAPIHandlers) ForceUnlockHandler(w http.ResponseWriter, r *http.Requ

 	var args dsync.LockArgs
 	var lockers []dsync.NetLocker
-	for _, path := range strings.Split(vars["paths"], ",") {
+	for path := range strings.SplitSeq(vars["paths"], ",") {
 		if path == "" {
 			continue
 		}
@@ -1193,7 +1193,7 @@ type dummyFileInfo struct {
 	mode    os.FileMode
 	modTime time.Time
 	isDir   bool
-	sys     interface{}
+	sys     any
 }

 func (f dummyFileInfo) Name() string       { return f.name }
@@ -1201,7 +1201,7 @@ func (f dummyFileInfo) Size() int64        { return f.size }
 func (f dummyFileInfo) Mode() os.FileMode  { return f.mode }
 func (f dummyFileInfo) ModTime() time.Time { return f.modTime }
 func (f dummyFileInfo) IsDir() bool        { return f.isDir }
-func (f dummyFileInfo) Sys() interface{}   { return f.sys }
+func (f dummyFileInfo) Sys() any           { return f.sys }

 // DownloadProfilingHandler - POST /minio/admin/v3/profiling/download
 // ----------
@@ -1243,17 +1243,17 @@ func extractHealInitParams(vars map[string]string, qParams url.Values, r io.Read
 		if hip.objPrefix != "" {
 			// Bucket is required if object-prefix is given
 			err = ErrHealMissingBucket
-			return
+			return hip, err
 		}
 	} else if isReservedOrInvalidBucket(hip.bucket, false) {
 		err = ErrInvalidBucketName
-		return
+		return hip, err
 	}

 	// empty prefix is valid.
 	if !IsValidObjectPrefix(hip.objPrefix) {
 		err = ErrInvalidObjectName
-		return
+		return hip, err
 	}

 	if len(qParams[mgmtClientToken]) > 0 {
@@ -1275,7 +1275,7 @@ func extractHealInitParams(vars map[string]string, qParams url.Values, r io.Read
 	if (hip.forceStart && hip.forceStop) ||
 		(hip.clientToken != "" && (hip.forceStart || hip.forceStop)) {
 		err = ErrInvalidRequest
-		return
+		return hip, err
 	}

 	// ignore body if clientToken is provided
@@ -1284,12 +1284,12 @@ func extractHealInitParams(vars map[string]string, qParams url.Values, r io.Read
 		if jerr != nil {
 			adminLogIf(GlobalContext, jerr, logger.ErrorKind)
 			err = ErrRequestBodyParse
-			return
+			return hip, err
 		}
 	}

 	err = ErrNone
-	return
+	return hip, err
 }

 // HealHandler - POST /minio/admin/v3/heal/
@@ -2022,7 +2022,7 @@ func extractTraceOptions(r *http.Request) (opts madmin.ServiceTraceOpts, err err
 		opts.OS = true
 		// Older mc - cannot deal with more types...
 	}
-	return
+	return opts, err
 }

 // TraceHandler - POST /minio/admin/v3/trace
@@ -402,7 +402,7 @@ func (b byResourceUID) Less(i, j int) bool {
 func TestTopLockEntries(t *testing.T) {
 	locksHeld := make(map[string][]lockRequesterInfo)
 	var owners []string
-	for i := 0; i < 4; i++ {
+	for i := range 4 {
 		owners = append(owners, fmt.Sprintf("node-%d", i))
 	}

@@ -410,7 +410,7 @@ func TestTopLockEntries(t *testing.T) {
 	// request UID, but 10 different resource names associated with it.
 	var lris []lockRequesterInfo
 	uuid := mustGetUUID()
-	for i := 0; i < 10; i++ {
+	for i := range 10 {
 		resource := fmt.Sprintf("bucket/delete-object-%d", i)
 		lri := lockRequesterInfo{
 			Name:   resource,
@@ -425,7 +425,7 @@ func TestTopLockEntries(t *testing.T) {
 	}

 	// Add a few concurrent read locks to the mix
-	for i := 0; i < 50; i++ {
+	for i := range 50 {
 		resource := fmt.Sprintf("bucket/get-object-%d", i)
 		lri := lockRequesterInfo{
 			Name:   resource,
@@ -22,6 +22,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"maps"
 	"net/http"
 	"sort"
 	"sync"
@@ -520,9 +521,7 @@ func (h *healSequence) getScannedItemsMap() map[madmin.HealItemType]int64 {

 	// Make a copy before returning the value
 	retMap := make(map[madmin.HealItemType]int64, len(h.scannedItemsMap))
-	for k, v := range h.scannedItemsMap {
-		retMap[k] = v
-	}
+	maps.Copy(retMap, h.scannedItemsMap)

 	return retMap
 }
@@ -534,9 +533,7 @@ func (h *healSequence) getHealedItemsMap() map[madmin.HealItemType]int64 {

 	// Make a copy before returning the value
 	retMap := make(map[madmin.HealItemType]int64, len(h.healedItemsMap))
-	for k, v := range h.healedItemsMap {
-		retMap[k] = v
-	}
+	maps.Copy(retMap, h.healedItemsMap)

 	return retMap
 }
@@ -549,9 +546,7 @@ func (h *healSequence) getHealFailedItemsMap() map[madmin.HealItemType]int64 {

 	// Make a copy before returning the value
 	retMap := make(map[madmin.HealItemType]int64, len(h.healFailedItemsMap))
-	for k, v := range h.healFailedItemsMap {
-		retMap[k] = v
-	}
+	maps.Copy(retMap, h.healFailedItemsMap)

 	return retMap
 }
@@ -296,7 +296,7 @@ func registerAdminRouter(router *mux.Router, enableConfigOps bool) {
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-iam").HandlerFunc(adminMiddleware(adminAPI.ImportIAM, noGZFlag))
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-iam-v2").HandlerFunc(adminMiddleware(adminAPI.ImportIAMV2, noGZFlag))

-		// IDentity Provider configuration APIs
+		// Identity Provider configuration APIs
 		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.AddIdentityProviderCfg))
 		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/idp-config/{type}/{name}").HandlerFunc(adminMiddleware(adminAPI.UpdateIdentityProviderCfg))
 		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/idp-config/{type}").HandlerFunc(adminMiddleware(adminAPI.ListIdentityProviderCfg))
@@ -65,7 +65,7 @@ func setCommonHeaders(w http.ResponseWriter) {
 }

 // Encodes the response headers into XML format.
-func encodeResponse(response interface{}) []byte {
+func encodeResponse(response any) []byte {
 	var buf bytes.Buffer
 	buf.WriteString(xml.Header)
 	if err := xml.NewEncoder(&buf).Encode(response); err != nil {
@@ -83,7 +83,7 @@ func encodeResponse(response interface{}) []byte {
 // Do not use this function for anything other than ListObjects()
 // variants, please open a github discussion if you wish to use
 // this in other places.
-func encodeResponseList(response interface{}) []byte {
+func encodeResponseList(response any) []byte {
 	var buf bytes.Buffer
 	buf.WriteString(xxml.Header)
 	if err := xxml.NewEncoder(&buf).Encode(response); err != nil {
@@ -94,7 +94,7 @@ func encodeResponseList(response interface{}) []byte {
 }

 // Encodes the response headers into JSON format.
-func encodeResponseJSON(response interface{}) []byte {
+func encodeResponseJSON(response any) []byte {
 	var bytesBuffer bytes.Buffer
 	e := json.NewEncoder(&bytesBuffer)
 	e.Encode(response)
@@ -31,7 +31,7 @@ func getListObjectsV1Args(values url.Values) (prefix, marker, delimiter string,
 		var err error
 		if maxkeys, err = strconv.Atoi(values.Get("max-keys")); err != nil {
 			errCode = ErrInvalidMaxKeys
-			return
+			return prefix, marker, delimiter, maxkeys, encodingType, errCode
 		}
 	} else {
 		maxkeys = maxObjectList
@@ -41,7 +41,7 @@ func getListObjectsV1Args(values url.Values) (prefix, marker, delimiter string,
 	marker = values.Get("marker")
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
-	return
+	return prefix, marker, delimiter, maxkeys, encodingType, errCode
 }

 func getListBucketObjectVersionsArgs(values url.Values) (prefix, marker, delimiter string, maxkeys int, encodingType, versionIDMarker string, errCode APIErrorCode) {
@@ -51,7 +51,7 @@ func getListBucketObjectVersionsArgs(values url.Values) (prefix, marker, delimit
 		var err error
 		if maxkeys, err = strconv.Atoi(values.Get("max-keys")); err != nil {
 			errCode = ErrInvalidMaxKeys
-			return
+			return prefix, marker, delimiter, maxkeys, encodingType, versionIDMarker, errCode
 		}
 	} else {
 		maxkeys = maxObjectList
@@ -62,7 +62,7 @@ func getListBucketObjectVersionsArgs(values url.Values) (prefix, marker, delimit
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
 	versionIDMarker = values.Get("version-id-marker")
-	return
+	return prefix, marker, delimiter, maxkeys, encodingType, versionIDMarker, errCode
 }

 // Parse bucket url queries for ListObjects V2.
@@ -73,7 +73,7 @@ func getListObjectsV2Args(values url.Values) (prefix, token, startAfter, delimit
 	if val, ok := values["continuation-token"]; ok {
 		if len(val[0]) == 0 {
 			errCode = ErrIncorrectContinuationToken
-			return
+			return prefix, token, startAfter, delimiter, fetchOwner, maxkeys, encodingType, errCode
 		}
 	}

@@ -81,7 +81,7 @@ func getListObjectsV2Args(values url.Values) (prefix, token, startAfter, delimit
 		var err error
 		if maxkeys, err = strconv.Atoi(values.Get("max-keys")); err != nil {
 			errCode = ErrInvalidMaxKeys
-			return
+			return prefix, token, startAfter, delimiter, fetchOwner, maxkeys, encodingType, errCode
 		}
 	} else {
 		maxkeys = maxObjectList
@@ -97,11 +97,11 @@ func getListObjectsV2Args(values url.Values) (prefix, token, startAfter, delimit
 		decodedToken, err := base64.StdEncoding.DecodeString(token)
 		if err != nil {
 			errCode = ErrIncorrectContinuationToken
-			return
+			return prefix, token, startAfter, delimiter, fetchOwner, maxkeys, encodingType, errCode
 		}
 		token = string(decodedToken)
 	}
-	return
+	return prefix, token, startAfter, delimiter, fetchOwner, maxkeys, encodingType, errCode
 }

 // Parse bucket url queries for ?uploads
@@ -112,7 +112,7 @@ func getBucketMultipartResources(values url.Values) (prefix, keyMarker, uploadID
 		var err error
 		if maxUploads, err = strconv.Atoi(values.Get("max-uploads")); err != nil {
 			errCode = ErrInvalidMaxUploads
-			return
+			return prefix, keyMarker, uploadIDMarker, delimiter, maxUploads, encodingType, errCode
 		}
 	} else {
 		maxUploads = maxUploadsList
@@ -123,7 +123,7 @@ func getBucketMultipartResources(values url.Values) (prefix, keyMarker, uploadID
 	uploadIDMarker = values.Get("upload-id-marker")
 	delimiter = values.Get("delimiter")
 	encodingType = values.Get("encoding-type")
-	return
+	return prefix, keyMarker, uploadIDMarker, delimiter, maxUploads, encodingType, errCode
 }

 // Parse object url queries
@@ -134,7 +134,7 @@ func getObjectResources(values url.Values) (uploadID string, partNumberMarker, m
 	if values.Get("max-parts") != "" {
 		if maxParts, err = strconv.Atoi(values.Get("max-parts")); err != nil {
 			errCode = ErrInvalidMaxParts
-			return
+			return uploadID, partNumberMarker, maxParts, encodingType, errCode
 		}
 	} else {
 		maxParts = maxPartsList
@@ -143,11 +143,11 @@ func getObjectResources(values url.Values) (uploadID string, partNumberMarker, m
 	if values.Get("part-number-marker") != "" {
 		if partNumberMarker, err = strconv.Atoi(values.Get("part-number-marker")); err != nil {
 			errCode = ErrInvalidPartNumberMarker
-			return
+			return uploadID, partNumberMarker, maxParts, encodingType, errCode
 		}
 	}

 	uploadID = values.Get("uploadId")
 	encodingType = values.Get("encoding-type")
-	return
+	return uploadID, partNumberMarker, maxParts, encodingType, errCode
 }
@@ -889,6 +889,12 @@ func generateMultiDeleteResponse(quiet bool, deletedObjects []DeletedObject, err
 }

 func writeResponse(w http.ResponseWriter, statusCode int, response []byte, mType mimeType) {
+	// Don't write a response if one has already been written.
+	// Fixes https://github.com/minio/minio/issues/21633
+	if headersAlreadyWritten(w) {
+		return
+	}
+
 	if statusCode == 0 {
 		statusCode = 200
 	}
@@ -1015,3 +1021,63 @@ func writeCustomErrorResponseJSON(ctx context.Context, w http.ResponseWriter, er
 	encodedErrorResponse := encodeResponseJSON(errorResponse)
 	writeResponse(w, err.HTTPStatusCode, encodedErrorResponse, mimeJSON)
 }
+
+type unwrapper interface {
+	Unwrap() http.ResponseWriter
+}
+
+// headersAlreadyWritten returns true if an HTTP status has already been written
+// to this response writer. It will unwrap the ResponseWriter if possible to try
+// and find a trackingResponseWriter.
+func headersAlreadyWritten(w http.ResponseWriter) bool {
+	for {
+		if trw, ok := w.(*trackingResponseWriter); ok {
+			return trw.headerWritten
+		} else if uw, ok := w.(unwrapper); ok {
+			w = uw.Unwrap()
+		} else {
+			return false
+		}
+	}
+}
+
+// trackingResponseWriter wraps a ResponseWriter and records when an HTTP status
+// has been written, explicitly or implicitly by Write or an effective Flush.
+//
+// Informational responses are treated as final. internal/http.ResponseRecorder
+// has the same limitation, so 1xx support must be fixed in both layers.
+type trackingResponseWriter struct {
+	http.ResponseWriter
+	headerWritten bool
+}
+
+var _ http.Flusher = (*trackingResponseWriter)(nil)
+
+func (w *trackingResponseWriter) WriteHeader(statusCode int) {
+	if !w.headerWritten {
+		w.headerWritten = true
+		w.ResponseWriter.WriteHeader(statusCode)
+	}
+}
+
+func (w *trackingResponseWriter) Write(b []byte) (int, error) {
+	if !w.headerWritten {
+		w.WriteHeader(http.StatusOK)
+	}
+	return w.ResponseWriter.Write(b)
+}
+
+func (w *trackingResponseWriter) Flush() {
+	f, ok := w.ResponseWriter.(http.Flusher)
+	if !ok {
+		return
+	}
+	if !w.headerWritten {
+		w.WriteHeader(http.StatusOK)
+	}
+	f.Flush()
+}
+
+func (w *trackingResponseWriter) Unwrap() http.ResponseWriter {
+	return w.ResponseWriter
+}
@@ -18,8 +18,14 @@
 package cmd

 import (
+	"compress/gzip"
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"testing"
+
+	"github.com/klauspost/compress/gzhttp"
+	xhttp "github.com/minio/minio/internal/http"
 )

 // Tests object location.
@@ -100,7 +106,6 @@ func TestObjectLocation(t *testing.T) {
 		},
 	}
 	for _, testCase := range testCases {
-		testCase := testCase
 		t.Run("", func(t *testing.T) {
 			gotLocation := getObjectLocation(testCase.request, testCase.domains, testCase.bucket, testCase.object)
 			if testCase.expectedLocation != gotLocation {
@@ -123,3 +128,226 @@ func TestGetURLScheme(t *testing.T) {
 		t.Errorf("Expected %s, got %s", httpsScheme, gotScheme)
 	}
 }
+
+type writeHeaderSpy struct {
+	http.ResponseWriter
+	codes []int
+}
+
+func (r *writeHeaderSpy) WriteHeader(code int) {
+	r.codes = append(r.codes, code)
+	r.ResponseWriter.WriteHeader(code)
+}
+
+func (r *writeHeaderSpy) Flush() {
+	if f, ok := r.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+func TestTrackingResponseWriter(t *testing.T) {
+	rw := httptest.NewRecorder()
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+	trw.WriteHeader(299)
+	if !trw.headerWritten {
+		t.Fatal("headerWritten was not set by WriteHeader call")
+	}
+
+	_, err := trw.Write([]byte("hello"))
+	if err != nil {
+		t.Fatalf("Write unexpectedly failed: %v", err)
+	}
+	xhttp.Flush(trw)
+
+	// Check that WriteHeader, Write, and Flush were called on the underlying response writer.
+	resp := rw.Result()
+	if resp.StatusCode != 299 {
+		t.Fatalf("unexpected status: %v", resp.StatusCode)
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("reading response body failed: %v", err)
+	}
+	if string(body) != "hello" {
+		t.Fatalf("response body incorrect: %v", string(body))
+	}
+	if !rw.Flushed {
+		t.Fatal("underlying ResponseRecorder was not flushed")
+	}
+
+	// Check that Unwrap works
+	if trw.Unwrap() != rw {
+		t.Fatalf("Unwrap returned wrong result: %v", trw.Unwrap())
+	}
+}
+
+func TestTrackingResponseWriterWriteImplicitHeader(t *testing.T) {
+	testCases := []struct {
+		name string
+		body []byte
+	}{
+		{name: "non-empty", body: []byte("hello")},
+		{name: "empty", body: nil},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			rw := &writeHeaderSpy{ResponseWriter: rec}
+			trw := &trackingResponseWriter{ResponseWriter: rw}
+
+			n, err := trw.Write(testCase.body)
+			if err != nil {
+				t.Fatalf("Write unexpectedly failed: %v", err)
+			}
+			if n != len(testCase.body) {
+				t.Fatalf("unexpected bytes written: got %d, want %d", n, len(testCase.body))
+			}
+			if !trw.headerWritten {
+				t.Fatal("Write did not set headerWritten")
+			}
+			if len(rw.codes) != 1 || rw.codes[0] != http.StatusOK {
+				t.Fatalf("unexpected WriteHeader calls: got %v, want [%d]", rw.codes, http.StatusOK)
+			}
+			if got := rec.Body.String(); got != string(testCase.body) {
+				t.Fatalf("unexpected body: got %q, want %q", got, testCase.body)
+			}
+		})
+	}
+}
+
+func TestTrackingResponseWriterFlush(t *testing.T) {
+	rec := httptest.NewRecorder()
+	rw := &writeHeaderSpy{ResponseWriter: rec}
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+
+	xhttp.Flush(trw)
+	if !trw.headerWritten {
+		t.Fatal("Flush did not set headerWritten")
+	}
+	if len(rw.codes) != 1 || rw.codes[0] != http.StatusOK {
+		t.Fatalf("unexpected WriteHeader calls: got %v, want [%d]", rw.codes, http.StatusOK)
+	}
+	if !rec.Flushed {
+		t.Fatal("underlying ResponseRecorder was not flushed")
+	}
+}
+
+func TestTrackingResponseWriterFlushUnsupported(t *testing.T) {
+	rw := struct{ http.ResponseWriter }{ResponseWriter: httptest.NewRecorder()}
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+
+	trw.Flush()
+	if trw.headerWritten {
+		t.Fatal("unsupported Flush set headerWritten")
+	}
+}
+
+func TestTrackingResponseWriterGzipStreaming(t *testing.T) {
+	const (
+		eventPayload = "event data"
+		sentinel     = "<sentinel-error/>"
+	)
+
+	rw := httptest.NewRecorder()
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+	var (
+		committed bool
+		writeErr  error
+	)
+	handler := gzipHandler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		setEventStreamHeaders(w)
+		_, writeErr = w.Write([]byte(eventPayload))
+		if writeErr != nil {
+			return
+		}
+		xhttp.Flush(w)
+		committed = headersAlreadyWritten(w)
+		writeResponse(w, http.StatusInternalServerError, []byte(sentinel), mimeXML)
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Accept-Encoding", "gzip")
+
+	handler.ServeHTTP(trw, req)
+
+	if writeErr != nil {
+		t.Fatalf("Write unexpectedly failed: %v", writeErr)
+	}
+	if !committed {
+		t.Fatal("headersAlreadyWritten returned false after Write and Flush")
+	}
+	resp := rw.Result()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("unexpected status: got %d, want %d", resp.StatusCode, http.StatusOK)
+	}
+	if got := resp.Header.Get("Content-Encoding"); got != "gzip" {
+		t.Fatalf("unexpected Content-Encoding: got %q, want %q", got, "gzip")
+	}
+	zr, err := gzip.NewReader(resp.Body)
+	if err != nil {
+		t.Fatalf("creating gzip reader failed: %v", err)
+	}
+	defer zr.Close()
+	body, err := io.ReadAll(zr)
+	if err != nil {
+		t.Fatalf("reading gzip response body failed: %v", err)
+	}
+	if got := string(body); got != eventPayload {
+		t.Fatalf("unexpected response body: got %q, want %q (sentinel %q must be suppressed)", got, eventPayload, sentinel)
+	}
+}
+
+func TestHeadersAlreadyWritten(t *testing.T) {
+	rw := httptest.NewRecorder()
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+
+	if headersAlreadyWritten(trw) {
+		t.Fatal("headers have not been written yet")
+	}
+
+	trw.WriteHeader(299)
+	if !headersAlreadyWritten(trw) {
+		t.Fatal("headers were written")
+	}
+}
+
+func TestHeadersAlreadyWrittenWrapped(t *testing.T) {
+	rw := httptest.NewRecorder()
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+	wrap1 := &gzhttp.NoGzipResponseWriter{ResponseWriter: trw}
+	wrap2 := &gzhttp.NoGzipResponseWriter{ResponseWriter: wrap1}
+
+	if headersAlreadyWritten(wrap2) {
+		t.Fatal("headers have not been written yet")
+	}
+
+	// Pin the current stack-wide 1xx limitation documented on trackingResponseWriter.
+	wrap2.WriteHeader(http.StatusContinue)
+	if !headersAlreadyWritten(wrap2) {
+		t.Fatal("headers were written")
+	}
+}
+
+func TestWriteResponseHeadersNotWritten(t *testing.T) {
+	rw := httptest.NewRecorder()
+	trw := &trackingResponseWriter{ResponseWriter: rw}
+
+	writeResponse(trw, 299, []byte("hello"), "application/foo")
+
+	resp := rw.Result()
+	if resp.StatusCode != 299 {
+		t.Fatal("response wasn't written")
+	}
+}
+
+func TestWriteResponseHeadersWritten(t *testing.T) {
+	rw := httptest.NewRecorder()
+	rw.Code = -1
+	trw := &trackingResponseWriter{ResponseWriter: rw, headerWritten: true}
+
+	writeResponse(trw, 200, []byte("hello"), "application/foo")
+
+	if rw.Code != -1 {
+		t.Fatalf("response was written when it shouldn't have been (Code=%v)", rw.Code)
+	}
+}
@@ -218,6 +218,8 @@ func s3APIMiddleware(f http.HandlerFunc, flags ...s3HFlag) http.HandlerFunc {
 	handlerName := getHandlerName(f, "objectAPIHandlers")

 	var handler http.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
+		w = &trackingResponseWriter{ResponseWriter: w}
+
 		// Wrap the actual handler with the appropriate tracing middleware.
 		var tracedHandler http.HandlerFunc
 		if handlerFlags.has(traceHdrsS3HFlag) {
@@ -43,7 +43,7 @@ func shouldEscape(c byte) bool {
 //   - Force encoding of '~'
 func s3URLEncode(s string) string {
 	spaceCount, hexCount := 0, 0
-	for i := 0; i < len(s); i++ {
+	for i := range len(s) {
 		c := s[i]
 		if shouldEscape(c) {
 			if c == ' ' {
@@ -70,7 +70,7 @@ func s3URLEncode(s string) string {

 	if hexCount == 0 {
 		copy(t, s)
-		for i := 0; i < len(s); i++ {
+		for i := range len(s) {
 			if s[i] == ' ' {
 				t[i] = '+'
 			}
@@ -79,7 +79,7 @@ func s3URLEncode(s string) string {
 	}

 	j := 0
-	for i := 0; i < len(s); i++ {
+	for i := range len(s) {
 		switch c := s[i]; {
 		case c == ' ':
 			t[j] = '+'
@@ -347,8 +347,9 @@ const _APIErrorCode_name = "NoneAccessDeniedBadDigestEntityTooSmallEntityTooLarg
 var _APIErrorCode_index = [...]uint16{0, 4, 16, 25, 39, 53, 67, 81, 94, 112, 129, 144, 161, 174, 186, 208, 228, 254, 268, 289, 306, 321, 344, 361, 379, 396, 420, 435, 456, 474, 486, 506, 523, 546, 567, 579, 597, 618, 646, 676, 697, 720, 746, 783, 813, 846, 871, 903, 933, 962, 987, 1009, 1035, 1057, 1085, 1114, 1148, 1179, 1216, 1240, 1264, 1292, 1318, 1349, 1379, 1388, 1400, 1416, 1429, 1443, 1461, 1481, 1502, 1518, 1529, 1545, 1556, 1584, 1604, 1620, 1648, 1662, 1679, 1699, 1712, 1726, 1739, 1752, 1768, 1785, 1806, 1820, 1841, 1854, 1876, 1899, 1915, 1930, 1945, 1966, 1984, 1999, 2016, 2041, 2059, 2082, 2097, 2116, 2132, 2151, 2172, 2186, 2198, 2211, 2230, 2249, 2259, 2274, 2310, 2341, 2374, 2403, 2415, 2435, 2459, 2483, 2504, 2528, 2547, 2568, 2585, 2595, 2612, 2629, 2650, 2670, 2693, 2715, 2741, 2762, 2780, 2807, 2838, 2865, 2886, 2907, 2931, 2956, 2984, 3012, 3028, 3051, 3081, 3092, 3104, 3121, 3136, 3154, 3183, 3200, 3216, 3232, 3250, 3268, 3291, 3312, 3335, 3346, 3362, 3385, 3402, 3430, 3449, 3479, 3499, 3527, 3542, 3560, 3575, 3589, 3624, 3643, 3654, 3667, 3682, 3705, 3731, 3747, 3765, 3783, 3804, 3818, 3835, 3866, 3886, 3907, 3928, 3947, 3966, 3984, 4007, 4031, 4055, 4080, 4115, 4140, 4174, 4207, 4228, 4242, 4261, 4290, 4313, 4340, 4374, 4406, 4436, 4459, 4487, 4519, 4547, 4571, 4595, 4624, 4642, 4659, 4681, 4698, 4716, 4736, 4762, 4778, 4797, 4818, 4822, 4840, 4857, 4883, 4897, 4921, 4942, 4957, 4975, 4998, 5013, 5032, 5049, 5066, 5090, 5117, 5140, 5163, 5180, 5202, 5218, 5238, 5257, 5279, 5300, 5320, 5342, 5366, 5385, 5427, 5448, 5471, 5492, 5523, 5542, 5564, 5584, 5610, 5631, 5653, 5673, 5697, 5720, 5739, 5759, 5781, 5804, 5835, 5873, 5914, 5944, 5958, 5979, 5995, 6017, 6047, 6073, 6101, 6135, 6153, 6176, 6211, 6251, 6293, 6325, 6342, 6367, 6382, 6399, 6409, 6420, 6458, 6512, 6558, 6610, 6658, 6701, 6745, 6773, 6787, 6805, 6841, 6864, 6887, 6909, 6924, 6952, 6975, 6993, 7020, 7052, 7067, 7083, 7100, 7120, 7136, 7152, 7169, 7182}

 func (i APIErrorCode) String() string {
-	if i < 0 || i >= APIErrorCode(len(_APIErrorCode_index)-1) {
+	idx := int(i) - 0
+	if i < 0 || idx >= len(_APIErrorCode_index)-1 {
 		return "APIErrorCode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _APIErrorCode_name[_APIErrorCode_index[i]:_APIErrorCode_index[i+1]]
+	return _APIErrorCode_name[_APIErrorCode_index[idx]:_APIErrorCode_index[idx+1]]
 }
@@ -216,7 +216,7 @@ func getSessionToken(r *http.Request) (token string) {

 // Fetch claims in the security token returned by the client, doesn't return
 // errors - upon errors the returned claims map will be empty.
-func mustGetClaimsFromToken(r *http.Request) map[string]interface{} {
+func mustGetClaimsFromToken(r *http.Request) map[string]any {
 	claims, _ := getClaimsFromToken(getSessionToken(r))
 	return claims
 }
@@ -266,7 +266,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (*xjwt.MapClaims, error)
 }

 // Fetch claims in the security token returned by the client.
-func getClaimsFromToken(token string) (map[string]interface{}, error) {
+func getClaimsFromToken(token string) (map[string]any, error) {
 	jwtClaims, err := getClaimsFromTokenWithSecret(token, globalActiveCred.SecretKey)
 	if err != nil {
 		return nil, err
@@ -275,7 +275,7 @@ func getClaimsFromToken(token string) (map[string]interface{}, error) {
 }

 // Fetch claims in the security token returned by the client and validate the token.
-func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]interface{}, APIErrorCode) {
+func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]any, APIErrorCode) {
 	token := getSessionToken(r)
 	if token != "" && cred.AccessKey == "" {
 		// x-amz-security-token is not allowed for anonymous access.
@@ -343,6 +343,26 @@ func checkRequestAuthType(ctx context.Context, r *http.Request, action policy.Ac
 	return s3Err
 }

+func checkRequestAuthTypeWithExistingTags(ctx context.Context, r *http.Request, action policy.Action, bucketName, objectName, existingTags string) (s3Err APIErrorCode) {
+	logger.GetReqInfo(ctx).BucketName = bucketName
+	logger.GetReqInfo(ctx).ObjectName = objectName
+
+	if s3Err = authenticateRequest(ctx, r, action); s3Err != ErrNone {
+		return s3Err
+	}
+	return authorizeRequestWithExistingTags(ctx, r, action, existingTags)
+}
+
+func checkRequestAuthTypeWithRequestTags(ctx context.Context, r *http.Request, action policy.Action, bucketName, objectName string, requestTags *string) (s3Err APIErrorCode) {
+	logger.GetReqInfo(ctx).BucketName = bucketName
+	logger.GetReqInfo(ctx).ObjectName = objectName
+
+	if s3Err = authenticateRequest(ctx, r, action); s3Err != ErrNone {
+		return s3Err
+	}
+	return authorizeRequestWithTags(ctx, r, action, "", requestTags)
+}
+
 // checkRequestAuthTypeWithVID is similar to checkRequestAuthType
 // passes versionID additionally.
 func checkRequestAuthTypeWithVID(ctx context.Context, r *http.Request, action policy.Action, bucketName, objectName, versionID string) (s3Err APIErrorCode) {
@@ -416,6 +436,14 @@ func authenticateRequest(ctx context.Context, r *http.Request, action policy.Act
 }

 func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action) (s3Err APIErrorCode) {
+	return authorizeRequestWithExistingTags(ctx, r, action, "")
+}
+
+func authorizeRequestWithExistingTags(ctx context.Context, r *http.Request, action policy.Action, existingTags string) (s3Err APIErrorCode) {
+	return authorizeRequestWithTags(ctx, r, action, existingTags, nil)
+}
+
+func authorizeRequestWithTags(ctx context.Context, r *http.Request, action policy.Action, existingTags string, requestTags *string) (s3Err APIErrorCode) {
 	reqInfo := logger.GetReqInfo(ctx)
 	if reqInfo == nil {
 		return ErrAccessDenied
@@ -427,6 +455,19 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 	bucket := reqInfo.BucketName
 	object := reqInfo.ObjectName
 	versionID := reqInfo.VersionID
+	conditionValuesForAuth := func(locationConstraint string, credentials auth.Credentials) map[string][]string {
+		values := getConditionValuesWithTags(r, locationConstraint, credentials, existingTags, requestTags)
+		if action == policy.DeleteObjectAction {
+			// DeleteObjects carries the effective version ID in each XML object,
+			// not in the request query. Keep authorization scoped to that entry.
+			if versionID == "" {
+				delete(values, "versionid")
+			} else {
+				values["versionid"] = []string{versionID}
+			}
+		}
+		return values
+	}

 	if action != policy.ListAllMyBucketsAction && cred.AccessKey == "" {
 		// Anonymous checks are not meant for ListAllBuckets action
@@ -435,7 +476,7 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 			Groups:          cred.Groups,
 			Action:          action,
 			BucketName:      bucket,
-			ConditionValues: getConditionValues(r, region, auth.AnonymousCredentials),
+			ConditionValues: conditionValuesForAuth(region, auth.AnonymousCredentials),
 			IsOwner:         false,
 			ObjectName:      object,
 		}) {
@@ -451,7 +492,7 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 				Groups:          cred.Groups,
 				Action:          policy.ListBucketAction,
 				BucketName:      bucket,
-				ConditionValues: getConditionValues(r, region, auth.AnonymousCredentials),
+				ConditionValues: conditionValuesForAuth(region, auth.AnonymousCredentials),
 				IsOwner:         false,
 				ObjectName:      object,
 			}) {
@@ -468,7 +509,7 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 			Groups:          cred.Groups,
 			Action:          policy.Action(policy.DeleteObjectVersionAction),
 			BucketName:      bucket,
-			ConditionValues: getConditionValues(r, "", cred),
+			ConditionValues: conditionValuesForAuth("", cred),
 			ObjectName:      object,
 			IsOwner:         owner,
 			Claims:          cred.Claims,
@@ -482,7 +523,7 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 		Groups:          cred.Groups,
 		Action:          action,
 		BucketName:      bucket,
-		ConditionValues: getConditionValues(r, "", cred),
+		ConditionValues: conditionValuesForAuth("", cred),
 		ObjectName:      object,
 		IsOwner:         owner,
 		Claims:          cred.Claims,
@@ -499,7 +540,7 @@ func authorizeRequest(ctx context.Context, r *http.Request, action policy.Action
 			Groups:          cred.Groups,
 			Action:          policy.ListBucketAction,
 			BucketName:      bucket,
-			ConditionValues: getConditionValues(r, "", cred),
+			ConditionValues: conditionValuesForAuth("", cred),
 			ObjectName:      object,
 			IsOwner:         owner,
 			Claims:          cred.Claims,
@@ -720,6 +761,10 @@ func isPutRetentionAllowed(bucketName, objectName string, retDays int, retDate t
 // call verifies bucket policies and IAM policies, supports multi user
 // checks etc.
 func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectName string, r *http.Request, action policy.Action) (s3Err APIErrorCode) {
+	return isPutActionAllowedWithRequestTags(ctx, atype, bucketName, objectName, r, action, nil)
+}
+
+func isPutActionAllowedWithRequestTags(ctx context.Context, atype authType, bucketName, objectName string, r *http.Request, action policy.Action, requestTags *string) (s3Err APIErrorCode) {
 	var cred auth.Credentials
 	var owner bool
 	region := globalSite.Region()
@@ -760,7 +805,7 @@ func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectN
 			Groups:          cred.Groups,
 			Action:          action,
 			BucketName:      bucketName,
-			ConditionValues: getConditionValues(r, "", auth.AnonymousCredentials),
+			ConditionValues: getConditionValuesWithTags(r, "", auth.AnonymousCredentials, "", requestTags),
 			IsOwner:         false,
 			ObjectName:      objectName,
 		}) {
@@ -774,7 +819,7 @@ func isPutActionAllowed(ctx context.Context, atype authType, bucketName, objectN
 		Groups:          cred.Groups,
 		Action:          action,
 		BucketName:      bucketName,
-		ConditionValues: getConditionValues(r, "", cred),
+		ConditionValues: getConditionValuesWithTags(r, "", cred, "", requestTags),
 		ObjectName:      objectName,
 		IsOwner:         owner,
 		Claims:          cred.Claims,
@@ -27,8 +27,9 @@ const _authType_name = "UnknownAnonymousPresignedPresignedV2PostPolicyStreamingS
 var _authType_index = [...]uint8{0, 7, 16, 25, 36, 46, 61, 67, 75, 78, 81, 103, 127}

 func (i authType) String() string {
-	if i < 0 || i >= authType(len(_authType_index)-1) {
+	idx := int(i) - 0
+	if i < 0 || idx >= len(_authType_index)-1 {
 		return "authType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _authType_name[_authType_index[i]:_authType_index[i+1]]
+	return _authType_name[_authType_index[idx]:_authType_index[idx+1]]
 }
@@ -102,7 +102,7 @@ func waitForLowHTTPReq() {
 func initBackgroundHealing(ctx context.Context, objAPI ObjectLayer) {
 	bgSeq := newBgHealSequence()
 	// Run the background healer
-	for i := 0; i < globalBackgroundHealRoutine.workers; i++ {
+	for range globalBackgroundHealRoutine.workers {
 		go globalBackgroundHealRoutine.AddWorker(ctx, objAPI, bgSeq)
 	}

@@ -24,6 +24,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -269,12 +270,7 @@ func (h *healingTracker) delete(ctx context.Context) error {
 func (h *healingTracker) isHealed(bucket string) bool {
 	h.mu.RLock()
 	defer h.mu.RUnlock()
-	for _, v := range h.HealedBuckets {
-		if v == bucket {
-			return true
-		}
-	}
-	return false
+	return slices.Contains(h.HealedBuckets, bucket)
 }

 // resume will reset progress to the numbers at the start of the bucket.
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"github.com/tinylib/msgp/msgp"
 )
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"bytes"
 	"testing"
@@ -37,7 +37,7 @@ import (
 	"github.com/minio/pkg/v3/wildcard"
 	"github.com/minio/pkg/v3/workers"
 	"github.com/minio/pkg/v3/xtime"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 // expire: # Expire objects that match a condition
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"time"

@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"bytes"
 	"testing"
@@ -21,7 +21,7 @@ import (
 	"slices"
 	"testing"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 func TestParseBatchJobExpire(t *testing.T) {
@@ -25,6 +25,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"math/rand"
 	"net/http"
 	"net/url"
@@ -51,7 +52,7 @@ import (
 	"github.com/minio/pkg/v3/env"
 	"github.com/minio/pkg/v3/policy"
 	"github.com/minio/pkg/v3/workers"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 var globalBatchConfig batch.Config
@@ -248,7 +249,7 @@ func (r *BatchJobReplicateV1) copyWithMultipartfromSource(ctx context.Context, a
 		pInfo PartInfo
 	)

-	for i := 0; i < partsCount; i++ {
+	for i := range partsCount {
 		gopts := minio.GetObjectOptions{
 			VersionID:  srcObjInfo.VersionID,
 			PartNumber: i + 1,
@@ -574,9 +575,7 @@ func toObjectInfo(bucket, object string, objInfo minio.ObjectInfo) ObjectInfo {
 		oi.UserDefined[xhttp.AmzStorageClass] = objInfo.StorageClass
 	}

-	for k, v := range objInfo.UserMetadata {
-		oi.UserDefined[k] = v
-	}
+	maps.Copy(oi.UserDefined, objInfo.UserMetadata)

 	return oi
 }
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"github.com/tinylib/msgp/msgp"
 )
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"bytes"
 	"testing"
@@ -21,7 +21,7 @@ import (
 	"slices"
 	"testing"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 func TestBatchJobPrefix_UnmarshalYAML(t *testing.T) {
@@ -24,7 +24,7 @@ import (

 	"github.com/dustin/go-humanize"
 	"github.com/minio/pkg/v3/wildcard"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 //go:generate msgp -file $GOFILE
@@ -275,7 +275,7 @@ func (sf BatchJobSizeFilter) Validate() error {
 type BatchJobSize int64

 // UnmarshalYAML to parse humanized byte values
-func (s *BatchJobSize) UnmarshalYAML(unmarshal func(interface{}) error) error {
+func (s *BatchJobSize) UnmarshalYAML(unmarshal func(any) error) error {
 	var batchExpireSz string
 	err := unmarshal(&batchExpireSz)
 	if err != nil {
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"github.com/tinylib/msgp/msgp"
 )
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"bytes"
 	"testing"
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"github.com/tinylib/msgp/msgp"
 )
@@ -1,7 +1,7 @@
-package cmd
-
 // Code generated by github.com/tinylib/msgp DO NOT EDIT.

+package cmd
+
 import (
 	"bytes"
 	"testing"
@@ -21,7 +21,7 @@ import (
 	"slices"
 	"testing"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )

 func TestParseBatchJobReplicate(t *testing.T) {
--- a/Show More
+++ b/Show More