mirror of
https://github.com/pgsty/minio.git
synced 2026-11-09 17:21:51 +03:00
Feng Ruohang
1f731549e4
Record RELEASE.2026-11-09T00-00-00Z (package 20261109000000.0.0) in the changelog: the fixes since 20261026, Console v2.7.0, mcli 20261109 and silo-pkg v3.16.0, upgrade notes and known issues. Point the README quick starts at the new image, replace the 20261026 release section with the 20261109 upgrade notice in both languages, refresh the contributor roll to 2026-11-09, and add a second security contact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com>
55 lines
3.0 KiB
Markdown
55 lines
3.0 KiB
Markdown
# Security Policy
|
|
|
|
Silo is an independent, community-maintained object-storage server derived from
|
|
the open-source MinIO server. Upstream MinIO security contacts do not handle
|
|
Silo-specific fixes or release notes.
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are tracked on the active development branch and summarized in
|
|
[the security advisory ledger](https://silo.pgsty.com/about/security-advisories/). Only the current
|
|
Silo release line is supported unless an advisory says otherwise.
|
|
|
|
## Inherited Fix Evidence
|
|
|
|
The canonical ledger also records security fixes inherited from upstream when
|
|
they are part of the Silo release baseline. Source and fork commits are linked
|
|
separately even when the fork preserves the original commit object and SHA.
|
|
|
|
- [CVE-2025-62506](https://github.com/advisories/GHSA-jjjj-jwhf-8rgr):
|
|
upstream [PR #21642](https://github.com/minio/minio/pull/21642) merged as
|
|
[`minio/minio@c1a49490`](https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190),
|
|
inherited unchanged as
|
|
[`pgsty/silo@c1a49490`](https://github.com/pgsty/silo/commit/c1a49490c78e9c3ebcad86ba0662319138ace190),
|
|
and is present in every Silo community release beginning with
|
|
[`RELEASE.2025-12-03T12-00-00Z`](https://github.com/pgsty/silo/releases/tag/RELEASE.2025-12-03T12-00-00Z).
|
|
The inherited [service-account](https://github.com/pgsty/silo/blob/c1a49490c78e9c3ebcad86ba0662319138ace190/cmd/admin-handlers-users_test.go#L211-L212)
|
|
and [STS](https://github.com/pgsty/silo/blob/c1a49490c78e9c3ebcad86ba0662319138ace190/cmd/sts-handlers_test.go#L45-L46)
|
|
regression groups remain part of `go test ./cmd`; see the
|
|
[canonical ledger](https://silo.pgsty.com/about/security-advisories/#inherited)
|
|
for the operator-facing record.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
The security contact for Silo is [ron@pgsty.com](mailto:ron@pgsty.com).
|
|
This address also receives automated security reports for this repository.
|
|
|
|
For vulnerabilities in this fork:
|
|
|
|
1. Follow the fork-specific expectations in [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md).
|
|
2. Prefer this repository's [private GitHub security advisory](https://github.com/pgsty/silo/security/advisories/new) workflow.
|
|
3. If you cannot use GitHub private reporting, email [ron@pgsty.com](mailto:ron@pgsty.com) or rh@vonng.com
|
|
directly. Do not publish vulnerability details or exploit code in public
|
|
issues or pull requests.
|
|
4. If you confirm the issue also affects upstream `minio/minio`, report it upstream separately.
|
|
|
|
## Scanner Configuration
|
|
|
|
The [OSS Scanner build environment](.oss-scanner/Dockerfile) and
|
|
[scan scope and offline checks](.oss-scanner/threat_model.md) are maintained
|
|
with the source. Update them when dependencies or security boundaries change.
|
|
|
|
## Disclosure Process
|
|
|
|
Fork-specific fixes and user-visible upgrade notes are published in [the security advisory ledger](https://silo.pgsty.com/about/security-advisories/). The fork-specific triage and remediation process is described in [VULNERABILITY_REPORT.md](VULNERABILITY_REPORT.md).
|