Design

Console PR #83, contributed by Eduardo Andrade Machado, supplies Brazilian Portuguese. silo#277, opened by siyahkut, requests Turkish. These contributions led to a configurable ten-language UI. Status as of 2026-11-09: the ten-language UI, reviewed …

This record covers issue #284 and two regressions of the first native-restore safeguards for #281, described in Restored Copies: Expire the Copy, Not the Object. It was evaluated against main at 69fcf50cd and the integration branch for the next …

This record covers a defect found during local acceptance of the next release. It reproduces on the local integration of the next release and on 69fcf50cd. It has no GitHub issue yet. Status: fix approved by an adversarial review (with nits, all …

This record covers a defect found during local acceptance of the next release. It reproduces on 69fcf50cd and is inherited from upstream MinIO. It has no GitHub issue yet. Status: analyzed and reproduced. A fix was drafted, but an adversarial review …

This record covers a lock-domain defect found during review of the restored-copy fix (Restored Copies: Expire the Copy, Not the Object), evaluated against main at 69fcf50cd. No issue has been filed yet. Status: fix approved by review and committed …

This record covers issue #281 and PR #282 by Denis Babchuk, evaluated against main at 69fcf50cd. The fix ships in the same maintainer integration PR as the multi-pool lifecycle fix (Multi-Pool Lifecycle Expiry, #278). That PR keeps the contributor …

This record covers issue #285 and PR #286 by Denis Babchuk, evaluated against main at 69fcf50cd and the PR head ed05d982a. Status: fix approved by review and committed locally. Tested together with the other fixes for the next release on one …

This record covers issue #278 and PR #279 by Denis Babchuk, evaluated against main at 69fcf50cd. The fix will ship through a maintainer integration PR that keeps the contributor commits unchanged and adds the maintainer follow-ups described below. …

This record covers the dry-run part of PR #280 by Jasper Bernhardt (@dihmandrake), evaluated against main at 69fcf50cd. The same PR also verifies an object’s drives concurrently during deep scans. That optimization is reviewed separately and is …

This record covers a defect found during review of the #278 fix (Multi-Pool Lifecycle Expiry). It was evaluated against main at 69fcf50cd and against the maintainer integration branch for #278 and #281, which is not yet published. Status: fix …

This record covers silo-console#72 (a quota set in the web Console shows as a dash in the bucket list) and silo-console#73 (numeric validation in the bucket-creation form). It is evaluated against the Console source before the fix, 3d264aea9, and the …

This record covers issue #259, reported by Henrik Feldt, evaluated against main at 69fcf50cd. The fix completes earlier, uncommitted maintainer work. It adds the Kafka call site, a handoff of records queued in a target that never started, and Kafka …

This record covers issue #265, the contributor change PR #266, and maintainer follow-up #276. The merged #264 and #267 are relevant predecessors. The review was updated against main after #276 on 2026-11-02. #266’s decommission commit is 19910230a, …

This record covers issue #263 and PR #264, updated against main at 0fc5a0b5, with the #264 merge recorded at 0cfca29c. The PR is three linked repairs, not three unrelated workarounds. Short answer The report is real. A free version is an internal …

This record covers issue #261 and PR #262, updated against main at 0fc5a0b5 after the #276 follow-up. The fix was merged through maintainer PR #267; #262 was the superseded duplicate. Short answer The report is real. A successful degraded overwrite …

This record reviews #261, #263, and #265, together with their fixes #262, #264, and #266. It also records the maintainer follow-up #276. It is a design and review record, not a release note. The review was updated against the post-#276 main branch on …

Decision, October 24, 2026: merge the corrected PR #257 (shipped in Server 20261026). Commit aafe4f8886 fixes the multi-pool deletion failures reported in issue #256 and closes the in-flight failure window after preflight checks. The core invariant …

Decision, October 24, 2026: do not merge the tested pool-affinity changes (PR #245). The experiment addressed a real space-efficiency problem, but neither the broad policy nor the narrower unversioned-only policy achieved an acceptable performance …

Issue #254 reported a replication failure affecting multipart objects uploaded with a FULL_OBJECT CRC32 or CRC32C checksum: the object uploads and reads normally on the source, but the replication target rejects CompleteMultipartUpload with 400 …

Server PR #250 (merged at d43adc0f2 and shipped in Server 20261026) fixes a login failure affecting LDAP users whose normalized Distinguished Name (DN) exceeds the 255-byte single-component filename limit of the object-storage IAM backend, while …

Commit 1b5477f3d (pgsty/silo#251) resolves two coupled failure modes under slow KMS/KES responses: Authentication-cache lock contention: ListPolicies and ListPolicyDocs now load and decrypt policy replacements outside the in-memory …

Decision, 2026-10-23: mcli PR #44 is merged on main at 91006a587. We accepted the per-alias region design, kept its small production implementation and supplemented the regression coverage. This records the original design decision. The capability is …

SILO integrates with external key-management systems through PGSTY KES (MINIO_KMS_KES_ENDPOINT). The current release is KES 20261026 (built with Go 1.27.3 and updated cloud dependencies while retaining the API, configuration, and key formats …

Shipped in SILO Server 20261018, PR #239 (merged as fbcb51197, closing #218 and retaining mr javad seydi’s original signed commits from #221) and the October 18 directory/common-prefix follow-ups (3dd53eb81 and 2080b3d03) resolve silent object …

Server 20261018 ships Server PR #242 (commit 2616d43fb on baseline 00a375c4e, merged as 4e55fc7db) and the bulk self-listing follow-up 995439260 to close SN-2026-017. This design note records the problem scope, handler-level authorization contract, …

This article records the design and verification of PR #233 (tested head 86c5a92eef3d, merged as d94b3b3c9251), which shipped in Server 20261018. It fixes stale fields carried over when legacy xl.meta version headers and remote namespace-scanner …

After the Go TLS default repair 48e184652 shipped in Server 20260916, the reporter of issue #154 retested on that release and still saw connection reset by peer on OIDC discovery. Meanwhile, upstream Go issues reported the exact same symptom and …

This record covers the listing omission investigated on 2026-09-16: an unversioned bucket under concurrent overwrites returned HTTP 200 listings that lacked keys the same endpoint could still GET. It describes the confirmed mechanism, the targeted …

After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”, shipped in Server 20260916) removed explicit curve overrides across eight Server TLS configuration points. This …

This article records the repair of Server’s HTTP read deadlines, merged in PR #196 (fix 055030ea5) and shipped in Server 20260916 (40220bd836cbd066ca424fa4dc5dbb90057fb55a). The investigation was prompted by a slow-HTTP DoS scanner report (#183) and …

Shipped in SILO Server 20260916 (40220bd836cbd066ca424fa4dc5dbb90057fb55a), PR #194 (commit 4fcdf37ce, merged as 9f3037e941, retaining Mikhail Khadarenka’s original implementation from PR #187) fixes a regression where a trusted replication receiver …

Shipped in SILO Server 20260916 (40220bd836cbd066ca424fa4dc5dbb90057fb55a), PR #193 (commit 03027727d) and PR #196 (commit 680eac66e) fix two defects in how object tags preserve ordering across bucket replication: SSE-KMS destination copies silently …

This article records the SSE-C replica integrity contract formed by #122, #123, #124, #126, and #134, which shipped in Server 20260916, building on the earlier zero-byte/read-attribute authentication and destination-key checksum repairs from Server …

Initial Object Lock replication timestamp ordering (f4c1286c9) shipped in SILO Server 20260903 (recorded in the security advisory ledger). Subsequent fixes for timestamp-only removals, SSE-C replica retransmission, and multi-pool Object Lock …

Shipped in SILO Server 20260916, PR #178 repairs multi-pool mutation ordering, PR #207 extends current-object selection to conditional PUT (closing #133 and #144), and commit fced86303 preserves object tags across pool rebalance and decommission. …

Server 20260916 repairs the legacy etcd bucket-federation CopyObject path across PR #157, PR #159, PR #163, PR #177, and PR #179. When CopyObject forwards a copy across federated deployments as a remote PutObject, the proxy streams logical source …

SILO retains the revision of every deleted IAM record so an offline site cannot resurrect a deleted identity or policy grant when it reconnects. This mechanism covers built-in users, service accounts, groups, policy documents, and policy mappings …

#77 is a site-replication correctness defect repaired in Server 20260916 (PR #180, commit 48ec10312). Before this repair, a receiving site overwrote the peer’s source timestamp with local arrival time (UTCNow) and could then reject a genuinely newer …

This article records the root-cause analysis, design tradeoffs, and validation across three rounds of replication reliability repairs shipped in Server 20260916: Round 1 (PR #162, merged as d1105bbb): addresses #153, #152, and #137, covering …

This article records the unsigned-header coverage repair committed to SILO as 123325430 in PR #173 (tracked as SN-2026-011) and the follow-up signing and payload-verification fixes in PR #177 (tracked as SN-2026-012), which shipped in Server …

This is the pre-release engineering review behind SILO 20260903 (RELEASE.2026-09-03T13-18-01Z at 9b11dc9469e650815b775cb47b039610644f5da4, reviewed candidate 6e112d1856d4f3655f30fc81ee47e9f43d50d8f3, against baseline RELEASE.2026-08-06T00-00-00Z at …

This note documents the CORS hot-path and replication-request trust repair merged in PR #101 (938603458 through 04b097fd9), tracked as SN-2026-008, and shipped in Server 20260903. Overview Two defects that appeared unrelated shared a single …

This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect discovered during release review. The command merged into pgsty/mc through pull requests #8 and #13 and shipped …

This note documents the CopyObject SSE-C checksum response repair committed as e73436c99 and shipped in Server 20260903. It covers the successful CopyObject XML and HTTP response after the destination object has committed; stored object bytes, …

This note defines the startup contract for MINIO_CONFIG_ENV_FILE and documents the compatibility repair committed as 2aea7fe9c and shipped in Server 20260903. The file is a SILO input format; supporting an optional export prefix for operator …

The repairs for #48 and #50 shipped in Server 20260903, and the streaming-checksum follow-up (PR #143) shipped in Server 20260916. This record supersedes the earlier August proposal to leave CRC64NVME canonicalization unchanged. 20261018: Message …

Shipped in SILO Server 20260903, PR #37 (commit e9c5340be, merged as 49c8aeac4, closing SILO #32) fixes an S3 compatibility regression where three early-return shortcuts in ListObjects, ListObjectsV2, and ListObjectVersions returned HTTP 200 OK with …

This article records the authorization design and verification for upstream issue minio/minio#21478, SILO PR #73 (commits 58735ee38 / 2e2377d1c), and the set-group-status follow-up (229fe2b3c), which shipped in Server 20260903. Too Long; Didn’t Read …

Single-object conditional deletion (If-Match on DeleteObject) landed in PR #145, and PR #178 repaired multi-pool serialization and reconciliation. Both changes shipped in Server 20260916. An earlier August proposal around PR #12 sketched a broader …

PR #57, contributed by Shooks (@Dansyuqri), resolved #47 and shipped in Server 20260903. It restores the ChecksumType element in CompleteMultipartUpload XML responses whenever an object stores an additional S3 checksum. The Defect and Its Scope …

This is the design and implementation record for SILO #46 (merged as 7fea6d5a5 and shipped in Server 20260903, with follow-up items #63 and #64). It documents how handling an optional S3 part checksum header affected multipart completion semantics, …

SILO Console v2.1.1 displayed NaN% in the Downloads / Uploads drawer while downloading a folder. Although the streamed ZIP archive continued transferring normally and stored objects were intact, the progress bar entered an invalid determinate …

SILO Console previews images, PDFs, audio, and video, but in v2.1.1 it could not preview the small logs, text files, JSON documents, and XML documents that operators inspect every day. Even when an object stored an accurate Content-Type, the frontend …

Shipped in SILO Server 20260903 via commit f1ba68358, this design resolves SILO issue #53 by establishing the compatibility boundary, legacy-migration behavior, and startup error handling for PostgreSQL and MySQL bucket-notification targets. Decision …