Design Records
Design records capture the reasoning behind SILO maintenance decisions: the problem being solved, the compatibility boundary, rejected alternatives, implementation requirements, and the evidence required before release.
-
Go 1.27 TLS Defaults and OIDC Discovery Failure Modes
After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …
After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …
-
Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts
This page records the repair of Server’s HTTP read deadlines, merged into main as part of PR #196 (fix 055030ea5). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the published Server 20260903. Evidence class: synthetic — a …
This page records the repair of Server’s HTTP read deadlines, merged into main as part of PR #196 (fix 055030ea5). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the published Server 20260903. Evidence class: synthetic — a …
-
Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject
This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …
This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …
-
Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection
This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …
This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …
-
Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence
#77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …
#77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …
-
Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation
This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …
This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …
-
An Unsigned Header Is Not Part of the Request
This record describes the unsigned-header coverage repair committed to SILO as 123325430 and merged through PR #173, tracked as SN-2026-011. It was reported by Oren Yomtov against a released build and reproduced locally on both signature paths. …
This record describes the unsigned-header coverage repair committed to SILO as 123325430 and merged through PR #173, tracked as SN-2026-011. It was reported by Oren Yomtov against a released build and reproduced locally on both signature paths. …
-
SILO Server 20260903 Pre-release Review
This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …
This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …
-
No I/O Before Auth, No Privilege From Headers
This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …
This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …
-
Should SILO Fix ListMultipartUploads? Design Review of Issue #79
This is the problem, design, and decision record for SILO issue #79. September 16 implementation and upgrade contract PR #198 retains mr javad seydi’s original metadata-and-scan contribution and adds maintainer fixes for disappearing markers, …
This is the problem, design, and decision record for SILO issue #79. September 16 implementation and upgrade contract PR #198 retains mr javad seydi’s original metadata-and-scan contribution and adds maintainer fixes for disappearing markers, …
-
Read-Only Checksum Audit and Reliable CLI Output
This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …
This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …
-
Two SSE-C Keys, One CopyObject Response
This record explains the CopyObject SSE-C checksum response repair committed in SILO as e73436c99. Status on 2026-08-28: implementation, encryption and key-rotation tests, complete server suites, race tests, static checks, build, and independent …
This record explains the CopyObject SSE-C checksum response repair committed in SILO as e73436c99. Status on 2026-08-28: implementation, encryption and key-rotation tests, complete server suites, race tests, static checks, build, and independent …
-
Config Environment Files Are Not Shell Scripts
This record defines the startup contract for MINIO_CONFIG_ENV_FILE and explains the compatibility repair committed in SILO as 2aea7fe9c. Status on 2026-08-28: implementation, focused tests, the complete cmd and internal suites, tagged tests, race …
This record defines the startup contract for MINIO_CONFIG_ENV_FILE and explains the compatibility repair committed in SILO as 2aea7fe9c. Status on 2026-08-28: implementation, focused tests, the complete cmd and internal suites, tagged tests, race …
-
BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract
This is the design, investigation, and verification record for SILO #48, with the decision boundary for the related SILO #50. Status: pgsty/silo#74 merged as 590aeaa7d, and pgsty/silo.pgsty.com#6 merged as 9805dd7; full local verification, remote CI, …
This is the design, investigation, and verification record for SILO #48, with the decision boundary for the related SILO #50. Status: pgsty/silo#74 merged as 590aeaa7d, and pgsty/silo.pgsty.com#6 merged as 9805dd7; full local verification, remote CI, …
-
A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One
This document records the problem analysis, design discussion, and repair decision for SILO #32 and PR #37. Status on 2026-08-26: PR #37 was updated to the DCO-signed head e9c5340be, formally approved, and merged as 49c8aeac4; #32 closed …
This document records the problem analysis, design discussion, and repair decision for SILO #32 and PR #37. Status on 2026-08-26: PR #37 was updated to the DCO-signed head e9c5340be, formally approved, and merged as 49c8aeac4; #32 closed …
-
One Endpoint, Two Privileges: Separating User and Group Status
This document records the discussion, repair, and final authorization design for upstream issue minio/minio#21478 and SILO PR #73. Status on 2026-08-26: SILO PR #73 was merged as 2e2377d1c, preserving the signed-off repair commit 58735ee38. All eight …
This document records the discussion, repair, and final authorization design for upstream issue minio/minio#21478 and SILO PR #73. Status on 2026-08-26: SILO PR #73 was merged as 2e2377d1c, preserving the signed-off repair commit 58735ee38. All eight …
-
Conditional DELETE: Why the Condition Must Be Evaluated Once
Follow-up, 2026-09-13: single-object If-Match DELETE later landed as 40bee4b7b, followed by main-branch multi-pool serialization and cleanup fixes. Latest published Server 20260903 does not contain these later changes. The August 26 design status …
Follow-up, 2026-09-13: single-object If-Match DELETE later landed as 40bee4b7b, followed by main-branch multi-pool serialization and cleanup fixes. Latest published Server 20260903 does not contain these later changes. The August 26 design status …
-
Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57
This is the design, review, and decision record for SILO #47 and PR #57. Status on 2026-08-26: PR #57 was approved and merged as a96116b1; #47 closed automatically. All nine checks on the tested PR head passed, followed by green Go CI and VulnCheck …
This is the design, review, and decision record for SILO #47 and PR #57. Status on 2026-08-26: PR #57 was approved and merged as a96116b1; #47 closed automatically. All nine checks on the tested PR head passed, followed by green Go CI and VulnCheck …
-
Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility
This is the complete design and implementation record for SILO #46. The repair was not merely a changed if statement. One apparently optional S3 header reached into multipart completion semantics, copy responses, compression and encryption pipelines, …
This is the complete design and implementation record for SILO #46. The repair was not merely a changed if statement. One apparently optional S3 header reached into multipart completion semantics, copy responses, compression and encryption pipelines, …
-
When the Total Is Unknown: Folder Download Progress
Status: Shipped in SILO Console 2.2.0 (16960f7ab); the server embeds it since its Console pin was updated (4d6e1ea8e) · Priority: P1 · Owner: pgsty/silo-console · Related issue: pgsty/silo#62 · PRD review: Claude Fable 5 (xhigh) — APPROVE · …
Status: Shipped in SILO Console 2.2.0 (16960f7ab); the server embeds it since its Console pin was updated (4d6e1ea8e) · Priority: P1 · Owner: pgsty/silo-console · Related issue: pgsty/silo#62 · PRD review: Claude Fable 5 (xhigh) — APPROVE · …