diff --git a/CHANGELOG.md b/CHANGELOG.md index bec1d90..e306407 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## v3.16.0 — 2026-11-08 + +- Update go-jose/v4 from v4.1.6 to v4.1.9, including the five security fixes + in [v4.1.7](https://github.com/go-jose/go-jose/releases/tag/v4.1.7) and the + subsequent OpaqueSigner and unsupported-key error fixes. These are dependency + fixes; their applicability depends on the consuming application's use of JOSE. +- Publish the networking dependency updates already on main: x/net v0.62.0 and + x/crypto `v0.58.1-0.20261009181718-2f1f834330b2`, replacing v0.61.0 and + v0.58.0 respectively. +- Update cpuid/v2 to v2.4.2 to correct XSAVE/OSXSAVE feature detection, and + go.yaml.in/yaml/v3 to v3.0.6 to quote literal `<<` keys instead of emitting + ambiguous YAML merge keys. Cover configuration save/load with a regression test. +- Clarify that the built-in infraAdmin policy includes batch-job administration. + Public package APIs, policy formats and authorization decisions remain compatible. +- Retain Go 1.27.3, the existing upstream minio-go commit `320af050c445`, + go-humanize v1.0.1, go-runewidth v0.0.29, and the go-systemd v22.6.0 + compatibility replacement. Consumers must retain their own required replacements. +- This is a source-only module release. Server, Console and mcli must select + v3.16.0 and rebuild; this release does not publish their binaries or images. + ## v3.15.2 — 2026-10-26 - Update upstream minio-go to `v7.4.2-0.20261025165926-320af050c445`. diff --git a/README.md b/README.md index 75596d3..de3c3b4 100644 --- a/README.md +++ b/README.md @@ -7,13 +7,15 @@ collection of common packages used in MinIO projects. It exists so the community MinIO fork has somewhere to take fixes that upstream, now driven by a closed product, will not carry. -Version: **v3.15.2**. See [GitHub releases](https://github.com/pgsty/silo-pkg/releases) for publication status. -This maintenance release requires **Go 1.27.3** and updates minio-go to upstream -commit `320af050c445`, accepting HTTP 204 when removing bucket replication. -It preserves policy semantics and CLI output compatibility. -The published Server 20261026, mcli 20261026, and Console v2.5.1 all select -v3.15.2. This source-only module has no binary or image; consumers must -update their dependency and rebuild to adopt it. +Version: **v3.16.0**. See [GitHub releases](https://github.com/pgsty/silo-pkg/releases) for publication status. +This maintenance release requires **Go 1.27.3** and updates JOSE, networking, +CPU detection, and YAML dependencies. It includes the go-jose security fixes, +corrects XSAVE/OSXSAVE detection on x86, and preserves literal `<<` YAML keys +when saving and loading configuration. Public package APIs and policy semantics +remain compatible with v3.15.2. +This source-only module has no binary or image; Server, Console, and mcli must +adopt v3.16.0 and rebuild independently. Their existing releases are not changed +by this library release. Read the [changelog](CHANGELOG.md) and [component version matrix](https://silo.pgsty.com/compatibility/versions/) before adopting the password-authorization changes introduced in v3.14.0. The matrix tracks which matching Server and Console releases include them. @@ -24,7 +26,7 @@ Import it directly. This repository declares `module github.com/pgsty/silo-pkg/v so a consumer requires it by name and needs no `replace` directive: ```go -require github.com/pgsty/silo-pkg/v3 v3.15.2 +require github.com/pgsty/silo-pkg/v3 v3.16.0 ``` ```go diff --git a/README_ZH.md b/README_ZH.md index 6559aac..49d2d4b 100644 --- a/README_ZH.md +++ b/README_ZH.md @@ -6,16 +6,16 @@ Pigsty 维护的 [minio/pkg](https://github.com/minio/pkg) 分支，为 SILO Ser ## 当前版本 -**v3.15.2** 要求 **Go 1.27.3**，将 minio-go 更新至上游提交 `320af050c445`，修复删除桶复制配置时误将 HTTP 204 当作失败的问题，保留策略语义与 CLI 输出兼容性。发布状态见 [GitHub Releases](https://github.com/pgsty/silo-pkg/releases)。完整变更见 [CHANGELOG.md](CHANGELOG.md)。 +**v3.16.0** 要求 **Go 1.27.3**，更新 JOSE、网络、CPU 检测与 YAML 依赖，纳入 go-jose 安全修复，修正 x86 XSAVE/OSXSAVE 检测，并使配置读写保留字面量 `<<` YAML 键。公开包 API 与策略语义保持和 v3.15.2 兼容。发布状态见 [GitHub Releases](https://github.com/pgsty/silo-pkg/releases)。完整变更见 [CHANGELOG.md](CHANGELOG.md)。 -已发布的 Server 20261026、mcli 20261026 与 Console v2.5.1 均选用 v3.15.2。本模块仅发布源码，没有独立二进制或镜像，消费方须重新构建。组件的独立发布状态见[版本矩阵](https://silo.pgsty.com/zh/compatibility/versions/)。 +本模块仅发布源码，没有独立二进制或镜像。Server、Console 与 mcli 需分别采用 v3.16.0 并重新构建；本次库发布不会更新这些组件的既有发布制品。组件的独立发布状态见[版本矩阵](https://silo.pgsty.com/zh/compatibility/versions/)。 ## 使用方法 直接声明模块，无需 `replace`： ```go -require github.com/pgsty/silo-pkg/v3 v3.15.2 +require github.com/pgsty/silo-pkg/v3 v3.16.0 ``` ```go diff --git a/go.mod b/go.mod index 10dd048..a6ba494 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/tinylib/msgp v1.6.5 github.com/zeebo/xxh3 v1.1.0 go.etcd.io/etcd/client/v3 v3.7.3 - go.yaml.in/yaml/v3 v3.0.5 + go.yaml.in/yaml/v3 v3.0.6 golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2 golang.org/x/oauth2 v0.37.0 golang.org/x/sys v0.49.0 @@ -39,12 +39,12 @@ require ( github.com/coreos/go-systemd/v22 v22.7.0 // indirect github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect - github.com/go-jose/go-jose/v4 v4.1.6 // indirect + github.com/go-jose/go-jose/v4 v4.1.9 // indirect github.com/goccy/go-json v0.11.2 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/uuid v1.6.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 // indirect - github.com/klauspost/cpuid/v2 v2.4.1 // indirect + github.com/klauspost/cpuid/v2 v2.4.2 // indirect github.com/lestrrat-go/blackmagic v1.0.4 // indirect github.com/lestrrat-go/dsig v1.4.0 // indirect github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect diff --git a/go.sum b/go.sum index af0fa05..b4de87e 100644 --- a/go.sum +++ b/go.sum @@ -25,8 +25,8 @@ github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo= github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M= github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ= github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= -github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4= -github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.9 h1:pKfeQkig1NmgK4hJrZYXLEYURXfoJB61Larw0uIW4gY= +github.com/go-jose/go-jose/v4 v4.1.9/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-ldap/ldap/v3 v3.4.15 h1:eRB4f4Ecn1POL1mO86+uUDlecmyWsdiJwh60bAUS4UY= github.com/go-ldap/ldap/v3 v3.4.15/go.mod h1:jeD0c98EdZQCKKKKe4kTWs5aCf6y+j8KuYsYLznZSQk= github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4= @@ -63,8 +63,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY= github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc= github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= -github.com/klauspost/cpuid/v2 v2.4.1 h1:I9KxadAkvo+QjtcEE2f2tyfEvmIla/T0m+14PrZNl0U= -github.com/klauspost/cpuid/v2 v2.4.1/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= +github.com/klauspost/cpuid/v2 v2.4.2 h1:xRw7IZEsAgVCp6trS/DgWbTAqpixhmywgVgBjYGg1bQ= +github.com/klauspost/cpuid/v2 v2.4.2/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= github.com/lestrrat-go/dsig v1.4.0 h1:g7LUjK8cT74A5DzBXJI5HzsJuLhoYN0Wzj4nuOMIrH8= @@ -132,8 +132,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= -go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= -go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= +go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2 h1:zGDaB+/Mus2mScKvZ23k+W9NAUbP56sNM9SptgvWI5A= golang.org/x/crypto v0.58.1-0.20261009181718-2f1f834330b2/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= diff --git a/quick/quick_test.go b/quick/quick_test.go index d395a32..6b2a13f 100644 --- a/quick/quick_test.go +++ b/quick/quick_test.go @@ -21,6 +21,7 @@ import ( "bytes" "encoding/json" "os" + "path/filepath" "reflect" "runtime" "strings" @@ -273,6 +274,28 @@ directories: } } +func TestYAMLLiteralMergeKeyRoundTrip(t *testing.T) { + type settings struct { + Version string + Values map[string]string + } + want := settings{ + Version: "1", + Values: map[string]string{"<<": "literal key", "value": "<<"}, + } + filename := filepath.Join(t.TempDir(), "config.yaml") + if err := SaveConfig(&want, filename, nil); err != nil { + t.Fatal(err) + } + var got settings + if _, err := LoadConfig(filename, nil, &got); err != nil { + t.Fatal(err) + } + if !reflect.DeepEqual(got, want) { + t.Fatalf("configuration changed after YAML round trip: got %#v, want %#v", got, want) + } +} + func TestJSONFormat(t *testing.T) { testJSON := "test.json" defer os.RemoveAll(testJSON)