This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

About PGSTY Silo

The PGSTY SILO manifesto, license, trademark, attribution, and security policy for the project and its documentation.

Silo is a community fork of MinIO, published and maintained by Pigsty. This section collects the terms the project publishes about itself: the Manifesto with the project’s public commitments, what license the code and the documentation are under, how the MinIO name is used, whom this documentation is attributed to, and how to report a security issue.

Silo is not affiliated with, endorsed by, or sponsored by MinIO, Inc. MinIO® is a registered trademark of MinIO, Inc.; see the Trademark Notice.

1 - The PGSTY SILO Manifesto

PGSTY SILO’s commitments in eleven articles: what the project maintains, what it refuses to promise, and where to check both.

PGSTY SILO keeps an open-source, feature-complete, S3-compatible object store maintained and installable, with a build and release chain anyone can inspect. That is the whole scope.

This page is the project’s public commitment, and it follows one rule: every article below is either something we already do, with public evidence, or something we explicitly refuse to promise. A promise we could not keep would be worse than no promise.

Article 1 · Reason to exist, and an exit clause

This project started when upstream wound down its community edition: the web console was cut back to a stub, prebuilt community binaries stopped, and the community repository was archived. Silo keeps existing MinIO-compatible deployments running. Pigsty runs it in production as its PostgreSQL backup storage, so our own operations depend on the artifacts we publish.

The fork is a means, not an identity. If upstream restores its community edition, we will narrow our scope and offer our fixes back.

Background:

Article 2 · The compatibility contract

The product and its trademark are renamed; the protocol and your data are not.

  • The S3 API, MINIO_* environment variables, minio_* metrics, x-minio-* headers, /minio/* routes, and the on-disk format (including .minio.sys) are preserved, and held in place by a CI compatibility check.
  • Every release documents its tested rollback target and path in the release notes.
  • New capabilities do not touch the on-disk format. Any exception must be explicitly marked as non-reversible before you can enable it.
  • The migration guide, which includes how to leave Silo, and the per-component compatibility audits are public and maintained.

Article 3 · The license cannot change

Silo is AGPLv3. There is no CLA and no copyright aggregation: contributions are accepted only with DCO sign-off, so copyright stays with each contributor. That is not a verbal promise not to relicense. It means nobody here, ourselves included, holds enough copyright to relicense the project on everyone else’s behalf.

Our reading of the AGPL boundary is a position, not legal advice: using Silo through its S3 API does not make your application a derivative work. We will not use the license as a threat or a sales instrument.

Article 4 · Change discipline

Changes relative to the upstream baseline fall into four classes only: security fixes, defect fixes, restored community features, and optional additions. Existing API semantics change only when a security fix demands it, and every such compatibility cost is recorded in the advisory that caused it. Every divergence from upstream is listed in the code-verified compatibility audit.

Article 5 · The never list

Silo will never:

  • move an existing feature behind a paywall;
  • put a registration or login wall in front of downloads;
  • ship telemetry — the upstream phone-home paths (update checks, SUBNET, call-home) are removed outright, not merely disabled;
  • require a CLA;
  • change the license;
  • use trademarks against normal use or descriptive mention.

This list is append-only: entries may be added, never removed.

Article 6 · Security discipline

  • Vulnerabilities are reported through a private channel and triaged reproducibly. Writeups are held until the fixed release ships.
  • Every security fix ships with a public advisory, including its evidence and its compatibility cost.
  • Dependencies are tracked for CVEs, with reachability analysis before any change.
  • Every release ships SHA-256 checksums, SPDX SBOMs, Sigstore-signed manifests, and GitHub build provenance.

Severe, remotely exploitable issues are expedited on a best-effort basis, but we do not commit to a specific fix-time SLA.

Article 7 · Release cadence

Releases ship typically every one to two months, and at most a quarter apart. Security and defect fixes are batched into these releases. The history is public; judge the promise against it.

Version tags keep the RELEASE.YYYY-MM-DDTHH-MM-SSZ format, and each release documents its upstream baseline. Deprecations get at least six months’ notice and a migration path. The exception is a removal that security requires immediately; the removal and its justification are then published in the security advisories.

Article 8 · Upstream relations

We renamed the project out of respect for upstream’s trademarks. Upstream copyright, license, and third-party notices are preserved in full: attribution and trademark. If upstream resumes accepting contributions, applicable fixes will be offered back as appropriate.

Article 9 · Continuity

  • The repositories live under the pgsty organization, not a personal account.
  • The build is documented and provenance-attested: anyone can rebuild equivalent artifacts from source without us.
  • If active maintenance stops for six months, we will say so publicly and archive the project rather than let it go quiet. Released artifacts and documentation stay up as long as we can keep them up.
  • If an established open-source organization (a CNCF-style foundation, say) wanted to bring Silo under more formal governance, we would cooperate.

Article 10 · The commercial boundary

Everything in the Silo repositories is complete and free of charge: the server, the client, the console, and the released artifacts. That does not change.

Article 11 · Amendment discipline

Additions and strengthenings of this manifesto take effect immediately. Weakening or removing any article requires ninety days’ public notice. Article 5 is append-only, always.

Where to check:

2 - License

The Silo software is licensed under AGPLv3; this documentation is licensed under CC BY 4.0.

Silo carries two separate licenses. The software and the documentation are distributed under different terms, and each inherits the license its upstream work already used.

What License Where
silo server GNU AGPLv3 pgsty/silo
mcli client GNU AGPLv3 pgsty/mc
This documentation CC BY 4.0 pgsty/silo.pgsty.com

Software: AGPLv3

PGSTY SILO is a fork of MinIO, which has been distributed under the GNU Affero General Public License v3.0 since 2021. That license is irrevocable for code already released under it — the legal basis on which this fork exists. PGSTY SILO keeps the same license: no relicensing, no added restrictions, no open-core carve-outs.

In practice, AGPLv3 lets you run, study, modify, and redistribute PGSTY SILO; if you offer a modified PGSTY SILO to users over a network, you must offer those users the corresponding source of your modified version.

Read the full license text before acting on any summary, including this one.

Documentation: CC BY 4.0

Everything published on this site is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0) — the same license the upstream MinIO documentation used. The full legal text is reproduced verbatim in the documentation repository.

You are free to share and adapt this documentation, including commercially, provided you give appropriate credit, link to the license, and indicate whether changes were made. You may not impose legal or technological measures that restrict others from doing anything the license permits.

Attribution is the only substantive obligation; Attribution gives you a ready-to-copy credit line along with the full copyright stack.

What the license does not cover

A license grants rights in copyright. It says nothing about names. Permission to use the MinIO codebase and documentation is not permission to use the MinIO trademark — see the Trademark Notice.

Disclaimer

Both licenses provide the work as-is, without warranties or conditions of any kind. See Section 5 of CC BY 4.0 and Sections 15–17 of AGPLv3 for the complete disclaimers of warranty and limitations of liability.

See also

3 - Trademark Notice

MinIO is a trademark of MinIO, Inc. Silo is an independently maintained community fork, with no affiliation.

What the project does to avoid confusion

  • The fork is published under its own name, PGSTY SILO, not under MinIO’s.
  • Every page of this site carries a trademark disclaimer in the footer.
  • It is labeled a community fork across every distribution channel — repositories, container images, release artifacts, and this documentation.
  • No claim of affiliation, endorsement, certification, or commercial relationship with MinIO, Inc. is ever made.

Why the name still appears in this documentation

A license grants rights in copyright; it says nothing about names. AGPLv3 gives anyone the right to fork and redistribute the MinIO codebase, but trademark law is a separate matter that a license does not settle.

The MinIO name appears in this documentation to identify the upstream project this work derives from, and to name the things that still carry the upstream name in practice:

  • the upstream project and its history, in attribution and in prose
  • the wire protocol, API surface, and S3 compatibility statements
  • command names, configuration keys, environment variables, binary names, and error strings — part of the software’s compatibility contract
  • content carried over from the MinIO documentation, where renaming would break the correspondence between the text and the software it describes

Other marks

“Pigsty” and “PGSTY” refer to the Pigsty project and its maintainers, who publish PGSTY SILO. Amazon S3 is a trademark of Amazon.com, Inc. or its affiliates; references to S3 describe protocol compatibility only. All other trademarks are the property of their respective owners.

See also

  • License — AGPLv3 for the software, CC BY 4.0 for this documentation
  • Attribution — copyright stack and derivation of this documentation

4 - Attribution

Copyright, derivation, and translation notices for the Silo documentation, and how to credit it when you reuse it.

Copyright © 2020–Present MinIO, Inc. Original MinIO Object Storage Documentation.

Copyright © 2026–Present PIGSTY & SILO Contributors Fork maintenance, format conversion, modifications, restored and newly written content, and Simplified Chinese translation.

Both layers apply at once. A translated or modified page carries MinIO’s copyright in the underlying expression and the PGSTY SILO project’s copyright in the translation and the changes; neither replaces the other.

License

All documentation content on this site is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0) — the same license as the upstream work. The full legal text is in LICENSE. The PGSTY SILO software itself is licensed separately; see License.

Derivation

Portions of this documentation are derived from the MinIO Object Storage Documentation. The work has been modified from the original: rebranding to PGSTY SILO, restoration of documentation for features removed upstream, conversion of the frozen RST/MyST source to bilingual Markdown, replacement of the Sphinx presentation layer with Hugo and Docsy, link and build fixes, ongoing maintenance, and translation into Chinese. The commit history is the complete record of changes.

Not every page is derived from MinIO. The blog, download and release pages, this section, and PGSTY SILO-specific content are original works of the PGSTY SILO project. Pages that do carry upstream material say so in a notice at the bottom of the page, and pages that PGSTY SILO has changed beyond the format conversion link to their own change history.

Translation

Chinese translations are unofficial and are maintained by the PGSTY SILO project, not by MinIO, Inc. Where a translation and the original English text differ, the English text is authoritative.

How to attribute

If you reuse content from this site, the following credit line satisfies CC BY 4.0:

[PGSTY SILO Documentation](https://silo.pgsty.com) by PGSTY and MinIO. Inc, licensed under CC BY 4.0.

For Chinese-language contexts:

[PGSTY SILO 文档](https://silo.pgsty.com/zh)，作者 PGSTY 与 MinIO. Inc，依据 CC BY 4.0 授权。

Disclaimer

Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. See Section 5 of the license for the complete disclaimer of warranties and limitation of liability.

See also

  • License — AGPLv3 for the software, CC BY 4.0 for this documentation
  • Trademark Notice — how the MinIO name is used here

5 - Security Policy

How to report a vulnerability in PGSTY SILO, and where fixed issues are published.

Security maintenance is the reason this fork exists. Upstream minio/minio is archived; Silo tracks CVEs against the codebase, backports or writes the fixes, and publishes what it found.

Reporting a vulnerability

Report undisclosed high-severity vulnerabilities through a private channel, not in a public issue.

Include the affected release, a description of the impact, and reproduction steps if you have them — this helps us confirm the issue faster.

We will do our best to respond within a reasonable time, but note that Silo is a community project: we promise no fix SLA and no guaranteed response time.

Vulnerabilities in upstream MinIO

Silo is a fork, so the vast majority of findings apply to minio/minio as well. The upstream repository is archived and no longer accepts reports — precisely the gap this project fills. Report to Silo; where an issue affects other distributions of the same code, the project coordinates disclosure with them.

Where fixes are published

  • Security Chronicle — one article per investigated CVE: the original threat model, the back-and-forth of the review, the rejected alternatives, the invariant finally settled on, the verifying evidence, and the compatibility cost.

  • Release Notes — the release each fix first shipped in and became publicly available.

Hardening your own deployment

Reporting is one half; configuration is the other. See the security checklist for deployment hardening, and network encryption for TLS setup.

See also

  • License — the software is provided as-is, without warranty of any kind
  • Attribution — copyright and derivation of this documentation