mcli 20261025

Released on 2026-10-25. The signed Git tag is RELEASE.2026-10-25T00-00-00Z, and the package version is 20261025000000.0.0. The downloads page provides platform archives, Linux packages, and Docker images. This client is part of the 20261025 maintenance batch.

Changes since 20261018

• Build with Go 1.27.3 and silo-pkg v3.15.1, retaining shared policy evaluation improvements and existing authorization semantics while refreshing Prometheus, etcd, gRPC, JWX, JSON, and terminal dependencies. Go certificate-trust fixes and the release container root blocklist are covered in the maintenance announcement.
• Upgrade to upstream minio-go v7.4.2-0.20261020194015-ab93db7ba435 (a pinned post-v7.4.1 upstream commit): truncated sequential and parallel multipart streams now fail immediately instead of completing a short object, a failed single-delete fallback reports one error result, and ReadAt EOF/negative-offset handling and post-Stat read/seek bounds are fixed (parallel SDK GET remains opt-in).
• Honor the optional region field in persisted alias configuration (MC_REGION, then AWS_REGION, then the alias configuration, falling back to bucket-location discovery when unset). Client caching isolates signing regions. This release does not add an alias set --region CLI flag.
• Return a nonzero exit status when admin info --json fails while preserving its JSON error output (in 20261018, access denial could print status: error with exit status 0).
• Package Windows amd64 and arm64 archives as ZIP while keeping tar.gz for Linux and macOS. Release checks verify archive formats, bundled documents, checksums, and binary source stamps.
• Clarify disabled server-update and SUBNET command messages, SQL examples, and SILO help links. CI functional tests use the checksum-pinned SILO 20261018 release.

Upgrade considerations

The maintained server target is pgsty/silo, with best-effort compatibility for upstream MinIO and other S3 services. This client update does not require a coordinated Server or Console upgrade.

Existing CLI configuration and MC_* environment variables remain supported, retaining go-systemd v22.6.0 (NetBSD compatibility), go-runewidth v0.0.29 (terminal column widths), and the tablewriter v0.0.5 API. Scripts that automate Windows downloads must switch to .zip archives starting with this release.

SIGINT during a CLI multipart upload exits with status 130 without exposing a completed object, though incomplete upload parts may remain (as in 20261018). Clean up the prefix when needed:

mcli rm --incomplete --recursive --force ALIAS/BUCKET/PREFIX

A download interrupted mid-stream returns a nonzero exit status; retry the command to fetch the complete object.

Acceptance and delivery

Local acceptance against current SILO source and the published 20261018 Server release (single node, four data directories) covers the Go and Shell functional suites over HTTP and trusted TLS; SSE-S3, SSE-C, and a dedicated test KMS key; versioning, Object Lock, replication, IAM, and STS; failed-copy source preservation, partial mirror failures, watch-mode history, SQL, and network fault recovery. Unit tests with -race, static analysis, vulnerability scans, and all 262 visible command help pages pass. The filesystem-attribute test compares the pre-read snapshot to handle Linux atime updates when reading the upload source. All six archives, six Linux packages, and both Linux container architectures pass local checks, including full 20261018 -> 20261025 install, upgrade, rollback, and uninstall verification across all six Linux package variants with client configuration preserved. Local runs cover native macOS arm64, Linux arm64, and emulated Linux amd64; hosted CI passes native tests on Windows amd64, macOS arm64, and Linux amd64 plus cross-compilation checks for Windows arm64 and macOS amd64.

The release source is dcc78d506f94. The signed tag is fixed to this commit, and GitHub’s Release workflow built the final artifacts from that tag.

Release gate passed (4/4): Go, Crosscompile, VulnCheck, and Test Release Pipeline all succeeded on main, and the pre-build release gate verified that the tagged commit was the tip of main.

Published artifacts

The GitHub Release provides 19 files: six platform archives, six Linux packages, the archive checksum manifest, and six package checksum files. All 19 files were downloaded anonymously and matched their final SHA-256 digests. The six archive binaries carry the release commit above, and each package contains the corresponding Linux archive binary.

Both RPMs are signed with the PGSTY key 9592A7BC7A682E7333376E09E7935D8DB9BD8B20 (public key). All 11 GitHub build attestations were verified against the exact release tag, commit, filename, digest, and hosted Release workflow: six archives, the archive checksum manifest, two DEBs, and two APKs. RPM integrity is covered by its GPG signature because signing changes the package bytes after the build.

The Docker publication workflow published Docker Hub images for linux/amd64 and linux/arm64. Both were pulled back and run; their binaries match the public Linux archives, their OCI version and source labels match the release, and their legal files and certificate blocklist were checked. The version tag and latest resolve to the same multi-architecture digest:

docker.io/pgsty/mc:RELEASE.2026-10-25T00-00-00Z
sha256:770d5f14a70ecb88e0086d3a8061de726309bee986298fef06f09429fdd683cf

Use the version tag for an explicit release, or pin the index digest:

docker run --rm docker.io/pgsty/mc@sha256:770d5f14a70ecb88e0086d3a8061de726309bee986298fef06f09429fdd683cf --version

See downloads and installation for every platform and package format. Windows archives are ZIP; Linux and macOS archives remain tar.gz.