mcli 20261112: Strict Policy Validation and Access-Key Policy Reset

mcli 20261112 is released. Tag: RELEASE.2026-11-12T00-00-00Z; package version: 20261112000000.0.0; source: a37a9f054fba. These notes cover changes since mcli 20261109.

This is a standalone mcli maintenance release. Console 2.7.1 adopts this exact release commit (v0.0.0-20261111180825-a37a9f054fba), while published SILO Server 20261109 retains mcli 20261109 until the next Server release is published. The maintained target is PGSTY SILO; upstream MinIO and other S3-compatible services remain best effort.

Policy validation and inline-policy reset

• Explicit empty inline-policy reset (pgsty/mc#78): admin accesskey edit --policy, idp ldap accesskey edit --policy, and idp openid accesskey edit --policy now accept an explicit empty policy document ({} or {"Statement":[]}), matching admin user svcacct edit --policy and admin user svcacct set. When paired with a SILO Server containing the post-20261109 service-account policy fix (SN-2026-021), passing an explicit empty document clears the inline session policy and restores inheritance from the parent user, whereas omitting --policy preserves the existing inline policy. Updating the client binary alone does not change an older Server’s behavior.
• Strict policy JSON validation: adopts silo-pkg v3.16.1 so client-side IAM and bucket policy parsing rejects unknown JSON fields, trailing payloads, non-object documents, empty Principal: {} blocks, and unsupported NotPrincipal clauses instead of silently dropping them. Account creation and named-policy writes continue to reject empty policy documents.

Toolchain, dependencies and delivery

• Requires Go 1.27.4 across source builds, CI, and the development build container.
• Updates grpc-gateway/v2 to v2.33.0, google.golang.org/grpc to v1.85.0, go-humanize to v1.1.0, klauspost/compress to v1.20.4, xo/terminfo to v1.2.1, GoReleaser to v2.20.1, and refreshes pinned container base digests while retaining the verified minio-go/v7 (320af050c445), gjson, go-systemd v22.6.0, terminal-width, and tablewriter selections.
• Ships 19 immutable GitHub Release assets (Windows ZIP, Linux/macOS tar.gz, GPG-signed x86_64 and aarch64 RPMs, DEB/APK packages, SHA-256 checksums, and Sigstore provenance) plus multi-platform Docker Hub images docker.io/pgsty/mc:RELEASE.2026-11-12T00-00-00Z and docker.io/pgsty/mc:latest (sha256:b532278b7a3747dbab6fe45eebb40a653efa704e6758e24e9d9ec54fc96c1800).

Verification

Checked by Go CI, Crosscompile, VulnCheck, Test Release Pipeline, Release, and Docker Hub publication.

GitHub release · Compatibility notes · Changes since 20261109 · Downloads