https://silo.pgsty.com/tags/object-lock/ Recent content in Object Lock on SILO Hugo en Mon, 28 Sep 2026 07:36:54 +0800 https://silo.pgsty.com/blog/security/20260926-governance-retention-bypass/ Sat, 26 Sep 2026 00:00:00 +0000 https://silo.pgsty.com/blog/security/20260926-governance-retention-bypass/ <p><strong>Status on 2026-09-26: design, not fixed.</strong> This is a fix design for review. No SILO release fixes this defect yet. Every published Server release is affected, including <code>RELEASE.2026-09-16T00-00-00Z</code>, and so is Server main at <a href="https://github.com/pgsty/silo/commit/b0a540190"><code>b0a540190</code></a>. The code came from upstream MinIO, and upstream master has the same logic.</p> <p>When a <code>PutObjectRetention</code> request carries <code>x-amz-bypass-governance-retention: true</code>, the server treats that header as authorization. It should be only a declaration of intent. Three results follow, in decreasing severity:</p>