Document the container A/B on the corrected single-pool rig (one 16-drive
EC:4 set, 2 MiB non-inlined objects):
- single-trip proven directly: with xl.meta and the canonical data dir
deleted on all drives, FAST_GET=1 still serves byte-exact from the shadow
(multi-pool returned 404).
- cold single-stream TTFB ~26% lower (server-side trace) / ~21% (curl),
captured paired on the same requests; saturated throughput flat on the
seek-free loopback medium.
- record the two rig traps (multi-pool xl.meta pre-read; inline cutoff is
per-shard, so EC:4 inlines everything below ~1.5 MiB).
Design note: the on-disk shadow header should be variable-length with a
self-describing payload so fields can evolve without lockstep; the fixed
1024-byte positional header is a phase-1 shortcut.
cluster.sh emitted one endpoint arg per node, which brought the rig up as
four independent server pools. Multi-pool GET resolves the owning pool via
getLatestObjectInfoWithIdx (a per-pool xl.meta read) before the set-level
fast path runs, so BUCKIT_FAST_GET=1 still read xl.meta and the single-trip
path was never exercised.
Emit a single pool spanning all nodes (http://node{1...4}:9000/data/...)
so SinglePool() is true and GET dispatches straight to the set, letting the
fast path bypass xl.meta. Regenerated docker-compose.yml reflects the change.
Address security review: specify the exact epoch-key derivation scheme
(deterministic KMS MAC, or random-and-wrap) since cloud KMS GenerateDataKey
is random by default and would otherwise make keys unrecoverable. Promote
authenticated metadata binding, basic token scoping, a minimal revocation
path, and bounded historical cache into MVP requirements; keep full replay
protection and coordinated revocation as phase-2. Add the accepted-residual-
risk note and a multi-instance proxy section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Switch the design to a true-HSM model where the master key never leaves
the KMS, unlike KES/MinKMS which load it into memory. The KMS produces an
epoch key per window; bucket and object keys derive locally. Adds the
two-window model (12h epoch + ~15min Buckit cache TTL), corrected near-zero
cost analysis, the bounded-compromise security framing, and clarifies that
only the bucket key is cached.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Design for replacing deprecated MinIO KES with an open-source approach:
a cached per-cluster encryption key in Buckit (L1) plus a stateless
KMS-auth proxy (Fargate, L2) that holds the cloud credentials so they
never live in Buckit. Covers cost analysis, the two-tier cache, security
boundary (credential isolation vs. key-material exposure), and open
decisions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Resolves govulncheck failures flagged in CI:
- GO-2026-5013..5023 (golang.org/x/crypto/ssh) — fixed in v0.52.0
- GO-2026-5026 (golang.org/x/net/idna) — fixed in v0.55.0
x/sys bumped to v0.45.0 as a transitive dependency.
Pulls in buckit-io/console@f8ce35f8, which replaces the
CSP-blocked Google Fonts <link> with a 6.7 KB embedded
Montserrat subset for the BuckitLogo wordmark.
- update-gh-pages: remove zip_binary/publish_package/trim_archives; only write
4 buckit.sha256sum files for self-update; generate release/index.html with
per-platform download links and archives/index.html from GitHub API listing
all stable releases; add force_orphan to prevent git history bloat
- gh-pages-index.yml: skip server/buckit/release and server/buckit/archives
so the auto-indexer does not overwrite the custom HTML pages
Binaries exceed GitHub's 100MB git push limit so they cannot be stored
in the gh-pages branch. Two changes to fix this:
- release.yml: stop copying binaries/minisig to gh-pages; write
buckit.sha256sum files with the release tag embedded in the filename
field (e.g. 'buckit.RELEASE.xxx') so the Go code can construct the
versioned GitHub Releases URL.
- update.go / admin-handlers.go: getBinaryURL now constructs a
github.com/releases/download URL when the checksum source is github.io
and the sha256sum filename contains a release tag. Fixes two dead-code
bugs in both admin handlers where 'if updateURL == ""' was always
false after updateURL had already been set.
abuckit