Skip to content

Document Server 549 publication and scoped SBOM acceptance #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 24, 2026
Merged

Document Server 549 publication and scoped SBOM acceptance #354

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 49 additions & 30 deletions COMPATIBILITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,36 +2,55 @@

<a id="server-v16549-web-console-sbom"></a>

## Server v1.6.549 prepared, not published

This source candidate consumes Web Console `1.6.195` from verified producer
`f905bc12daae18d98a6ac65942625562fff2a424`,
[run 40086505425](https://github.com/PastureStack/web-console/actions/runs/40086505425).
Its archive and independent
browser runtime CycloneDX SBOM must match the declared release version, source
commit, archive SHA-256, lock SHA-256 and SBOM SHA-256 before packaging.
The original SBOM bytes are retained at
`/usr/share/licenses/pasturestack/web-console/runtime.cdx.json` and are copied
from the actual candidate rootfs into the Server release evidence with their
own checksum and identity receipt. The browser inventory remains separate
from the OS SBOM and preserves its `coverage=incomplete` limitations.
Its independent fresh-DB component scan must identify every npm PURL and pass
the unchanged exact finding gate; unsupported snapshots are itemized as unknown,
without applying OS VEX or treating zero scanner findings as full coverage.
The exact archive/SBOM/lock identities are recorded in the
[candidate note](docs/releases/server-1.6.549.md); their verification does not
establish publication or deployment acceptance for Server v1.6.549.

GitHub runner Ruby/toolcache presence is build-host evidence, not a shipped
browser dependency or an established reachable product vulnerability. The
Ubuntu Ruby backport status and unobserved SDK activation remain tracked as
unknowns; an absent scanner CVE is not evidence of remediation.

The existing six-stage build, final one-layer publication process, component
pins other than Web Console, runtime security thresholds, named volumes and
operator settings are retained. Publication and scoped deployment acceptance
have not been established for this candidate. See the
[candidate note](docs/releases/server-1.6.549.md).
## Server v1.6.549 published

Producer `ed3f334f2c371a3038ca5fe3e63c6581c8c1aabf` completed the source,
build, security, startup/restart, image publication and both attestation steps in
[run 40096562378](https://github.com/PastureStack/server/actions/runs/40096562378).
The original job remains failed because GitHub rejected its zero-byte browser
findings attachment. The same verified CI reports were recovered as 34 immutable
release assets, with the empty TSV losslessly encoded as deterministic gzip.
The published [recovery receipt](https://github.com/PastureStack/server/releases/download/v1.6.549/publication-recovery.json)
records this transport-only completion; no image was rebuilt or tag overwritten.
All assets passed anonymous checksum readback, and both image attestations were
independently verified against the exact producer and image.

The one-layer linux/amd64 image identity is
`ghcr.io/pasturestack/server:v1.6.549@sha256:dae1c8e490e012a030855d73d7af0bfcd85f4c9d9bf94148664d492c35e5684c`.
Its distinct OCI config is
`sha256:ba535844f1b3e37ad3be74c7037ef7be90cd186f7058dad9a421de4d95f09a24`.
Installation examples retain only the numeric tag.

Web Console `1.6.195` retains producer
`f905bc12daae18d98a6ac65942625562fff2a424` and its original browser runtime SBOM
at `/usr/share/licenses/pasturestack/web-console/runtime.cdx.json`. Its archive,
source, version, lock and SBOM hashes passed identity checks. The independent
fresh-DB scan recognized all 87 npm PURLs, reported zero browser findings and
explicitly retained six unsupported source snapshots as unknown. The SBOM and
coverage report remain `incomplete`; no OS VEX or not-affected disposition is
applied to these snapshots.

The complete runtime gate retains 51 raw findings and 29 exact, officially
unfixed LOW/MEDIUM occurrences across 18 CVEs after existing VEX dispositions.
HIGH/CRITICAL, available fixes, unregistered findings and secrets are zero.
Tracking is not remediation or zero risk. Build-host Ruby inventories and
unmeasured Server intermediate-stage packages remain separate from runtime
coverage. The Web195 Node build container passed Ruby-absence gates before and
after building; this does not establish Ruby absence on the enclosing runner.

The same digest passed the scoped 8080 cutover with environment, HostConfig,
all three data volumes, the existing Docker socket bind and AppArmor preserved.
Actual-container readback verified
Server 549, Web195 and the producer's original runtime SBOM hash. Chrome155
passed OIDC with IdP and platform TOTP, seven JSON API reads, three active
Hosts/Agents, session refresh and a received WebSocket frame. The successful
pass had no browser/HTTP/request errors or passive DELETE requests.

The six-stage build, final one-layer publication process, other component pins,
named volumes and operator settings are retained. This scope did not rerun the
full permission matrix or add a manual Server restart. See the
[release note](docs/releases/server-1.6.549.md) for retained fixture failures,
the consistent backup, acceptance boundaries and rollback guidance.

<a id="server-v16548-provider-watch"></a>

Expand Down
52 changes: 19 additions & 33 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,37 +11,24 @@ upstream history, authorship, licenses, and notices.

<a id="current-release"></a>

## Current source candidate

Server `v1.6.549` is a prepared source candidate, not a published image.
It consumes the verified Web Console `1.6.195` producer and preserves its independent browser runtime
SBOM alongside the exact static archive, source commit and lock identity.
The SBOM retains its explicit incomplete coverage and known opaque inputs;
build dependencies and GitHub runner Ruby inventories remain separate.
Web producer [40086505425](https://github.com/PastureStack/web-console/actions/runs/40086505425)
passed its container Ruby-absence checks before and after the build.
This candidate is not yet available from GHCR. The numeric examples below are
prepared for `ghcr.io/pasturestack/server:v1.6.549`; run them only after its official release
and image have been published and read back.
See the [549 candidate note](docs/releases/server-1.6.549.md) and
[compatibility contract](COMPATIBILITY.md#server-v16549-web-console-sbom).
The latest published Server is [`v1.6.548`](https://github.com/PastureStack/server/releases/tag/v1.6.548);
its [release note](docs/releases/server-1.6.548.md) retains the verified image identity.

## Previous published release

Server [`v1.6.548`](https://github.com/PastureStack/server/releases/tag/v1.6.548) is published.
It retains the security refresh and uses Catalog `v0.3.16` with Network Plugin
Manager `v0.8.25` and Metadata Service `v0.10.6` for CNI provider handoff and
opaque metadata change-token preservation during infrastructure upgrades.
Authentication, API Key authorization and host registration contracts remain unchanged.
Engine `v0.183.354`, Web Console `1.6.194`, Host API `0.38.8`,
WebSocket Proxy `0.23.18`, and Temurin `25.0.5+8` are verified component inputs.
See the [548 release note](docs/releases/server-1.6.548.md) and
[compatibility contract](COMPATIBILITY.md#server-v16548-provider-watch)
for dependency identities and acceptance boundaries.
Scoped infrastructure upgrades, browser checks and controlled Server restarts
passed; this is not a complete feature-matrix claim.
## Current release

Server [`v1.6.549`](https://github.com/PastureStack/server/releases/tag/v1.6.549) is published.
It packages Web Console `1.6.195` with an independent browser runtime SBOM,
exact artifact identity and component vulnerability lookup. All 34 immutable
release assets, the image provenance and SBOM attestations were verified.
The browser inventory retains incomplete coverage for six unsupported snapshots;
zero reported browser findings is not a claim of zero risk.

Engine `v0.183.354`, Catalog `v0.3.16`, Host API `0.38.8`, Node Agent `0.13.33`
and Temurin `25.0.5+8` retain their reviewed inputs. Authentication, API Key
authorization, host registration and operator settings remain unchanged.
The scoped 8080 upgrade, packaged SBOM readback, browser authentication,
seven JSON APIs, session refresh and WebSocket smoke passed with the existing
configuration and volumes preserved. This is not a full feature-matrix claim.
See the [549 release note](docs/releases/server-1.6.549.md) and
[compatibility contract](COMPATIBILITY.md#server-v16549-web-console-sbom)
for exact identities, attachment recovery and acceptance boundaries.

Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.

Expand All @@ -68,8 +55,7 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
## Quick start

Public GHCR downloads do not require a registry login. Keep all three named volumes.
The examples below use the prepared numeric `v1.6.549` tag; run them only after its official release.
This candidate is not yet available from GHCR.
The examples below use the published numeric `v1.6.549` tag.

```sh
docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
Expand Down
4 changes: 4 additions & 0 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ runtime gates have passed.

## Release notes

- [Server v1.6.549](releases/server-1.6.549.md) — published Web Console 1.6.195
with an independent browser runtime SBOM, exact artifact identity and separate
fresh-DB component lookup. The release note records incomplete coverage,
same-image attachment recovery and scoped 8080/browser/SBOM-readback acceptance.
- [Server v1.6.548](releases/server-1.6.548.md) — published Catalog revision 13
with CNI provider lifecycle and opaque Metadata version-watch repairs;
scoped eight-stack upgrades, browser authentication/session recovery and
Expand Down
5 changes: 2 additions & 3 deletions docs/performance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,8 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.

The example uses the prepared numeric Server v1.6.549 tag; run it only after its official release and image have been published and read back.
This candidate is not yet available from GHCR.
See the [candidate note](../releases/server-1.6.549.md) and the
The example uses the published numeric Server v1.6.549 tag.
See the [release note](../releases/server-1.6.549.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
volumes during an upgrade or restart.
Expand Down
110 changes: 94 additions & 16 deletions docs/releases/server-1.6.549.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,35 @@
# Server v1.6.549 candidate
# Server v1.6.549

Prepared source only; no Server image or release has been published.
The Web Console 1.6.195 producer, archive, runtime SBOM and lock pins are bound
to its successful official producer evidence. Server publication and deployment
acceptance remain separate and have not been established.
Published from producer `ed3f334f2c371a3038ca5fe3e63c6581c8c1aabf` using the
image and evidence produced by
[run 40096562378](https://github.com/PastureStack/server/actions/runs/40096562378).
All 34 immutable release assets passed anonymous SHA-256 readback. Image
provenance and SBOM attestations were independently verified against the exact
source, workflow and image identity.

Published image identity:
`ghcr.io/pasturestack/server:v1.6.549@sha256:dae1c8e490e012a030855d73d7af0bfcd85f4c9d9bf94148664d492c35e5684c`.
The distinct OCI config is
`sha256:ba535844f1b3e37ad3be74c7037ef7be90cd186f7058dad9a421de4d95f09a24`.
The linux/amd64 image has one runtime layer. Installation examples use only
the numeric `ghcr.io/pasturestack/server:v1.6.549` tag.

## Attachment recovery

The original workflow conclusion remains `failure`. Its source, build,
rootfs-equivalence, security, startup/restart, image push and two attestation
steps passed; the final release upload failed with HTTP 400 `Bad Content-Length`
when sending the valid zero-byte browser findings TSV.

The preserved official CI artifact and its checksums were verified before
completing the release. Its empty TSV was losslessly encoded as deterministic
gzip, the checksum manifest was regenerated for that transport filename, and
`publication-recovery.json` was included as the 34th public asset. The
[recovery receipt](https://github.com/PastureStack/server/releases/download/v1.6.549/publication-recovery.json)
records the original job, artifact hash, successful steps, exact image digest
and byte-identical decompression. The image was not rebuilt, its tag was not
overwritten, and no security gate was bypassed. The permanent upload fix is
[PR353](https://github.com/PastureStack/server/pull/353).

## Verified component inputs

Expand All @@ -29,8 +55,8 @@ acceptance remain separate and have not been established.

The original browser runtime SBOM is stored at
`/usr/share/licenses/pasturestack/web-console/runtime.cdx.json`. The publisher
reads that same file from the actual candidate rootfs, verifies its pinned
identity, and retains `web-console-runtime.cdx.json`, its SHA-256 sidecar and
read that same file from the actual image rootfs, verified its pinned
identity, and retained `web-console-runtime.cdx.json`, its SHA-256 sidecar and
`web-console-sbom-identity.txt` as separate Server release assets.
No normalization or merge into the OS SBOM changes the producer's bytes.

Expand All @@ -43,6 +69,19 @@ finding block publication. The existing Ubuntu no-fix ledger is not expanded.
The raw/effective scan reports, coverage report and browser findings table are
included in the release checksum manifest.

The published scan recognized all 87 npm PURLs and reported zero browser
findings. Six source snapshots remain unsupported by ecosystem lookup:
Bootstrap 3 presentation compatibility, Bootswatch Cosmo, PastureStack icons,
Lato webfonts, the frozen noVNC bundle and jQuery.PositionCalculator. Their
references and source hashes remain itemized in the published
[coverage report](https://github.com/PastureStack/server/releases/download/v1.6.549/web-console-runtime-scan-coverage.json).
Raw and effective report SHA-256 are both
`8f35d4bd158998acc75d48ebb9c4c32e6fcc3b9e657b590ff177931022767b76`.
The scan used Trivy `0.74.0`; its DB was fresh at scan time with SHA-256
`9f227eaae45c4fa4d8b3e4baea563e4aca69de04c7fef933e469cfb66b8ccfa0`.
The published findings report is `web-console-runtime-vulnerabilities.tsv.gz`;
decompression yields the original zero-row TSV.

The coverage report binds recognized npm PURLs to scanner package inventory,
records the scanner and exact DB identity, and lists unsupported snapshots with
their names, versions, references and provenance hashes. Missing npm lookup
Expand Down Expand Up @@ -74,16 +113,55 @@ and absence gates found no Ruby interpreter, libruby, RubyGems or Onigmo in that
container. This result does not describe the enclosing GitHub runner or every
Server intermediate stage.

## Security, publication and acceptance boundaries
## Security and acceptance boundaries

The complete runtime gate retains 51 raw findings and, after exact existing
VEX dispositions, 29 officially unfixed LOW/MEDIUM occurrences across 18 CVEs.
HIGH/CRITICAL, fixed-available, unregistered findings and detected secrets are
zero. These dispositions do not claim zero vulnerabilities or complete browser
coverage. The six-stage build and final one-layer publication process are
preserved.

The official image passed startup and restart checks with HTTP 200/pong and
the public/private API contract before publication. These CI checks are
separate from the scoped deployment acceptance below.

## Scoped 8080 acceptance and rollback

The exact published digest passed the 8080 cutover. Environment variables,
HostConfig, all three data volumes, the existing Docker socket bind and AppArmor
were preserved. Before the upgrade,
all 104 InnoDB tables were backed up in one transaction; the backup SHA-256
and gzip integrity were verified. The v1.6.548 rollback container and matching
backup remain available.

Readback from the actual running container verified Server `v1.6.549`,
Web Console `1.6.195`, its exact producer/archive/lock identity and the original
runtime SBOM SHA-256 `ca31669f58aa342cd346e1d33ec7061d65f9b84d6a3afcbd132e09361425a88a`.
Its phase remained `runtime` and coverage remained `incomplete`.

Chrome `155.0.8059.41` passed OIDC login with IdP and platform TOTP, seven
authenticated JSON API reads returning HTTP200, three active Hosts and Agents,
session-preserving refresh and one received WebSocket frame. The audit read
returned ten retained records using a legitimate 24-hour window. The successful
pass recorded zero browser errors, HTTP errors, request failures and passive
DELETE requests.

Two earlier attempts remain in the evidence and are not product failures or
acceptance PASS: the wrapper initially omitted an existing fixture secret,
and a one-hour audit query had no new write records during the read-only smoke.
The final query read retained 24-hour history; it did not manufacture a new
audit event or change a product contract.

The existing Server runtime CVE/VEX dispositions and scanner thresholds are
retained with the v1.6.549 release binding. Fresh source, image, security,
startup/restart, rootfs equivalence and release readback checks remain required;
the earlier v1.6.548 results are not a v1.6.549 release or deployment PASS.
The six-stage build and final one-layer publication process are preserved.
No additional manual Server restart was performed for this SBOM/build scope;
the publisher's fresh-candidate startup/restart checks remain the restart
evidence. The full permission matrix, unchanged VM configurations and unrelated
functional areas were not rerun. This is scoped acceptance, not a complete
feature matrix or a production deployment.

This change does not alter authentication, authorization, Catalog behavior,
database schema, host registration, named volumes or operator configuration.
No production deployment or new VM acceptance is claimed. Preserve the
verified v1.6.548 image and matching database/volume backup for rollback, and
follow the [upgrade guidance](../upgrades/README.md) for any later deployment.
Preserve the verified v1.6.548 image and matching database/volume backup for
rollback, and follow the [upgrade guidance](../upgrades/README.md) for later
deployments. After a database migration, selecting an older image alone may
not be a safe rollback.