From 5896585034e54095ff1d8f1eeecb1ff87f3b3d34 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 02:53:36 +0800 Subject: [PATCH] Align numeric 551 install docs with verified release and QA --- COMPATIBILITY.md | 33 +++++++++++++- README.md | 19 ++++---- docs/performance/README.md | 2 +- docs/releases/server-1.6.551.md | 77 +++++++++++++++++++-------------- 4 files changed, 87 insertions(+), 44 deletions(-) diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 6dfdbfbc69..bbc4104441 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,17 +1,46 @@ # Compatibility Contract + + +## Server v1.6.551 published + +The immutable linux/amd64 image is +`ghcr.io/pasturestack/server:v1.6.551@sha256:150c3eaa2d84df6236e7634843e506a79df71d9e434ad2038427108c14ac358e`, +produced from `9abef4712901981e5917c41356bb261974fdba47` in successful +[run 40120970328](https://github.com/PastureStack/server/actions/runs/40120970328). +All 33 assets passed anonymous byte/checksum readback. The Host API archive also +matches its original producer SHA-256, retains its internal checksums and binary, +and both image attestations bind the exact producer and digest. + +The 550 PCRE2 fixes, Web Console 1.6.195, Engine v0.183.354 and other component +inputs are unchanged. The 8080 cutover, one restart, package integrity/linkage, +MariaDB regex controls and three active Host/Agent states passed. Configuration, +three existing data volumes, socket bind, AppArmor and the 550 rollback were +preserved. No production site, HAProxy or firewall was changed. + +The scan retains 13 pending LOW/MEDIUM occurrences across 10 CVEs. Unrelated +native candidates and build-host coverage are separate; none is presented as a +remediated consumer. See the [release note](docs/releases/server-1.6.551.md). + ## Server v1.6.550 published +The Server image is valid, but its standalone Host API Release attachment was +mistakenly replaced with an empty gzip during manual publication completion. +Use 551 or the original Host API producer release for that download. The immutable +bad attachment is retained as failure evidence; checksum self-consistency alone +did not establish producer identity. See the [correction](docs/releases/server-1.6.550.md). + The immutable one-layer linux/amd64 identity is `ghcr.io/pasturestack/server:v1.6.550@sha256:03542028c3ce4be11d7ff87f96beddf5179c67caf9f0d28ad57043acf3cf52c5`, produced from `54deb98ee33ffab78437070d61179b602844182e` in [run 40116218929](https://github.com/PastureStack/server/actions/runs/40116218929). All 34 assets passed anonymous checksum readback; both image provenance and SBOM attestations bind the same digest and producer. The original job remains failed -at its final release-note heading check. The exact signed image and original CI -bytes completed publication without a rebuild or tag overwrite; see the immutable +at its final release-note heading check. The exact signed image completed +publication without a rebuild or tag overwrite; the attachment correction above +supersedes the broader asset claim in the original immutable [completion receipt](https://github.com/PastureStack/server/releases/download/v1.6.550/publication-recovery.json). The permanent note preflight now validates the actual candidate document. diff --git a/README.md b/README.md index 856caed810..370a375587 100644 --- a/README.md +++ b/README.md @@ -13,10 +13,11 @@ upstream history, authorship, licenses, and notices. ## Current release -Server [`v1.6.550`](https://github.com/PastureStack/server/releases/tag/v1.6.550) is published. -It fixes eight PCRE2 CVEs using the upstream-supported 10.46 backports and +Server [`v1.6.551`](https://github.com/PastureStack/server/releases/tag/v1.6.551) is published. +It retains the eight PCRE2 CVE fixes using the upstream-supported 10.46 backports and original Ubuntu packaging. The two rebuilt runtime packages retain ABI, JIT, -POSIX interfaces and hardening; all other component versions are unchanged. +POSIX interfaces and hardening. Its standalone Host API archive matches the +original producer; the incorrect 550 attachment is superseded. Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`, Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs. @@ -24,9 +25,9 @@ The scoped 8080 upgrade and restart passed package/hash/linkage checks, regex controls in grep, Git and MariaDB, and three active Host/Agent states. Existing configuration, volumes, AppArmor and the previous rollback image remain. -See the [550 release note](docs/releases/server-1.6.550.md) and -[compatibility contract](COMPATIBILITY.md#server-v16550-pcre2-backports) -for the immutable identity, publication completion and remaining risks. +See the [551 release note](docs/releases/server-1.6.551.md) and +[compatibility contract](COMPATIBILITY.md#server-v16551-release-assets) +for the immutable identity, verified assets and remaining risks. Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -53,14 +54,14 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy ` ## Quick start Public GHCR downloads do not require a registry login. Keep all three named volumes. -The examples below use the published numeric `v1.6.550` tag. +The examples below use the published numeric `v1.6.551` tag. ```sh docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.550 + ghcr.io/pasturestack/server:v1.6.551 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -68,7 +69,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.550 + image: ghcr.io/pasturestack/server:v1.6.551 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index f82a3d7764..6b0f7d035d 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -20,7 +20,7 @@ evidence is not a performance benchmark; measure the actual workload. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.550 + image: ghcr.io/pasturestack/server:v1.6.551 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.551.md b/docs/releases/server-1.6.551.md index 616da968a3..6825addb9f 100644 --- a/docs/releases/server-1.6.551.md +++ b/docs/releases/server-1.6.551.md @@ -1,39 +1,52 @@ -# Server v1.6.551 candidate +# Server v1.6.551 -Not published. +Published image: +`ghcr.io/pasturestack/server:v1.6.551@sha256:150c3eaa2d84df6236e7634843e506a79df71d9e434ad2038427108c14ac358e`. +Producer: `9abef4712901981e5917c41356bb261974fdba47`. ## Verified component inputs -This release retains the PCRE2 security backports and all component inputs from -550, including Web Console 1.6.195, Engine v0.183.354 and Host API 0.38.8. -No application behavior or database migration is introduced. - -The manual completion of 550 accidentally replaced its standalone Host API -Release attachment with an empty gzip stream while converting an empty browser -findings table. The image itself contains the correct producer archive. Do not -use the 550 Host API attachment; the original official Host API 0.38.8 release -remains valid. The faulty immutable attachment is retained as evidence. - -The normal publisher now checks the exact producer archive SHA-256 again after -report conversion and before upload. Its regression test rejects an empty gzip -substitution even though that stream is syntactically valid. All downloadable -archive bytes must match the producer pin; a self-consistent checksum manifest -alone does not establish that identity. - -## Acceptance and remaining risk - -Only the release-asset guards and version metadata changed. Original unaffected -PCRE2 native, consumer, UI and authorization evidence is retained. Normal release -source, image/security, startup/restart and exact attachment checks still apply. -8080 deployment and attachment readback are separate acceptance steps. No -production site, HAProxy, firewall or production database is modified. - -The prior scan retains 13 pending LOW/MEDIUM occurrences across 10 CVEs. Other -product candidates and the Ruby/Onigmo build-host coverage gap remain tracked; -this release does not claim they have been remediated. +All component inputs retain the 550 pins, including Web Console 1.6.195, +Engine v0.183.354, Host API 0.38.8 and the eight PCRE2 CVE backports. No +application behavior or database migration is introduced. + +The manual completion of 550 accidentally converted its standalone Host API +attachment into an empty gzip while converting an empty browser findings table. +The 550 image itself contains the correct package. That incorrect immutable +attachment remains as evidence; do not use it. The original Host API producer +release remains valid. + +The normal publisher rechecks the pinned producer archive SHA-256 after report +conversion and before upload. Its executed negative fixture rejects an empty +gzip substitution even though the stream itself is syntactically valid. No +released image or asset was overwritten. + +## Verification and remaining risk + +[Run 40120970328](https://github.com/PastureStack/server/actions/runs/40120970328) +passed the source, image, security, startup/restart and publication checks. All +33 immutable assets passed anonymous byte/checksum readback, and the Host API +archive additionally matches producer SHA-256 +`6903ffb6a618f5a9bc8c7c8997a1e0419c93a8bbdeaee6d288957366dccef444`. +Its archive contents and internal checksums are intact. Both OCI attestations +bind the exact producer and image digest; the final image retains one layer. + +The scoped 8080 cutover and one controlled restart passed. Package integrity and +linkage, grep/Git and two read-only MariaDB regex controls, ping and three active +Host/Agent states passed. Existing HostConfig, operator environment, all three +named data volumes, socket bind and AppArmor were preserved. A consistent +104-table InnoDB backup and the 550 rollback container/image remain. + +The exact rootfs scan retains 51 raw occurrences, 38 VEX dispositions and 13 +pending LOW/MEDIUM occurrences across 10 CVEs. Other product candidates and +Ruby/Onigmo build-host coverage remain separately tracked. Unchanged UI, role, +OIDC and MFA evidence is carried forward; no full feature-matrix rerun or +all-project zero-risk claim is made. The production site, HAProxy, firewall and +production database were not modified. ## Upgrade and rollback -Use the new numeric tag after publication and preserve existing configuration, -named volumes, restart policy and security options. Keep the prior image and -matching backup for rollback. Do not patch running containers or overwrite tags. +Use the numeric `v1.6.551` tag after verifying backups and the published image +identity. Preserve existing Compose settings, named volumes, restart policy and +security options. Keep the prior image and matching backup until acceptance. +Do not patch running containers or overwrite release tags.