Skip to content

Bind Server 556 gates to qualified component identities #388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 29, 2026
Merged

Bind Server 556 gates to qualified component identities #388

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 28 additions & 28 deletions scripts/check-server-api-explorer-patch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
SERVER_INCREMENTAL_RELEASE_BASE_MISSING
for web_sbom_release_marker in \
'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.197-runtime.cdx.json' \
'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.199-runtime.cdx.json' \
'"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
'--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
'--webmcp-ceiling enabled;' \
Expand Down Expand Up @@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
python3 server/security/test_web_console_sbom_scan.py

require_marker "$release_dockerfile" \
'ARG SERVER_RELEASE_TAG=v1.6.555' \
'ARG SERVER_RELEASE_TAG=v1.6.556' \
SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
require_marker "$release_dockerfile" \
'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
Expand Down Expand Up @@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
'bash source/server/artifacts/verify-host-api-package.sh' \
SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_RELEASE_TAG=1.6.197' \
'ARG WEB_CONSOLE_RELEASE_TAG=1.6.199' \
SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz' \
'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.199.tar.gz' \
SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad' \
'ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570' \
SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3' \
'ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff' \
SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464' \
'ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173' \
SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
require_marker "$release_dockerfile" \
'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421' \
'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31' \
SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
require_marker "$release_dockerfile" \
"grep -aF 'hostsPage.permissionDenied'" \
Expand All @@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
'"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
require_marker "$build_script" \
'web_console_commit=${WEB_CONSOLE_COMMIT:-4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3}' \
'web_console_commit=${WEB_CONSOLE_COMMIT:-80a47df65f6406087b80aa81cfa99fe1f438ecff}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
require_marker "$build_script" \
'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}' \
'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.199}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
require_marker "$build_script" \
'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.197.tar.gz}' \
'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.199.tar.gz}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
require_marker "$build_script" \
'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad}' \
'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
require_marker "$build_script" \
'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464}' \
'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
require_marker "$build_script" \
'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421}' \
'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
require_marker "$release_dockerfile" \
'ARG CATALOG_SERVICE_VERSION=0.20.15' \
Expand Down Expand Up @@ -1139,21 +1139,21 @@ require_marker "$build_script" \
'--file server/Dockerfile.web-compose-release' \
SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
require_marker "$build_script" \
'image=${IMAGE:-pasturestack-validation/server:v1.6.555}' \
'image=${IMAGE:-pasturestack-validation/server:v1.6.556}' \
SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
require_marker "$build_script" \
'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.555}' \
'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.556}' \
SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
require_marker "$build_script" \
'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
for release_engine_marker in \
'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.355' \
'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.356' \
'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f' \
'ARG ORCHESTRATION_ENGINE_COMMIT=9ea138d1db1718cf65157c9564c379e62bafe9a0' \
'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=dfce4c6df625a905a837770780bd09d871752cf9d8493b590145f84a8c78dd09' \
'ARG ORCHESTRATION_ENGINE_COMMIT=24cfa1db113f54de3148cd4ac3191e66a1702806' \
'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
'ARG ORCHESTRATION_ENGINE_VERSION=0.183.355' \
'ARG ORCHESTRATION_ENGINE_VERSION=0.183.356' \
'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
Expand All @@ -1172,10 +1172,10 @@ for release_engine_marker in \
SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
done
for release_engine_build_marker in \
'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.355}' \
'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.356}' \
'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f}' \
'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-9ea138d1db1718cf65157c9564c379e62bafe9a0}' \
'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-dfce4c6df625a905a837770780bd09d871752cf9d8493b590145f84a8c78dd09}' \
'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-24cfa1db113f54de3148cd4ac3191e66a1702806}' \
'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
'< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
Expand Down Expand Up @@ -1694,10 +1694,10 @@ fi
if grep -Fxq '## Current source candidate' README.md; then
for candidate_readme_marker in \
'<a id="current-release"></a>' \
'Server `v1.6.555` is a prepared source candidate, not a published image.' \
'Server `v1.6.556` is a prepared source candidate, not a published image.' \
'run them only after its official release' \
'This candidate is not yet available' \
'ghcr.io/pasturestack/server:v1.6.555'; do
'ghcr.io/pasturestack/server:v1.6.556'; do
require_marker README.md "$candidate_readme_marker" \
SERVER_CURRENT_CANDIDATE_README_MISSING
done
Expand Down Expand Up @@ -2303,7 +2303,7 @@ done
jq -e '
["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
| .["@context"] == "https://openvex.dev/ns/v0.2.0"
and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.555"
and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.556"
and (.statements | length) == 56
and ([.statements[].vulnerability.name] | length == (unique | length))
and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
Expand Down Expand Up @@ -2341,7 +2341,7 @@ jq -r '
| @tsv
' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
bash "$vendor_pending_validator" "$runtime_vendor_pending" \
"$vendor_pending_fixture" v1.6.555 >/dev/null
"$vendor_pending_fixture" v1.6.556 >/dev/null
bash scripts/test-vendor-pending-findings.sh >/dev/null
rm -f "$vendor_pending_fixture"
trap - EXIT
Expand Down Expand Up @@ -2430,4 +2430,4 @@ for release_readback_contract in \
fi
done

printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.555 base=v1.6.460 engine=0.183.355 web_console=1.6.197 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.556 base=v1.6.460 engine=0.183.356 web_console=1.6.199 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
Loading