diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index c332eff210..b9e0f09849 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,19 @@
# Compatibility Contract
+## Server v1.6.561 source candidate
+
+Consumes published Web Console 1.6.202 / bridge 0.2.4 and the original qualified
+Engine 0.183.361 JAR. Repairs verified native Container network cleanup,
+registered typed audit targets and fixed audit-owner topology. The new fixed
+child accepts normalized local HTTP(S) service origins only; ordinary broker
+operator settings and native role/Key boundaries remain. Certificate plans
+change name/description only; material remains in the human UI.
+
+Required image publication and designated business/role/layout acceptance are
+separate pending gates. Published installation examples remain on 560 until the
+new image passes. See [candidate details](docs/releases/server-1.6.561.md).
+
+
## Server v1.6.560 published
diff --git a/docs/releases/server-1.6.561.md b/docs/releases/server-1.6.561.md
new file mode 100644
index 0000000000..09aa654259
--- /dev/null
+++ b/docs/releases/server-1.6.561.md
@@ -0,0 +1,65 @@
+# Server v1.6.561 candidate
+
+Not published. Matching component publication, required image checks and
+designated runtime acceptance remain pending.
+
+## Verified component inputs
+
+- Web Console 1.6.202 / bridge 0.2.4: published original producer
+ `3350a566b77c46ccf3686975bdcc8d9c14ee2985`, tag source
+ `1b426175a55fd63260466cacd02e962e1bd44f8f`; all 13 public assets verified.
+- Web archive SHA256:
+ `333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6`.
+- Web runtime SBOM SHA256:
+ `54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8`;
+ original lock `81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae`.
+- Engine 0.183.361 producer `592bd47ca9417f24d5acea07b567b9385852f381`;
+ original JAR SHA256 `9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136`.
+ Required CI, same-tree merge, original artifact checks and all 12 public assets
+ passed; tag source `4e86a5890798d64f1f3f656c6c78e4dedef7aa39`.
+ Official structured results: 412 suites / 3843 tests / zero failure or error / 1 existing skip.
+ Runtime SBOM SHA256 `7163aba0bc8e77f0901a1d07be9ce23e77c548a7d20813a24b1bae22254701f8`.
+- Catalog 0.20.17, Compose 0.14.40 and other package inputs remain unchanged.
+
+## Corrected workflows
+
+Standalone Container removal preserves its verified native remove frame and
+owned retired NIC/IP cleanup. Current role, original Key revision, explicit
+DENY and shared/foreign-resource ownership remain enforced. Genuine structured
+child authorization denial becomes terminal instead of retrying as UNKNOWN.
+
+Registered External Service, DNS Alias and Certificate metadata audit targets
+remain in the existing durable metadata-only audit owner. Audit failure stays
+fail-closed. This change does not grant access to those resource types.
+
+The fixed private audit query CLI shares the operator-configured broker
+upstream. Previously its 8082 literal and cleared child environment diverged
+from the image topology. Java passes only that exact nonsecret operator
+setting after clearing the other environment, reconstructed from fixed local
+HTTP(S) origins and a bounded numeric port; credentials remain private stdin.
+Callers cannot choose an upstream, executable, SQL or raw audit payload.
+
+Certificate name/description plans use normal human approval and the native
+metadata-only PUT. Certificate PEM, private key and chain are preserved and
+excluded from tool snapshots. Other material operations stay in the human UI.
+
+## Acceptance boundary
+
+Required component CI, original artifacts, image/startup/restart and designated
+business tests are separate gates. The original failing runtime reports remain.
+Core lifecycle, External/Alias, all twelve audit-query cases, affected role/Key
+and cross-ID boundaries, new layouts and actual weak-model workflows must pass
+before their own matrix entries are marked accepted. Preserve unaffected PASS
+at its original scope; do not promote a subcase to complete frontend coverage.
+The baseline remains 243 groups and 3,089 source rows. New source coverage is
+partial and does not establish whole-group or complete-product acceptance.
+
+## Upgrade and rollback
+
+Use only the newly published immutable numeric image tag. Preserve existing
+volumes, operator configuration, origins, MFA/session protection, restart policy
+and AppArmor. Retain the last healthy container/image and a compatible database
+backup. A later downgrade does not reverse completed writes. Do not replay
+uncertain operations, replace their captured Key identity or patch database state.
+After deployment, confirm old denied work is terminal before a separately
+authorized operator cleanup. Production, HAProxy and firewall are unchanged.
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 09881409c2..7ba1011081 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
SERVER_INCREMENTAL_RELEASE_BASE_MISSING
for web_sbom_release_marker in \
'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
- 'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.201-runtime.cdx.json' \
+ 'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.202-runtime.cdx.json' \
'"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
'--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
'--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
python3 server/security/test_web_console_sbom_scan.py
require_marker "$release_dockerfile" \
- 'ARG SERVER_RELEASE_TAG=v1.6.560' \
+ 'ARG SERVER_RELEASE_TAG=v1.6.561' \
SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
require_marker "$release_dockerfile" \
'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
'bash source/server/artifacts/verify-host-api-package.sh' \
SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.201' \
+ 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.202' \
SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.201.tar.gz' \
+ 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.202.tar.gz' \
SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_ARTIFACT_SHA256=5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8' \
+ 'ARG WEB_CONSOLE_ARTIFACT_SHA256=333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6' \
SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_COMMIT=24715414f143e2c58cf53084bd84cbea0922798f' \
+ 'ARG WEB_CONSOLE_COMMIT=3350a566b77c46ccf3686975bdcc8d9c14ee2985' \
SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_LOCK_SHA256=d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f' \
+ 'ARG WEB_CONSOLE_LOCK_SHA256=81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae' \
SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
require_marker "$release_dockerfile" \
- 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503' \
+ 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8' \
SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
require_marker "$release_dockerfile" \
"grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
'"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
require_marker "$build_script" \
- 'web_console_commit=${WEB_CONSOLE_COMMIT:-24715414f143e2c58cf53084bd84cbea0922798f}' \
+ 'web_console_commit=${WEB_CONSOLE_COMMIT:-3350a566b77c46ccf3686975bdcc8d9c14ee2985}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
require_marker "$build_script" \
- 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.201}' \
+ 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
require_marker "$build_script" \
- 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.201.tar.gz}' \
+ 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.202.tar.gz}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
require_marker "$build_script" \
- 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8}' \
+ 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
require_marker "$build_script" \
- 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f}' \
+ 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
require_marker "$build_script" \
- 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503}' \
+ 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8}' \
SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
require_marker "$release_dockerfile" \
'ARG CATALOG_SERVICE_VERSION=0.20.17' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
'--file server/Dockerfile.web-compose-release' \
SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
require_marker "$build_script" \
- 'image=${IMAGE:-pasturestack-validation/server:v1.6.560}' \
+ 'image=${IMAGE:-pasturestack-validation/server:v1.6.561}' \
SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
require_marker "$build_script" \
- 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.560}' \
+ 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.561}' \
SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
require_marker "$build_script" \
'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
for release_engine_marker in \
- 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.360' \
+ 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361' \
'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
- 'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21' \
- 'ARG ORCHESTRATION_ENGINE_COMMIT=72230c8b471312377bae968c0c17d63e8ad97ffb' \
+ 'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136' \
+ 'ARG ORCHESTRATION_ENGINE_COMMIT=592bd47ca9417f24d5acea07b567b9385852f381' \
'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
- 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.360' \
+ 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.361' \
'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
done
for release_engine_build_marker in \
- 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}' \
+ 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}' \
'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
- 'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21}' \
- 'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-72230c8b471312377bae968c0c17d63e8ad97ffb}' \
+ 'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136}' \
+ 'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-592bd47ca9417f24d5acea07b567b9385852f381}' \
'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
'< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
if grep -Fxq '## Current source candidate' README.md; then
for candidate_readme_marker in \
'' \
- 'Server `v1.6.560` is a prepared source candidate, not a published image.' \
+ 'Server `v1.6.561` is a prepared source candidate, not a published image.' \
'run them only after its official release' \
'This candidate is not yet available' \
- 'ghcr.io/pasturestack/server:v1.6.560'; do
+ 'ghcr.io/pasturestack/server:v1.6.561'; do
require_marker README.md "$candidate_readme_marker" \
SERVER_CURRENT_CANDIDATE_README_MISSING
done
@@ -2303,7 +2303,7 @@ done
jq -e '
["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
| .["@context"] == "https://openvex.dev/ns/v0.2.0"
- and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.560"
+ and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.561"
and (.statements | length) == 56
and ([.statements[].vulnerability.name] | length == (unique | length))
and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
| @tsv
' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
bash "$vendor_pending_validator" "$runtime_vendor_pending" \
- "$vendor_pending_fixture" v1.6.560 >/dev/null
+ "$vendor_pending_fixture" v1.6.561 >/dev/null
bash scripts/test-vendor-pending-findings.sh >/dev/null
rm -f "$vendor_pending_fixture"
trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
fi
done
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.560 base=v1.6.460 engine=0.183.360 web_console=1.6.201 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.561 base=v1.6.460 engine=0.183.361 web_console=1.6.202 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index f1c07f8a78..df19597d3c 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -34,23 +34,23 @@
PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = '5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8'
-WEB_SOURCE = '24715414f143e2c58cf53084bd84cbea0922798f'
-WEB_SBOM_SHA = '8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503'
-WEB_LOCK_SHA = 'd255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f'
+WEB_SHA = '333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6'
+WEB_SOURCE = '3350a566b77c46ccf3686975bdcc8d9c14ee2985'
+WEB_SBOM_SHA = '54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8'
+WEB_LOCK_SHA = '81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae'
CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297'
-ENGINE_SHA = '0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21'
-ENGINE_SOURCE = '72230c8b471312377bae968c0c17d63e8ad97ffb'
+ENGINE_SHA = '9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136'
+ENGINE_SOURCE = '592bd47ca9417f24d5acea07b567b9385852f381'
OLD_COORDINATES = {
- 'v1.6.560': 'v1.6.521',
- '1.6.201': '1.6.181',
+ 'v1.6.561': 'v1.6.521',
+ '1.6.202': '1.6.181',
WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
}
-# Engine353 and Web193 use the reviewed component input identities.
+# Current Engine and Web use the reviewed immutable component identities.
# Published521 component values remain mutation controls.
-# Component coordinates do not establish Server545 artifact/runtime PASS.
+# Component coordinates do not establish Server artifact/runtime acceptance.
CATALOG_FIELDS = (
('VERSION', 'version', '0.20.17'),
('COMMIT', 'commit', '2f70559e340865eb6243662ed33d8cbc7b1efa90'),
@@ -60,29 +60,29 @@
('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'),
)
LEGACY_ENGINE_COORDINATES = {
- '0.183.360': '0.183.337',
+ '0.183.361': '0.183.337',
ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80',
ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e',
}
EXPECTED = {
COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
- 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.560'),
+ 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.561'),
'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
- 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.201'),
- 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.201.tar.gz'),
+ 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.202'),
+ 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.202.tar.gz'),
'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
'SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_LOCK_SHA256=' + WEB_LOCK_SHA),
'SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=' + WEB_SBOM_SHA),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
- 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.201}'),
- 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.201.tar.gz}'),
+ 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}'),
+ 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.202.tar.gz}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'),
'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'),
- 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.560}'),
- 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.560}'),
+ 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.561}'),
+ 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.561}'),
'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -103,18 +103,18 @@
CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING']
ENGINE_EXPECTED = {
'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', (
- 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.360',
+ 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361',
'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar',
'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA,
'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE,
- 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.360',
+ 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.361',
'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"',
'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar',
'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar',
'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}',
)),
'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', (
- 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}',
+ 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}',
'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}',
'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}',
'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}',
@@ -608,15 +608,15 @@ def verify(files, gate=GATE):
pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
if len(re.findall(pipeline, source)) != 1:
raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
- if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.560"' not in gate:
+ if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.561"' not in gate:
raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
- if '"$vendor_pending_fixture" v1.6.560 >/dev/null' not in gate:
+ if '"$vendor_pending_fixture" v1.6.561 >/dev/null' not in gate:
raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
- if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.560':
+ if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.561':
raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
- if json.loads(files[VENDOR]).get('release') != 'v1.6.560':
+ if json.loads(files[VENDOR]).get('release') != 'v1.6.561':
raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
- if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.560 base=v1.6.460 engine=0.183.360 web_console=1.6.201 catalog_service=0.20.17 ' not in gate:
+ if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.561 base=v1.6.460 engine=0.183.361 web_console=1.6.202 catalog_service=0.20.17 ' not in gate:
raise AssertionError('CURRENT_SUMMARY_MISMATCH')
verify_incremental_contract(files, gate)
verify_load_balancer_contract(files, gate)
@@ -631,11 +631,11 @@ def previous_gate(gate=GATE):
if stale(marker) != marker:
replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
replacements.update({
- 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.560"':
+ 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.561"':
'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
- '"$vendor_pending_fixture" v1.6.560 >/dev/null':
+ '"$vendor_pending_fixture" v1.6.561 >/dev/null':
'"$vendor_pending_fixture" v1.6.521 >/dev/null',
- 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.560 base=v1.6.460 engine=0.183.360 web_console=1.6.201 catalog_service=0.20.17 ':
+ 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.561 base=v1.6.460 engine=0.183.361 web_console=1.6.202 catalog_service=0.20.17 ':
'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
})
for marker, stale_marker in replacements.items():
@@ -1299,7 +1299,7 @@ def test_each_old_engine_coordinate_rejected(self):
self.assertGreater(checked, 0)
def test_historical_engine340_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.340',
+ old = {'0.183.361': '0.183.340',
ENGINE_SHA: '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea',
ENGINE_SOURCE: 'ff0a41e7676211043eb4f755a306a9e2a19abee1'}
checked = 0
@@ -1320,13 +1320,13 @@ def test_historical_engine340_cannot_be_packaged(self):
def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8')
- self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.560}', candidate)
- self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}', candidate)
+ self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.561}', candidate)
+ self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}', candidate)
for old in (
- {'0.183.360': '0.183.351',
+ {'0.183.361': '0.183.351',
ENGINE_SHA: 'efd0e826364c551f782b281f081d53cadb48faa7d5c37c2f101e6f9c7d7f9ea6',
ENGINE_SOURCE: '1befd83278618f9a5b7cdaf96522004dd89918ba'},
- {'0.183.360': '0.183.350',
+ {'0.183.361': '0.183.350',
ENGINE_SHA: '637ddaa42cd93c019b4d0813d7053b71dc42797a7f3ac2aa4b10fcc7e304cb31',
ENGINE_SOURCE: '9c884710e5ea3d4136d80a870d9de9485674f3c3'},
{ENGINE_SOURCE: '109f2623f00ca3a3a9079414a0f0f8bd23cd1eb2'},
@@ -1349,7 +1349,7 @@ def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
def test_immediately_previous_engine341_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.341',
+ old = {'0.183.361': '0.183.341',
ENGINE_SHA: '3ede1ad28b7a7e0754c4c953bd486162f7ffe0b2f76ce384ec485632af6b8e6d',
ENGINE_SOURCE: 'b245cf778479445ded0786d3898b03fea153212e'}
checked = 0
@@ -1370,7 +1370,7 @@ def test_immediately_previous_engine341_cannot_be_packaged(self):
def test_immediately_previous_engine342_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.342',
+ old = {'0.183.361': '0.183.342',
ENGINE_SHA: '3533f247392795329c92516a7966510aafbe81a52e3f922e5ec657a2071363b5',
ENGINE_SOURCE: 'ddae4bb8e12806f70816f5782cd999eccd0f2ce6'}
checked = 0
@@ -1391,7 +1391,7 @@ def test_immediately_previous_engine342_cannot_be_packaged(self):
def test_immediately_previous_engine343_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.343',
+ old = {'0.183.361': '0.183.343',
ENGINE_SHA: 'b29c0057f96dbae38bfe2c663c63bbe4c8b5c755b3090f39414aa51f9813025f',
ENGINE_SOURCE: '5aa9d8978c75a7fe63330453c399a92716d88568'}
checked = 0
@@ -1412,7 +1412,7 @@ def test_immediately_previous_engine343_cannot_be_packaged(self):
def test_immediately_previous_engine344_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.344',
+ old = {'0.183.361': '0.183.344',
ENGINE_SHA: 'ffafa4700156b74ec11bcae1b830738e49943f1a3b8b0565895ed6d7726eebf1',
ENGINE_SOURCE: '72c42e6f2000301fe03ffd2442fb9ee89aee120c'}
checked = 0
@@ -1432,7 +1432,7 @@ def test_immediately_previous_engine344_cannot_be_packaged(self):
self.assertGreater(checked, 0)
def test_immediately_previous_engine345_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.345',
+ old = {'0.183.361': '0.183.345',
ENGINE_SHA: '780263c4a884527fa80a28b998ad4bda88b9ad6002a687f9f074602ecad46e62',
ENGINE_SOURCE: 'd27d4ac73fa05ae43b9ae0c32875780e8a3765b1'}
checked = 0
@@ -1452,7 +1452,7 @@ def test_immediately_previous_engine345_cannot_be_packaged(self):
self.assertGreater(checked, 0)
def test_immediately_previous_engine346_cannot_be_packaged(self):
- old = {'0.183.360': '0.183.346',
+ old = {'0.183.361': '0.183.346',
ENGINE_SHA: '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806',
ENGINE_SOURCE: 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'}
checked = 0
@@ -1628,7 +1628,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
def test_current_readme_status_specific_prose_does_not_block_publication_transition(self):
common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0]
self.assertNotIn('candidate', common)
- self.assertNotIn('v1.6.560', common)
+ self.assertNotIn('v1.6.561', common)
self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE)
status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1]
candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1)
@@ -1637,7 +1637,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit
self.assertIn('This candidate is not yet available', candidate)
self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published)
self.assertNotIn('candidate', published)
- self.assertNotIn('v1.6.560', published)
+ self.assertNotIn('v1.6.561', published)
if __name__ == '__main__':
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 4c38c4550d..f66acf66cd 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -90,13 +90,13 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968
ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.201
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.201.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8
-ARG WEB_CONSOLE_COMMIT=24715414f143e2c58cf53084bd84cbea0922798f
-ARG WEB_CONSOLE_LOCK_SHA256=d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f
-ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.201-runtime.cdx.json
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.202
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.202.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6
+ARG WEB_CONSOLE_COMMIT=3350a566b77c46ccf3686975bdcc8d9c14ee2985
+ARG WEB_CONSOLE_LOCK_SHA256=81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae
+ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.202-runtime.cdx.json
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8
ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
ARG CATALOG_SERVICE_VERSION=0.20.17
ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
@@ -118,9 +118,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.360
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361
ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136
ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
ARG COMPOSE_EXECUTOR_VERSION=0.14.40
ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732
@@ -709,12 +709,12 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.560
+ARG SERVER_RELEASE_TAG=v1.6.561
ARG API_EXPLORER_RELEASE_TAG=v1.1.20
ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.360
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.360
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.361
ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
ARG HOST_API_VERSION=0.38.8
@@ -736,11 +736,11 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1
ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.201
-ARG WEB_CONSOLE_ARTIFACT_SHA256=5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8
-ARG WEB_CONSOLE_COMMIT=24715414f143e2c58cf53084bd84cbea0922798f
-ARG WEB_CONSOLE_LOCK_SHA256=d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.202
+ARG WEB_CONSOLE_ARTIFACT_SHA256=333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6
+ARG WEB_CONSOLE_COMMIT=3350a566b77c46ccf3686975bdcc8d9c14ee2985
+ARG WEB_CONSOLE_LOCK_SHA256=81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8
ARG CATALOG_SERVICE_VERSION=0.20.17
ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20
@@ -759,8 +759,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=4da77ccac464bc7f7cd2020e0659a666a5d1ff7e
ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21
-ARG ORCHESTRATION_ENGINE_COMMIT=72230c8b471312377bae968c0c17d63e8ad97ffb
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136
+ARG ORCHESTRATION_ENGINE_COMMIT=592bd47ca9417f24d5acea07b567b9385852f381
ARG HOST_PROVISIONER_VERSION=0.39.10
ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index ac51a8cd81..f428dfd10d 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
fi
revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.560}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.561}
source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
-orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}
+orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}
orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}
-orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21}
-orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-72230c8b471312377bae968c0c17d63e8ad97ffb}
+orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136}
+orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-592bd47ca9417f24d5acea07b567b9385852f381}
orchestration_engine_version=${orchestration_engine_release_tag#v}
engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233}
engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51}
@@ -63,13 +63,13 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.20.tar.gz}
api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb}
api_explorer_commit=${API_EXPLORER_COMMIT:-a586f0dc0aa50df579049a8d4bf26f04400fdf75}
web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.201}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.201.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8}
-web_console_commit=${WEB_CONSOLE_COMMIT:-24715414f143e2c58cf53084bd84cbea0922798f}
-web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.202.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6}
+web_console_commit=${WEB_CONSOLE_COMMIT:-3350a566b77c46ccf3686975bdcc8d9c14ee2985}
+web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae}
web_console_runtime_sbom_artifact=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${web_console_release_tag}-runtime.cdx.json}
-web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503}
+web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8}
catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.17}
catalog_service_commit=${CATALOG_SERVICE_COMMIT:-2f70559e340865eb6243662ed33d8cbc7b1efa90}
@@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4
usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}
supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.560}
+image=${IMAGE:-pasturestack-validation/server:v1.6.561}
build_options=()
[[ "$revision" =~ ^[0-9a-f]{40}$ ]]
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index 0677de05d5..fe678fcdcd 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -18,10 +18,10 @@ for name in "${required[@]}"; do
case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
export "$name"
done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.560}
-export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.561}
+export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}
export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.201}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}
export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
export WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${WEB_CONSOLE_RELEASE_TAG}-runtime.cdx.json}
export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.18}
diff --git a/server/console-broker/ai_audit_owner.go b/server/console-broker/ai_audit_owner.go
index 86b815a031..2cabe24c2f 100644
--- a/server/console-broker/ai_audit_owner.go
+++ b/server/console-broker/ai_audit_owner.go
@@ -71,7 +71,7 @@ func runAIAuditOwnerCLI(stdin io.Reader, stdout io.Writer) int {
input.CredentialKind != "apiKey" && input.CredentialKind != "apiKeyRestricted") {
return 2 // No private input or diagnostic is printed.
}
- cfg := brokerConfig{UpstreamURL: "http://127.0.0.1:8082", SessionDialURL: "http://127.0.0.1:8080",
+ cfg := brokerConfig{UpstreamURL: consoleUpstreamFromEnvironment(), SessionDialURL: "http://127.0.0.1:8080",
MaxSessions: 1, ReplayBytes: 65536, ActiveTTL: time.Hour, HistoryTTL: time.Hour, CleanupInterval: time.Hour}
b, err := newBroker(cfg, log.New(io.Discard, "", 0))
if err != nil {
diff --git a/server/console-broker/ai_audit_topology_test.go b/server/console-broker/ai_audit_topology_test.go
new file mode 100644
index 0000000000..acaa4665d8
--- /dev/null
+++ b/server/console-broker/ai_audit_topology_test.go
@@ -0,0 +1,113 @@
+package main
+
+import (
+ "bytes"
+ "encoding/json"
+ "net/http"
+ "net/http/httptest"
+ "strings"
+ "sync"
+ "testing"
+)
+
+func TestAIAuditCLIUsesOperatorUpstreamForCookieAndOriginalKey(t *testing.T) {
+ for _, credential := range []string{"cookie", "key"} {
+ t.Run(credential, func(t *testing.T) {
+ input := ownerInput()
+ if credential == "cookie" {
+ input.Cookie = "token=PRIVATE-COOKIE-CANARY"
+ input.Authorization, input.CredentialID, input.CredentialKind, input.Revision = "", "", "", 0
+ }
+ seen := map[string]int{}
+ var seenMu sync.Mutex
+ upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ if r.Method != "POST" || r.URL.Path != "/v2-beta/aiResourceViews" || r.URL.RawQuery != "" ||
+ r.Header.Get("Authorization") != input.Authorization || r.Header.Get("Cookie") != input.Cookie ||
+ r.Header.Get("X-Forwarded-User") != "" {
+ t.Error("configured owner source changed route or private credential binding")
+ w.WriteHeader(500)
+ return
+ }
+ if credential == "key" && r.Header.Get("X-PastureStack-Key-Expected-Revision") != "3" ||
+ credential == "cookie" && r.Header.Get("X-PastureStack-Key-Expected-Revision") != "" {
+ t.Error("source changed credential revision binding")
+ w.WriteHeader(500)
+ return
+ }
+ var body map[string]any
+ if json.NewDecoder(r.Body).Decode(&body) != nil {
+ t.Error("source input invalid")
+ w.WriteHeader(500)
+ return
+ }
+ category := auditString(body, "resourceType")
+ seenMu.Lock()
+ seen[category]++
+ seenMu.Unlock()
+ page := body["sourcePage"].(map[string]any)
+ project := auditString(page, "projectId")
+ authority := map[string]any{"actorId": input.ActorID, "accountId": firstNonEmpty(project, input.ActorID)}
+ if credential == "key" {
+ authority["credentialId"], authority["credentialKind"], authority["credentialRevision"] = input.CredentialID, input.CredentialKind, input.Revision
+ }
+ rows := []map[string]any{}
+ switch category {
+ case "project":
+ rows = append(rows, map[string]any{"id": "1a5", "type": "project", "name": "Visible"})
+ case "account":
+ rows = append(rows, map[string]any{"id": "1a1", "type": "account", "name": "Viewer"})
+ case "auditLog":
+ if project != "" {
+ rows = append(rows, map[string]any{"id": "1al10", "type": "auditLog", "accountId": "1a5", "authenticatedAsAccountId": "1a1",
+ "created": "2026-10-01T12:00:00Z", "eventType": "api.service.update", "decision": "ALLOW", "outcome": "SUCCEEDED"})
+ }
+ default:
+ t.Error("unrequested source type")
+ w.WriteHeader(500)
+ return
+ }
+ w.Header().Set("Content-Type", "application/json")
+ _ = json.NewEncoder(w).Encode(map[string]any{"resourceType": category, "data": rows, "nextMarker": nil,
+ "nativeAuthority": authority, "sourcePageResult": true})
+ }))
+ defer upstream.Close()
+ t.Setenv("PASTURESTACK_CONSOLE_UPSTREAM_URL", upstream.URL)
+ cfg, err := configFromEnvironment()
+ if err != nil || cfg.UpstreamURL != upstream.URL {
+ t.Fatal("ordinary broker did not use the operator setting")
+ }
+ private, _ := json.Marshal(input)
+ var output bytes.Buffer
+ if runAIAuditOwnerCLI(bytes.NewReader(private), &output) != 0 {
+ t.Fatal("owner did not return a complete private frame")
+ }
+ var result struct {
+ Status int
+ Body map[string]any
+ }
+ seenMu.Lock()
+ defer seenMu.Unlock()
+ if json.Unmarshal(output.Bytes(), &result) != nil || result.Status != 200 || result.Body["total"] != float64(1) ||
+ seen["project"] == 0 || seen["auditLog"] == 0 {
+ t.Fatalf("CLI did not use the configured source: status=%d sources=%v", result.Status, seen)
+ }
+ if strings.Contains(output.String(), "PRIVATE") || strings.Contains(output.String(), upstream.URL) {
+ t.Fatal("private credential or operator topology escaped the safe output")
+ }
+ })
+ }
+}
+
+func TestConsoleUpstreamRetainsDefaultAndRejectsInvalidConfiguredOwner(t *testing.T) {
+ t.Setenv("PASTURESTACK_CONSOLE_UPSTREAM_URL", "")
+ cfg, err := configFromEnvironment()
+ if err != nil || cfg.UpstreamURL != "http://127.0.0.1:8082" {
+ t.Fatal("ordinary unset/empty upstream fallback changed")
+ }
+ t.Setenv("PASTURESTACK_CONSOLE_UPSTREAM_URL", "://invalid")
+ private, _ := json.Marshal(ownerInput())
+ var output bytes.Buffer
+ if runAIAuditOwnerCLI(bytes.NewReader(private), &output) != 2 || output.Len() != 0 {
+ t.Fatal("invalid operator topology must not fall back or disclose private diagnostics")
+ }
+}
diff --git a/server/console-broker/main.go b/server/console-broker/main.go
index ab7801790f..22373b016d 100644
--- a/server/console-broker/main.go
+++ b/server/console-broker/main.go
@@ -57,7 +57,7 @@ func main() {
func configFromEnvironment() (brokerConfig, error) {
cfg := brokerConfig{
ListenAddress: environmentString("PASTURESTACK_CONSOLE_LISTEN_ADDRESS", ":8081"),
- UpstreamURL: environmentString("PASTURESTACK_CONSOLE_UPSTREAM_URL", "http://127.0.0.1:8082"),
+ UpstreamURL: consoleUpstreamFromEnvironment(),
SessionDialURL: environmentString(
"PASTURESTACK_CONSOLE_SESSION_DIAL_URL",
"http://127.0.0.1:8080",
@@ -85,6 +85,10 @@ func configFromEnvironment() (brokerConfig, error) {
return cfg, nil
}
+func consoleUpstreamFromEnvironment() string {
+ return environmentString("PASTURESTACK_CONSOLE_UPSTREAM_URL", "http://127.0.0.1:8082")
+}
+
func environmentString(name, fallback string) string {
if value := os.Getenv(name); value != "" {
return value
diff --git a/server/security/openvex.json b/server/security/openvex.json
index f9660d8d1f..9ce8f47213 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
- "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.560",
+ "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.561",
"author": "PastureStack Security",
- "timestamp": "2026-10-30T01:53:41Z",
- "version": 73,
+ "timestamp": "2026-10-30T05:40:22Z",
+ "version": 74,
"statements": [
{
"vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index 1b9cfb27cd..2eb505bf75 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
{
"schemaVersion": 1,
- "release": "v1.6.560",
+ "release": "v1.6.561",
"generatedAt": "2026-10-29T09:57:33.809116+00:00",
"policy": {
"allowedSeverities": [