From 6f099e79b44ca466219da02e6ce2096f49fef6c2 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Wed, 21 Oct 2026 11:13:19 +0800 Subject: [PATCH] fix: refresh unavailable Alpine package pins for v0.9.29 --- README.md | 12 ++++++++---- package/haproxy/alpine-apk.lock | 16 ++++++++-------- scripts/supply-chain-check | 4 ++-- 3 files changed, 18 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 005c8b2..e050809 100644 --- a/README.md +++ b/README.md @@ -14,10 +14,14 @@ ghcr.io/pasturestack/load-balancer-service:v0.9.27 Release deployments pin the image by digest. The image is not intended to be started by itself because the control plane supplies metadata, API credentials, service links, port rules, and health-check configuration. -This branch prepares the `v0.9.28` source candidate for drain weight recovery. +This branch prepares the `v0.9.29` source candidate for drain weight recovery. The candidate has passed the focused local race tests and static checks described -below. Protected pull-request CI and native PastureStack load-balancer QA remain -release qualification gates; `v0.9.28` has not been tagged or published. +below. The signed `v0.9.28` tag is retained, but its release build failed because +Alpine no longer served several locked package versions; no runtime image or +GitHub release was published. This candidate updates only those direct-package +pins and the matching OpenSSL safety checks. Protected pull-request CI and native +PastureStack load-balancer QA remain release qualification gates; `v0.9.29` has +not been tagged or published. ## Compatibility @@ -32,7 +36,7 @@ It also accepts the generic `CATTLE_ACCESS_KEY` and `CATTLE_SECRET_KEY` pair use The HAProxy logging helper keeps its configuration under the standard `/etc/rsyslog.d` path and does not require a daemon PID file. Logging initialization is validated independently before HAProxy configuration is applied. -### Drain weight recovery (v0.9.28 source candidate) +### Drain weight recovery (v0.9.29 source candidate) The controller records each backend's runtime weight before setting it to zero for `target.drain`, including drains that already have zero active sessions. diff --git a/package/haproxy/alpine-apk.lock b/package/haproxy/alpine-apk.lock index 89f3fa7..b51b925 100644 --- a/package/haproxy/alpine-apk.lock +++ b/package/haproxy/alpine-apk.lock @@ -2,19 +2,19 @@ # The base image is pinned in Dockerfile; transitive packages are recorded in the image. ALPINE_BASH_VERSION='5.3.9-r1' ALPINE_BUILD_BASE_VERSION='0.5-r4' -ALPINE_CA_CERTIFICATES_VERSION='20260611-r0' -ALPINE_CURL_VERSION='8.21.0-r0' -ALPINE_LIBCRYPTO3_VERSION='3.5.8-r0' +ALPINE_CA_CERTIFICATES_VERSION='20261020-r0' +ALPINE_CURL_VERSION='8.22.0-r0' +ALPINE_LIBCRYPTO3_VERSION='3.5.9-r0' ALPINE_LIBCAP_UTILS_VERSION='2.78-r0' -ALPINE_LIBSSL3_VERSION='3.5.8-r0' +ALPINE_LIBSSL3_VERSION='3.5.9-r0' ALPINE_LINUX_HEADERS_VERSION='7.0.0-r1' ALPINE_LUA5_4_DEV_VERSION='5.4.8-r0' ALPINE_LUA5_4_LIBS_VERSION='5.4.8-r0' -ALPINE_OPENSSL_DEV_VERSION='3.5.8-r0' -ALPINE_PCRE2_DEV_VERSION='10.47-r1' -ALPINE_PCRE2_VERSION='10.47-r1' +ALPINE_OPENSSL_DEV_VERSION='3.5.9-r0' +ALPINE_PCRE2_DEV_VERSION='10.49-r0' +ALPINE_PCRE2_VERSION='10.49-r0' ALPINE_PROCPS_NG_VERSION='4.0.6-r0' ALPINE_RSYSLOG_VERSION='8.2604.0-r0' ALPINE_SU_EXEC_VERSION='0.3-r0' ALPINE_TINI_VERSION='0.19.0-r3' -ALPINE_ZLIB_DEV_VERSION='1.3.2-r0' +ALPINE_ZLIB_DEV_VERSION='1.3.2-r1' diff --git a/scripts/supply-chain-check b/scripts/supply-chain-check index 6babbaf..a15a960 100755 --- a/scripts/supply-chain-check +++ b/scripts/supply-chain-check @@ -22,8 +22,8 @@ require_text package/haproxy/Dockerfile 'ARG HAPROXY_VERSION=3.4.3' require_text package/haproxy/Dockerfile 'ARG ALPINE_IMAGE=docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b' require_text package/haproxy/Dockerfile '"libcrypto3=${ALPINE_LIBCRYPTO3_VERSION}"' require_text package/haproxy/Dockerfile '"libssl3=${ALPINE_LIBSSL3_VERSION}"' -require_text package/haproxy/alpine-apk.lock "ALPINE_LIBCRYPTO3_VERSION='3.5.8-r0'" -require_text package/haproxy/alpine-apk.lock "ALPINE_LIBSSL3_VERSION='3.5.8-r0'" +require_text package/haproxy/alpine-apk.lock "ALPINE_LIBCRYPTO3_VERSION='3.5.9-r0'" +require_text package/haproxy/alpine-apk.lock "ALPINE_LIBSSL3_VERSION='3.5.9-r0'" require_text package/haproxy/Dockerfile 'TARGET=linux-musl' require_text package/haproxy/Dockerfile '"tini=${ALPINE_TINI_VERSION}"' require_text .github/workflows/security-release-gate.yml 'TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'