diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index fd2e0fad35..2a5b1fe634 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,5 +1,21 @@ # Compatibility Contract +## Server v1.6.534 published + +This release packages immutable Web Console `1.6.189` and unchanged Engine `v0.183.348`. + +The immutable Server producer is `52714c372b38ea0b6f56bb205fbdfb0a584707e1`. Official workflow [38663986172](https://github.com/PastureStack/server/actions/runs/38663986172) and readback of 24 assets passed without bypassing required checks. The linux/amd64 image has one runtime layer. Registry manifest: `sha256:e218bd31b39207c969f331aab097fd9773ef0071216e794f9a4bd23010d8fc96`. Distinct OCI config: `sha256:1d31677fbc05073830eaee66592a8c274edd7d4cf743c3c3371383b5e36bd7fd`. Artifact identity, not an installation command: `ghcr.io/pasturestack/server:v1.6.534@sha256:e218bd31b39207c969f331aab097fd9773ef0071216e794f9a4bd23010d8fc96`. Documentation commits do not replace the producer. + +Immutable Web producer: `f30f5e81dd9ee25878c3aff681eed5bb61883453`. `web-console-1.6.189.tar.gz` is 3,024,592 bytes, SHA-256 `1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc`. Official publication and anonymous readback passed; later documentation commits do not replace this producer. + +Official QA deployment and restart passed with preserved volumes and runtime overrides. The final 52-case matrix covers 13 locales, 1440px/390px widths and light/dark themes: 44 unaffected Web 188 results are carried, and eight fa-ir/en-us views were newly run on Web 189 after the step-circle RTL fix. These are not 52 new Web 189 runs. A separate ordinary-HTTP native copy was newly verified on Web 189 with the Clipboard API absent. Clipboard payloads matched exactly. Permission rejection was an explicit denial fixture, distinct from the real HTTP fallback. Preferences, presentation and clipboard were restored; page errors, missing translations and unexpected resource writes were zero. + +Six new focused CSS cases passed for the exact shared step-list change, SVG geometry, generated LTR/RTL background and number alignment, both themes and version identities. Four actual-DOM cases added and passed on Web 188 are carried for native hover/leave, real static tooltip content, feedback success/failure, listener cleanup after destruction, action-menu overrides and host registration copy. The earlier thirteen clipboard/host cases and one corrected-caption rerun retain their original evidence; they were not replayed. The unchanged 32-key resource contract across 13 locales is carried from the same translation sources, not presented as a new resource run. + +The official curl packages use Ubuntu's `8.18.0-1ubuntu2.8` security backport. The scanner feed still reports the 54 exact curl findings covered by evidence-backed OpenVEX `fixed` statements; raw findings are retained rather than reported as zero. The original 20 MEDIUM findings across 10 CVEs remain vendor-pending for review on 2026-10-20. See the release note for the exact package/PURL boundaries and unchanged gates. + +Focused acceptance does not complete the broader role/backend/lifecycle matrix; historical HOLDs and deferred KVM cases retain their status. See the [release note](docs/releases/server-1.6.534.md). + ## Server v1.6.533 published; RTL visual follow-up required This candidate packages immutable Web Console `1.6.188`, source diff --git a/README.md b/README.md index 054b106b53..b4f8f8abb9 100644 --- a/README.md +++ b/README.md @@ -13,21 +13,21 @@ upstream history, authorship, licenses, and notices. ## Current release -Server [`v1.6.533`](https://github.com/PastureStack/server/releases/tag/v1.6.533) -packages Web Console `1.6.188` and Orchestration Engine `v0.183.348`. -It repairs native clipboard hover and localized feedback and includes Ubuntu's -official curl security update. Publication, immutable readback, QA startup and -restart passed with preserved volumes and runtime settings. - -The 52 clipboard locale/width/theme combinations and ordinary-HTTP copy passed. -Visual review found a separate RTL step-background alignment defect; its fix -requires a new immutable component and Server patch. This is not complete -whole-page or broader role/lifecycle acceptance. See the -[release note](docs/releases/server-1.6.533.md) for identities and evidence. +Server [`v1.6.534`](https://github.com/PastureStack/server/releases/tag/v1.6.534) +packages Web Console `1.6.189` and Orchestration Engine `v0.183.348`. +Native clipboard behavior from 188 is retained and RTL step-circle alignment is repaired; +the image also includes Ubuntu's official curl `8.18.0-1ubuntu2.8` security backport. + +Official publication, immutable readback and QA startup/restart passed with +preserved volumes and runtime overrides. The final 52 browser cases comprise 44 +unaffected 188 results and 8 new 189 fa-ir/en-us views; HTTP fallback was newly run on 189. +Broader role/backend/lifecycle acceptance and historical pending cases remain +incomplete. See the [release note](docs/releases/server-1.6.534.md) for +exact component identities, curl/VEX evidence and acceptance limits. Personal API Keys remain available without an accessible environment. Existing -API authorization, registration, OIDC/MFA and performance contracts are retained. -See the [Host guide](docs/hosts/README.md) before enrolling a host. +API authorization, registration, OIDC/MFA and performance settings retain their +contracts. See the [Host guide](docs/hosts/README.md) before enrolling a host. ## API Keys @@ -58,7 +58,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.533 + ghcr.io/pasturestack/server:v1.6.534 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -66,7 +66,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.533 + image: ghcr.io/pasturestack/server:v1.6.534 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index 7ed7d84202..9487839dae 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,21 +8,20 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the published `v1.6.533` image, packaging Web Console `1.6.188` -and Engine `v0.183.348`. See the [release note](../releases/server-1.6.533.md) -for exact identities and acceptance limits. +The example uses published Server `v1.6.534`, packaging Web Console `1.6.189` +and Engine `v0.183.348`. See the [release note](../releases/server-1.6.534.md) +for immutable identities and acceptance limits. -This release does not change these settings. Official image publication and -immutable readback passed. The QA 8080 switch preserved runtime overrides and -volumes; startup and restart checks passed. A native hover event-lifecycle -repair and 52 clipboard combinations passed in Web `1.6.188`. A separate RTL -step-background alignment defect remains pending; it does not change these -performance settings or establish a performance benchmark. +This release retains these performance settings. Official image readback and +QA startup/restart passed with preserved runtime overrides and volumes. The +final 52 browser cases use 44 carried 188 results plus 8 new 189 views; ordinary-HTTP +copy was newly verified on 189. This does +not establish a performance benchmark or complete broader acceptance. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.533 + image: ghcr.io/pasturestack/server:v1.6.534 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.533.md b/docs/releases/server-1.6.533.md index 3308639949..81cd659dce 100644 --- a/docs/releases/server-1.6.533.md +++ b/docs/releases/server-1.6.533.md @@ -29,13 +29,13 @@ Producer `6ef201a937500f894f8ec0f5a589cb7f796b66c3`；正式成品識別（非 歷史矩陣與KVM待驗維持原狀。 正式成品安全 gate 發現 curl `8.18.0-1ubuntu2.7` 的 `CVE-2026-92392` HIGH。 -本候選版改用 Ubuntu 2026-10-14 [USN-8927-1](https://ubuntu.com/security/notices/USN-8927-1) +本版採用 Ubuntu 2026-10-14 [USN-8927-1](https://ubuntu.com/security/notices/USN-8927-1) 正式修補的 `curl`、`libcurl3t64-gnutls`、`libcurl4t64` `8.18.0-1ubuntu2.8`。 三包直接取自官方安全套件庫，以簽章索引與實際 deb bytes 核對 SHA-256 後鎖定； 保留其他套件的既有 snapshot、原套件 metadata、授權與安裝路徑。 既有 `PASTURESTACK_CURL_SECURITY_SNAPSHOT=20261002T000000Z` 僅保留為 apt 來源標記； 本次 curl 三包由上述獨立官方 ADD 與 checksum 提供，不來自該舊 snapshot。 -不新增 HIGH 豁免或 vendor-pending；仍須由正式成品安全 gate 確認修補結果。 +不新增 HIGH 豁免或 vendor-pending；正式 workflow 已以既有成品安全 gate 通過。 第二次官方掃描已讀回三包 `.8`，未解決輸出仍列 74 筆：上述 curl 18 個 CVE／54 筆（含 3 筆 HIGH）及原本 20 筆 MEDIUM，curl 的 @@ -45,12 +45,12 @@ CVE 的安全補丁，並與 Ubuntu USN-8927-1、curl 上游修補 commit 交叉 `.8` PURL 生效，附官方公告、補丁與已驗簽 deb SHA-256。 gate 同步精確鎖定 69 項聲明及這 18 項修補集合，舊 `.7`、缺包、 `not_affected` 或無證據的新 CVE 都不得通過。保留 scanner 原始判斷， -不宣稱原始掃描為零，不降低 HIGH gate，仍需正式 workflow 以原 gate 重驗。 +不宣稱原始掃描為零，不降低 HIGH gate；正式 workflow 已以同一精確集合 gate 通過。 ## 邊界與升級 不改註冊API、帳號權限、OIDC、MFA、HAProxy、DB、網路後端或效能設定。 -官方成品確認後只更新Server數字tag，保留既有三卷、環境變數、restart、 +安裝／升級只使用已發布Server數字tag，保留既有三卷、環境變數、restart、 AppArmor及Runtime。無DB遷移，保留532容器／SQL備份作回復點。 保留既有OpenVEX判斷與vendor-pending精確集合；20筆MEDIUM／10CVE仍無官方 diff --git a/docs/releases/server-1.6.534.md b/docs/releases/server-1.6.534.md index c278a5423d..1e8b4d43cd 100644 --- a/docs/releases/server-1.6.534.md +++ b/docs/releases/server-1.6.534.md @@ -1,24 +1,45 @@ -# Server v1.6.534 candidate - -This candidate packages the new immutable Web Console `1.6.189` RTL -host-onboarding step alignment repair. The step circle and timeline now follow -their number on the right in RTL output, using the existing RTL compiler. -LTR geometry, SVGs, copy controls, tooltip lifecycle and API behavior are retained. - -Server `v1.6.533` and Web `1.6.188` remain immutable published artifacts. Their -52 clipboard combinations and ordinary-HTTP copy passed, but subsequent visual -review found this existing step-background defect. This candidate is a focused -follow-up, not a replacement of those artifacts or a whole-site retest. - -Engine remains `v0.183.348`; other component versions, the official Ubuntu curl -security backport, all 69 evidence-backed VEX decisions and the exact 20 -vendor-pending MEDIUM findings are retained. See the -[533 release note](server-1.6.533.md) for the security evidence. - -Native acceptance will rerun the four RTL combinations and four LTR controls, -plus a separate ordinary-HTTP native copy. The unaffected 44 combinations retain -their immutable 188 evidence. Publication, deployment and the new eight views -remain pending; historical matrix HOLDs and KVM are not promoted to PASS. - -No authentication, authorization, database, HAProxy, networking backend, volume -or performance-setting change. Preserve the previous working Server as rollback. +# Server v1.6.534 + +本版封裝正式不可變 Web Console `1.6.189`，Engine 維持 `v0.183.348`。188視覺驗收發現既有RTL步驟圓圈背景與數字分離，本版明確設定背景定位並由RTL編譯器鏡射；原hover修正、API及權限保留。 + +## 修正與驗證 + +只新增step-list背景定位，保留SVG幾何與原生tooltip行為。新增CSS檢查6／6及受影響封裝檢查38／38、當前安裝文件檢查1／1通過。188的DOM4項與原13／caption修正1項、32鍵×13語系資源證據沿用，未重新執行冒充新測。 + +## 正式成品與部署證據 + +The immutable Server producer is `52714c372b38ea0b6f56bb205fbdfb0a584707e1`. Official workflow [38663986172](https://github.com/PastureStack/server/actions/runs/38663986172) and readback of 24 assets passed without bypassing required checks. The linux/amd64 image has one runtime layer. Registry manifest: `sha256:e218bd31b39207c969f331aab097fd9773ef0071216e794f9a4bd23010d8fc96`. Distinct OCI config: `sha256:1d31677fbc05073830eaee66592a8c274edd7d4cf743c3c3371383b5e36bd7fd`. Artifact identity, not an installation command: `ghcr.io/pasturestack/server:v1.6.534@sha256:e218bd31b39207c969f331aab097fd9773ef0071216e794f9a4bd23010d8fc96`. Documentation commits do not replace the producer. + +Immutable Web producer: `f30f5e81dd9ee25878c3aff681eed5bb61883453`. `web-console-1.6.189.tar.gz` is 3,024,592 bytes, SHA-256 `1c90e273b7db8ebf9d851a0ae1ec49dc59067b5ee1099ea3886919c1a79ccdfc`. Official publication and anonymous readback passed; later documentation commits do not replace this producer. + +正式 QA 部署與重啟檢查通過；部署讀回的 producer、manifest 與 config符合上述正式成品，原資料卷與 runtime 覆寫保留。文件 main 與成品 producer 分開。 + +最終矩陣為13語系×1440／390px×亮／暗色共52組PASS：44組同來源未受CSS影響的188證據沿用，fa-ir/en-us共8組在189新跑，絕非52組皆189新跑。另於189以未覆寫 Clipboard API 的普通 HTTP 瀏覽器確認 API 不存在時的原生 fallback，實際複製與精確剪貼簿讀回通過；拒絕權限的失敗提示是明確 denial fixture，兩者分列。偏好、呈現與剪貼簿已恢復，頁面錯誤、缺翻譯與非預期資源寫入均為0。原13／caption修正1項與188實際DOM4項證據沿用；32鍵×13語系資源來源未變，沒有重跑冒充新結果。歷史全矩陣仍未完成，HOLD與KVM待驗維持原狀；187 hover失敗不追認通過。 + +## curl 官方修補與掃描判定 + +v1.6.533 的第一個未發布候選在正式成品安全 gate 發現 curl `8.18.0-1ubuntu2.7` 的 `CVE-2026-92392` HIGH。 +本版採用 Ubuntu 2026-10-14 [USN-8927-1](https://ubuntu.com/security/notices/USN-8927-1) +正式修補的 `curl`、`libcurl3t64-gnutls`、`libcurl4t64` `8.18.0-1ubuntu2.8`。 +三包直接取自官方安全套件庫，以簽章索引與實際 deb bytes 核對 SHA-256 後鎖定； +保留其他套件的既有 snapshot、原套件 metadata、授權與安裝路徑。 +既有 `PASTURESTACK_CURL_SECURITY_SNAPSHOT=20261002T000000Z` 僅保留為 apt 來源標記； +本次 curl 三包由上述獨立官方 ADD 與 checksum 提供，不來自該舊 snapshot。 +不新增 HIGH 豁免或 vendor-pending；正式 workflow 已以既有成品安全 gate 通過。 + +該版第二次未發布候選的官方掃描已讀回三包 `.8`，未解決輸出仍列 74 筆：上述 curl +18 個 CVE／54 筆（含 3 筆 HIGH）及原本 20 筆 MEDIUM，curl 的 +`FixedVersion` 欄位仍空白。正式 `.8` deb 的變更紀錄逐項列出這 18 個 +CVE 的安全補丁，並與 Ubuntu USN-8927-1、curl 上游修補 commit 交叉核對。 +本版以 OpenVEX `fixed` 記錄已套用的 Ubuntu backport；每項只對三個精確 +`.8` PURL 生效，附官方公告、補丁與已驗簽 deb SHA-256。 +gate 同步精確鎖定 69 項聲明及這 18 項修補集合，舊 `.7`、缺包、 +`not_affected` 或無證據的新 CVE 都不得通過。保留 scanner 原始判斷， +不宣稱原始掃描為零，不降低 HIGH gate；正式 workflow 已以同一精確集合 gate 通過。 + +## 邊界與升級 + +不改註冊API、帳號權限、OIDC、MFA、HAProxy、DB、網路後端或效能設定。安裝／升級使用Server數字tag `v1.6.534`，保留既有三卷、環境變數、restart、AppArmor及Runtime。無DB遷移，保留533映像／資料備份作回復點；部署成功不代表實際回滾演練完成。 + +保留既有OpenVEX判斷與vendor-pending精確集合；20筆MEDIUM／10CVE仍無官方 +修補版，2026-10-20複查。正式workflow必要安全與來源檢查不可繞過。