From 41d7dac2b35be964a4b104c4e01efe0e63c022bf Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Thu, 15 Oct 2026 11:24:50 +0800 Subject: [PATCH] docs: align current release and scoped-key acceptance --- COMPATIBILITY.md | 53 +++++++++++++++++++++++++++++++ README.md | 25 +++++++-------- docs/performance/README.md | 15 +++++---- docs/releases/server-1.6.535.md | 56 +++++++++++++++++++++++++++++++-- 4 files changed, 125 insertions(+), 24 deletions(-) diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 2a5b1fe634..c854a02e26 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,5 +1,58 @@ # Compatibility Contract +## Server v1.6.535 published + +This patch packages immutable Engine `v0.183.349` with unchanged Web Console +`1.6.189`. Engine producer: `0733430fac11892a17ba53749fe02d99d26b1f52`; +`cattle.jar` SHA-256: +`6e61f05598c12941c3b07ebfcf81f40e7fb1bd5439ec4c7d9c34484306378f04`. + +Server producer: `6b7dca3a4d9154e37f9475e7b47d73bce26e1938`. +Official workflow [38672753267](https://github.com/PastureStack/server/actions/runs/38672753267) +and immutable readback of 24 assets passed without bypassing required checks. +The linux/amd64 image has one runtime layer. Manifest: +`sha256:634613baf631d54e4cf576aeaa2f9f003b035fdfec4a28e28aa3c8f0aa38283d`. +Distinct OCI config: +`sha256:599313735f18cc95330e0bbb76bd76bd74251c8bc4f56cba019afed4a0a3fc31`. +Documentation commits are separate from the immutable producer. + +Fifteen resource-typed action pairs extend scoped-Key admission and queued +reclassification without adding restrictions to Full/legacy Keys or widening +owner authority. The focused Engine suite passed 150 cases and affected Server +packaging contracts passed 38 cases; unaffected suites are carried forward. +No schema migration, runtime patch, authentication or firewall change is needed. + +The official 535 image passed QA startup/restart and ten bounded native Stack +output cases across both API roots, with eight audit pairs and normal fixture +cleanup. Actual 535 -> retained 534 -> 535 code rollback retained Closed/expired +Key policy, revision and expiry in twelve denial cases without restoring the +database. The final container was ready 535 and the two test Keys were removed. +Prior six-role OIDC A comparisons retain their original 534 provenance; neither +this release nor those results claim completion of every role/action combination. + +The final-image gate reports zero untracked, critical/high, fixed-available or +secret findings under its existing vendor/VEX policy. It retains 22 unfixed +MEDIUM package findings across 11 CVEs for review on 2026-10-20. Newly reported +CVE-2026-107161 remains Ubuntu 26.04 Needs evaluation; its upstream CVSS 7.5 High +score is retained, not represented as fixed or not affected. See the +[release note](docs/releases/server-1.6.535.md) for acceptance and rollback limits. + +### Legacy CLI error reporting + +The configured official CLI `0.6.14` download is an external client, not an +executable installed inside Server. Native Full and stored-null legacy Key +`inspect` commands produced identical data with no extra authentication headers. +Legacy policy readback is canonical Full with revision zero, not JSON null. + +The same client returned exit code zero and no output when a Closed Key was +correctly rejected with HTTP 403 `KeyPolicyDenied`; the server's matching audit +pair confirms denial, not successful access. This client error-reporting defect +remains open. The maintained `0.6.17` source propagates the error, but it is not a +published product and its original release gates have not passed. Do not treat +empty CLI output or exit zero as proof of a successful API operation. Use an +HTTP client that checks response status for constrained-Key automation until a +verified maintained CLI is released. The server does not waive the Key policy. + ## Server v1.6.534 published This release packages immutable Web Console `1.6.189` and unchanged Engine `v0.183.348`. diff --git a/README.md b/README.md index b4f8f8abb9..c78fe5f346 100644 --- a/README.md +++ b/README.md @@ -13,17 +13,14 @@ upstream history, authorship, licenses, and notices. ## Current release -Server [`v1.6.534`](https://github.com/PastureStack/server/releases/tag/v1.6.534) -packages Web Console `1.6.189` and Orchestration Engine `v0.183.348`. -Native clipboard behavior from 188 is retained and RTL step-circle alignment is repaired; -the image also includes Ubuntu's official curl `8.18.0-1ubuntu2.8` security backport. - -Official publication, immutable readback and QA startup/restart passed with -preserved volumes and runtime overrides. The final 52 browser cases comprise 44 -unaffected 188 results and 8 new 189 fa-ir/en-us views; HTTP fallback was newly run on 189. -Broader role/backend/lifecycle acceptance and historical pending cases remain -incomplete. See the [release note](docs/releases/server-1.6.534.md) for -exact component identities, curl/VEX evidence and acceptance limits. +Server [`v1.6.535`](https://github.com/PastureStack/server/releases/tag/v1.6.535) +packages Web Console `1.6.189` and Orchestration Engine `v0.183.349`. +Scoped API Keys recognize additional existing Stack, Service, Container and Volume +actions through a resource-typed central registry. Full and legacy Keys retain +the normal authorization path; a Key cannot exceed its owner's live permissions. +See the [release note](docs/releases/server-1.6.535.md) for artifact identities, +focused acceptance and upgrade/rollback boundaries. This is not a claim that +every platform action or historical matrix item has been verified. Personal API Keys remain available without an accessible environment. Existing API authorization, registration, OIDC/MFA and performance settings retain their @@ -47,6 +44,8 @@ Engine-verified project contexts; a caller-supplied project header is not a gran Delegated terminal/log access requires the verified Host API audit capability and a compatible Linux Node Agent lifecycle. Open a Key's audit from its action menu. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. +For automation, check HTTP status explicitly: legacy CLI `0.6.14` can silently +exit successfully after a rejected request. See [client compatibility](COMPATIBILITY.md#legacy-cli-error-reporting). ## Quick start @@ -58,7 +57,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.534 + ghcr.io/pasturestack/server:v1.6.535 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -66,7 +65,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.534 + image: ghcr.io/pasturestack/server:v1.6.535 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index 9487839dae..26fe664fd3 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,20 +8,19 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses published Server `v1.6.534`, packaging Web Console `1.6.189` -and Engine `v0.183.348`. See the [release note](../releases/server-1.6.534.md) +The example uses published Server `v1.6.535`, packaging Web Console `1.6.189` +and Engine `v0.183.349`. See the [release note](../releases/server-1.6.535.md) for immutable identities and acceptance limits. -This release retains these performance settings. Official image readback and -QA startup/restart passed with preserved runtime overrides and volumes. The -final 52 browser cases use 44 carried 188 results plus 8 new 189 views; ordinary-HTTP -copy was newly verified on 189. This does -not establish a performance benchmark or complete broader acceptance. +This release retains the same performance-setting contract. Existing runtime +overrides and volumes must be preserved on upgrade or code rollback. The scoped +API Key action repair does not establish a performance improvement or complete +broader acceptance. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.534 + image: ghcr.io/pasturestack/server:v1.6.535 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.535.md b/docs/releases/server-1.6.535.md index 6df45e1960..5248003350 100644 --- a/docs/releases/server-1.6.535.md +++ b/docs/releases/server-1.6.535.md @@ -3,6 +3,19 @@ This patch packages immutable Engine `v0.183.349` with unchanged Web Console `1.6.189` and the existing component set. +## Published artifact + +Server producer: `6b7dca3a4d9154e37f9475e7b47d73bce26e1938`. +The normal official workflow +[38672753267](https://github.com/PastureStack/server/actions/runs/38672753267) +and immutable readback of 24 assets passed. The linux/amd64 image has one runtime +layer; its manifest is +`sha256:634613baf631d54e4cf576aeaa2f9f003b035fdfec4a28e28aa3c8f0aa38283d`. +The distinct OCI config is +`sha256:599313735f18cc95330e0bbb76bd76bd74251c8bc4f56cba019afed4a0a3fc31`. +Installation examples use the numeric `v1.6.535` tag, not a digest-pinned command. +Later documentation commits do not replace this producer. + ## Scoped API Key action repair Fifteen exact persisted-resource/action pairs are registered centrally, including @@ -24,9 +37,36 @@ Engine suite passed 150 cases without replaying unrelated suites. The previous Server's normal-vs-Full/legacy read comparison and six-role OIDC normal-vs-Full checks are carried as their original evidence. They cover the -tested accounts and operations, not every account, action or matrix row. Native -packaged action acceptance, official final-image security checks, deployment and -rollback are separate gates; component publication alone does not prove them. +tested accounts and operations, not every account, action or matrix row. On 534, +the administrator comparison covered 156 read cases; six OIDC roles used one +existing identity each, with exact visible-set/schema comparisons and bounded +owned writes or foreign-ID rejection according to live capabilities. This is +not a two-identities-per-role or whole-platform permission matrix. + +On the official 535 image, ten native cases across v1 and v2-beta passed: +normal/Full compatibility, exact custom update, other-ID rejection and read-only +rejection for Stack outputs. Eight authorization/response audit pairs matched +request IDs. The two empty Stacks and three Keys were normally removed. This +does not claim native coverage of all fifteen new mappings or every API action. + +QA startup and restart passed with original volumes and runtime overrides. +An actual 535 -> retained 534 -> 535 stop/start cycle used the same database and +normal session: twelve cases retained exact policy/revision/expiry and rejected +Closed and expired Keys on both API roots. It finished on ready 535 and removed +both test Keys. The expiration barrier uses the server clock; deliberately +expired authentication is rejected before successful principal headers are set. +No old database was restored. Deactivated-Key rollback and a full role/client +rollback matrix are not claimed. + +The configured official external CLI `0.6.14` was also exercised without new +headers. Full and stored-null legacy Keys returned identical native `inspect` +data; each issued six HTTP 200 requests with complete audit pairs. A Closed Key +was correctly rejected by Server with 403 `KeyPolicyDenied` and a matching audit +pair, but the old CLI swallowed that error and exited zero with no output. This +is an unresolved client-reporting failure, not authorization bypass or a complete +interoperability PASS. The maintained source already fixes propagation; its +formal release remains a separate required gate. No CLI artifact or release +check was replaced, waived or declared successful by this Server release. ## Upgrade and rollback @@ -39,3 +79,13 @@ The existing Ubuntu curl backport and precise OpenVEX decisions are unchanged. Unfixed LOW/MEDIUM findings remain in the versioned vendor-pending tracker; none is hidden or promoted to a HIGH waiver. The normal source, CodeQL and final-image security gates remain required. + +The first unpublished attempt was correctly rejected when the vulnerability +feed added CVE-2026-107161 for two Cyrus SASL package versions. Ubuntu lists +26.04 as [Needs evaluation](https://ubuntu.com/security/CVE-2026-107161), with +Medium vendor priority and no fixed package. Its upstream CVSS v3 score is 7.5 +High. The exact versions were registered without changing packages, VEX decisions +or security thresholds. The successful final gate records 22 unfixed MEDIUM +package findings across 11 CVEs, review date 2026-10-20; zero untracked, +critical/high, fixed-available and secret findings under the existing policy. +Raw findings and the failed attempt remain evidence, not a zero-risk claim.