diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index f4bd36b2d2..ea81006d4f 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,12 +1,18 @@ # Compatibility Contract -## Server v1.6.537 prepared, not published - -This candidate targets Web Console `1.6.190` and Engine `v0.183.350`. -Component producer commits and artifact SHA-256 values are pinned in the recipe. -Server producer, final image identity and official release checks remain pending. See the -[candidate note](docs/releases/server-1.6.537.md). No Server537 publication or -deployment is claimed; the Server536 identities below remain historical facts. +## Server v1.6.537 published + +Immutable Server producer `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e` packages +official Web Console `1.6.190` and Engine `v0.183.350`. Official workflow +[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175) +and anonymous exact-set readback of all 24 assets passed without bypassing checks. +Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`. +Distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`. +Artifact identity (not an installation command): +`ghcr.io/pasturestack/server:v1.6.537@sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`. +The linux/amd64 image has one runtime layer; documentation commits do not replace +the producer. Numeric installation tags remain required. See the +[release note](docs/releases/server-1.6.537.md). Stack and Service `archived` is a persisted boolean with missing values treated as false. Archive requires stopped services and instances, rejects system/driver @@ -27,11 +33,16 @@ warns that mounts and volumes are retained and require operator backups. Reviewed pre-release isolated evidence covers focused tests, native role/Key archive/restore, thirteen-locale layouts, owner-read Key audit, and separate physical workload/mount preservation and first-host checks. It does not establish -the final537 image or future published190/350 artifact identities. Existing API +an exhaustive preserved-database upgrade or distributed race matrix. Separate +official final-image startup/restart passed with HTTP200/pong after 12/8 polling +attempts, with 34 MFA-policy API checks and seven registration-entry checks; this +is not a Docker Healthcheck or a company-production deployment claim. Existing API Key policy, authentication/OIDC/MFA, three-volume persistence, CLI defaults, performance overrides and firewall contracts are not changed by this feature. -Security document release IDs advance only; VEX statements, vendor findings and -their review deadlines are preserved pending the new final-image security gate. +The new final-image scan records 66 raw findings and the existing exact 22 unfixed +package findings across 11 CVEs after VEX policy, review 2026-10-20. Its gate passed +with zero untracked, critical/high, fixed-available or secret findings. VEX and +vendor tracking are not remediation, a HIGH waiver or a zero-risk claim. ## Server v1.6.536 published diff --git a/README.md b/README.md index 80bfe55db9..7d09959dd9 100644 --- a/README.md +++ b/README.md @@ -11,15 +11,19 @@ upstream history, authorship, licenses, and notices. -## Current source candidate +## Current release -Server `v1.6.537` is a prepared source candidate, not a published image. -It targets Web Console `1.6.190` and Engine `v0.183.350` for persistent -Stack/Service archive and restore. See the [candidate note](docs/releases/server-1.6.537.md) -for the behavior, isolated acceptance scope, pinned component identities and -remaining Server publication gates. -The latest published release remains [Server `v1.6.536`](https://github.com/PastureStack/server/releases/tag/v1.6.536); -its [release note](docs/releases/server-1.6.536.md) retains the official artifact evidence. +[Server `v1.6.537`](https://github.com/PastureStack/server/releases/tag/v1.6.537) +packages Web Console `1.6.190` and Engine `v0.183.350` for persistent +Stack/Service archive and restore. The official source/build, fresh startup/restart, +security/SBOM and anonymous artifact readback gates passed. See the +[release note](docs/releases/server-1.6.537.md) for the immutable producer and +image identities, archive behavior and bounded acceptance evidence. + +Producer: `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`. +Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`; +distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`. +Documentation updates do not replace the producer or its immutable artifacts. Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -46,9 +50,7 @@ Maintained CLI `0.6.18` propagates rejected requests as nonzero errors. Legacy ` ## Quick start Public GHCR downloads do not require a registry login. Keep all three named volumes. -The examples below target the prepared numeric `v1.6.537` tag; run them only after its official release. -This candidate is not yet available from GHCR. Until publication, use the latest -published release identified above. +The examples below use the published numeric `v1.6.537` tag. ```sh docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ diff --git a/docs/README.md b/docs/README.md index 7211e6e771..74dec84e48 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,9 +7,11 @@ runtime gates have passed. ## Release notes -- [Server v1.6.537 candidate](releases/server-1.6.537.md) — prepared for Web - Console `1.6.190` and Engine `v0.183.350` archive/restore. Component identities - are pinned; official Server image/publication gates remain pending. +- [Server v1.6.537](releases/server-1.6.537.md) — published Web Console `1.6.190` + and Engine `v0.183.350` archive/restore; official source/build, fresh startup/restart, + final-image security/SBOM and anonymous 24-asset/image readback passed. + Immutable producer and manifest/config identities are recorded separately from + documentation. Pre-release feature acceptance retains its bounded original scope. - [Server v1.6.529](releases/server-1.6.529.md) — published with Engine `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its diff --git a/docs/performance/README.md b/docs/performance/README.md index 7214375e6a..85f85f3192 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,11 +8,15 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example targets prepared Server `v1.6.537`, Web Console `1.6.190` and Engine -`v0.183.350`; run it only after its official release and image have been published and read back. -This candidate is not yet available from GHCR. See the -[candidate note](../releases/server-1.6.537.md) for pinned component identities -and the bounded pre-release acceptance evidence. +The example uses published Server `v1.6.537`, Web Console `1.6.190` and Engine +`v0.183.350`. Official workflow +[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175) +and anonymous release/image readback passed. Immutable producer: +`f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`; +manifest `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`; +distinct OCI config `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`. +See the [release note](../releases/server-1.6.537.md) for component identities +and the bounded acceptance evidence. Documentation changes do not replace the producer. This release retains the same performance-setting contract. Existing runtime overrides and volumes must be preserved on upgrade or code rollback. Archive and diff --git a/docs/releases/server-1.6.537.md b/docs/releases/server-1.6.537.md index 7b46bfd5f5..887603d036 100644 --- a/docs/releases/server-1.6.537.md +++ b/docs/releases/server-1.6.537.md @@ -1,12 +1,38 @@ -# Server v1.6.537 candidate +# Server v1.6.537 -Prepared source only; no Server image or release has been published. - -This candidate targets Web Console `1.6.190` and Engine `v0.183.350` for +Published Server `v1.6.537` packages Web Console `1.6.190` and Engine `v0.183.350` for Stack/Service archive and restore. It retains the pinned Server460 build base, the other component producers, maintained CLI `v0.6.18` defaults, authentication, performance settings and the three-volume persistence contract. +## Immutable publication + +Producer: `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`. +Official workflow +[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175) +passed all source/build, fresh startup/restart, final-image security/SBOM and +publication gates without bypassing required checks. Anonymous readback verified +the exact 24-asset roster and SHA-256 values, registry identity, versions and source. + +Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`. +Distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`. +Artifact identity (not an installation command): +`ghcr.io/pasturestack/server:v1.6.537@sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`. +The single linux/amd64 runtime layer was flattened from 22 build layers with +identical runtime configuration. Documentation commits do not replace the producer. + +The official disposable database started/restarted to HTTP200/pong after 12/8 +polling attempts, including public-origin/private-cache checks, 34 MFA-policy API +checks and seven registration-entry checks. These are not a Docker Healthcheck, +an active-node registration proof or a company-production deployment claim. + +The final merged-rootfs scan (Trivy0.74.0) records 66 raw findings. After the +existing exact VEX/vendor policy, 22 unfixed package findings across 11 CVEs remain +tracked for review on 2026-10-20. The gate passed with zero untracked, +critical/high, fixed-available or secret findings. Tracking is not remediation, +not_affected or a HIGH waiver, and neither a source SBOM nor this gate proves zero risk. +Image provenance and SBOM attestations were published for the manifest above. + ## Behavior `archived` is a server-persisted boolean; missing values mean false. Archive @@ -27,10 +53,10 @@ older Engines without the field do not offer archive. Native v1/v2-beta writes retain the original role and API Key `update` authorization, including live owner RBAC and scope limits. Archive writes send only `archived`. -## Reviewed isolated candidate evidence +## Reviewed isolated pre-release evidence The following local acceptance receipts concern pre-release feature inputs, -not the final537 image or the future published190/350 artifact identities: +not a rerun of the final537 image or a whole-platform acceptance matrix: - `backend-tests.json`: 63 unique focused tests, zero failures/errors/skips. - `frontend-tests.json`: 37 unique focused tests; 36 unaffected results are @@ -57,15 +83,15 @@ not the final537 image or the future published190/350 artifact identities: These checks do not claim a full preserved-database upgrade, distributed multi-node race test, unrelated OIDC/MFA rerun or final release-image validation. -Formal image health/restart, security scan/SBOM, anonymous asset readback and -publication remain separate gates. Do not turn these local receipt names into -published asset claims without attaching their reviewed immutable evidence. +The separate final-image publication gates are recorded above. Do not turn these +local receipt names into published asset claims without attaching their reviewed +immutable evidence. -## Component identities and remaining release gates +## Component identities The recipe pins the following reviewed packager outputs, not previous189/349 -identities. Official component publication/readback must complete before Server -assembly; the pins alone do not establish a published Server image. +identities. Official Web190 and Engine350 publication and anonymous artifact +readback completed before Server assembly; the pins alone are not publication evidence. | Input | Pinned value | Locations | | --- | --- | --- | @@ -84,19 +110,16 @@ Its `WEB-INF/lib/cattle-resources-0.183.350.jar` contains `schema/v1/readonly.se and `schema/v1/restricted.ser` (355,023 bytes, SHA-256 `f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51`). These actual reads confirm the retained frozen-schema pins for this artifact. -Server537 producer commit, manifest/config digests, workflow and publication -readback are also pending and must be recorded from the actual final outputs. The existing coordinate predicates continue to reject placeholders. OpenVEX and vendor tracking advance their release IDs only: the 69 VEX statements, 11 vendor-pending CVEs/22 package rows, severities, fix policy and 2026-10-20 review -deadline are unchanged. This metadata update is not a new scan or remediation; -the new final-image security gate must still verify the exact current findings. +deadline are unchanged. The metadata update is not remediation; the separate +final-image scan verified the exact current findings as recorded above. ## Install and rollback boundary Operational examples use only `ghcr.io/pasturestack/server:v1.6.537`, never a -digest-qualified or SHA-only installation tag. Run them only after official -publication and readback. Preserve all three existing named volumes, runtime -overrides and a working rollback container; do not restore old policy/revocation +digest-qualified or SHA-only installation tag. Preserve all three existing named +volumes, runtime overrides and a working rollback container; do not restore old policy/revocation or database state merely to roll back code. See the [upgrade guide](../upgrades/README.md).