diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 8671c8c7db..2163f6779f 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -2,28 +2,60 @@ -## Server v1.6.553 prepared, not published +## Server v1.6.553 published -This candidate adds the exact accepted Google Brotli fix for CVE-2026-111497 to -the Ubuntu runtime package. Ubuntu's distribution advisory remains under -evaluation; the downstream package is a PastureStack rebuild, not a Canonical -release. Original package ownership, ABI and ordinary compression/streaming -tests must pass before consumers install it. - -Publication requires the qualified immutable bundle, final-rootfs package and -linkage readback, SBOM and the existing full-severity scan policy. Existing -unfixed findings and the original raw reports remain separate. No publication, -deployment or multi-Host acceptance is claimed by this source preparation. - -The candidate pins published Catalog `v0.3.18` source +The published linux/amd64 image is +`ghcr.io/pasturestack/server:v1.6.553@sha256:daf2562134dcd735a265f531f2e7fdf0a3aca762062566e4406c35ba7ce81101`, +produced from `b0c121abf9a812f83204ee93bb28ee7046815021` in successful +[run 40182084293](https://github.com/PastureStack/server/actions/runs/40182084293). +Its distinct OCI config is +`sha256:bf7147449c0e9e029579b6ae708abd7506d4dfccf5ca7c7966474f254aa4afb9`. +All 35 anonymous release assets matched their producer checksums; native OCI +provenance and CycloneDX attestations matched this exact image and source. +Documentation commits do not change the runtime producer. + +The qualified build-only Ubuntu backport bundle applies the accepted Google +Brotli decoder fix for CVE-2026-111497. The final image verified +`libbrotli1 1.2.0-3build1+pasturestack.1` through an ordinary compression and +linkage control. Its seven selected existing packages are `libbrotli1`, +`libc-bin`, `libc-gconv-modules-extra`, `libc6`, `libp11-kit0`, `libpcre2-8-0` +and `libpcre2-posix3`. Package ownership, ABI, configuration and the original +package set/provider are preserved. These are PastureStack downstream rebuilds +of pinned Ubuntu sources, not packages issued by Canonical. + +The release pins published Catalog `v0.3.18` source `00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and Node Agent `v1.2.34`, based on compatibility base `v0.3.8`. Their immutable publication identities remain -separate from this Server candidate and its later deployment acceptance. +separate. Web Console `1.6.195`, Engine `v0.183.354`, Host API `0.38.8` and +Temurin `25.0.5+8` retain their verified inputs and application behavior. + +The full raw report retains 51 finding occurrences; the qualified effective +report retains 10 occurrences across nine officially unfixed CVEs. Critical, +High, available-fix and secret counts are zero under the existing release +policy. Exact-package code-absence decisions do not exempt the entire image. +The original browser runtime SBOM and its incomplete coverage are retained; +this release does not claim a new browser attestation or complete coverage. + +Scoped QA8080 cutover, actual Brotli runtime control, strict TLS, one Server +restart and post-restart verification passed. Environment, mounts, AppArmor, +restart policy and the three existing data volumes were preserved. All three +Hosts/Agents are active; Agent `v1.2.34` has its separate per-Host acceptance +receipts. The Server552 rollback remains retained. Eight-Stack functional +and normal finish-upgrade acceptance passed separately across both projects. +Together with the two previously completed independent Stack adoptions, the +security-refresh scope has ten accepted affected Stacks and three Node Agent +`v1.2.34` adoptions. The two unchanged NFS/diagnostics Stacks retain their health readbacks +without new owning-function tests. Existing tenant container IDs, mounts and +marker hashes were preserved; rollback checkpoints and old images remain. +Role, UI and language evidence is carried forward, not rerun for this CVE refresh. Keep the existing environment, authentication, firewall backend, mounts, volumes and restart policy. Infrastructure Stacks and Host Agents adopt new images only through their normal upgrade lifecycle; changing Server defaults does not override an operator's existing database settings. +See the [release note](docs/releases/server-1.6.553.md) for publication and +scoped deployment evidence. Production, HAProxy and host firewall configuration +were not changed by this QA deployment. diff --git a/README.md b/README.md index 4848acf534..a4be1d96b6 100644 --- a/README.md +++ b/README.md @@ -11,25 +11,21 @@ upstream history, authorship, licenses, and notices. -## Current source candidate +## Current release -Server `v1.6.553` is a prepared source candidate, not a published image. -It adds the accepted Google Brotli fix for CVE-2026-111497 through the qualified +[Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553) +is published. It applies the accepted Google Brotli fix for CVE-2026-111497 through the qualified Ubuntu backport bundle. Only already-installed packages are updated; package sets, providers, library interfaces and configuration are preserved. Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`, Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs. Node Agent `v1.2.34` uses compatibility base `v0.3.8`. Published Catalog -`v0.3.18` is pinned to `00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and records -the qualified component images and their publication evidence. +`v0.3.18` records the qualified component images and their publication evidence. See its [release note](docs/releases/server-1.6.553.md) and the [compatibility contract](COMPATIBILITY.md#server-v16553-brotli) for producer identities, immutable image digests, SBOMs and remaining findings. -The current published release remains -[Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552), -with its [release note](docs/releases/server-1.6.552.md). Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -56,8 +52,6 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy ` ## Quick start Public GHCR downloads do not require a registry login. Keep all three named volumes. -This candidate is not yet available. The examples below use its numeric tag; -run them only after its official release. ```sh docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ diff --git a/docs/README.md b/docs/README.md index a13950b5b8..290f33bdc9 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,6 +7,9 @@ runtime gates have passed. ## Release notes +- [Server v1.6.553](releases/server-1.6.553.md) — published qualified Brotli + security backports, with exact artifact identities and scoped QA evidence + recorded separately from component publication. - [Server v1.6.549](releases/server-1.6.549.md) — published Web Console 1.6.195 with an independent browser runtime SBOM, exact artifact identity and separate fresh-DB component lookup. The release note records incomplete coverage, diff --git a/docs/performance/README.md b/docs/performance/README.md index fcedfc17b0..3ab13b789d 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,9 +8,7 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the prepared numeric Server v1.6.553 tag. It -is not yet available from GHCR; -run it only after its official release and image have been published and read back. +The example uses the published numeric Server `v1.6.553` image. See the [release note](../releases/server-1.6.553.md) and the [current release](../../README.md#current-release) for component versions and release details. Preserve the existing runtime overrides and all three named diff --git a/docs/releases/server-1.6.553.md b/docs/releases/server-1.6.553.md index 24cf266533..6c6aa3f76b 100644 --- a/docs/releases/server-1.6.553.md +++ b/docs/releases/server-1.6.553.md @@ -1,8 +1,10 @@ -# Server v1.6.553 candidate +# Server v1.6.553 -Prepared source only; no Server image or release has been published. -Deployment acceptance is not claimed until the normal protected release workflow -and the affected runtime checks complete. +Published image: `ghcr.io/pasturestack/server:v1.6.553@sha256:daf2562134dcd735a265f531f2e7fdf0a3aca762062566e4406c35ba7ce81101`. + +Source commit: `b0c121abf9a812f83204ee93bb28ee7046815021`. + +The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results. ## Verified component inputs @@ -40,3 +42,81 @@ retain their earlier results. Runtime adoption must identify the actual container digest on each eligible Host; registry publication alone is not deployment acceptance. Production, HAProxy and host firewall configuration are outside this QA deployment. + +## Independent publication readback + +[Publisher run 40182084293](https://github.com/PastureStack/server/actions/runs/40182084293) +completed successfully. All 35 anonymous release assets matched the producer's +SHA256SUMS and GitHub asset digests. Anonymous tag/manifest/config readback and +both native OCI provenance and CycloneDX attestations matched the exact producer +and manifest above. The distinct OCI config is +`sha256:bf7147449c0e9e029579b6ae708abd7506d4dfccf5ca7c7966474f254aa4afb9`. +The published release-note body above is retained unchanged; later documentation +commits do not become the image producer. + +The final image verified seven already-installed backport packages, including +`libbrotli1 1.2.0-3build1+pasturestack.1`, with ordinary compression and linkage +controls. Package/provider/configuration preservation and consumer receipts +passed. The raw scan retains 51 finding occurrences; the qualified effective +report retains 10 occurrences across nine officially unfixed CVEs. Available +fixes, unreviewed findings, Critical/High findings and secrets remain blocking. +The existing browser runtime SBOM retains its original identity and incomplete +coverage; no complete-browser-coverage claim or new browser attestation is added. + +## Scoped QA8080 Server deployment + +The isolated QA8080 deployment adopted this exact published image and source. +Cutover, independent identity/configuration verification, ordinary Brotli runtime +control, strict TLS (`200 ssl_verify_result=0`), one Server restart and a second +identity/configuration verification passed. The existing environment, mounts, +AppArmor, restart policy and three data volumes were preserved. + +The active Server container is `99afac6647e1`; the preceding Server552 container +`b7be489f6085` is retained as +`pasturestack-server-v1.6.552-rollback-553-20261025`, with the original image and +matching data checkpoint preserved. All three Hosts and Agents were active. +The separate Agent `v1.2.34` adoption receipts passed 15 checks on each Host; +these are not a new application/UI/role matrix. + +The retained local QA receipts below are separate from the publisher's public +release assets. They bind the Server-only deployment scope; production, +HAProxy, host firewall changes and broader role/UI acceptance are outside it. + +| QA receipt | SHA-256 | +| --- | --- | +| `server553-qa-cutover.json` | `fdf8c3c889c7c2f73da86b47533a6275cc002bd7241264df22fa1a9f3f19c6e6` | +| `server553-qa-verify.json` | `ec920d6d7ff0108e12017b465c542de36e2891376fa58eb3e5ef69e495791d32` | +| `server553-qa-smoke.json` | `5bd94dc1d72527dd50770f5d62928198204f85766415fb88f2cfd9029a692920` | +| `server553-qa-restart.json` | `c61d4fe0d30f9a18a8eb53d38a22fcec158a5e7908eed4ac6f9ef106004c2d4b` | +| `server553-qa-verify-after-restart.json` | `863b25498bdbd778f0252ed3b574752e99f8b5e56334d39bd3542b1374b033d1` | + +## System Stack adoption + +The security refresh has accepted ten affected Stacks: the two independently +completed `network-policy-manager` and `secret-volume-driver` adoptions retain +their original PASS receipts, and the eight Brotli-target Stacks completed +normal Catalog upgrades and `finishupgrade` across Default and the isolated +single-Host project. Those eight final receipts report PASS for complete named +primary/sidekick configuration, exact runtime artifact/producer and Host-role +coverage, rollback retention and post-finish checks. They are active. + +One Default bidirectional probe passed cross-Host IPsec SA/packet-delta, DNS and +strict TLS/egress checks. One isolated `1h19` managed namespace passed DNS, +Metadata and strict TLS/egress checks; it makes no cross-Host claim. The common +`runtime553-functional-group.json` receipt has SHA-256 +`7ec2af7ca38ee98d783a0d8c6ea94a397951f664f71204dcd7bf0fc2aa571ac0` +and binds all eight current service/launch/instance/artifact sets. Each Stack's +separate `runtime553--stack-final.json` records the final completion. + +The normal replacements and recorded healthy states provide the affected +scheduler/health-reporting evidence; no additional test Stacks were created. +Before and after the project probes, the existing `qa545upgrade` tenant +container IDs, images, volume mounts and data-marker hashes matched the retained +Agent snapshots on all three Hosts. Full private checkpoints and previous +images remain available for rollback. + +The three Agent `v1.2.34` adoptions retain their 15-check per-Host PASS receipts. +The other two unchanged NFS/diagnostics Stacks carry forward their health +readbacks without new owning-function runs. This acceptance is limited to the +CVE refresh; role, UI, language and other unaffected evidence is retained and +was not rerun or promoted to a new full-matrix PASS.