Skip to content

Document published Server 553 and scoped fleet acceptance #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 25, 2026
Merged

Document published Server 553 and scoped fleet acceptance #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 46 additions & 14 deletions COMPATIBILITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,60 @@

<a id="server-v16553-brotli"></a>

## Server v1.6.553 prepared, not published
## Server v1.6.553 published

This candidate adds the exact accepted Google Brotli fix for CVE-2026-111497 to
the Ubuntu runtime package. Ubuntu's distribution advisory remains under
evaluation; the downstream package is a PastureStack rebuild, not a Canonical
release. Original package ownership, ABI and ordinary compression/streaming
tests must pass before consumers install it.

Publication requires the qualified immutable bundle, final-rootfs package and
linkage readback, SBOM and the existing full-severity scan policy. Existing
unfixed findings and the original raw reports remain separate. No publication,
deployment or multi-Host acceptance is claimed by this source preparation.

The candidate pins published Catalog `v0.3.18` source
The published linux/amd64 image is
`ghcr.io/pasturestack/server:v1.6.553@sha256:daf2562134dcd735a265f531f2e7fdf0a3aca762062566e4406c35ba7ce81101`,
produced from `b0c121abf9a812f83204ee93bb28ee7046815021` in successful
[run 40182084293](https://github.com/PastureStack/server/actions/runs/40182084293).
Its distinct OCI config is
`sha256:bf7147449c0e9e029579b6ae708abd7506d4dfccf5ca7c7966474f254aa4afb9`.
All 35 anonymous release assets matched their producer checksums; native OCI
provenance and CycloneDX attestations matched this exact image and source.
Documentation commits do not change the runtime producer.

The qualified build-only Ubuntu backport bundle applies the accepted Google
Brotli decoder fix for CVE-2026-111497. The final image verified
`libbrotli1 1.2.0-3build1+pasturestack.1` through an ordinary compression and
linkage control. Its seven selected existing packages are `libbrotli1`,
`libc-bin`, `libc-gconv-modules-extra`, `libc6`, `libp11-kit0`, `libpcre2-8-0`
and `libpcre2-posix3`. Package ownership, ABI, configuration and the original
package set/provider are preserved. These are PastureStack downstream rebuilds
of pinned Ubuntu sources, not packages issued by Canonical.

The release pins published Catalog `v0.3.18` source
`00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and Node Agent `v1.2.34`, based on
compatibility base `v0.3.8`. Their immutable publication identities remain
separate from this Server candidate and its later deployment acceptance.
separate. Web Console `1.6.195`, Engine `v0.183.354`, Host API `0.38.8` and
Temurin `25.0.5+8` retain their verified inputs and application behavior.

The full raw report retains 51 finding occurrences; the qualified effective
report retains 10 occurrences across nine officially unfixed CVEs. Critical,
High, available-fix and secret counts are zero under the existing release
policy. Exact-package code-absence decisions do not exempt the entire image.
The original browser runtime SBOM and its incomplete coverage are retained;
this release does not claim a new browser attestation or complete coverage.

Scoped QA8080 cutover, actual Brotli runtime control, strict TLS, one Server
restart and post-restart verification passed. Environment, mounts, AppArmor,
restart policy and the three existing data volumes were preserved. All three
Hosts/Agents are active; Agent `v1.2.34` has its separate per-Host acceptance
receipts. The Server552 rollback remains retained. Eight-Stack functional
and normal finish-upgrade acceptance passed separately across both projects.
Together with the two previously completed independent Stack adoptions, the
security-refresh scope has ten accepted affected Stacks and three Node Agent
`v1.2.34` adoptions. The two unchanged NFS/diagnostics Stacks retain their health readbacks
without new owning-function tests. Existing tenant container IDs, mounts and
marker hashes were preserved; rollback checkpoints and old images remain.
Role, UI and language evidence is carried forward, not rerun for this CVE refresh.

Keep the existing environment, authentication, firewall backend, mounts,
volumes and restart policy. Infrastructure Stacks and Host Agents adopt new
images only through their normal upgrade lifecycle; changing Server defaults
does not override an operator's existing database settings.
See the [release note](docs/releases/server-1.6.553.md) for publication and
scoped deployment evidence. Production, HAProxy and host firewall configuration
were not changed by this QA deployment.

<a id="server-v16552-runtime-backports"></a>

Expand Down
14 changes: 4 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,25 +11,21 @@ upstream history, authorship, licenses, and notices.

<a id="current-release"></a>

## Current source candidate
## Current release

Server `v1.6.553` is a prepared source candidate, not a published image.
It adds the accepted Google Brotli fix for CVE-2026-111497 through the qualified
[Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553)
is published. It applies the accepted Google Brotli fix for CVE-2026-111497 through the qualified
Ubuntu backport bundle. Only already-installed packages are updated; package sets,
providers, library interfaces and configuration are preserved.

Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`,
Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
Node Agent `v1.2.34` uses compatibility base `v0.3.8`. Published Catalog
`v0.3.18` is pinned to `00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and records
the qualified component images and their publication evidence.
`v0.3.18` records the qualified component images and their publication evidence.

See its [release note](docs/releases/server-1.6.553.md) and the
[compatibility contract](COMPATIBILITY.md#server-v16553-brotli)
for producer identities, immutable image digests, SBOMs and remaining findings.
The current published release remains
[Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
with its [release note](docs/releases/server-1.6.552.md).

Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.

Expand All @@ -56,8 +52,6 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
## Quick start

Public GHCR downloads do not require a registry login. Keep all three named volumes.
This candidate is not yet available. The examples below use its numeric tag;
run them only after its official release.

```sh
docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
Expand Down
3 changes: 3 additions & 0 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ runtime gates have passed.

## Release notes

- [Server v1.6.553](releases/server-1.6.553.md) — published qualified Brotli
security backports, with exact artifact identities and scoped QA evidence
recorded separately from component publication.
- [Server v1.6.549](releases/server-1.6.549.md) — published Web Console 1.6.195
with an independent browser runtime SBOM, exact artifact identity and separate
fresh-DB component lookup. The release note records incomplete coverage,
Expand Down
4 changes: 1 addition & 3 deletions docs/performance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,7 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.

The example uses the prepared numeric Server v1.6.553 tag. It
is not yet available from GHCR;
run it only after its official release and image have been published and read back.
The example uses the published numeric Server `v1.6.553` image.
See the [release note](../releases/server-1.6.553.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
Expand Down
88 changes: 84 additions & 4 deletions docs/releases/server-1.6.553.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
# Server v1.6.553 candidate
# Server v1.6.553

Prepared source only; no Server image or release has been published.
Deployment acceptance is not claimed until the normal protected release workflow
and the affected runtime checks complete.
Published image: `ghcr.io/pasturestack/server:v1.6.553@sha256:daf2562134dcd735a265f531f2e7fdf0a3aca762062566e4406c35ba7ce81101`.

Source commit: `b0c121abf9a812f83204ee93bb28ee7046815021`.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

## Verified component inputs

Expand Down Expand Up @@ -40,3 +42,81 @@ retain their earlier results. Runtime adoption must identify the actual
container digest on each eligible Host; registry publication alone is not
deployment acceptance. Production, HAProxy and host firewall configuration are
outside this QA deployment.

## Independent publication readback

[Publisher run 40182084293](https://github.com/PastureStack/server/actions/runs/40182084293)
completed successfully. All 35 anonymous release assets matched the producer's
SHA256SUMS and GitHub asset digests. Anonymous tag/manifest/config readback and
both native OCI provenance and CycloneDX attestations matched the exact producer
and manifest above. The distinct OCI config is
`sha256:bf7147449c0e9e029579b6ae708abd7506d4dfccf5ca7c7966474f254aa4afb9`.
The published release-note body above is retained unchanged; later documentation
commits do not become the image producer.

The final image verified seven already-installed backport packages, including
`libbrotli1 1.2.0-3build1+pasturestack.1`, with ordinary compression and linkage
controls. Package/provider/configuration preservation and consumer receipts
passed. The raw scan retains 51 finding occurrences; the qualified effective
report retains 10 occurrences across nine officially unfixed CVEs. Available
fixes, unreviewed findings, Critical/High findings and secrets remain blocking.
The existing browser runtime SBOM retains its original identity and incomplete
coverage; no complete-browser-coverage claim or new browser attestation is added.

## Scoped QA8080 Server deployment

The isolated QA8080 deployment adopted this exact published image and source.
Cutover, independent identity/configuration verification, ordinary Brotli runtime
control, strict TLS (`200 ssl_verify_result=0`), one Server restart and a second
identity/configuration verification passed. The existing environment, mounts,
AppArmor, restart policy and three data volumes were preserved.

The active Server container is `99afac6647e1`; the preceding Server552 container
`b7be489f6085` is retained as
`pasturestack-server-v1.6.552-rollback-553-20261025`, with the original image and
matching data checkpoint preserved. All three Hosts and Agents were active.
The separate Agent `v1.2.34` adoption receipts passed 15 checks on each Host;
these are not a new application/UI/role matrix.

The retained local QA receipts below are separate from the publisher's public
release assets. They bind the Server-only deployment scope; production,
HAProxy, host firewall changes and broader role/UI acceptance are outside it.

| QA receipt | SHA-256 |
| --- | --- |
| `server553-qa-cutover.json` | `fdf8c3c889c7c2f73da86b47533a6275cc002bd7241264df22fa1a9f3f19c6e6` |
| `server553-qa-verify.json` | `ec920d6d7ff0108e12017b465c542de36e2891376fa58eb3e5ef69e495791d32` |
| `server553-qa-smoke.json` | `5bd94dc1d72527dd50770f5d62928198204f85766415fb88f2cfd9029a692920` |
| `server553-qa-restart.json` | `c61d4fe0d30f9a18a8eb53d38a22fcec158a5e7908eed4ac6f9ef106004c2d4b` |
| `server553-qa-verify-after-restart.json` | `863b25498bdbd778f0252ed3b574752e99f8b5e56334d39bd3542b1374b033d1` |

## System Stack adoption

The security refresh has accepted ten affected Stacks: the two independently
completed `network-policy-manager` and `secret-volume-driver` adoptions retain
their original PASS receipts, and the eight Brotli-target Stacks completed
normal Catalog upgrades and `finishupgrade` across Default and the isolated
single-Host project. Those eight final receipts report PASS for complete named
primary/sidekick configuration, exact runtime artifact/producer and Host-role
coverage, rollback retention and post-finish checks. They are active.

One Default bidirectional probe passed cross-Host IPsec SA/packet-delta, DNS and
strict TLS/egress checks. One isolated `1h19` managed namespace passed DNS,
Metadata and strict TLS/egress checks; it makes no cross-Host claim. The common
`runtime553-functional-group.json` receipt has SHA-256
`7ec2af7ca38ee98d783a0d8c6ea94a397951f664f71204dcd7bf0fc2aa571ac0`
and binds all eight current service/launch/instance/artifact sets. Each Stack's
separate `runtime553-<stackId>-stack-final.json` records the final completion.

The normal replacements and recorded healthy states provide the affected
scheduler/health-reporting evidence; no additional test Stacks were created.
Before and after the project probes, the existing `qa545upgrade` tenant
container IDs, images, volume mounts and data-marker hashes matched the retained
Agent snapshots on all three Hosts. Full private checkpoints and previous
images remain available for rollback.

The three Agent `v1.2.34` adoptions retain their 15-check per-Host PASS receipts.
The other two unchanged NFS/diagnostics Stacks carry forward their health
readbacks without new owning-function runs. This acceptance is limited to the
CVE refresh; role, UI, language and other unaffected evidence is retained and
was not rerun or promoted to a new full-matrix PASS.