From a07266bd6a70a927dffee1e9f6cf5cbfb7a71cad Mon Sep 17 00:00:00 2001 From: chen21019 Date: Mon, 2 Nov 2026 01:21:59 +0800 Subject: [PATCH] Package verified WebMCP Service and Catalog fixes and retain trusted audit actor metadata --- COMPATIBILITY.md | 11 ++ docs/releases/server-1.6.565.md | 54 ++++++++++ scripts/check-server-api-explorer-patch.sh | 72 ++++++------- .../test-current-server-packaging-contract.py | 100 +++++++++--------- server/Dockerfile.web-compose-release | 52 ++++----- server/build-api-explorer-patch-image.sh | 32 +++--- server/build-component-candidate.sh | 6 +- server/console-broker/ai_audit_owner.go | 5 + server/console-broker/ai_audit_owner_test.go | 39 ++++++- server/security/openvex.json | 6 +- server/security/vendor-pending.json | 2 +- 11 files changed, 242 insertions(+), 137 deletions(-) create mode 100644 docs/releases/server-1.6.565.md diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index d9b7907313..ad2005ade9 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,5 +1,16 @@ # Compatibility Contract +## Server v1.6.565 source candidate + +Engine366 / Web205 / optional Bridge0.2.7 / Compose0.14.41 add reviewed Service +create ports and health checks, preserve Catalog transform/request values, and +retain verified audit actor metadata. Native authority, schema restrictions and +default-off flags remain. Component publication is qualified; Server publication +and designated runtime/matrix acceptance remain pending. See the +[candidate note](docs/releases/server-1.6.565.md). Published installation below +remains v1.6.564 until the new image is actually released. + + ## Server v1.6.564 published diff --git a/docs/releases/server-1.6.565.md b/docs/releases/server-1.6.565.md new file mode 100644 index 0000000000..63f0c775dd --- /dev/null +++ b/docs/releases/server-1.6.565.md @@ -0,0 +1,54 @@ +# Server v1.6.565 candidate + +Source candidate. The publisher adds the actual image identity only after its +required checks pass; deployment acceptance is recorded separately. + +## Verified component inputs + +This release consumes original published +Engine v0.183.366, Web Console 1.6.205 / optional Bridge0.2.7 and Compose0.14.41; +Catalog0.20.17 and other runtime components remain unchanged. + +Service create supports typed native ports and a closed health-check subset. +Creation remains stopped; start is separately reviewed. Verified completion +reports actual assigned ports without altering the approved intent. Native +role/Key limits, current revision, explicit DENY and exactly-once claims remain. + +Catalog's Compose producer excludes typed API response envelopes from mutation +requests and sends explicit empty service links. Engine projection preserves +the real transformer's image/environment/ports/log settings through the current +role schema; hidden and create-only values remain restricted. The audit gateway +forwards only the successful Engine response's authenticated actor metadata; +incoming forged identity headers and response-body fields cannot supply it. + +Published producers: Engine `3ce114486954403cead091379916c2d69c052336`, Web `931562ac0302b0406c5c2b44ec7a0f94307e5b2e`, +Compose `ed3dbddda8a04522e6969fef12672bfb30f3d180`. Source component CI and exact original artifact +qualification are separate from designated QA runtime acceptance. + +| Published component | Original artifact SHA256 | +|---|---| +| Engine v0.183.366 cattle.jar | `0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81` | +| Web Console 1.6.205 archive | `5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620` | +| Optional Bridge 0.2.7 ZIP | `3b7124d239b3f2b8c2a62775aded1e819953dce7a19471b0f3ac5c00587e20ad` | +| Compose 0.14.41 archive | `a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0` | + +Engine original CI ran 3,912 cases with zero failures/errors and one existing +skip. Its 21 new methods are distinct from inherited coverage. Web original CI +passed 1,122 Ember cases and 12 new source cases. All 12 Engine, 13 Web and 20 +Compose public assets passed anonymous checksum/length readback. Web archive +provenance and runtime-SBOM attestations passed. Compose's 99 additional +build-only Medium findings have no official fix and remain individually tracked; +the safety policy is unchanged. These are not claims of zero vulnerabilities +or completed runtime acceptance. +No production site, HAProxy, firewall or database setting changes are included. + +The four AI opt-ins remain independently default-off. Existing Compose +environment variables, named volumes and restart/security settings are retained. +Back up data and preserve the prior Server image/configuration before upgrade; +rollback uses that exact retained image and compatible data. Never remove volumes. + +The publisher records Server checks, immutable image identity and original +component inputs. QA8080 Audit remainder, Catalog launch/archive/restore and +new Service-field/weak-model evidence are recorded separately. Existing +unaffected PASS and original failures are retained; component or release +checks do not establish acceptance of all 243 frontend groups. diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh index 3b4fdf1f94..1c16a2d1c4 100755 --- a/scripts/check-server-api-explorer-patch.sh +++ b/scripts/check-server-api-explorer-patch.sh @@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \ SERVER_INCREMENTAL_RELEASE_BASE_MISSING for web_sbom_release_marker in \ 'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \ - 'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.204-runtime.cdx.json' \ + 'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.205-runtime.cdx.json' \ '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \ '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \ '--webmcp-ceiling enabled;' \ @@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py python3 server/security/test_web_console_sbom_scan.py require_marker "$release_dockerfile" \ - 'ARG SERVER_RELEASE_TAG=v1.6.564' \ + 'ARG SERVER_RELEASE_TAG=v1.6.565' \ SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING require_marker "$release_dockerfile" \ 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \ @@ -629,22 +629,22 @@ require_marker "$publish_workflow" \ 'bash source/server/artifacts/verify-host-api-package.sh' \ SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.204' \ + 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.205' \ SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz' \ + 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.205.tar.gz' \ SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e' \ + 'ARG WEB_CONSOLE_ARTIFACT_SHA256=5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620' \ SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194' \ + 'ARG WEB_CONSOLE_COMMIT=931562ac0302b0406c5c2b44ec7a0f94307e5b2e' \ SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32' \ + 'ARG WEB_CONSOLE_LOCK_SHA256=999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31' \ SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING require_marker "$release_dockerfile" \ - 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa' \ + 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602' \ SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING require_marker "$release_dockerfile" \ "grep -aF 'hostsPage.permissionDenied'" \ @@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \ '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \ SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING require_marker "$build_script" \ - 'web_console_commit=${WEB_CONSOLE_COMMIT:-64caa55d0b0768de1633549b54a169ddb62c9194}' \ + 'web_console_commit=${WEB_CONSOLE_COMMIT:-931562ac0302b0406c5c2b44ec7a0f94307e5b2e}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING require_marker "$build_script" \ - 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}' \ + 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.205}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz}' \ + 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.205.tar.gz}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING require_marker "$build_script" \ - 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e}' \ + 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING require_marker "$build_script" \ - 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32}' \ + 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING require_marker "$build_script" \ - 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa}' \ + 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602}' \ SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING require_marker "$release_dockerfile" \ 'ARG CATALOG_SERVICE_VERSION=0.20.17' \ @@ -750,8 +750,8 @@ for incremental_producer_marker in \ 'ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628' \ 'ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866' \ 'ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be' \ - 'ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d' \ - 'ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732'; do + 'ARG COMPOSE_EXECUTOR_COMMIT=ed3dbddda8a04522e6969fef12672bfb30f3d180' \ + 'ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0'; do require_marker "$release_dockerfile" "$incremental_producer_marker" \ SERVER_INCREMENTAL_RUNTIME_PRODUCER_PIN_MISSING done @@ -768,10 +768,10 @@ for incremental_producer_build_marker in \ 'usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}' \ 'usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}' \ 'usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}' \ - 'compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40}' \ - 'compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d}' \ - 'compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732}' \ - 'compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc}'; do + 'compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.41}' \ + 'compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-ed3dbddda8a04522e6969fef12672bfb30f3d180}' \ + 'compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0}' \ + 'compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa}'; do require_marker "$build_script" "$incremental_producer_build_marker" \ SERVER_INCREMENTAL_RUNTIME_PRODUCER_BUILD_PIN_MISSING done @@ -998,10 +998,10 @@ for release_webhook_build_marker in \ SERVER_INCREMENTAL_WEBHOOK_BUILD_GATE_MISSING done require_marker "$release_dockerfile" \ - 'ARG COMPOSE_EXECUTOR_VERSION=0.14.40' \ + 'ARG COMPOSE_EXECUTOR_VERSION=0.14.41' \ SERVER_INCREMENTAL_COMPOSE_VERSION_MISSING require_marker "$release_dockerfile" \ - 'ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc' \ + 'ARG COMPOSE_EXECUTOR_BINARY_SHA256=56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa' \ SERVER_INCREMENTAL_COMPOSE_HASH_MISSING require_marker "$release_dockerfile" \ 'tar --no-same-owner --no-same-permissions -xzf "${web_archive}"' \ @@ -1139,21 +1139,21 @@ require_marker "$build_script" \ '--file server/Dockerfile.web-compose-release' \ SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING require_marker "$build_script" \ - 'image=${IMAGE:-pasturestack-validation/server:v1.6.564}' \ + 'image=${IMAGE:-pasturestack-validation/server:v1.6.565}' \ SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING require_marker "$build_script" \ - 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564}' \ + 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.565}' \ SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING require_marker "$build_script" \ 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \ SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING for release_engine_marker in \ - 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365' \ + 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.366' \ 'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \ - 'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047' \ - 'ARG ORCHESTRATION_ENGINE_COMMIT=10e674d32de9c5d6ad63867a1b76d080ac76af48' \ + 'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81' \ + 'ARG ORCHESTRATION_ENGINE_COMMIT=3ce114486954403cead091379916c2d69c052336' \ 'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \ - 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.365' \ + 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.366' \ 'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \ 'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \ 'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \ @@ -1172,10 +1172,10 @@ for release_engine_marker in \ SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING done for release_engine_build_marker in \ - 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}' \ + 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.366}' \ 'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \ - 'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047}' \ - 'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-10e674d32de9c5d6ad63867a1b76d080ac76af48}' \ + 'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81}' \ + 'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-3ce114486954403cead091379916c2d69c052336}' \ 'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \ 'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \ '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do @@ -1694,10 +1694,10 @@ fi if grep -Fxq '## Current source candidate' README.md; then for candidate_readme_marker in \ '' \ - 'Server `v1.6.564` is a prepared source candidate, not a published image.' \ + 'Server `v1.6.565` is a prepared source candidate, not a published image.' \ 'run them only after its official release' \ 'This candidate is not yet available' \ - 'ghcr.io/pasturestack/server:v1.6.564'; do + 'ghcr.io/pasturestack/server:v1.6.565'; do require_marker README.md "$candidate_readme_marker" \ SERVER_CURRENT_CANDIDATE_README_MISSING done @@ -2303,7 +2303,7 @@ done jq -e ' ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves | .["@context"] == "https://openvex.dev/ns/v0.2.0" - and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564" + and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.565" and (.statements | length) == 56 and ([.statements[].vulnerability.name] | length == (unique | length)) and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort) @@ -2341,7 +2341,7 @@ jq -r ' | @tsv ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture" bash "$vendor_pending_validator" "$runtime_vendor_pending" \ - "$vendor_pending_fixture" v1.6.564 >/dev/null + "$vendor_pending_fixture" v1.6.565 >/dev/null bash scripts/test-vendor-pending-findings.sh >/dev/null rm -f "$vendor_pending_fixture" trap - EXIT @@ -2430,4 +2430,4 @@ for release_readback_contract in \ fi done -printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' +printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.565 base=v1.6.460 engine=0.183.366 web_console=1.6.205 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n' diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py index 3ab65f4183..1267b51a2a 100644 --- a/scripts/test-current-server-packaging-contract.py +++ b/scripts/test-current-server-packaging-contract.py @@ -34,16 +34,16 @@ PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。' STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`' COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING' -WEB_SHA = '8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e' -WEB_SOURCE = '64caa55d0b0768de1633549b54a169ddb62c9194' -WEB_SBOM_SHA = '195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa' -WEB_LOCK_SHA = 'bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32' +WEB_SHA = '5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620' +WEB_SOURCE = '931562ac0302b0406c5c2b44ec7a0f94307e5b2e' +WEB_SBOM_SHA = 'dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602' +WEB_LOCK_SHA = '999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31' CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297' -ENGINE_SHA = '46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047' -ENGINE_SOURCE = '10e674d32de9c5d6ad63867a1b76d080ac76af48' +ENGINE_SHA = '0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81' +ENGINE_SOURCE = '3ce114486954403cead091379916c2d69c052336' OLD_COORDINATES = { - 'v1.6.564': 'v1.6.521', - '1.6.204': '1.6.181', + 'v1.6.565': 'v1.6.521', + '1.6.205': '1.6.181', WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03', WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550', CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3', @@ -60,29 +60,29 @@ ('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'), ) LEGACY_ENGINE_COORDINATES = { - '0.183.365': '0.183.337', + '0.183.366': '0.183.337', ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80', ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e', } EXPECTED = { COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508), - 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.564'), + 'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.565'), 'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'), 'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.204'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.205'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.205.tar.gz'), 'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA), 'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE), 'SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_LOCK_SHA256=' + WEB_LOCK_SHA), 'SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=' + WEB_SBOM_SHA), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}'), - 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.205}'), + 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.205.tar.gz}'), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'), 'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.564}'), - 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.565}'), + 'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.565}'), 'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'), 'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'), 'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'), @@ -103,18 +103,18 @@ CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING'] ENGINE_EXPECTED = { 'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', ( - 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365', + 'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.366', 'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar', 'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA, 'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE, - 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.365', + 'ARG ORCHESTRATION_ENGINE_VERSION=0.183.366', 'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"', 'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar', 'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar', 'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}', )), 'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', ( - 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}', + 'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.366}', 'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}', 'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}', 'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}', @@ -154,8 +154,8 @@ "ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628", "ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866", "ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be", - "ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d", - "ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732" + "ARG COMPOSE_EXECUTOR_COMMIT=ed3dbddda8a04522e6969fef12672bfb30f3d180", + "ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0" ] ], [ @@ -174,10 +174,10 @@ "usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}", "usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}", "usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}", - "compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40}", - "compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d}", - "compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732}", - "compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc}" + "compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.41}", + "compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-ed3dbddda8a04522e6969fef12672bfb30f3d180}", + "compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0}", + "compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa}" ] ], [ @@ -608,15 +608,15 @@ def verify(files, gate=GATE): pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))' if len(re.findall(pipeline, source)) != 1: raise AssertionError('CURRENT_CATALOG_HASH_BYPASS') - if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564"' not in gate: + if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.565"' not in gate: raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH') - if '"$vendor_pending_fixture" v1.6.564 >/dev/null' not in gate: + if '"$vendor_pending_fixture" v1.6.565 >/dev/null' not in gate: raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH') - if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.564': + if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.565': raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH') - if json.loads(files[VENDOR]).get('release') != 'v1.6.564': + if json.loads(files[VENDOR]).get('release') != 'v1.6.565': raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH') - if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 ' not in gate: + if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.565 base=v1.6.460 engine=0.183.366 web_console=1.6.205 catalog_service=0.20.17 ' not in gate: raise AssertionError('CURRENT_SUMMARY_MISMATCH') verify_incremental_contract(files, gate) verify_load_balancer_contract(files, gate) @@ -631,11 +631,11 @@ def previous_gate(gate=GATE): if stale(marker) != marker: replacements["'" + marker + "' "] = "'" + stale(marker) + "' " replacements.update({ - 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564"': + 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.565"': 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"', - '"$vendor_pending_fixture" v1.6.564 >/dev/null': + '"$vendor_pending_fixture" v1.6.565 >/dev/null': '"$vendor_pending_fixture" v1.6.521 >/dev/null', - 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 ': + 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.565 base=v1.6.460 engine=0.183.366 web_console=1.6.205 catalog_service=0.20.17 ': 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ', }) for marker, stale_marker in replacements.items(): @@ -841,10 +841,10 @@ def test_other_formal_component_coordinates_and_stale_inputs_fail_closed(self): [ "COMPOSE_EXECUTOR", "compose_executor", - "0.14.40", - "1835f8db645a8488e327b1f6e750bfdf3d1fb84d", - "fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732", - "a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc" + "0.14.41", + "ed3dbddda8a04522e6969fef12672bfb30f3d180", + "a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0", + "56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa" ], [ "VSPHERE_CLI_BUNDLE", @@ -1299,7 +1299,7 @@ def test_each_old_engine_coordinate_rejected(self): self.assertGreater(checked, 0) def test_historical_engine340_cannot_be_packaged(self): - old = {'0.183.365': '0.183.340', + old = {'0.183.366': '0.183.340', ENGINE_SHA: '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea', ENGINE_SOURCE: 'ff0a41e7676211043eb4f755a306a9e2a19abee1'} checked = 0 @@ -1320,13 +1320,13 @@ def test_historical_engine340_cannot_be_packaged(self): def test_engine352_actual_war_producer_and_previous351_350_boundary(self): candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8') - self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.564}', candidate) - self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}', candidate) + self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.565}', candidate) + self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.366}', candidate) for old in ( - {'0.183.365': '0.183.351', + {'0.183.366': '0.183.351', ENGINE_SHA: 'efd0e826364c551f782b281f081d53cadb48faa7d5c37c2f101e6f9c7d7f9ea6', ENGINE_SOURCE: '1befd83278618f9a5b7cdaf96522004dd89918ba'}, - {'0.183.365': '0.183.350', + {'0.183.366': '0.183.350', ENGINE_SHA: '637ddaa42cd93c019b4d0813d7053b71dc42797a7f3ac2aa4b10fcc7e304cb31', ENGINE_SOURCE: '9c884710e5ea3d4136d80a870d9de9485674f3c3'}, {ENGINE_SOURCE: '109f2623f00ca3a3a9079414a0f0f8bd23cd1eb2'}, @@ -1349,7 +1349,7 @@ def test_engine352_actual_war_producer_and_previous351_350_boundary(self): def test_immediately_previous_engine341_cannot_be_packaged(self): - old = {'0.183.365': '0.183.341', + old = {'0.183.366': '0.183.341', ENGINE_SHA: '3ede1ad28b7a7e0754c4c953bd486162f7ffe0b2f76ce384ec485632af6b8e6d', ENGINE_SOURCE: 'b245cf778479445ded0786d3898b03fea153212e'} checked = 0 @@ -1370,7 +1370,7 @@ def test_immediately_previous_engine341_cannot_be_packaged(self): def test_immediately_previous_engine342_cannot_be_packaged(self): - old = {'0.183.365': '0.183.342', + old = {'0.183.366': '0.183.342', ENGINE_SHA: '3533f247392795329c92516a7966510aafbe81a52e3f922e5ec657a2071363b5', ENGINE_SOURCE: 'ddae4bb8e12806f70816f5782cd999eccd0f2ce6'} checked = 0 @@ -1391,7 +1391,7 @@ def test_immediately_previous_engine342_cannot_be_packaged(self): def test_immediately_previous_engine343_cannot_be_packaged(self): - old = {'0.183.365': '0.183.343', + old = {'0.183.366': '0.183.343', ENGINE_SHA: 'b29c0057f96dbae38bfe2c663c63bbe4c8b5c755b3090f39414aa51f9813025f', ENGINE_SOURCE: '5aa9d8978c75a7fe63330453c399a92716d88568'} checked = 0 @@ -1412,7 +1412,7 @@ def test_immediately_previous_engine343_cannot_be_packaged(self): def test_immediately_previous_engine344_cannot_be_packaged(self): - old = {'0.183.365': '0.183.344', + old = {'0.183.366': '0.183.344', ENGINE_SHA: 'ffafa4700156b74ec11bcae1b830738e49943f1a3b8b0565895ed6d7726eebf1', ENGINE_SOURCE: '72c42e6f2000301fe03ffd2442fb9ee89aee120c'} checked = 0 @@ -1432,7 +1432,7 @@ def test_immediately_previous_engine344_cannot_be_packaged(self): self.assertGreater(checked, 0) def test_immediately_previous_engine345_cannot_be_packaged(self): - old = {'0.183.365': '0.183.345', + old = {'0.183.366': '0.183.345', ENGINE_SHA: '780263c4a884527fa80a28b998ad4bda88b9ad6002a687f9f074602ecad46e62', ENGINE_SOURCE: 'd27d4ac73fa05ae43b9ae0c32875780e8a3765b1'} checked = 0 @@ -1452,7 +1452,7 @@ def test_immediately_previous_engine345_cannot_be_packaged(self): self.assertGreater(checked, 0) def test_immediately_previous_engine346_cannot_be_packaged(self): - old = {'0.183.365': '0.183.346', + old = {'0.183.366': '0.183.346', ENGINE_SHA: '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806', ENGINE_SOURCE: 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'} checked = 0 @@ -1628,7 +1628,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self): def test_current_readme_status_specific_prose_does_not_block_publication_transition(self): common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0] self.assertNotIn('candidate', common) - self.assertNotIn('v1.6.564', common) + self.assertNotIn('v1.6.565', common) self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE) status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1] candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1) @@ -1637,7 +1637,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit self.assertIn('This candidate is not yet available', candidate) self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published) self.assertNotIn('candidate', published) - self.assertNotIn('v1.6.564', published) + self.assertNotIn('v1.6.565', published) if __name__ == '__main__': diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index 3319d6dbdc..8b986ab76e 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -90,13 +90,13 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download -ARG WEB_CONSOLE_RELEASE_TAG=1.6.204 -ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz -ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e -ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194 -ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32 -ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.204-runtime.cdx.json -ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa +ARG WEB_CONSOLE_RELEASE_TAG=1.6.205 +ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.205.tar.gz +ARG WEB_CONSOLE_ARTIFACT_SHA256=5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620 +ARG WEB_CONSOLE_COMMIT=931562ac0302b0406c5c2b44ec7a0f94307e5b2e +ARG WEB_CONSOLE_LOCK_SHA256=999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31 +ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.205-runtime.cdx.json +ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download ARG CATALOG_SERVICE_VERSION=0.20.17 ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90 @@ -118,13 +118,13 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download -ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365 +ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.366 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar -ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047 +ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download -ARG COMPOSE_EXECUTOR_VERSION=0.14.40 -ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732 -ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc +ARG COMPOSE_EXECUTOR_VERSION=0.14.41 +ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0 +ARG COMPOSE_EXECUTOR_BINARY_SHA256=56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa ARG VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL=https://github.com/PastureStack/vsphere-cli-bundle/releases/download ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0 @@ -709,12 +709,12 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5 ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904 ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf -ARG SERVER_RELEASE_TAG=v1.6.564 +ARG SERVER_RELEASE_TAG=v1.6.565 ARG API_EXPLORER_RELEASE_TAG=v1.1.20 ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75 -ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365 -ARG ORCHESTRATION_ENGINE_VERSION=0.183.365 +ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.366 +ARG ORCHESTRATION_ENGINE_VERSION=0.183.366 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51 ARG HOST_API_VERSION=0.38.8 @@ -736,11 +736,11 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4 ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3 ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1 -ARG WEB_CONSOLE_RELEASE_TAG=1.6.204 -ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e -ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194 -ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32 -ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa +ARG WEB_CONSOLE_RELEASE_TAG=1.6.205 +ARG WEB_CONSOLE_ARTIFACT_SHA256=5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620 +ARG WEB_CONSOLE_COMMIT=931562ac0302b0406c5c2b44ec7a0f94307e5b2e +ARG WEB_CONSOLE_LOCK_SHA256=999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31 +ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602 ARG CATALOG_SERVICE_VERSION=0.20.17 ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90 ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20 @@ -759,8 +759,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=4da77ccac464bc7f7cd2020e0659a666a5d1ff7e ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c -ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047 -ARG ORCHESTRATION_ENGINE_COMMIT=10e674d32de9c5d6ad63867a1b76d080ac76af48 +ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81 +ARG ORCHESTRATION_ENGINE_COMMIT=3ce114486954403cead091379916c2d69c052336 ARG HOST_PROVISIONER_VERSION=0.39.10 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661 @@ -773,10 +773,10 @@ ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866 ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be -ARG COMPOSE_EXECUTOR_VERSION=0.14.40 -ARG COMPOSE_EXECUTOR_COMMIT=1835f8db645a8488e327b1f6e750bfdf3d1fb84d -ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732 -ARG COMPOSE_EXECUTOR_BINARY_SHA256=a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc +ARG COMPOSE_EXECUTOR_VERSION=0.14.41 +ARG COMPOSE_EXECUTOR_COMMIT=ed3dbddda8a04522e6969fef12672bfb30f3d180 +ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0 +ARG COMPOSE_EXECUTOR_BINARY_SHA256=56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4 ARG VSPHERE_CLI_BUNDLE_COMMIT=35ca999b775a41e7fb34e9a6b6ceb4fa51f3f242 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0 diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh index 6a5a715f9f..f44b0b3361 100755 --- a/server/build-api-explorer-patch-image.sh +++ b/server/build-api-explorer-patch-image.sh @@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then fi revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)} -server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564} +server_release_tag=${SERVER_RELEASE_TAG:-v1.6.565} source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403} orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download} -orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365} +orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.366} orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar} -orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047} -orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-10e674d32de9c5d6ad63867a1b76d080ac76af48} +orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81} +orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-3ce114486954403cead091379916c2d69c052336} orchestration_engine_version=${orchestration_engine_release_tag#v} engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233} engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51} @@ -63,13 +63,13 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.20.tar.gz} api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb} api_explorer_commit=${API_EXPLORER_COMMIT:-a586f0dc0aa50df579049a8d4bf26f04400fdf75} web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download} -web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204} -web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz} -web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e} -web_console_commit=${WEB_CONSOLE_COMMIT:-64caa55d0b0768de1633549b54a169ddb62c9194} -web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32} +web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.205} +web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.205.tar.gz} +web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-5e33c9e2c71965552fb1e7c66c2c3f3c19b85fc6e4a74bd64c20c8dd51f57620} +web_console_commit=${WEB_CONSOLE_COMMIT:-931562ac0302b0406c5c2b44ec7a0f94307e5b2e} +web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-999806f5d7ea027d535c394a8a34716aa0dcdff658e52e0b91a9254ade7baf31} web_console_runtime_sbom_artifact=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${web_console_release_tag}-runtime.cdx.json} -web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa} +web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-dfc530bdbd9bb5e49da94b7da81caaacf3e8cf734b780ce5d3f103979b5dd602} catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download} catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.17} catalog_service_commit=${CATALOG_SERVICE_COMMIT:-2f70559e340865eb6243662ed33d8cbc7b1efa90} @@ -93,10 +93,10 @@ webhook_automation_service_commit=${WEBHOOK_AUTOMATION_SERVICE_COMMIT:-4da77ccac webhook_automation_service_archive_sha256=${WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256:-f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b} webhook_automation_service_binary_sha256=${WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256:-b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c} compose_executor_release_base_url=${COMPOSE_EXECUTOR_RELEASE_BASE_URL:-https://github.com/PastureStack/compose-cli/releases/download} -compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.40} -compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-1835f8db645a8488e327b1f6e750bfdf3d1fb84d} -compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732} -compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc} +compose_executor_version=${COMPOSE_EXECUTOR_VERSION:-0.14.41} +compose_executor_commit=${COMPOSE_EXECUTOR_COMMIT:-ed3dbddda8a04522e6969fef12672bfb30f3d180} +compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0} +compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa} vsphere_cli_bundle_release_base_url=${VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/vsphere-cli-bundle/releases/download} machine_driver_bundle_release_base_url=${MACHINE_DRIVER_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/machine-driver-bundle/releases/download} machine_driver_bundle_version=${MACHINE_DRIVER_BUNDLE_VERSION:-0.16.6} @@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be} supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0' newest_docker_version=v29.8.0 -image=${IMAGE:-pasturestack-validation/server:v1.6.564} +image=${IMAGE:-pasturestack-validation/server:v1.6.565} build_options=() [[ "$revision" =~ ^[0-9a-f]{40}$ ]] @@ -874,7 +874,7 @@ docker run --rm --env "ORCHESTRATION_ENGINE_VERSION=${orchestration_engine_versi done cat <<'"'"'EOF'"'"' | sha256sum -c - e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192 /usr/bin/authentication-service.real -a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc /usr/bin/compose-executor.real +56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa /usr/bin/compose-executor.real 92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff /usr/bin/host-provisioner.real 1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c /usr/bin/secret-delivery-api 90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be /usr/bin/usage-telemetry-agent diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh index 2423b6531c..549d67f5ef 100755 --- a/server/build-component-candidate.sh +++ b/server/build-component-candidate.sh @@ -18,10 +18,10 @@ for name in "${required[@]}"; do case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac export "$name" done -export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.564} -export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365} +export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.565} +export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.366} export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar -export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.204} +export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.205} export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz" export WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${WEB_CONSOLE_RELEASE_TAG}-runtime.cdx.json} export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.18} diff --git a/server/console-broker/ai_audit_owner.go b/server/console-broker/ai_audit_owner.go index 2cabe24c2f..5939f830d0 100644 --- a/server/console-broker/ai_audit_owner.go +++ b/server/console-broker/ai_audit_owner.go @@ -258,6 +258,11 @@ func (b *broker) serveAIAuditGateway(w http.ResponseWriter, r *http.Request) { w.Header().Set(header, value) } } + if response.StatusCode >= 200 && response.StatusCode < 300 { + if actor := response.Header.Get("X-Api-User-Id"); actor != "" { + w.Header().Set("X-Api-User-Id", actor) + } + } w.WriteHeader(response.StatusCode) _, _ = w.Write(result) } diff --git a/server/console-broker/ai_audit_owner_test.go b/server/console-broker/ai_audit_owner_test.go index 6d8f9ee25a..f9d08353cc 100644 --- a/server/console-broker/ai_audit_owner_test.go +++ b/server/console-broker/ai_audit_owner_test.go @@ -188,9 +188,10 @@ func TestAIAuditPublicGatewayIsFixedTypedAndForwardsOnlyVerifiedResponseMetadata calls++ if r.Method != "POST" || r.URL.Path != "/v2-beta/aiAuditQueries" || r.URL.RawQuery != "" || r.Header.Get("Authorization") != "Basic caller" || r.Header.Get("X-PastureStack-Key-Expected-Revision") != "3" || - r.Header.Get("X-Forwarded-User") != "" || r.Header.Get("X-API-Project-ID") != "" { + r.Header.Get("X-Forwarded-User") != "" || r.Header.Get("X-API-Project-ID") != "" || r.Header.Get("X-Api-User-Id") != "" { t.Error("gateway escaped fixed route/authority") } + w.Header().Set("X-API-USER-ID", "1a1") w.Header().Set("X-PastureStack-Key-Purpose", "ai-bridge") w.Header().Set("X-PastureStack-Key-Revision", "3") _, _ = w.Write([]byte(`{"resourceType":"auditLog","data":[]}`)) @@ -200,9 +201,10 @@ func TestAIAuditPublicGatewayIsFixedTypedAndForwardsOnlyVerifiedResponseMetadata r.Header.Set("X-PastureStack-Key-Expected-Revision", "3") r.Header.Set("X-Forwarded-User", "forged") r.Header.Set("X-API-Project-ID", "foreign") + r.Header.Set("X-Api-User-Id", "forged-incoming") w := httptest.NewRecorder() b.ServeHTTP(w, r) - if w.Code != 200 || calls != 1 || w.Header().Get("X-PastureStack-Key-Revision") != "3" { + if w.Code != 200 || calls != 1 || w.Header().Get("X-PastureStack-Key-Revision") != "3" || w.Header().Get("X-Api-User-Id") != "1a1" { t.Fatal("fixed typed gateway failed") } r = httptest.NewRequest("POST", aiAuditQueryPath+"?url=http://foreign/", strings.NewReader("{}")) @@ -213,6 +215,39 @@ func TestAIAuditPublicGatewayIsFixedTypedAndForwardsOnlyVerifiedResponseMetadata } } +func TestAIAuditPublicGatewayNeverFillsMissingOrEmptyUpstreamActor(t *testing.T) { + for _, headerPresent := range []bool{false, true} { + name := "absent" + if headerPresent { + name = "empty" + } + t.Run(name, func(t *testing.T) { + body := `{"resourceType":"auditLog","data":[],"actorId":"forged-body"}` + b := ownerTestBroker(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.Header.Get("X-Api-User-Id") != "" { + t.Error("incoming actor reached the Engine as authority") + } + if headerPresent { + w.Header().Set("X-Api-User-Id", "") + } + w.Header().Set("X-PastureStack-Key-Purpose", "ai-bridge") + w.Header().Set("X-PastureStack-Key-Revision", "3") + w.WriteHeader(http.StatusCreated) + _, _ = io.WriteString(w, body) + })) + r := httptest.NewRequest("POST", aiAuditQueryPath, strings.NewReader("{}")) + r.Header.Set("Authorization", "Basic caller") + r.Header.Set("X-Api-User-Id", "forged-incoming") + w := httptest.NewRecorder() + b.ServeHTTP(w, r) + if w.Code != http.StatusCreated || len(w.Header().Values("X-Api-User-Id")) != 0 || w.Body.String() != body || + w.Header().Get("X-PastureStack-Key-Purpose") != "ai-bridge" || w.Header().Get("X-PastureStack-Key-Revision") != "3" { + t.Fatal("gateway invented actor metadata or changed the upstream response") + } + }) + } +} + func TestAIAuditCLIRejectsUnverifiedUnknownOrTruncatedPrivateInputWithoutOutput(t *testing.T) { for _, input := range []string{`{}`, `{"query":{},"actorId":"1a1","url":"http://foreign/","cookie":"secret"}`, `{"query":{},"actorId":"1a1","cookie":"a","authorization":"b"}`, `{"query":{}`, strings.Repeat("x", 65538)} { diff --git a/server/security/openvex.json b/server/security/openvex.json index f79b129cb4..d16c668e44 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.564", + "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.565", "author": "PastureStack Security", - "timestamp": "2026-11-01T14:33:29Z", - "version": 77, + "timestamp": "2026-11-01T17:19:43Z", + "version": 78, "statements": [ { "vulnerability": { diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 8c06ba1182..1d5433b781 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "release": "v1.6.564", + "release": "v1.6.565", "generatedAt": "2026-10-29T09:57:33.809116+00:00", "policy": { "allowedSeverities": [