Skip to content

docs: use published Server 1.6.519 in installation examples #269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 11, 2026
Merged

docs: use published Server 1.6.519 in installation examples #269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 7 additions & 16 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves
upstream history, authorship, licenses, and notices.

## Current source
## Current release

Server `v1.6.519` is an unpublished candidate, packaging Web Console `1.6.181`
Server `v1.6.519` packages Web Console `1.6.181`
and Orchestration Engine `v0.183.335`. API Keys support full, custom and closed
policies, optional expiry, and key-scoped durable audit records. Their permissions
remain bounded by the owner's current role and environment access. Delegated
Expand All @@ -35,11 +35,11 @@ Audit export closes its own menu before locking the request, allowing consecutiv
JSON, CSV and XLSX downloads without leaving a disabled menu open.
Key scope choices use the viewer's authorized environment list. Environment,
stack and resource selectors close before dependent loading or verification.
See the [candidate release note](docs/releases/server-1.6.519.md) for exact
See the [release note](docs/releases/server-1.6.519.md) for exact
component identities and verification boundaries. A version or packaged feature
does not establish that every resource/role/hardware combination has been tested.

## API Keys in the source candidate
## API Keys

Choose allow-by-default with deny exceptions, or deny-by-default with allow
exceptions, with optional expiry. Without exceptions these retain full or closed
Expand All @@ -58,14 +58,6 @@ keyboard highlighting; narrow layouts keep the matrix in its own scroll region.
Errors use the existing API status/code and console error
handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts.

## Current release

The currently downloadable [Server v1.6.518](https://github.com/PastureStack/server/releases/tag/v1.6.518)
includes Web Console `1.6.180` and Orchestration Engine `v0.183.333`.
The quick-start examples below use this published image until the candidate is
verified and separately released. Its exact artifact identity and verification
boundaries are recorded in the [published release note](docs/releases/server-1.6.518.md).

## Quick start

Public GHCR downloads do not require a registry login. Use the published numeric
Expand All @@ -76,15 +68,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
-v pasturestack-cattle:/var/lib/cattle \
-v pasturestack-mysql:/var/lib/mysql \
-v pasturestack-mysqllog:/var/log/mysql \
ghcr.io/pasturestack/server:v1.6.518
ghcr.io/pasturestack/server:v1.6.519
```

For HTTPS termination at a reverse proxy, set the exact public origin:

```yaml
services:
pasturestack-server:
image: ghcr.io/pasturestack/server:v1.6.518
image: ghcr.io/pasturestack/server:v1.6.519
restart: unless-stopped
ports:
- "8080:8080"
Expand Down Expand Up @@ -148,8 +140,7 @@ gates. `server/build-component-candidate.sh` requires actual component commits
and SHA-256 values; it does not publish or deploy. Set
`PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five
component assets for an unpublished candidate. Without it, the same hashes
verify the versioned HTTPS release assets. The current published release remains
`v1.6.518` until a candidate is verified and separately released.
verify the versioned HTTPS release assets.

## Language and licensing

Expand Down
24 changes: 17 additions & 7 deletions docs/releases/server-1.6.519.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,18 @@
# Server v1.6.519

Status: unpublished candidate. No registry digest or new artifact-scan result
is claimed by this source document.
Status: [published immutable release](https://github.com/PastureStack/server/releases/tag/v1.6.519).

Image: `ghcr.io/pasturestack/server:v1.6.519`.
Registry digest: `sha256:498ad827ee21d5ec331f71fd2d1eb69b7941b0a089e773b3c7a3cd80744931ff`.
Artifact producer: `fd9d9b289746b2d5db9a7d3a63f1dc61ba9e0b24`.
The release contains 22 RootFS layers. Its original SBOM, scan, VEX and
registry identity binding are attached to the release; integration-only
CodeQL workflow changes do not relabel or rebuild the artifact.

Engine 0.183.335 adds a shared live Project-membership authority check before
custom Key evaluation. It corrects a legitimate member's Project being rejected
before the normal resource manager could authorize it. Key deny rules, expiry,
non-Project resource permissions and background authorization remain independent.
The previous 0.183.334 component is superseded for this unpublished candidate.

## Scope

Expand Down Expand Up @@ -65,7 +70,10 @@ Keyboard or pointer interaction cancels delayed focus, including an ABA return
to the original active element. Teardown cancels only the component's own work.
Audit export hides its own existing dropdown before disabling the request
control, preserving consecutive JSON, CSV and XLSX selection. Related Chrome
tests pass; native acceptance of this new production bundle remains separate.
tests pass. Native selector/review and consecutive CSV/XLSX export
acceptance passed on the assembled image. JSON export acceptance passed earlier
with the same Web Console production bytes. These checks do not imply every
role/filter combination in the broader matrix has been tested.
The govc bundle
uses x/text `0.41.0` for
[GO-2026-6629](https://pkg.go.dev/vuln/GO-2026-6629); its upstream Go source and
Expand Down Expand Up @@ -156,6 +164,8 @@ artifact-specific checks; a source commit or inherited VEX statement is not
evidence that the new assembled image passed them.

The existing VEX assessments, vendor-pending findings and review deadlines
are retained without relaxing the release policy or claiming a new scan.
The published installation target remains `v1.6.518` until the candidate is
verified and separately published.
remain tracked without relaxing the release policy; the new assembled-image scan is summarized below.
The assembled image passed the release policy with no High/Critical,
available-fix, untracked or secret findings. Eight upstream vendor-pending
findings remain tracked with their VEX and review deadline; this is not a claim
of zero vulnerabilities. The published installation target is `v1.6.519`.