Skip to content

security: refresh build headers and release docs #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 2 commits into from
Sep 9, 2026
Merged

security: refresh build headers and release docs #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da309ff
docs: align current release coordinates
chen21019 Sep 9, 2026
298d0ee
security: refresh fixed build headers
chen21019 Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions Dockerfile.dapper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea264
ENV DEBIAN_FRONTEND=noninteractive
ARG GO_VERSION=1.27.0
ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
ARG UBUNTU_SNAPSHOT=20260825T000000Z
ARG UBUNTU_SNAPSHOT=20260909T000000Z

ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
https://snapshot.ubuntu.com/ubuntu/20260825T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
/tmp/ca-certificates.deb
ENV GOPATH=/go
ENV GOROOT=/usr/local/go
Expand All @@ -31,6 +31,7 @@ RUN set -eux; \
apt-get install -y --no-install-recommends \
ca-certificates \
build-essential \
linux-libc-dev=7.0.0-31.31 \
curl \
git \
tar \
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz

## Project status

This is a reviewed migration candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
The current reviewed compatibility release is `v0.39.7`, based on the preserved upstream `v0.39.4` boundary and consumed by PastureStack Server `v1.6.410`. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files.

## Configuration

Expand All @@ -26,7 +26,7 @@ make package

Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.

The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.5` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.5-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.
The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.7` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.7-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.

See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).

Expand Down