From 2fdfdac25656caf3c3f3a8cb11fcb0c7ebaf7fea Mon Sep 17 00:00:00 2001 From: chen21019 Date: Sat, 12 Sep 2026 21:36:52 +0800 Subject: [PATCH] Describe network manager v0.8.15 candidate and VM gate --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 35ceeef..c5b79e0 100644 --- a/README.md +++ b/README.md @@ -8,9 +8,9 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Runtime image -The current released image is `v0.8.14`, with GHCR manifest digest +The `v0.8.14` image was published with GHCR manifest digest `sha256:59b4bb31df28503337e9f3b8f08c18aa0dbe9749692c721fe8bdfc4cc921f263`. -Its immutable tag resolves to signed source commit +Its annotated tag resolves to signed source commit `98ffacd24436d42e33db721ab7026739d0edee41`. The release workflow passed tests, a reproducible build, Trivy source/binary/image scans, CycloneDX source and image SBOM checks, and asset/image provenance attestations. Image @@ -24,6 +24,12 @@ without changing rules, and passed a Docker restart check and a legacy-mode host reboot check. This does not establish multi-host rollout or existing-stack upgrade safety. +The `v0.8.15` source candidate moves same-subnet NAT exclusion into this +manager's xtables rules, matching its native nftables ownership. The isolated +VM applied, reapplied, inspected, and removed candidate host NAT and host-port +rules under Docker's iptables-nft and iptables-legacy frontends. This is not +yet evidence of a published `v0.8.15` image or a managed-service rollout. + The current preflight inspects already loaded legacy tables using an independent iptables-legacy executable. Active old platform or Docker hooks in the other frontend block startup; an unhooked chain declaration alone does