From 9effd06d15b23371e4ab24f562d43b6bdd6ff7bc Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Sun, 11 Oct 2026 14:03:44 +0800 Subject: [PATCH] docs: align installation guide with published Server 1.6.519 --- README.md | 23 +++++++---------------- docs/releases/server-1.6.519.md | 24 +++++++++++++++++------- 2 files changed, 24 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 5c09922ff3..61695aba2c 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,9 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves upstream history, authorship, licenses, and notices. -## Current source +## Current release -Server `v1.6.519` is an unpublished candidate, packaging Web Console `1.6.181` +Server `v1.6.519` packages Web Console `1.6.181` and Orchestration Engine `v0.183.335`. API Keys support full, custom and closed policies, optional expiry, and key-scoped durable audit records. Their permissions remain bounded by the owner's current role and environment access. Delegated @@ -35,11 +35,11 @@ Audit export closes its own menu before locking the request, allowing consecutiv JSON, CSV and XLSX downloads without leaving a disabled menu open. Key scope choices use the viewer's authorized environment list. Environment, stack and resource selectors close before dependent loading or verification. -See the [candidate release note](docs/releases/server-1.6.519.md) for exact +See the [release note](docs/releases/server-1.6.519.md) for exact component identities and verification boundaries. A version or packaged feature does not establish that every resource/role/hardware combination has been tested. -## API Keys in the source candidate +## API Keys Choose allow-by-default with deny exceptions, or deny-by-default with allow exceptions, with optional expiry. Without exceptions these retain full or closed @@ -58,14 +58,6 @@ keyboard highlighting; narrow layouts keep the matrix in its own scroll region. Errors use the existing API status/code and console error handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts. -## Current release - -The currently downloadable [Server v1.6.518](https://github.com/PastureStack/server/releases/tag/v1.6.518) -includes Web Console `1.6.180` and Orchestration Engine `v0.183.333`. -The quick-start examples below use this published image until the candidate is -verified and separately released. Its exact artifact identity and verification -boundaries are recorded in the [published release note](docs/releases/server-1.6.518.md). - ## Quick start Public GHCR downloads do not require a registry login. Use the published numeric @@ -76,7 +68,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.518 + ghcr.io/pasturestack/server:v1.6.519 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -84,7 +76,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.518 + image: ghcr.io/pasturestack/server:v1.6.519 restart: unless-stopped ports: - "8080:8080" @@ -148,8 +140,7 @@ gates. `server/build-component-candidate.sh` requires actual component commits and SHA-256 values; it does not publish or deploy. Set `PASTURESTACK_COMPONENT_ARTIFACT_DIR` to an isolated directory with the five component assets for an unpublished candidate. Without it, the same hashes -verify the versioned HTTPS release assets. The current published release remains -`v1.6.518` until a candidate is verified and separately released. +verify the versioned HTTPS release assets. ## Language and licensing diff --git a/docs/releases/server-1.6.519.md b/docs/releases/server-1.6.519.md index 591b90cda2..d9f93cfa9f 100644 --- a/docs/releases/server-1.6.519.md +++ b/docs/releases/server-1.6.519.md @@ -1,13 +1,18 @@ # Server v1.6.519 -Status: unpublished candidate. No registry digest or new artifact-scan result -is claimed by this source document. +Status: [published immutable release](https://github.com/PastureStack/server/releases/tag/v1.6.519). + +Image: `ghcr.io/pasturestack/server:v1.6.519`. +Registry digest: `sha256:498ad827ee21d5ec331f71fd2d1eb69b7941b0a089e773b3c7a3cd80744931ff`. +Artifact producer: `fd9d9b289746b2d5db9a7d3a63f1dc61ba9e0b24`. +The release contains 22 RootFS layers. Its original SBOM, scan, VEX and +registry identity binding are attached to the release; integration-only +CodeQL workflow changes do not relabel or rebuild the artifact. Engine 0.183.335 adds a shared live Project-membership authority check before custom Key evaluation. It corrects a legitimate member's Project being rejected before the normal resource manager could authorize it. Key deny rules, expiry, non-Project resource permissions and background authorization remain independent. -The previous 0.183.334 component is superseded for this unpublished candidate. ## Scope @@ -65,7 +70,10 @@ Keyboard or pointer interaction cancels delayed focus, including an ABA return to the original active element. Teardown cancels only the component's own work. Audit export hides its own existing dropdown before disabling the request control, preserving consecutive JSON, CSV and XLSX selection. Related Chrome -tests pass; native acceptance of this new production bundle remains separate. +tests pass. Native selector/review and consecutive CSV/XLSX export +acceptance passed on the assembled image. JSON export acceptance passed earlier +with the same Web Console production bytes. These checks do not imply every +role/filter combination in the broader matrix has been tested. The govc bundle uses x/text `0.41.0` for [GO-2026-6629](https://pkg.go.dev/vuln/GO-2026-6629); its upstream Go source and @@ -156,6 +164,8 @@ artifact-specific checks; a source commit or inherited VEX statement is not evidence that the new assembled image passed them. The existing VEX assessments, vendor-pending findings and review deadlines -are retained without relaxing the release policy or claiming a new scan. -The published installation target remains `v1.6.518` until the candidate is -verified and separately published. +remain tracked without relaxing the release policy; the new assembled-image scan is summarized below. +The assembled image passed the release policy with no High/Critical, +available-fix, untracked or secret findings. Eight upstream vendor-pending +findings remain tracked with their VEX and review deadline; this is not a claim +of zero vulnerabilities. The published installation target is `v1.6.519`.