Skip to content

docs: keep official release and producer evidence accurate #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 21, 2026
Merged

docs: keep official release and producer evidence accurate #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz

## Project status

This is the `v0.39.9` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.3 for Linux/amd64. Published `v0.39.8` and earlier tags/assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
This repository maintains the `v0.39.9` recipe based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.3 for Linux/amd64. The official [v0.39.9 release](https://github.com/PastureStack/host-provisioner/releases/tag/v0.39.9) and earlier tags/assets remain immutable; later recipe or documentation commits do not change their producer identity. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.

## Configuration

Expand All @@ -26,7 +26,7 @@ make package

Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.

The build container does not receive the host Docker socket. For the current candidate, build with `VERSION_OVERRIDE=v0.39.9` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic asset `host-provisioner-0.39.9-linux-amd64.tar.xz`. Publication and matching Server acceptance are separate required steps. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads published assets from their versioned GitHub Release and verifies the new SHA-256 digest before installation. Users do not need to host a package mirror.
The build container does not receive the host Docker socket. For this recipe, build with `VERSION_OVERRIDE=v0.39.9` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic asset `host-provisioner-0.39.9-linux-amd64.tar.xz`. Source changes alone are not publication proof: verify the official release assets and their SHA-256. Component publication and matching Server acceptance are separate evidence boundaries. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads published assets from their versioned GitHub Release and verifies the new SHA-256 digest before installation. Users do not need to host a package mirror.

The build-only Ubuntu snapshot is fixed at `20261010T200000Z`, with kernel headers `7.0.0-38.38` and OpenSSL `3.5.5-1ubuntu3.7`. CI builds and scans that container separately from the static product executable; available upstream fixes must pass the existing security gate rather than be classified as pending vendor fixes.

Expand Down
Loading