diff --git a/README.md b/README.md index 56e13b6..0d49d78 100644 --- a/README.md +++ b/README.md @@ -6,9 +6,17 @@ PastureStack is an independent community effort to preserve, audit, and moderniz **Upstream:** [`rancher/scheduler`](https://github.com/rancher/scheduler). This GitHub fork retains the upstream Git history, authorship, dates, and license notices. PastureStack maintenance is consolidated into one commit after the preserved upstream boundary. -The current published release and Catalog image are `v0.8.18`. - -The `v0.8.19` candidate refreshes the official Go security release and Ubuntu packages. It is not a published release or a Catalog deployment until its required checks and release workflow complete. +The current published release is [`v0.8.19`](https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.19). +The corresponding Catalog version `5` is recorded in the +[Catalog update](https://github.com/PastureStack/catalog-templates/pull/18). + +Release `v0.8.19` refreshes the official Go security release and Ubuntu packages. +Its actual runtime scan has 0 High/Critical findings, 0 vendor-fixed findings, +and 0 secrets. The 4 Low and 47 Medium vendor-unfixed findings remain +`under_investigation` in the release risk register and OpenVEX; they are not +resolved. Release checksums and the SBOM and image build-provenance attestations +were verified against the exact signed tag, source commit, and release workflow. +Publication does not establish a managed-system upgrade or rollback result. Its disposable builder also selects the official `golang.org/x/net` 0.60.0, OpenTelemetry-Go 1.45.0, and containerd 2.3.6 security updates for Docker CLI @@ -22,6 +30,14 @@ vendor-fixed builder finding remain blocking. This does not assess the host kernel; vendor-unfixed Low/Medium and unrated builder findings retain their original severity and `under_investigation` status. +The [native evidence run](https://github.com/PastureStack/resource-scheduler/actions/runs/39357570483) +retains the raw builder scan: 8 Critical and 192 High header source-package +matches are separately classified by 200 exact `not_affected` statements. +Another 2,600 vendor-unfixed package findings remain recorded, including the +unrated `GO-2026-5932` module advisory. The actual Buildx compilation graph +contains no `golang.org/x/crypto/openpgp` packages; that fact does not remove +the module finding or assess any host kernel. + ## Runtime image The maintained image is published from this repository as: @@ -38,7 +54,7 @@ The native command is `resource-scheduler`. A `scheduler` executable symlink rem ## Build and test -The candidate build uses Go 1.27.2 to compile Docker CLI 29.7.2 and Docker Buildx 0.36.1 from checksum-pinned source. A small checksum-locked Buildx patch removes its sole compiled dependency on the legacy Docker module; the security-sensitive Buildx modules are then pinned to `github.com/moby/go-archive` 0.3.0 and `golang.org/x/mod` 0.41.0, with the final binary metadata checked in CI. The Ubuntu base image is digest-pinned; all inherited base packages are updated from the fixed `20261020T000000Z` Canonical snapshot before the direct packages pinned in `ubuntu-apt.lock` are installed, and each built image records the complete resolved `dpkg` inventory. BuildKit receives the source commit time through `SOURCE_DATE_EPOCH`, and CI compares binary hashes, runtime configuration, and resolved package inventories across clean rebuilds. +The maintained build uses Go 1.27.2 to compile Docker CLI 29.7.2 and Docker Buildx 0.36.1 from checksum-pinned source. A small checksum-locked Buildx patch removes its sole compiled dependency on the legacy Docker module; the security-sensitive Buildx modules are then pinned to `github.com/moby/go-archive` 0.3.0 and `golang.org/x/mod` 0.41.0, with the final binary metadata checked in CI. The Ubuntu base image is digest-pinned; all inherited base packages are updated from the fixed `20261020T000000Z` Canonical snapshot before the direct packages pinned in `ubuntu-apt.lock` are installed, and each built image records the complete resolved `dpkg` inventory. BuildKit receives the source commit time through `SOURCE_DATE_EPOCH`, and CI compares binary hashes, runtime configuration, and resolved package inventories across clean rebuilds. The dependency graph is declared in `go.mod`, checksum-bound by `go.sum`, and committed in the standard module-aware `vendor` tree for reproducible offline builds. Security CI produces short-lived source and runtime CycloneDX SBOMs, runs binary reachability analysis, and blocks detected secrets, every High/Critical runtime finding, and any finding for which Ubuntu has published a fixed package. Low/Medium findings without an available Ubuntu fix remain visible as `under_investigation` in the release risk register and OpenVEX artifact; they are not represented as resolved and are re-evaluated when the vendor, base digest, or vulnerability data changes. diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 5c5f081..7b2e080 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,6 +1,6 @@ # Release Notes -## 0.8.19 candidate +## 0.8.19 - Rebuild with the official Go 1.27.2 security release and checksum-verified archives. - Refresh the dated Canonical snapshot to `20261020T000000Z`, including the @@ -11,6 +11,10 @@ kernel is outside that package-only assessment. - Verify the packaged scheduler's non-root port-80 health endpoint and the liveness/readiness behavior with isolated CI fixtures. +- Publish the exact signed release tag with checksum-verified image SBOM and + build-provenance attestations. The actual runtime has 0 High/Critical, + 0 vendor-fixed findings, and 0 secrets; 4 Low and 47 Medium vendor-unfixed + findings remain `under_investigation` rather than resolved. ## 0.8.18 diff --git a/scripts/check-migration-policy b/scripts/check-migration-policy index ada1e32..d2e585d 100755 --- a/scripts/check-migration-policy +++ b/scripts/check-migration-policy @@ -43,7 +43,7 @@ done grep -Fq "PastureStack is an independent community effort to preserve, audit, and modernize the ${legacy_title} 1.6 ecosystem. It is not affiliated with or endorsed by ${legacy_title} Labs or SUSE." README.md || fail "independence_notice_missing" grep -Fq 'ad28c1d94b7f1b1814fa6404886398b4f4094d64' ORIGIN.md || fail "upstream_boundary_missing" grep -Fq 'ghcr.io/pasturestack/resource-scheduler' README.md || fail "public_image_missing" -grep -Fq 'v0.8.18' README.md || fail "current_numeric_release_missing" +grep -Fq 'v0.8.19' README.md || fail "current_numeric_release_missing" grep -Fq "[[ \"\$RELEASE_TAG\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+\$ ]]" .github/workflows/release.yml || fail "numeric_release_gate_missing" if git grep -I -n -E "${legacy_brand}-1\\.6-|${retired_short}" -- ':!vendor/**' ':!LICENSES/**' >/tmp/resource-scheduler-policy-matches 2>/dev/null; then