diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index d1f4e73070..4a00f4ab39 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -6,7 +6,7 @@ New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility i ## Docker host policy -Release `0.183.306` preserves the Docker host policy introduced in `0.183.299`, +Release `0.183.307` preserves the Docker host policy introduced in `0.183.299`, which adds Docker Engine `29.8.0` as an exact supported version alongside the preserved legacy ranges, `24.0.9`, and the existing `29.4.1` through `29.7.2` interval. It does not widen the interval to admit @@ -33,6 +33,11 @@ requests and repeated deletes return `204` without an expiry cookie. Unbound tokens created by older consoles retain their established delete behavior so a rolling upgrade does not strand legacy sessions. +Release `0.183.307` normalizes the authenticated current-token representation +before the ownership lookup, so both a cookie's bare key and an +`Authorization: Bearer ` header revoke the same matching session. It does +not accept another authorization scheme or a malformed multipart value. + When `api.auth.restrict.concurrent.sessions=true`, replacement is protected by one distributed lock per token account and authenticated account. The Engine compares the fixed-format generations, rejects a delayed older or unbound diff --git a/README.md b/README.md index 8f2dc8512a..a7f23798ca 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status The current public GitHub Release -[`v0.183.306`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.306) -produces engine version `0.183.306`. It retains the existing Java 25, Ubuntu +[`v0.183.307`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.307) +produces engine version `0.183.307`. It retains the existing Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and runtime-hardening work from the maintained compatibility line. Release builds consume the exact `5.7.4` runtime JAR published by @@ -21,8 +21,13 @@ product identity and provenance are carried by the artifact name, metadata, SBOM, and release evidence. Provenance and scope are documented in [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md). -Release `0.183.306` fixes the integrated project-member identity contract. -The reviewed external identity list now lives in the IAAS API packaged defaults +Release `0.183.307` fixes session-bound logout for both cookie and standard +`Authorization: Bearer` transports. Current-token discovery preserves the +transport representation, so the delete path now normalizes it to the database +key before checking session ownership; other schemes and malformed multipart +values remain fail-closed. It also retains the integrated project-member +identity fix from `0.183.306`. The reviewed external identity list lives in the +IAAS API packaged defaults that production Archaius startup actually loads, and the core schema factory waits for that initialization before parsing schemas. The shipped `oidc_user` and `oidc_group` options therefore appear in both public API generations in a @@ -98,7 +103,7 @@ dependency line. The existing platform JSON surface remains on `com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed, version-pinned pair and verify that their class namespaces are disjoint. -Host compatibility is evidence-based. Release `0.183.306` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate. +Host compatibility is evidence-based. Release `0.183.307` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate. The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release. @@ -146,7 +151,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK To create the complete release archive after the gate passes: ```sh -ENGINE_VERSION=0.183.306 bash scripts/build --release +ENGINE_VERSION=0.183.307 bash scripts/build --release bash scripts/check-release-artifact dist/artifacts/cattle.jar ``` diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml index c176a4759f..05da9499d8 100644 --- a/code/framework/api-pub-sub-jetty/pom.xml +++ b/code/framework/api-pub-sub-jetty/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml index b37af86413..ba7b4e88c9 100644 --- a/code/framework/api-pub-sub/pom.xml +++ b/code/framework/api-pub-sub/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml index 916af80665..3f556fbcde 100644 --- a/code/framework/api/pom.xml +++ b/code/framework/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml index cfc22a3b4e..9fce57a5f7 100644 --- a/code/framework/archaius/pom.xml +++ b/code/framework/archaius/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.306 + 0.183.307 ../../meta-parent/pom.xml diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml index fe580d8963..f49a5d3cf3 100644 --- a/code/framework/async/pom.xml +++ b/code/framework/async/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml index 22f149b9df..48747ef3c0 100644 --- a/code/framework/auditing/pom.xml +++ b/code/framework/auditing/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml index 1af6f8dd90..477064fc22 100644 --- a/code/framework/db-loader/pom.xml +++ b/code/framework/db-loader/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml index 77d3ae565c..ca5c91b291 100644 --- a/code/framework/deferred/pom.xml +++ b/code/framework/deferred/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml index 6c9da7f21c..1f0b079a3f 100644 --- a/code/framework/encryption/pom.xml +++ b/code/framework/encryption/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml index 8db857e598..62b7177531 100644 --- a/code/framework/engine/pom.xml +++ b/code/framework/engine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml index 9c1c0ed1ce..a0395d8b58 100644 --- a/code/framework/eventing/pom.xml +++ b/code/framework/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml index f89b0276f9..77d6213cee 100644 --- a/code/framework/events/pom.xml +++ b/code/framework/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml index 4011564faa..1ac3e5481e 100644 --- a/code/framework/extension-spring/pom.xml +++ b/code/framework/extension-spring/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml index 8d0fdb3870..1602bdb464 100644 --- a/code/framework/extension/pom.xml +++ b/code/framework/extension/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml index bfe7026c00..f2f6336236 100644 --- a/code/framework/java-server/pom.xml +++ b/code/framework/java-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml index 571630bc5f..d0f2983944 100644 --- a/code/framework/jmx/pom.xml +++ b/code/framework/jmx/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml index fc3c360cc9..0565f9c42a 100644 --- a/code/framework/jooq/pom.xml +++ b/code/framework/jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml index ffbf992e73..f5272fff6f 100644 --- a/code/framework/json/pom.xml +++ b/code/framework/json/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml index 917dd05c55..f5efb4ffc5 100644 --- a/code/framework/launcher/pom.xml +++ b/code/framework/launcher/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml index b3071bf5e5..262959cf74 100644 --- a/code/framework/lock/pom.xml +++ b/code/framework/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml index 78ad3f9d31..42cf47c65d 100644 --- a/code/framework/logback/pom.xml +++ b/code/framework/logback/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.306 + 0.183.307 ../../meta-parent/pom.xml diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml index bd64aabdfc..759982c53f 100644 --- a/code/framework/managed-context/pom.xml +++ b/code/framework/managed-context/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml index c992a54614..e4a920ba07 100644 --- a/code/framework/metrics/pom.xml +++ b/code/framework/metrics/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml index 11c15f707a..b98db58f79 100644 --- a/code/framework/module/pom.xml +++ b/code/framework/module/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml index e84bdca4e4..9f4895bacd 100644 --- a/code/framework/object/pom.xml +++ b/code/framework/object/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml index 227bed6bc7..e7d8f58c94 100644 --- a/code/framework/pool/pom.xml +++ b/code/framework/pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml index 090c4921b7..a701944242 100644 --- a/code/framework/resource-monitor/pom.xml +++ b/code/framework/resource-monitor/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml index 955f880175..1e08762077 100644 --- a/code/framework/schema/pom.xml +++ b/code/framework/schema/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml index 1e8beaf3f8..d9a332246e 100644 --- a/code/framework/server/pom.xml +++ b/code/framework/server/pom.xml @@ -4,7 +4,7 @@ cattle-meta-parent io.cattle - 0.183.306 + 0.183.307 ../../meta-parent/pom.xml diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml index 207c7f0d40..6449941341 100644 --- a/code/framework/spring/pom.xml +++ b/code/framework/spring/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml index a647fc733e..d2562dd335 100644 --- a/code/framework/system-task/pom.xml +++ b/code/framework/system-task/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml index b440fc7cda..a07a1f3bf3 100644 --- a/code/framework/token/pom.xml +++ b/code/framework/token/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml index ecd4745982..c34ba50e28 100644 --- a/code/framework/utils/pom.xml +++ b/code/framework/utils/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml index c49cbb034d..f296333f00 100644 --- a/code/iaas/agent-instance/pom.xml +++ b/code/iaas/agent-instance/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml index 0cbe001c75..2731faef4c 100644 --- a/code/iaas/agent-server/pom.xml +++ b/code/iaas/agent-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml index 13b57ffb57..16c7b9f822 100644 --- a/code/iaas/agent/pom.xml +++ b/code/iaas/agent/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml index d1561cba3f..f5e1293cb3 100644 --- a/code/iaas/allocator/pom.xml +++ b/code/iaas/allocator/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml index 0a33207136..875481fcaa 100644 --- a/code/iaas/api-logic/pom.xml +++ b/code/iaas/api-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml index 32028b4ef3..3da218a382 100644 --- a/code/iaas/archaius-management/pom.xml +++ b/code/iaas/archaius-management/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml index 42b0615b3b..5a67d4b77f 100644 --- a/code/iaas/auth-logic/pom.xml +++ b/code/iaas/auth-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/auth-logic/src/main/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManager.java b/code/iaas/auth-logic/src/main/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManager.java index d86eabbdf2..61b6d3c254 100644 --- a/code/iaas/auth-logic/src/main/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManager.java +++ b/code/iaas/auth-logic/src/main/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManager.java @@ -324,7 +324,7 @@ protected Object deleteInternal(String type, String id, Object obj, ApiRequest r protected Object deleteToken(Object obj, ApiRequest request) { request.setResponseCode(ResponseCodes.NO_CONTENT); Token token = listToken(); - String jwt = token == null ? null : token.getJwt(); + String jwt = normalizeTokenKey(token == null ? null : token.getJwt()); // DELETE is intentionally idempotent. A missing or already-revoked // token is not an exceptional condition and must not produce a 500. @@ -363,6 +363,27 @@ protected Object deleteToken(Object obj, ApiRequest request) { return obj; } + /** + * Current-token discovery preserves the original transport value. Cookie + * authentication therefore yields a bare key while Authorization headers + * yield "Bearer ". Database ownership checks must use the key in both + * cases without accepting another authentication scheme. + */ + static String normalizeTokenKey(String value) { + if (StringUtils.isBlank(value)) { + return null; + } + String[] parts = StringUtils.trim(value).split("\\s+"); + if (parts.length == 1) { + return parts[0]; + } + if (parts.length == 2 && Strings.CI.equals("bearer", parts[0]) + && StringUtils.isNotBlank(parts[1])) { + return parts[1]; + } + return null; + } + static String normalizeClientSessionId(Object value) { String clientSessionId = value == null ? null : String.valueOf(value); if (StringUtils.isBlank(clientSessionId)) { diff --git a/code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManagerTest.java b/code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManagerTest.java index 0976ef8f83..8e0f961fab 100644 --- a/code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManagerTest.java +++ b/code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/TokenResourceManagerTest.java @@ -31,7 +31,7 @@ public class TokenResourceManagerTest { @Test public void boundTokenRequiresMatchingClientSessionAndNeverEmitsExpiryCookie() { FakeAuthTokenDao dao = new FakeAuthTokenDao(record("token-key", VALID_SESSION)); - TestManager manager = manager(dao, "token-key"); + TestManager manager = manager(dao, "Bearer token-key"); RequestState missing = request(null); assertSame(missing.object, manager.deleteToken(missing.object, missing.request)); @@ -110,6 +110,17 @@ public void clientSessionFormatIsStrictAndComparisonIsNullSafe() { } } + @Test + public void normalizesCookieAndBearerTransportsWithoutAcceptingOtherSchemes() { + assertEquals("token-key", TokenResourceManager.normalizeTokenKey("token-key")); + assertEquals("token-key", TokenResourceManager.normalizeTokenKey("Bearer token-key")); + assertEquals("token-key", TokenResourceManager.normalizeTokenKey("bearer token-key")); + assertNull(TokenResourceManager.normalizeTokenKey(null)); + assertNull(TokenResourceManager.normalizeTokenKey("")); + assertNull(TokenResourceManager.normalizeTokenKey("Basic token-key")); + assertNull(TokenResourceManager.normalizeTokenKey("Bearer token-key extra")); + } + private static TestManager manager(FakeAuthTokenDao dao, String jwt) { TestManager manager = new TestManager(); manager.authTokenDao = dao; diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml index 10de47e112..b9dce4e9c0 100644 --- a/code/iaas/bootstrap/pom.xml +++ b/code/iaas/bootstrap/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml index 0486488afa..32a366713b 100644 --- a/code/iaas/config-item/api/pom.xml +++ b/code/iaas/config-item/api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml index 53d01fce1c..a67939c478 100644 --- a/code/iaas/config-item/common/pom.xml +++ b/code/iaas/config-item/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml index 605b9d10f0..0a75965bf7 100644 --- a/code/iaas/config-item/server/pom.xml +++ b/code/iaas/config-item/server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml index 555d377fcf..b5adea3622 100644 --- a/code/iaas/engine-jooq/pom.xml +++ b/code/iaas/engine-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml index d3d733e360..b23beafa0a 100644 --- a/code/iaas/events/pom.xml +++ b/code/iaas/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml index f5e785a1e7..0862813db2 100644 --- a/code/iaas/external-handler/pom.xml +++ b/code/iaas/external-handler/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml index 4d49a721ad..088d6f3362 100644 --- a/code/iaas/ha/pom.xml +++ b/code/iaas/ha/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml index b016b21c70..c12c527417 100644 --- a/code/iaas/healthcheck/pom.xml +++ b/code/iaas/healthcheck/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml index 9fa15ea430..67ab8791a2 100644 --- a/code/iaas/labels/pom.xml +++ b/code/iaas/labels/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml index 160d03b2e7..be5c45e64f 100644 --- a/code/iaas/logic-common/pom.xml +++ b/code/iaas/logic-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml index df08b17202..41e6256078 100644 --- a/code/iaas/logic/pom.xml +++ b/code/iaas/logic/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml index d072181ea6..cd2d482f80 100644 --- a/code/iaas/metadata/pom.xml +++ b/code/iaas/metadata/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml index c19935aa14..323e3d56b4 100644 --- a/code/iaas/model/pom.xml +++ b/code/iaas/model/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml index 3ce5d8a8fd..f50a6c6224 100644 --- a/code/iaas/resource-pool/pom.xml +++ b/code/iaas/resource-pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml index 31da5978ce..5d3c6d9b37 100644 --- a/code/iaas/service-discovery/api/pom.xml +++ b/code/iaas/service-discovery/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml index 4a2dea6d8d..4b7ecf902f 100644 --- a/code/iaas/service-discovery/server/pom.xml +++ b/code/iaas/service-discovery/server/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml index 28333f6818..77b399843b 100644 --- a/code/iaas/ssh-common/pom.xml +++ b/code/iaas/ssh-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml index 1c1e2c72f6..4f4229a420 100644 --- a/code/iaas/storage-service/pom.xml +++ b/code/iaas/storage-service/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml index 09384576db..b8add6431f 100644 --- a/code/iaas/task-jooq/pom.xml +++ b/code/iaas/task-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml index 081d98c72a..c075154279 100644 --- a/code/implementation/activity-log/pom.xml +++ b/code/implementation/activity-log/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml index 3a9a5e4b43..9e9891733a 100644 --- a/code/implementation/agent-instance-impl/pom.xml +++ b/code/implementation/agent-instance-impl/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml cattle-agent-instance-impl diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml index c5853facc5..856a68c781 100644 --- a/code/implementation/docker/api/pom.xml +++ b/code/implementation/docker/api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml index ba8591998e..12c2ad8c06 100644 --- a/code/implementation/docker/common/pom.xml +++ b/code/implementation/docker/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml index b60c4eda27..dd1ac729cf 100644 --- a/code/implementation/docker/compute/pom.xml +++ b/code/implementation/docker/compute/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml index 73cebad77b..2f6931c871 100644 --- a/code/implementation/docker/machine/pom.xml +++ b/code/implementation/docker/machine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml index bea8eb690b..dcc184fdba 100644 --- a/code/implementation/docker/storage/pom.xml +++ b/code/implementation/docker/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml @@ -21,12 +21,12 @@ io.cattle cattle-docker-common - 0.183.306 + 0.183.307 io.cattle cattle-iaas-allocator - 0.183.306 + 0.183.307 diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml index 903ac5e319..ce7ca8e37c 100644 --- a/code/implementation/extension-api/pom.xml +++ b/code/implementation/extension-api/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml cattle-extension-api diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml index 6596ddafcb..9f0dbcebd3 100644 --- a/code/implementation/hazelcast/common/pom.xml +++ b/code/implementation/hazelcast/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml index a2205a5021..3926a01d32 100644 --- a/code/implementation/hazelcast/eventing/pom.xml +++ b/code/implementation/hazelcast/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml index 90f76ca76b..e591362787 100644 --- a/code/implementation/hazelcast/lock/pom.xml +++ b/code/implementation/hazelcast/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml index da2bdbb094..1d3e4401e2 100644 --- a/code/implementation/host-api/pom.xml +++ b/code/implementation/host-api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml index dcb9864d4c..4229b346d0 100644 --- a/code/implementation/host-stats/pom.xml +++ b/code/implementation/host-stats/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml index 6d514a09fe..9df8d9c389 100644 --- a/code/implementation/register/pom.xml +++ b/code/implementation/register/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml index 7092dca130..3b426143c2 100644 --- a/code/implementation/sample-setup/pom.xml +++ b/code/implementation/sample-setup/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml index abb219745f..24952141a1 100644 --- a/code/implementation/settings-api/pom.xml +++ b/code/implementation/settings-api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml index 9aac44c6c8..86f95c18bd 100644 --- a/code/implementation/simulator/agent-connection/pom.xml +++ b/code/implementation/simulator/agent-connection/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml index 802586660e..8263443c4e 100644 --- a/code/implementation/simulator/storage/pom.xml +++ b/code/implementation/simulator/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../../parent/pom.xml diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml index c015ab6818..8b51f68b7a 100644 --- a/code/implementation/system-stack/pom.xml +++ b/code/implementation/system-stack/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml index 7793c96f46..a27bcb7f6c 100644 --- a/code/implementation/vm/pom.xml +++ b/code/implementation/vm/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml cattle-vm diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml index bc1a8ef94b..10673a0ab7 100644 --- a/code/meta-parent/pom.xml +++ b/code/meta-parent/pom.xml @@ -9,7 +9,7 @@ 4.0.0 io.cattle cattle-meta-parent - 0.183.306 + 0.183.307 pom PastureStack Orchestration Engine Compatibility orchestration engine for the PastureStack server. diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml index 55bce5a68e..88f0412fc1 100644 --- a/code/packaging/app-config/pom.xml +++ b/code/packaging/app-config/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml jar diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml index 65f98cce73..acc936f3af 100644 --- a/code/packaging/app/pom.xml +++ b/code/packaging/app/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml war diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml index 2589bf04b9..b5b1d8418f 100644 --- a/code/packaging/bundle/pom.xml +++ b/code/packaging/bundle/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml index e70415821b..3a857e648e 100644 --- a/code/packaging/dev/pom.xml +++ b/code/packaging/dev/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml index 4ffc38fb24..43c190a912 100644 --- a/code/packaging/meta/pom.xml +++ b/code/packaging/meta/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../../parent/pom.xml diff --git a/code/parent/pom.xml b/code/parent/pom.xml index 1151dee6cd..f122bb1156 100644 --- a/code/parent/pom.xml +++ b/code/parent/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-meta-parent ../meta-parent/pom.xml - 0.183.306 + 0.183.307 pom diff --git a/docs/releases/orchestration-engine-0.183.307.md b/docs/releases/orchestration-engine-0.183.307.md new file mode 100644 index 0000000000..2f351544d8 --- /dev/null +++ b/docs/releases/orchestration-engine-0.183.307.md @@ -0,0 +1,19 @@ +# Orchestration Engine 0.183.307 + +- Normalize the authenticated token transport before a session-bound logout + checks or deletes its database record. Cookie requests provide a bare key, + while standards-compliant API clients provide `Bearer `. +- Keep the logout contract fail-closed: only a bare token key or the Bearer + scheme is accepted, a missing or mismatched client session remains an + idempotent no-op, and only the matching generation can revoke a bound token. +- Extend the deletion regression test to exercise the real Authorization + header representation as well as cookie-style bare keys and reject other + schemes or malformed multi-part values. +- Retain the production-loaded OIDC identity defaults and integrated v1/v2 + project-member schema contract fixed in `0.183.306`. + +Server consumers must verify both Bearer and Cookie session-bound deletion in +the integrated candidate runtime before publishing. + +Use this release with Web Console `1.6.119` and Authentication Service +`v0.4.38`. diff --git a/pom.xml b/pom.xml index 1cece3db02..848c0d4fd6 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ io.cattle cattle-parent - 0.183.306 + 0.183.307 code/parent/pom.xml cattle diff --git a/resources/pom.xml b/resources/pom.xml index a920ecc460..11d165e7f8 100644 --- a/resources/pom.xml +++ b/resources/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.306 + 0.183.307 ../code/parent/pom.xml diff --git a/scripts/build b/scripts/build index 97bdf58b9d..1e5b2bacd8 100755 --- a/scripts/build +++ b/scripts/build @@ -16,7 +16,7 @@ fi SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)} SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} -ENGINE_VERSION=${ENGINE_VERSION:-0.183.306} +ENGINE_VERSION=${ENGINE_VERSION:-0.183.307} case "$SOURCE_REVISION" in ''|*[!0-9a-f]*) diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source index 38509f5704..e6d7acd0d7 100755 --- a/scripts/check-pasturestack-source +++ b/scripts/check-pasturestack-source @@ -51,7 +51,7 @@ fi project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1) [[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version -require_line code/meta-parent/pom.xml ' 0.183.306' +require_line code/meta-parent/pom.xml ' 0.183.307' require_line "$iaas_api_defaults" 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group' require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine' require_line Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b' @@ -207,7 +207,9 @@ require_line resources/content/db/core-126.xml ' '"'"' >/dev/null' require_line scripts/check-release-artifact 'if unzip -p "$workdir/$resources_entry" db/mysql/mysql-dump.sql | grep -F '"'"'client_session_id'"'"' >/dev/null; then' @@ -352,4 +354,4 @@ fi require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.' require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`' -printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.306 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use\n' +printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.307 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use\n' diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact index 442be4ec37..b24cbecb90 100755 --- a/scripts/check-release-artifact +++ b/scripts/check-release-artifact @@ -4,7 +4,7 @@ set -euo pipefail cd "$(dirname "$0")/.." artifact=${1:-dist/artifacts/cattle.jar} -expected_version=${EXPECTED_ENGINE_VERSION:-0.183.306} +expected_version=${EXPECTED_ENGINE_VERSION:-0.183.307} test -f "$artifact" artifact=$(realpath "$artifact")