diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 4a00f4ab39..57b6f48be6 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -6,7 +6,7 @@ New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility i ## Docker host policy -Release `0.183.307` preserves the Docker host policy introduced in `0.183.299`, +Release `0.183.308` preserves the Docker host policy introduced in `0.183.299`, which adds Docker Engine `29.8.0` as an exact supported version alongside the preserved legacy ranges, `24.0.9`, and the existing `29.4.1` through `29.7.2` interval. It does not widen the interval to admit @@ -33,11 +33,20 @@ requests and repeated deletes return `204` without an expiry cookie. Unbound tokens created by older consoles retain their established delete behavior so a rolling upgrade does not strand legacy sessions. -Release `0.183.307` normalizes the authenticated current-token representation +Release `0.183.308` normalizes the authenticated current-token representation before the ownership lookup, so both a cookie's bare key and an `Authorization: Bearer ` header revoke the same matching session. It does not accept another authorization scheme or a malformed multipart value. +The same release updates every shipped frozen v1 schema that exposes `token` +(`base`, `superadmin`, and `token`). Each snapshot retains `clientSessionId` as +a nullable password field with exact length 78, create access only, no update +access, and read-on-create-only semantics. This closes the v1-specific gap in +which authorization was correct in the dynamic schema but the frozen snapshot +silently removed the generation before token creation. Server release gates +must exercise session-bound creation and deletion through both `/v1/token` and +`/v2-beta/token`; a v2-only runtime check is not sufficient. + When `api.auth.restrict.concurrent.sessions=true`, replacement is protected by one distributed lock per token account and authenticated account. The Engine compares the fixed-format generations, rejects a delayed older or unbound @@ -51,11 +60,11 @@ it does not replace the cookie, grant access, or appear in URLs. The Web Console must keep JWT material out of Web Storage and hold its cross-tab mutex through the complete explicit-delete response before clearing its local state. -The token authorization overlay must retain `clientSessionId` as a -read-on-create-only input. Removing it from the public token schema turns every -new login into an unbound legacy token even when the Web Console supplies a -valid generation, so schema authorization is covered by a shipped-overlay -regression test. +The token authorization overlay and every frozen token schema must retain +`clientSessionId` as a read-on-create-only input. Removing it from either API +surface turns new logins on that path into unbound legacy tokens even when the +Web Console supplies a valid generation. Separate regression tests therefore +cover both the dynamic overlay and the deserialized frozen snapshots. ## External identity types diff --git a/README.md b/README.md index a7f23798ca..9b272b837c 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status The current public GitHub Release -[`v0.183.307`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.307) -produces engine version `0.183.307`. It retains the existing Java 25, Ubuntu +[`v0.183.308`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.308) +produces engine version `0.183.308`. It retains the existing Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and runtime-hardening work from the maintained compatibility line. Release builds consume the exact `5.7.4` runtime JAR published by @@ -21,11 +21,18 @@ product identity and provenance are carried by the artifact name, metadata, SBOM, and release evidence. Provenance and scope are documented in [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md). -Release `0.183.307` fixes session-bound logout for both cookie and standard -`Authorization: Bearer` transports. Current-token discovery preserves the -transport representation, so the delete path now normalizes it to the database -key before checking session ownership; other schemes and malformed multipart -values remain fail-closed. It also retains the integrated project-member +Release `0.183.308` completes session-bound logout for both v1 and v2 API +clients. The frozen v1 `base`, `superadmin`, and `token` schema snapshots now +publish the same fixed-format, sensitive, create-only `clientSessionId` input as +the live schema. Without that snapshot update, `/v1/token` silently discarded a +valid browser generation and created an unbound legacy token even though the +dynamic authorization overlay was correct. A regression test deserializes every +frozen schema that exposes `token` and checks the complete field contract. + +Current-token discovery also preserves the transport representation, so the +delete path normalizes both cookie keys and standard `Authorization: Bearer` +values to the database key before checking session ownership; other schemes and +malformed multipart values remain fail-closed. It also retains the integrated project-member identity fix from `0.183.306`. The reviewed external identity list lives in the IAAS API packaged defaults that production Archaius startup actually loads, and the core schema factory @@ -35,7 +42,7 @@ clean runtime without a Compose override. Base and configured options are merged in stable order without duplicates. `0.183.305` contained the schema ordering fix but left the reviewed list only in the installer resource, so it is superseded for this contract. This release retains -the browser-session ownership, fixed-format create-only `clientSessionId`, +the browser-session ownership and fixed-format generation validation, unknown identity rejection, and provider-state restoration introduced in `0.183.304`; deployment overrides remain dynamic without becoming required defaults. @@ -103,7 +110,7 @@ dependency line. The existing platform JSON surface remains on `com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed, version-pinned pair and verify that their class namespaces are disjoint. -Host compatibility is evidence-based. Release `0.183.307` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate. +Host compatibility is evidence-based. Release `0.183.308` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate. The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release. @@ -151,7 +158,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK To create the complete release archive after the gate passes: ```sh -ENGINE_VERSION=0.183.307 bash scripts/build --release +ENGINE_VERSION=0.183.308 bash scripts/build --release bash scripts/check-release-artifact dist/artifacts/cattle.jar ``` diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml index 05da9499d8..2b8a61ae5f 100644 --- a/code/framework/api-pub-sub-jetty/pom.xml +++ b/code/framework/api-pub-sub-jetty/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml index ba7b4e88c9..5e0f85f73c 100644 --- a/code/framework/api-pub-sub/pom.xml +++ b/code/framework/api-pub-sub/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml index 3f556fbcde..e30f34e046 100644 --- a/code/framework/api/pom.xml +++ b/code/framework/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml index 9fce57a5f7..719182e93e 100644 --- a/code/framework/archaius/pom.xml +++ b/code/framework/archaius/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.307 + 0.183.308 ../../meta-parent/pom.xml diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml index f49a5d3cf3..26320c3c59 100644 --- a/code/framework/async/pom.xml +++ b/code/framework/async/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml index 48747ef3c0..b33fb377a3 100644 --- a/code/framework/auditing/pom.xml +++ b/code/framework/auditing/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml index 477064fc22..03b212a9db 100644 --- a/code/framework/db-loader/pom.xml +++ b/code/framework/db-loader/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml index ca5c91b291..b361d8bf67 100644 --- a/code/framework/deferred/pom.xml +++ b/code/framework/deferred/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml index 1f0b079a3f..a1e61b7ac7 100644 --- a/code/framework/encryption/pom.xml +++ b/code/framework/encryption/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml index 62b7177531..55b530fe98 100644 --- a/code/framework/engine/pom.xml +++ b/code/framework/engine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml index a0395d8b58..98b2d82d44 100644 --- a/code/framework/eventing/pom.xml +++ b/code/framework/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml index 77d6213cee..633a10df38 100644 --- a/code/framework/events/pom.xml +++ b/code/framework/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml index 1ac3e5481e..069f9ae798 100644 --- a/code/framework/extension-spring/pom.xml +++ b/code/framework/extension-spring/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml index 1602bdb464..25416ee83d 100644 --- a/code/framework/extension/pom.xml +++ b/code/framework/extension/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml index f2f6336236..55706c8ec1 100644 --- a/code/framework/java-server/pom.xml +++ b/code/framework/java-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml index d0f2983944..46954cff02 100644 --- a/code/framework/jmx/pom.xml +++ b/code/framework/jmx/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml index 0565f9c42a..96ffff4520 100644 --- a/code/framework/jooq/pom.xml +++ b/code/framework/jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml index f5272fff6f..8602e3fd88 100644 --- a/code/framework/json/pom.xml +++ b/code/framework/json/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml index f5efb4ffc5..8cfd343d05 100644 --- a/code/framework/launcher/pom.xml +++ b/code/framework/launcher/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml index 262959cf74..1777bafa07 100644 --- a/code/framework/lock/pom.xml +++ b/code/framework/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml index 42cf47c65d..e88c5984f1 100644 --- a/code/framework/logback/pom.xml +++ b/code/framework/logback/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.307 + 0.183.308 ../../meta-parent/pom.xml diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml index 759982c53f..dcaf022df6 100644 --- a/code/framework/managed-context/pom.xml +++ b/code/framework/managed-context/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml index e4a920ba07..99410286c3 100644 --- a/code/framework/metrics/pom.xml +++ b/code/framework/metrics/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml index b98db58f79..e9599d9e27 100644 --- a/code/framework/module/pom.xml +++ b/code/framework/module/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml index 9f4895bacd..df1bd955bc 100644 --- a/code/framework/object/pom.xml +++ b/code/framework/object/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml index e7d8f58c94..9ab44efe0c 100644 --- a/code/framework/pool/pom.xml +++ b/code/framework/pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml index a701944242..29716e92e0 100644 --- a/code/framework/resource-monitor/pom.xml +++ b/code/framework/resource-monitor/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml index 1e08762077..b40a5883e8 100644 --- a/code/framework/schema/pom.xml +++ b/code/framework/schema/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml index d9a332246e..203399e294 100644 --- a/code/framework/server/pom.xml +++ b/code/framework/server/pom.xml @@ -4,7 +4,7 @@ cattle-meta-parent io.cattle - 0.183.307 + 0.183.308 ../../meta-parent/pom.xml diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml index 6449941341..6c8930f1b7 100644 --- a/code/framework/spring/pom.xml +++ b/code/framework/spring/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml index d2562dd335..a47d8fdd6c 100644 --- a/code/framework/system-task/pom.xml +++ b/code/framework/system-task/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml index a07a1f3bf3..63c9116f01 100644 --- a/code/framework/token/pom.xml +++ b/code/framework/token/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml index c34ba50e28..87a2213120 100644 --- a/code/framework/utils/pom.xml +++ b/code/framework/utils/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml index f296333f00..1bf32e5536 100644 --- a/code/iaas/agent-instance/pom.xml +++ b/code/iaas/agent-instance/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml index 2731faef4c..c67b76436d 100644 --- a/code/iaas/agent-server/pom.xml +++ b/code/iaas/agent-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml index 16c7b9f822..a09f89d1d7 100644 --- a/code/iaas/agent/pom.xml +++ b/code/iaas/agent/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml index f5e1293cb3..2173abaaae 100644 --- a/code/iaas/allocator/pom.xml +++ b/code/iaas/allocator/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml index 875481fcaa..fcd15f5175 100644 --- a/code/iaas/api-logic/pom.xml +++ b/code/iaas/api-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml index 3da218a382..cdc8862c00 100644 --- a/code/iaas/archaius-management/pom.xml +++ b/code/iaas/archaius-management/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml index 5a67d4b77f..07e28a7e1d 100644 --- a/code/iaas/auth-logic/pom.xml +++ b/code/iaas/auth-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml index b9dce4e9c0..302ad99efb 100644 --- a/code/iaas/bootstrap/pom.xml +++ b/code/iaas/bootstrap/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml index 32a366713b..28ad121d16 100644 --- a/code/iaas/config-item/api/pom.xml +++ b/code/iaas/config-item/api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml index a67939c478..3ef42f549f 100644 --- a/code/iaas/config-item/common/pom.xml +++ b/code/iaas/config-item/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml index 0a75965bf7..d75d7227c2 100644 --- a/code/iaas/config-item/server/pom.xml +++ b/code/iaas/config-item/server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml index b5adea3622..8ffc09baa2 100644 --- a/code/iaas/engine-jooq/pom.xml +++ b/code/iaas/engine-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml index b23beafa0a..d6c6a20b5c 100644 --- a/code/iaas/events/pom.xml +++ b/code/iaas/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml index 0862813db2..9ff8432f07 100644 --- a/code/iaas/external-handler/pom.xml +++ b/code/iaas/external-handler/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml index 088d6f3362..d2c420c8df 100644 --- a/code/iaas/ha/pom.xml +++ b/code/iaas/ha/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml index c12c527417..a1e13d4f55 100644 --- a/code/iaas/healthcheck/pom.xml +++ b/code/iaas/healthcheck/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml index 67ab8791a2..6957b505df 100644 --- a/code/iaas/labels/pom.xml +++ b/code/iaas/labels/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml index be5c45e64f..074d37885c 100644 --- a/code/iaas/logic-common/pom.xml +++ b/code/iaas/logic-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml index 41e6256078..1c1f8cba99 100644 --- a/code/iaas/logic/pom.xml +++ b/code/iaas/logic/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml index cd2d482f80..6988bd453b 100644 --- a/code/iaas/metadata/pom.xml +++ b/code/iaas/metadata/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml index 323e3d56b4..b824ed0746 100644 --- a/code/iaas/model/pom.xml +++ b/code/iaas/model/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml index f50a6c6224..1fcfb094b5 100644 --- a/code/iaas/resource-pool/pom.xml +++ b/code/iaas/resource-pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml index 5d3c6d9b37..9ee734e551 100644 --- a/code/iaas/service-discovery/api/pom.xml +++ b/code/iaas/service-discovery/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml index 4b7ecf902f..6c5976e9b9 100644 --- a/code/iaas/service-discovery/server/pom.xml +++ b/code/iaas/service-discovery/server/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml index 77b399843b..3cb639298d 100644 --- a/code/iaas/ssh-common/pom.xml +++ b/code/iaas/ssh-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml index 4f4229a420..a5484e3bea 100644 --- a/code/iaas/storage-service/pom.xml +++ b/code/iaas/storage-service/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml index b8add6431f..9a9a176556 100644 --- a/code/iaas/task-jooq/pom.xml +++ b/code/iaas/task-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml index c075154279..79ecde1501 100644 --- a/code/implementation/activity-log/pom.xml +++ b/code/implementation/activity-log/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml index 9e9891733a..f67926c240 100644 --- a/code/implementation/agent-instance-impl/pom.xml +++ b/code/implementation/agent-instance-impl/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml cattle-agent-instance-impl diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml index 856a68c781..0c54fc6beb 100644 --- a/code/implementation/docker/api/pom.xml +++ b/code/implementation/docker/api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml index 12c2ad8c06..4f4508d978 100644 --- a/code/implementation/docker/common/pom.xml +++ b/code/implementation/docker/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml index dd1ac729cf..9ab1bb064d 100644 --- a/code/implementation/docker/compute/pom.xml +++ b/code/implementation/docker/compute/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml index 2f6931c871..d4794ebd80 100644 --- a/code/implementation/docker/machine/pom.xml +++ b/code/implementation/docker/machine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml index dcc184fdba..79e5b469c2 100644 --- a/code/implementation/docker/storage/pom.xml +++ b/code/implementation/docker/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml @@ -21,12 +21,12 @@ io.cattle cattle-docker-common - 0.183.307 + 0.183.308 io.cattle cattle-iaas-allocator - 0.183.307 + 0.183.308 diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml index ce7ca8e37c..7e937088c5 100644 --- a/code/implementation/extension-api/pom.xml +++ b/code/implementation/extension-api/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml cattle-extension-api diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml index 9f0dbcebd3..1ebe8de5c0 100644 --- a/code/implementation/hazelcast/common/pom.xml +++ b/code/implementation/hazelcast/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml index 3926a01d32..2e1e0f3a37 100644 --- a/code/implementation/hazelcast/eventing/pom.xml +++ b/code/implementation/hazelcast/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml index e591362787..25d99abb4e 100644 --- a/code/implementation/hazelcast/lock/pom.xml +++ b/code/implementation/hazelcast/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml index 1d3e4401e2..60d072be8c 100644 --- a/code/implementation/host-api/pom.xml +++ b/code/implementation/host-api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml index 4229b346d0..bae49e4e12 100644 --- a/code/implementation/host-stats/pom.xml +++ b/code/implementation/host-stats/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml index 9df8d9c389..a4af68358c 100644 --- a/code/implementation/register/pom.xml +++ b/code/implementation/register/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml index 3b426143c2..e833c2d8d6 100644 --- a/code/implementation/sample-setup/pom.xml +++ b/code/implementation/sample-setup/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml index 24952141a1..338a3c7b99 100644 --- a/code/implementation/settings-api/pom.xml +++ b/code/implementation/settings-api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml index 86f95c18bd..bf278baaee 100644 --- a/code/implementation/simulator/agent-connection/pom.xml +++ b/code/implementation/simulator/agent-connection/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml index 8263443c4e..9a49497512 100644 --- a/code/implementation/simulator/storage/pom.xml +++ b/code/implementation/simulator/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../../parent/pom.xml diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml index 8b51f68b7a..be5d1e7e77 100644 --- a/code/implementation/system-stack/pom.xml +++ b/code/implementation/system-stack/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml index a27bcb7f6c..b7515300e3 100644 --- a/code/implementation/vm/pom.xml +++ b/code/implementation/vm/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml cattle-vm diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml index 10673a0ab7..36161d51ae 100644 --- a/code/meta-parent/pom.xml +++ b/code/meta-parent/pom.xml @@ -9,7 +9,7 @@ 4.0.0 io.cattle cattle-meta-parent - 0.183.307 + 0.183.308 pom PastureStack Orchestration Engine Compatibility orchestration engine for the PastureStack server. diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml index 88f0412fc1..da912c8b6f 100644 --- a/code/packaging/app-config/pom.xml +++ b/code/packaging/app-config/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml jar diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml index acc936f3af..fddc4707e7 100644 --- a/code/packaging/app/pom.xml +++ b/code/packaging/app/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml war diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml index b5b1d8418f..0f8230d4e3 100644 --- a/code/packaging/bundle/pom.xml +++ b/code/packaging/bundle/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml index 3a857e648e..c4e297e404 100644 --- a/code/packaging/dev/pom.xml +++ b/code/packaging/dev/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml index 43c190a912..656e22849b 100644 --- a/code/packaging/meta/pom.xml +++ b/code/packaging/meta/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../../parent/pom.xml diff --git a/code/parent/pom.xml b/code/parent/pom.xml index f122bb1156..e8b55035d0 100644 --- a/code/parent/pom.xml +++ b/code/parent/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-meta-parent ../meta-parent/pom.xml - 0.183.307 + 0.183.308 pom diff --git a/docs/releases/orchestration-engine-0.183.308.md b/docs/releases/orchestration-engine-0.183.308.md new file mode 100644 index 0000000000..eb732b26c0 --- /dev/null +++ b/docs/releases/orchestration-engine-0.183.308.md @@ -0,0 +1,24 @@ +# Orchestration Engine 0.183.308 + +- Publish the session-bound `clientSessionId` input in every frozen v1 token + schema (`base`, `superadmin`, and `token`) as a nullable, sensitive, + fixed-length, create-only field. This prevents `/v1/token` from silently + discarding the browser generation and creating an unbound legacy token. +- Add a deserialization regression test that discovers every frozen schema + exposing `token` and verifies create/update/read-on-create/nullability/type + and exact-length semantics rather than relying on a string-only assertion. +- Add source and packaged-artifact gates that prevent a future release from + omitting the field. Snapshot semantics are validated in the test suite rather + than by a separately shipped deserialization utility. +- Retain the `0.183.307` transport normalization: cookie keys and standard + Bearer values resolve to the same token key before ownership checks, while + malformed or unsupported authorization schemes remain fail-closed. +- Retain the production-loaded OIDC identity defaults and integrated v1/v2 + project-member schema contract from `0.183.306`. + +Server consumers must verify creation, mismatched deletion, matching deletion, +and repeated idempotent deletion through both `/v1/token` and +`/v2-beta/token` in the integrated candidate runtime before publishing. + +Use this release with Web Console `1.6.119` and Authentication Service +`v0.4.38`. diff --git a/pom.xml b/pom.xml index 848c0d4fd6..93b677514e 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ io.cattle cattle-parent - 0.183.307 + 0.183.308 code/parent/pom.xml cattle diff --git a/resources/content/schema/v1/base.ser b/resources/content/schema/v1/base.ser index a6e20d25c7..8921aa851d 100644 Binary files a/resources/content/schema/v1/base.ser and b/resources/content/schema/v1/base.ser differ diff --git a/resources/content/schema/v1/superadmin.ser b/resources/content/schema/v1/superadmin.ser index 155444309c..c002265a0e 100644 Binary files a/resources/content/schema/v1/superadmin.ser and b/resources/content/schema/v1/superadmin.ser differ diff --git a/resources/content/schema/v1/token.ser b/resources/content/schema/v1/token.ser index 3da6e003d0..c982ac6dae 100644 Binary files a/resources/content/schema/v1/token.ser and b/resources/content/schema/v1/token.ser differ diff --git a/resources/pom.xml b/resources/pom.xml index 11d165e7f8..238f21add5 100644 --- a/resources/pom.xml +++ b/resources/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.307 + 0.183.308 ../code/parent/pom.xml diff --git a/resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java b/resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java new file mode 100644 index 0000000000..6081335e95 --- /dev/null +++ b/resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java @@ -0,0 +1,70 @@ +package io.cattle.platform.resources; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; + +import io.github.ibuildthecloud.gdapi.model.Field; +import io.github.ibuildthecloud.gdapi.model.Schema; +import java.io.FileInputStream; +import java.io.ObjectInputStream; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.util.List; +import org.junit.Test; + +/** Verifies the frozen v1 schemas preserve the browser-session ownership input. */ +public class FrozenTokenSessionSchemaTest { + private final Path schemas = Paths.get("content", "schema", "v1"); + + @Test + public void everyFrozenSchemaWithTokenAcceptsClientSessionIdOnlyOnCreate() + throws Exception { + int checked = 0; + try (java.util.stream.Stream stream = Files.list(schemas)) { + for (Path schemaFile : (Iterable) stream + .filter(path -> path.getFileName().toString().endsWith(".ser"))::iterator) { + Schema token = find(readSchemas(schemaFile), "token"); + if (token == null) { + continue; + } + Field clientSessionId = token.getResourceFields().get("clientSessionId"); + assertNotNull(schemaFile + " lacks token.clientSessionId", clientSessionId); + assertTrue(schemaFile + " must create token.clientSessionId", + clientSessionId.isCreate()); + assertFalse(schemaFile + " must not update token.clientSessionId", + clientSessionId.isUpdate()); + assertTrue(schemaFile + " must keep token.clientSessionId read-on-create-only", + clientSessionId.isReadOnCreateOnly()); + assertTrue(schemaFile + " must allow a missing legacy client generation", + clientSessionId.isNullable()); + assertEquals(schemaFile + " changed token.clientSessionId type", + "password", clientSessionId.getType()); + assertEquals(schemaFile + " changed token.clientSessionId minimum length", + Long.valueOf(78L), clientSessionId.getMinLength()); + assertEquals(schemaFile + " changed token.clientSessionId maximum length", + Long.valueOf(78L), clientSessionId.getMaxLength()); + checked++; + } + } + assertTrue("no frozen schema exposed token", checked > 0); + } + + private List readSchemas(Path schemaFile) throws Exception { + try (ObjectInputStream input = + new ObjectInputStream(new FileInputStream(schemaFile.toFile()))) { + return (List) input.readObject(); + } + } + + private Schema find(List schemas, String id) { + for (Object item : schemas) { + if (item instanceof Schema && id.equals(((Schema) item).getId())) { + return (Schema) item; + } + } + return null; + } +} diff --git a/scripts/build b/scripts/build index 1e5b2bacd8..faf2384d9b 100755 --- a/scripts/build +++ b/scripts/build @@ -16,7 +16,7 @@ fi SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)} SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} -ENGINE_VERSION=${ENGINE_VERSION:-0.183.307} +ENGINE_VERSION=${ENGINE_VERSION:-0.183.308} case "$SOURCE_REVISION" in ''|*[!0-9a-f]*) diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source index e6d7acd0d7..6a5810a7e8 100755 --- a/scripts/check-pasturestack-source +++ b/scripts/check-pasturestack-source @@ -51,7 +51,7 @@ fi project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1) [[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version -require_line code/meta-parent/pom.xml ' 0.183.307' +require_line code/meta-parent/pom.xml ' 0.183.308' require_line "$iaas_api_defaults" 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group' require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine' require_line Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b' @@ -166,6 +166,9 @@ require_line resources/content/schema/token/token-auth.json ' "token.clie require_line resources/content/cattle-global.properties 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group' require_line code/packaging/app-config/src/main/java/io/cattle/platform/app/TypesConfig.java ' @DependsOn("ArchaiusStartup")' require_line code/framework/schema/src/test/java/io/cattle/platform/schema/processor/TokenSessionAuthOverlayTest.java ' public void clientSessionIdSurvivesAuthorizationAsCreateOnlyInput() throws Exception {' +require_line resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java ' public void everyFrozenSchemaWithTokenAcceptsClientSessionIdOnlyOnCreate()' +require_line resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java ' assertNotNull(schemaFile + " lacks token.clientSessionId", clientSessionId);' +require_line docs/releases/orchestration-engine-0.183.308.md 'Server consumers must verify creation, mismatched deletion, matching deletion,' require_line code/packaging/app-config/src/test/java/io/cattle/platform/app/TypesConfigTest.java ' public void coreSchemaWaitsForConfigurationAndPublishesOidcProjectMemberTypes() {' require_line code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/IdentityManagerExternalTypeTest.java ' public void rejectsUnknownExternalTypeEvenWhenProviderIsConfigured() {' require_line code/framework/auditing/src/main/java/io/cattle/platform/iaas/api/auditing/AuditServiceImpl.java ' if (identity != null && identity.getExternalIdType() != null' @@ -213,6 +216,8 @@ require_line code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth require_line resources/src/test/java/io/cattle/platform/resources/SessionBoundTokenMigrationTest.java ' public void addsSessionOwnershipWithoutRewritingTheHistoricalTokenTable() throws Exception {' require_line scripts/check-release-artifact ' grep -F '"'"''"'"' >/dev/null' require_line scripts/check-release-artifact 'if unzip -p "$workdir/$resources_entry" db/mysql/mysql-dump.sql | grep -F '"'"'client_session_id'"'"' >/dev/null; then' +require_line scripts/check-release-artifact 'for frozen_token_schema in base.ser superadmin.ser token.ser; do' +require_line scripts/check-release-artifact ' grep -aF '"'"'clientSessionId'"'"' >/dev/null' require_line resources/pom.xml ' cattle-framework-java-server' require_line resources/src/test/java/io/cattle/platform/resources/FrozenIdentitySecuritySchemaTest.java ' public void frozenSchemasExposeAccountScopedIdentitySecurityFilters() throws Exception {' require_line resources/src/test/java/io/cattle/platform/resources/FrozenIdentitySecuritySchemaTest.java ' accountId.getModifiers().contains("eq"));' @@ -354,4 +359,4 @@ fi require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.' require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`' -printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.307 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use\n' +printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.308 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized auth_token_frozen_v1_schema=base-superadmin-token oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use\n' diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact index b24cbecb90..e86868d54f 100755 --- a/scripts/check-release-artifact +++ b/scripts/check-release-artifact @@ -4,7 +4,7 @@ set -euo pipefail cd "$(dirname "$0")/.." artifact=${1:-dist/artifacts/cattle.jar} -expected_version=${EXPECTED_ENGINE_VERSION:-0.183.307} +expected_version=${EXPECTED_ENGINE_VERSION:-0.183.308} test -f "$artifact" artifact=$(realpath "$artifact") @@ -153,6 +153,10 @@ if unzip -p "$workdir/$resources_entry" db/mysql/mysql-dump.sql | grep -F 'clien fi unzip -p "$workdir/$resources_entry" schema/token/token-auth.json | grep -F '"token.clientSessionId": "cro",' >/dev/null +for frozen_token_schema in base.ser superadmin.ser token.ser; do + unzip -p "$workdir/$resources_entry" "schema/v1/$frozen_token_schema" | + grep -aF 'clientSessionId' >/dev/null +done unzip -p "$workdir/$resources_entry" cattle-global.properties | grep -Fx 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group' >/dev/null