Burrow v1.0.0

Burrow v1.0.0

Burrow v1.0.0 brings OIDC and a focused downstream SAML 2.0 IdP into one
single-organization service, with password authentication, shared SSO, optional
TOTP MFA and role-based application access. It includes the Jenkins integration,
protocol-grouped portal and refreshed management UI developed since v0.1.4.

Changes

• Accept signed SP-initiated HTTP Redirect AuthnRequests and return double-signed
  HTTP POST responses to an exactly registered ACS. Use persistent NameID and
  username, display name and email attributes; preserve forced password changes,
  MFA policy, current-access checks, ForceAuthn and replay protection.
• Add schema v6, independent encrypted SAML signing keys and audited certificate
  rotation, preserving existing OIDC data and the checksums of migrations 001–005.
• Add manual Jenkins SAML setup,
  explicit Matrix authorization and opt-in real-SP browser tests. Grafana and
  Nightingale continue to use OIDC; Jenkins owns its sessions and business permissions.
• Group authorized portal applications under OIDC and SAML. Compact management
  tables, simplify branding/navigation, improve narrow-screen tooltips and logout
  access, and refresh English/Chinese documentation and maintainer-supplied screenshots.
• Verify published image configs against the tested archive bytes, supporting
  Docker's containerd store while retaining exact platform and registry digest checks.
• Display the frontend package version in the footer and align installation
  examples with v1.0.0. Release preparation uses a short-lived PR followed by a
  verified main tag; a dedicated release branch is not required.

Install

Docker Compose is recommended. Published images and Linux amd64/arm64 binaries
include the frontend and require no Go or Bun at runtime:

ghcr.io/arkgravity/burrow:v1.0.0
docker.io/logic3579/burrow:v1.0.0

The release provides burrow_v1.0.0_linux_amd64.tar.gz,
burrow_v1.0.0_linux_arm64.tar.gz, burrow_v1.0.0_deploy.tar.gz,
INSTALL.md, IMAGES.txt and SHA256SUMS. Pin the version or digest and check
downloaded files before extracting. Native binaries require Linux with glibc 2.36+.
Follow the English installation guide
or the attached version-specific instructions.

Upgrade from v0.1.x

Back up the database, original master key and configuration. Stop the old server;
select the new image/binary, run migration and seed, then start the new server.
Migration 006 upgrades schema v5 to v6 and initializes separate encrypted SAML
keys and a 365-day signing certificate. It preserves existing OIDC users,
applications, passwords, permissions, keys, sessions, tokens and unfinished
authorizations. New sessions use UTC; legacy sessions retain their OIDC expiry
semantics and may require fresh password authentication for SAML.

MFA remains disabled by default. Explicitly set security.mfa_enabled: true or
BURROW_MFA_ENABLED=true to require TOTP for all accounts, especially when
upgrading from v0.1.0/v0.1.1. Existing authenticator bindings are preserved.
Do not replace the master key or modify applied migrations. Reverting only the
image cannot undo schema v6; rollback requires the pre-upgrade database backup
and matching configuration/key. Older development databases must also satisfy
the preceding password-only and MFA migration requirements.

SAML key rotation is separate from OIDC and requires an audit reason. Update
Jenkins's trusted IdP certificate after rotation and verify login during the
maintenance window. See backup, migration and SAML recovery.

Scope and verification

SAML encryption, Single Logout, IdP-initiated login, upstream federation and SCIM
are not included. Refresh Tokens and cross-application logout remain outside
the OIDC scope. Applications manage their own sessions and business permissions.

The maintainer reported successful local Grafana/Nightingale OIDC and Jenkins
SAML integration. Independent engineering tests also covered three real-Jenkins
configurations; see SAML verification evidence.
These are distinct from release validation and do not constitute official
protocol certification or validation of a production deployment.

Publication requires successful CI for the exact tagged main commit, native
amd64/arm64 release preparation, packaged-binary browser tests and PostgreSQL
production-container checks. Both registries must publish the tested images
with matching platform/index digests. Actual publication results are recorded
in the verification report.

中文说明

v1.0.0 整合现有 OIDC、下游 SAML IdP、Jenkins 手动接入、协议分组门户和紧凑的管理界面，
保留单组织、单实例、密码认证及可选全员 TOTP MFA 的范围。同步了截图、中英文安装说明和发布流程。

• 从 v0.1.x 升级前备份数据库、原主密钥和配置，停止旧服务后依次执行 migrate、seed、serve。
  迁移 006 升至 schema v6，保留已有 OIDC 数据并初始化独立加密的 SAML 密钥；
  旧会话使用 SAML 时可能需要重新认证。回退镜像不能回退数据库，回滚须恢复升级前备份。
• MFA 仍默认关闭，需要全员 TOTP 时显式开启；已有绑定保留。不要更换已有数据库的主密钥。
• SAML 证书轮换后需手动更新 Jenkins 信任并验证登录；不包含断言加密、SLO、IdP 发起登录、
  上游联合登录或 SCIM，应用自行管理其会话和业务权限。
• 发布包和镜像支持 Linux amd64/arm64，均包含前端；二进制要求 glibc 2.36+。
  按中文安装指南操作并校验附件。

正式发布以前述精确提交 CI、双架构实际产物测试和双仓库摘要核验为准；
本地人工接入验收与自动化结果分别记录，不代表生产部署验收或官方协议认证。