PastureStack Authentication Service v0.4.46

PastureStack Authentication Service v0.4.46

This maintenance release rebuilds the unchanged compatibility behavior with checksum-pinned Go 1.27.3, including the crypto/x509 fix for CVE-2026-111943. Existing tags and assets remain immutable. Server assembly and runtime acceptance are separate.

This release repairs the non-secret control-platform identity contract for an already stored OpenID Connect provider. Startup, reload, and policy-only updates reconcile the OIDC user type, identity separator, provider selection, lookup capability, and external-provider flag in a fail-closed order. It performs no discovery and never reads or rewrites the client secret. Upgraded databases with incomplete common settings therefore no longer fail the final token exchange with Identity externalIdType is invalid.

The existing source-versus-policy separation, explicit-empty allowlist wire contract, restart persistence, actor-bound MFA confirmation, and one-time legacy migration boundary remain intact. Reconciliation is idempotent and does not rewrite aligned policy or security settings.

Immutable coordinates

• Source commit: 35333ee3e40d9de032c10307ee80113c980be00a
• Artifact SHA-256: 15950344ac9cc688610eae6d1c023ae6ba66182de675f04445f4c98ced2f19ec

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.45

PastureStack Authentication Service v0.4.45

This maintenance release rebuilds the unchanged compatibility behavior with checksum-pinned Go 1.27.3, including the crypto/x509 fix for CVE-2026-111943. Existing tags and assets remain immutable. Server assembly and runtime acceptance are separate.

This release repairs the non-secret control-platform identity contract for an already stored OpenID Connect provider. Startup, reload, and policy-only updates reconcile the OIDC user type, identity separator, provider selection, lookup capability, and external-provider flag in a fail-closed order. It performs no discovery and never reads or rewrites the client secret. Upgraded databases with incomplete common settings therefore no longer fail the final token exchange with Identity externalIdType is invalid.

The existing source-versus-policy separation, explicit-empty allowlist wire contract, restart persistence, actor-bound MFA confirmation, and one-time legacy migration boundary remain intact. Reconciliation is idempotent and does not rewrite aligned policy or security settings.

Immutable coordinates

• Source commit: 2f54018191ffd4ff008c5ad2bfb6d6ace7890b39
• Artifact SHA-256: cd3d4a81ae694e53f38ab1be761bb0e8d266fd69cc1c19a5e5a9cdcfed04446b

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.44

PastureStack Authentication Service v0.4.44

This maintenance release rebuilds the unchanged compatibility behavior with checksum-pinned Go 1.27.3, including the crypto/x509 fix for CVE-2026-111943. Existing tags and assets remain immutable. Server assembly and runtime acceptance are separate.

This release repairs the non-secret control-platform identity contract for an already stored OpenID Connect provider. Startup, reload, and policy-only updates reconcile the OIDC user type, identity separator, provider selection, lookup capability, and external-provider flag in a fail-closed order. It performs no discovery and never reads or rewrites the client secret. Upgraded databases with incomplete common settings therefore no longer fail the final token exchange with Identity externalIdType is invalid.

The existing source-versus-policy separation, explicit-empty allowlist wire contract, restart persistence, actor-bound MFA confirmation, and one-time legacy migration boundary remain intact. Reconciliation is idempotent and does not rewrite aligned policy or security settings.

Immutable coordinates

• Source commit: 63e7941dd0c8c26fefaf1e252d67bccc34a9347f
• Artifact SHA-256: 3fab69156bcc07b96a4b404f24fe59c08958a4357113cecec440ea6d40c5c9a4

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

v0.4.43

Published from existing, checksum-verified producer archives; no rebuild.

Producer commit: cae736f377019bd9743648a8e9aa469a0e21b5e0.
Producer tree: d9a57b6910e68803033895d434373ad91039713f.
Integration: #9; merge 369285786a664fd5c9ef4a37b6390bf3b36e87cb.
The tag deliberately identifies the original artifact producer, not the squash merge.
Source relationship: EXACT_TREE.

Successful producer checks: Analyze (actions), Analyze (go).
Successful integration-head checks at cae736f377019bd9743648a8e9aa469a0e21b5e0: Analyze (actions), Analyze (go).

SHA256 (original assets):

• e9218771af8dd68323c8c6fdab149c40a3ad02da9ff23f8aad6f0b2977740273 authentication-service-0.4.43-linux-amd64.tar.xz

PastureStack Authentication Service v0.4.42

PastureStack Authentication Service v0.4.42

This release repairs the non-secret control-platform identity contract for an already stored OpenID Connect provider. Startup, reload, and policy-only updates reconcile the OIDC user type, identity separator, provider selection, lookup capability, and external-provider flag in a fail-closed order. It performs no discovery and never reads or rewrites the client secret. Upgraded databases with incomplete common settings therefore no longer fail the final token exchange with Identity externalIdType is invalid.

The existing source-versus-policy separation, explicit-empty allowlist wire contract, restart persistence, actor-bound MFA confirmation, and one-time legacy migration boundary remain intact. Reconciliation is idempotent and does not rewrite aligned policy or security settings.

Immutable coordinates

• Source commit: 5589ef8fda68ae56e1afd64096965d452ee8a17e
• Artifact SHA-256: f14d22036a0a88d6a8d669700506bba680fc7605bbca2b337e345c5cd71500fb

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.41

PastureStack Authentication Service v0.4.41

This release makes the common OIDC site-access policy authoritative after the encrypted authentication configuration has been created. Authentication-service startup no longer replays absent legacy OIDC keys over a saved restricted or unrestricted policy, so access mode and allowlist values survive process and Server container restarts. The one-time legacy migration path remains available before the canonical configuration exists.

It also preserves the previous explicit-empty allowlist wire contract: a confirmed unrestricted transition durably clears stale restricted identities. Access-only changes continue to skip discovery and provider reload; access expansion remains protected by a single-use MFA confirmation bound to the operator and canonical request digest.

Immutable coordinates

• Source commit: 1e566c8ba00aa134eb119be9d655625c870b28bc
• Artifact SHA-256: 2980282734e4d87bd92e73b8acef1dfa166df877e504e049c3556b13f66632bd

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.40

PastureStack Authentication Service v0.4.40

This release makes the common OIDC site-access policy authoritative after the encrypted authentication configuration has been created. Authentication-service startup no longer replays absent legacy OIDC keys over a saved restricted or unrestricted policy, so access mode and allowlist values survive process and Server container restarts. The one-time legacy migration path remains available before the canonical configuration exists.

It also preserves the previous explicit-empty allowlist wire contract: a confirmed unrestricted transition durably clears stale restricted identities. Access-only changes continue to skip discovery and provider reload; access expansion remains protected by a single-use MFA confirmation bound to the operator and canonical request digest.

Immutable coordinates

• Source commit: 25b075bbd6e44f72011501cd4135d161e4c55d7d
• Artifact SHA-256: 58b20efae80e94603fab6afe991a1d6838897d8ec3e29f8b031a02d246a1162e

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.39

PastureStack Authentication Service v0.4.39

This release preserves an explicit empty OIDC allowlist on the platform API wire. It avoids the generated setting client omitting an empty value, so a confirmed unrestricted transition durably clears stale restricted identities. Access-only changes continue to skip discovery and provider reload; access expansion remains protected by a single-use MFA confirmation bound to the operator and canonical request digest.

Immutable coordinates

• Source commit: 3217b783222bcdf9a25ff0ba4a2a64a6b5e99c66
• Artifact SHA-256: b2def9ebdf819cefa731c1b0a37c904a317d4e3d040738beef3f118f8d8d4e00

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.38

PastureStack Authentication Service v0.4.38

This release separates OIDC identity-source initialization from site-access policy updates. Access-only changes skip discovery and do not emit the provider-reload generation, unrestricted mode clears the allowlist, restricted and required policies accept only deduplicated OIDC users and groups, and access expansion requires a single-use MFA confirmation bound to the operator and canonical request digest. Initial enablement and identity-source changes retain the fresh local-recovery gate.

Immutable coordinates

• Source commit: d6689f6139b4f5edc99a5c3336b80da80f487e16
• Artifact SHA-256: 4715e014599684072fd80da0824db22b21fe40d34dd47a7db3acec66e8d7b29d

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Authentication Service v0.4.37

PastureStack Authentication Service v0.4.37

This release separates OIDC identity-source initialization from site-access policy updates. Access-only changes skip discovery, unrestricted mode clears the allowlist, restricted and required policies accept only deduplicated OIDC users and groups, and access expansion requires a single-use MFA confirmation bound to the operator and canonical request digest. Initial enablement and identity-source changes retain the fresh local-recovery gate.

Immutable coordinates

• Source commit: 48c3f9e850b4f91f8ea8ee78bf7c3b206464a4cb
• Artifact SHA-256: 5f749bc205443c27d696523ad470242365061bb25ab79fd1a09a1510465dbfa6

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.