Skip to content

PastureStack Authentication Service v0.4.38

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Sep 05:54
Immutable release. Only release title and notes can be modified.
v0.4.38
d6689f6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PastureStack Authentication Service v0.4.38

This release separates OIDC identity-source initialization from site-access policy updates. Access-only changes skip discovery and do not emit the provider-reload generation, unrestricted mode clears the allowlist, restricted and required policies accept only deduplicated OIDC users and groups, and access expansion requires a single-use MFA confirmation bound to the operator and canonical request digest. Initial enablement and identity-source changes retain the fresh local-recovery gate.

Immutable coordinates

  • Source commit: d6689f6139b4f5edc99a5c3336b80da80f487e16
  • Artifact SHA-256: 4715e014599684072fd80da0824db22b21fe40d34dd47a7db3acec66e8d7b29d

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Assets 15
Loading