PastureStack Authentication Service v0.4.41

PastureStack Authentication Service v0.4.41

This release makes the common OIDC site-access policy authoritative after the encrypted authentication configuration has been created. Authentication-service startup no longer replays absent legacy OIDC keys over a saved restricted or unrestricted policy, so access mode and allowlist values survive process and Server container restarts. The one-time legacy migration path remains available before the canonical configuration exists.

It also preserves the previous explicit-empty allowlist wire contract: a confirmed unrestricted transition durably clears stale restricted identities. Access-only changes continue to skip discovery and provider reload; access expansion remains protected by a single-use MFA confirmation bound to the operator and canonical request digest.

Immutable coordinates

• Source commit: 1e566c8ba00aa134eb119be9d655625c870b28bc
• Artifact SHA-256: 2980282734e4d87bd92e73b8acef1dfa166df877e504e049c3556b13f66632bd

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.