Skip to content

PastureStack Authentication Service v0.4.45

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 12:28
Immutable release. Only release title and notes can be modified.
v0.4.45
2f54018
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PastureStack Authentication Service v0.4.45

This maintenance release rebuilds the unchanged compatibility behavior with checksum-pinned Go 1.27.3, including the crypto/x509 fix for CVE-2026-111943. Existing tags and assets remain immutable. Server assembly and runtime acceptance are separate.

This release repairs the non-secret control-platform identity contract for an already stored OpenID Connect provider. Startup, reload, and policy-only updates reconcile the OIDC user type, identity separator, provider selection, lookup capability, and external-provider flag in a fail-closed order. It performs no discovery and never reads or rewrites the client secret. Upgraded databases with incomplete common settings therefore no longer fail the final token exchange with Identity externalIdType is invalid.

The existing source-versus-policy separation, explicit-empty allowlist wire contract, restart persistence, actor-bound MFA confirmation, and one-time legacy migration boundary remain intact. Reconciliation is idempotent and does not rewrite aligned policy or security settings.

Immutable coordinates

  • Source commit: 2f54018191ffd4ff008c5ad2bfb6d6ace7890b39
  • Artifact SHA-256: cd3d4a81ae694e53f38ab1be761bb0e8d266fd69cc1c19a5e5a9cdcfed04446b

Two clean builds produced byte-identical archives. The full race-enabled test suite, formatting check, and static analysis passed before publication.

The release includes source and product CycloneDX 1.7 SBOMs, complete Trivy JSON reports, Critical/High gates, OpenVEX applicability evidence, checksums, and GitHub-hosted SLSA provenance and SBOM attestations. Trivy 0.73.0 was fixed by exact asset SHA-256 and version checked before use.

The Trivy source organization rejected the hosted runner through its IP allow list, so its public provenance API could not be queried. This exact limitation is recorded in the attached verification-status evidence; every other scanner verification remains fail-closed.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Assets 15
Loading