Repository navigation
PastureStack Catalog Service v0.20.14
This maintenance release rebuilds both unchanged Catalog binaries with checksum-pinned Go 1.27.3, including the crypto/x509 fix for CVE-2026-111943. Existing tags and assets remain immutable.
This release excludes Git metadata from template traversal, validates version directories before allocating templates, omits metadata-only entries without a template definition, preserves template/version READMEs and icons, and rebuilds same-commit empty or unnamed indexes transactionally. Existing catalog origin, rooted-cache and bounded-input protections are retained.
Immutable coordinates
- Source commit:
9b0c0f40dc81eb83673df85f3de96f7e6f89b985 - Artifact SHA-256:
00380a63e1f95b3d9a1dfb8e2fb3f038d876d7decb0ae5c7798ea1b7d8dc54b6
The full test suite passed, and two clean builds produced byte-identical archives.
Python test dependencies are hash-locked; bootstrap installers are removed from the completed build image. Build-header VEX exceptions remain explicitly recorded and do not claim an absence of all CVEs. Server packaging and real catalog migration/UI acceptance are separate and not claimed by this component release.
PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.