Compose Executor v0.14.39

Exact Linux/amd64 byte-reproducible package from passed CI 39958045984; CodeQL Go/Python/Actions passed. Producer 53a33bd, signed release c9751f5, identical tree ee9fc823afb9091506dc13b4e89a895aa71e7687. Go 1.27.3; installer TLS/streaming and exact pip vendor-slice gates passed. No deployment.

Compose Executor 0.14.38

Official Go 1.27.3 rebuild of the unchanged runtime source. Producer commit 142bc11, tree 6eea0331262777791b558b9b5088d1e2da626a7b; Security release gate 39668541636 includes complete tests, two byte-identical packages, product/source zero HIGH or CRITICAL, zero secrets, and the unchanged disposable-builder header policy. Protected PR8 merged as signed 32712ca with the exact same tree. These are the existing producer archive bytes, not a reconstruction from merged main; the tag deliberately identifies their actual producer.

v0.14.37

Published from existing, checksum-verified producer archives; no rebuild.

Producer commit: 88e991e823f06d2334c07d5370595aae3c48ee99.
Producer tree: 5e2857929f3abfe6090ca541bdf1cc45f7917bca.
Integration: #7; merge 7d34626cf2c1a0d1fd7d78051bc9be2c30d298cf.
The tag deliberately identifies the original artifact producer, not the squash merge.
Source relationship: DOCUMENTATION_ONLY.

Successful producer checks: Analyze (actions), Analyze (go), Analyze (python).
Successful integration-head checks at 3d05ebf988aacfc9f1e19062ad6d9e14a344289b: Analyze (actions), Analyze (go), Analyze (python).

SHA256 (original assets):

• 5ff465601930218f531885a384f231d969033e4cef794ce33d16bfe24e5c1c81 compose-executor-0.14.37-linux-amd64.gz

PastureStack Compose Executor v0.14.36

Compose Executor v0.14.36

Preserve mapping-style environment and labels values after the YAML v3
parser migration. Nested service maps are now preprocessed and interpolated as
structured values instead of being flattened into a single Go string.

This restores stack create and upgrade requests that use object-form
environment variables or labels, including the PastureStack infrastructure
catalog templates. List-form values and the hardware options added in v0.14.35
remain unchanged.

Compose Executor v0.14.35

Compose Executor v0.14.35

Support runtime, PID limits and GPU requests in the existing v1/v2 Compose path.
Accept gpus: all, the GPU request list form, and
deploy.resources.reservations.devices; reject unrelated deploy fields rather
than silently discarding them. Count and device IDs are mutually exclusive.

Preserve shared memory, CPU limits, device mappings and supplementary groups
through the Docker HostConfig-to-LaunchConfig API conversion. Propagate API
validation errors instead of returning a success-shaped empty configuration.

These options require compatible orchestration-engine and node-agent releases.
They do not add full Compose deploy support or GPU exclusive scheduling.

PastureStack Compose CLI v0.14.34

Go 1.27.0 rebuild from the reviewed main commit. The release artifact is bound by SHA-256 and the attached product SBOM, Go build metadata, and successful Security release gate evidence.

PastureStack Compose CLI v0.14.33

PastureStack maintenance release for the Compose compatibility toolchain.

Security and reliability changes:

• confines local env_file and secret reads to the selected Compose-file directories;
• rejects traversal, absolute-path, and symbolic-link escapes while preserving valid local files;
• keeps remote executor requests fail-closed without a local resource root;
• updates the reproducible toolchain to Go 1.26.6 and Python 3.14.6;
• removes the unused Docker CLI and Docker socket from the isolated Dapper builder;
• validates normal and malicious resource-boundary cases, race detection, vet, integration compatibility, and two identical builds;
• publishes source and product CycloneDX SBOMs with deterministic release archives.

Source commit: af47214c648857d31c993a4e1aaf612c876a7376

Security results:

• CodeQL Critical/High: 0/0
• source Critical/High/secrets: 0/0/0
• product Critical/High/secrets: 0/0/0
• applicable builder Critical/High: 0/0

Asset SHA-256 values are recorded in SHA256SUMS.

This release has not been deployed to an operator control plane.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

PastureStack Compose CLI v0.14.31

PastureStack maintenance release for Server v1.6.273.

This release removes a stale pre-migration Compose event-handler registration before installing the canonical compose-executor handler. It prevents upgraded databases from dispatching one stack operation to two executors.

Source commit: 70392e1fb7a40945ccb7e9db5774ed7d99df3284

Validation:

• Ubuntu 26.04 and Go 1.26.5 race tests
• go vet, formatting, source, license, secret, and vulnerability gates
• exact Server v1.6.272 orchestration-engine compatibility test
• upgraded-database stack-create end-to-end test
• two identical Linux, Windows, and macOS builds
• two identical deterministic release packages

Asset SHA-256:

• compose-cli-0.14.31-darwin-amd64.tar.gz: a97069340b297318aee912b66cbca45386fc044e8af9d14f40488798264812eb
• compose-cli-0.14.31-linux-amd64.tar.gz: f4abf6ed8fbc87620b9daa2e8cec279756827446038dbda7d96c70e1fb83af82
• compose-cli-0.14.31-windows-amd64.zip: 0dd57d2bc1335cf49ec6adc43947b1607b683de5f5f733868b3347a7aba63745
• compose-executor-0.14.31-linux-amd64.gz: 05c74cf88bc7bdc9dfdc54aff3610e944a15b39252a0bdb0b99da3f833b33224

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.