Skip to content

Releases: PastureStack/distributed-cache-runtime

Release list

v5.7.3-pasturestack.4

v5.7.3-pasturestack.4 Latest
Latest

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 28 Aug 02:16
Immutable release. Only release title and notes can be modified.
v5.7.3-pasturestack.4
daab0b3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Reviewed PastureStack runtime artifact built from the existing signed tag.

  • Source commit: daab0b3
  • Tests: 38 suites / 385 tests / 0 failures
  • Source, artifact, and dependency Critical/High findings: 0
  • SBOM: CycloneDX 1.6, 15 runtime components, complete dependency graph
  • Exact JAR SHA-256: 9fa751998ce3cc1f17692e21933b24646c39a7142ca387af772e43f49dc77764
Assets 13
Loading

distributed-cache-runtime 5.7.3-pasturestack.3

distributed-cache-runtime 5.7.3-pasturestack.3

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 26 Aug 06:17
Immutable release. Only release title and notes can be modified.
v5.7.3-pasturestack.3
c77582d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

distributed-cache-runtime 5.7.3-pasturestack.3

This release is built from commit c77582dfec3d89f9c46dc95580200a775a5920ad and the SSH-signed annotated tag v5.7.3-pasturestack.3 (tag object d0a8e40130024f545001e19d0c12fdcb224e8806).

Runtime baseline

  • Apache Kafka: 4.3.1
  • Spring Boot: 4.1.1
  • Spring Framework: 7.0.9
  • Elasticsearch Java Client: 9.5.1
  • Debezium: 3.6.1.Final
  • Hadoop: 3.5.0
  • Build and verification JDK: Eclipse Temurin 25.0.4.1 LTS
  • Spring Boot 3 / Spring Framework 6 compatibility lane: removed
  • Jetty artifacts in the resolved dependency graph: 0

Verified artifacts

  • JAR SHA-256: 68772edf34eff953be148b4ed50e9d12c5c1c23ff81000a79f6c36a281979a94
  • OCI archive SHA-256: a28fc6dcc206d64de03f22c2f8fa1d8c1b1fa225a35074fce6a834ec73c5cc6f
  • GHCR manifest digest: sha256:50f3cdfe3a5d69c2b18a1e0c0cee9cc1b52552cb8e341c5bfbd49cfee53a0692
  • Image config ID: c9c143314f8a915602eef3a2cbd7fec5f98e87a5898220d6777ca980fade9783
  • Image revision label: c77582dfec3d89f9c46dc95580200a775a5920ad
  • GHCR tags: 5.7.3-pasturestack.3 and 5.7.3

The OCI artifact is a scratch-based JAR carrier. The JAR copied from the image was byte-for-byte identical to the formal release JAR. It is not the PastureStack HTTP server image and must not replace the service on port 8080.

Validation

  • Security release gate: 38 suites, 385 tests, 0 failures, 0 errors, 0 skipped.
  • Source, artifact, dependency and secret scans: Critical 0, High 0.
  • Final Trivy image and JAR scans: Critical 0, High 0, Medium 0, Low 0, Unknown 0.
  • Formal CycloneDX image and JAR SBOMs: specification 1.7, serial numbers present, 23 components, 24 dependency nodes, 0 vulnerability records.
  • CI Maven dependency graph: 15 components, 16 dependency nodes, 0 vulnerability records. This graph is supporting evidence; the formal release SBOMs are the two CycloneDX 1.7 files above.
  • Default CodeQL workflow passed for Actions, C/C++, Java/Kotlin and Python; open code-scanning alerts: 0.
  • Security release gate: https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32934120101
  • CodeQL: https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32934119786

Supply-chain controls

  • main requires the security gate and all four CodeQL checks, strict status checks, one approving review, CODEOWNERS, last-push approval, signed commits, administrator enforcement, conversation resolution and linear history.

  • Force pushes and branch deletion are disabled.

  • Repository immutable releases are enabled.

  • The release tag is SSH signed. Verify it with:

    git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=RELEASE-ALLOWED-SIGNERS tag -v v5.7.3-pasturestack.3

Honest limits

  • GitHub may display the commit or tag signature as unknown_key until the public SSH key is registered with GitHub as a signing key. Independent verification succeeds with RELEASE-ALLOWED-SIGNERS.
  • The Linux CI JAR and the formal Windows-host JAR differ at archive-byte level. The formal JAR carries the exact release commit, was independently scanned, and is the exact payload embedded in the published OCI image; no cross-platform byte-reproducibility claim is made.
  • GitHub SLSA provenance is not emitted by this release pipeline. The signed tag, immutable release, artifact hashes, SBOMs, Trivy results and CI evidence are the available provenance controls.
  • Cloud provisioning and multi-node production upgrade tests are conditional deployment checks and were not run because this release does not provision AWS, Azure or GCP infrastructure.
Loading

distributed-cache-runtime 5.7.3-pasturestack.2

distributed-cache-runtime 5.7.3-pasturestack.2

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 24 Aug 07:07
Immutable release. Only release title and notes can be modified.
v5.7.3-pasturestack.2
520a6d2

distributed-cache-runtime 5.7.3-pasturestack.2

This release is built from commit 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c and the SSH-signed annotated tag v5.7.3-pasturestack.2.

Runtime baseline

  • Apache Kafka: 4.3.1
  • Spring Boot primary lane: 4.1.1
  • Spring Framework primary lane: 7.0.9
  • Spring Boot compatibility lane: 3.5.16
  • Spring Framework compatibility lane: 6.2.19
  • Elasticsearch Java Client: 9.5.1
  • Debezium: 3.6.1.Final
  • Hadoop: 3.5.0
  • Build and verification JDK: Eclipse Temurin 25.0.4.1 LTS
  • Jetty artifacts in the resolved dependency graph: 0

Verified artifacts

  • JAR SHA-256: 6abb7d619f6ea57c52f04e8d4ebace83e731cfe89e6f5cd528ca7e6ce6b7b83b
  • OCI archive SHA-256: 9ab9633e10d2356b653c08700f46dfb1c75e5e44fb3873d73649793c343da570
  • GHCR manifest digest: sha256:80ee5f3f8f835c7f31e21100fb758d9632a5d239c3f7f4a379df7f9f4bcfab12
  • Image config ID: 3a07a0a491105206c83c3ea90d9eaea93defdc668333602a56af4c828d55fe68
  • Image revision label: 520a6d217e8809bd2a0d44ecbae5a8bcdb958b2c
  • GHCR tags: 5.7.3-pasturestack.2 and 5.7.3

The OCI artifact is a deterministic JAR carrier for this library/runtime distribution. It is not the PastureStack HTTP server image and must not replace the service on port 8080.

Validation

Supply-chain controls

  • main requires the security gate and all four CodeQL checks, strict status checks, one approving review, CODEOWNERS, last-push approval, signed commits, administrator enforcement and linear history.

  • Force pushes and branch deletion are disabled.

  • Repository immutable releases are enabled.

  • The release tag is SSH signed. Verify it with:

    git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=RELEASE-ALLOWED-SIGNERS tag -v v5.7.3-pasturestack.2

Honest limits

  • GitHub currently displays the commit signature as unknown_key because the public SSH key is not registered with GitHub as a signing key. Independent verification succeeds with the included RELEASE-ALLOWED-SIGNERS file.
  • GitHub SLSA provenance is not emitted by this release pipeline. The signed tag, immutable release, artifact hashes, SBOMs, Trivy results and CI evidence are the available provenance controls.
  • Cloud provisioning and multi-node production upgrade tests are conditional deployment checks and were not run because this release does not provision AWS, Azure or GCP infrastructure.
Loading

PastureStack distributed cache runtime 5.7.3

PastureStack distributed cache runtime 5.7.3

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 23 Aug 17:32
v5.7.3-pasturestack.1
f51a7c2

PastureStack distributed-cache-runtime 5.7.3 發布證據

結果

  • 發布版本：5.7.3
  • 發布標籤：v5.7.3-pasturestack.1
  • 來源提交：f51a7c219723b31a0690cee650dc2d021f441222
  • 來源樹：ad14310f8d92309912c9902bbb53456245996c06
  • 父提交：44a438ed136d07bd68c8786fd11a73a60f31840a
  • 作者：chen21019 <chen21019@gmail.com>
  • 發布結果：正式 JAR、OCI archive、GHCR image、CycloneDX SBOM 與掃描證據均已產生；GitHub 必要閘門通過。
  • 此 image 是只含 JAR／授權文件的 scratch 成品載體，Cmd 與 Entrypoint 均為空；它不是 8080 server，因此沒有替換既有 8080 工作負載。

版本與 EOL 收斂

項目 最終值 驗證
JDK Temurin 25.0.4+7，來源 image 固定 digest sha256:534968c051301957beae735e7ba1db54d99ddecf08746d3b9d4f318cc132dbc3 正式 image 重建通過
Maven 3.9.14 wrapper checksum gate 通過
Elasticsearch Java Client 9.5.1 真實 Elasticsearch Testcontainers 測試通過
Debezium 3.6.1.Final MySQL 與 PostgreSQL CDC Testcontainers 測試通過
Hadoop 3.5.0 SqlHadoopTest 14/14 通過
Spring Framework 6.2.19／7.0.8；Boot 3.5.15／4.1.0 來源清冊與正式建置通過
Jetty 發布依賴圖 0 Kafka Schema Registry 改用 MockSchemaRegistry；Hadoop 測試不再啟動 Jetty server graph
Python runtime protobuf 7.36.0、grpcio 1.83.0、typing_extensions 4.16.0 6/6 runtime 測試、SBOM 與 Trivy 通過

正式成品

成品 Bytes SHA-256／Registry digest
hazelcast-5.7.3.jar 23,802,527 e1d10fad54d22eb3c6937afe5c237ac4e3bf0015389769e7d3fd28376bd1489b
JAR 內嵌 checksum 86 checksum 值與 JAR 完全一致；檔案 SHA-256 124bdfa8f1fc1a208cdb75924320e6c2f51d821e8181e07ba546d84025cbdf5f
distributed-cache-runtime-5.7.3-pasturestack.1.oci.tar 22,128,640 a7103645409dcafb1af242ca8d62ed0e1a557ba6bf5b8a61e2e05e31ac01f7e4
GHCR 5.7.3-pasturestack.1 3 layers sha256:5716a2218e2847cefa2a05c7f574f19c548eccfce2ab23b5e38d6c8ef39d7701
GHCR 5.7.3 3 layers sha256:5716a2218e2847cefa2a05c7f574f19c548eccfce2ab23b5e38d6c8ef39d7701
OCI config 2,415 bytes sha256:5a0e017656ccb5ca8f1e06fa38827f8241fa099ab7dcd399c3719857592fbca5

匿名 GHCR manifest 與 config 回讀皆為 HTTP 200、Linux/amd64、revision=f51a7c219723b31a0690cee650dc2d021f441222、Cmd=null、Entrypoint=null。套件 visibility 為 public。

SBOM 與漏洞掃描

掃描器為固定 digest 的 Trivy 0.74.0：sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969。掃描使用已下載的 vulnerability DB 與 Java DB，執行時關閉網路與 DB 更新。

範圍 套件 CycloneDX dependencies Critical High Medium Low Unknown
最終 JAR 23 1.7 24 0 0 0 0 0
最終 OCI image 23 1.7 24 0 0 0 0 0
Python runtime 3 1.7 4 0 0 0 0 0

三份 CycloneDX 都有 serialNumber 與完整根節點／相依關係。GitHub Security release gate 另以 Maven effective POM 驗證正式 runtime graph：15 個元件、16 筆 dependencies、missing=0、unexpected=0、dangling=0。

GitHub 閘門

閘門 Run 結果
Security release gate https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32653170915 成功；385/385 測試、來源 secrets=0、來源／JAR／依賴 Critical+High=0
Default CodeQL https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32653170809 成功；Python、Java/Kotlin、C/C++、Actions 全部完成
CodeQL verification https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32653170825 成功；66 筆 Java SARIF 結果中 security score >= 7 為 0
Automatic Dependency Submission https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32653170861 成功
Dependabot Updates https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32652507370 成功；涵蓋實際依賴修改提交 44a438ed...；後續 f51a7c2... 只修改 CI DB preload
  • Dependabot open alerts：0。
  • CodeQL open Critical／High：0。
  • CodeQL py/path-injection hazelcast#228 已以 no_change 結果判定為 false positive：唯一 caller 使用固定 evidence 路徑、job 權限只有 contents: read，且 caller 已能執行 checkout 內容，不存在跨使用者或高權限檔案服務邊界。有效 evidence 輸入成功，外部非 XML 路徑在寫入 summary 前失敗。
  • 目前仍有 70 筆 Medium CodeQL baseline：39 筆由 CodeQL 分類為 test；31 筆為上游 production／未分類候選（Actions injection 2、temp-file disclosure 2、log injection 16、relative-path command 2、unreleased lock 9）。本次 security diff scan 對修改面回報 0 個新 reportable finding；這些不是 CVE／EOL，也不是這次升級新增的 Critical／High release blocker，仍保留在 GitHub 不隱藏。

重大相容性驗證

  • Elasticsearch ElasticClientsTest：1/1 通過。
  • MySQL CDC MySqlCdcIntegrationTest#customers：1/1 通過。
  • PostgreSQL CDC PostgresCdcIntegrationTest#customers：1/1 通過。
  • Kafka／Avro SqlAvroSchemaEvolutionTest：13 個案例，12 通過、1 個既有條件式 skip。
  • Hadoop SqlHadoopTest：14/14 通過。
  • Python runtime：6/6 通過。
  • Terraform 1.15.9 固定 image digest sha256:b88da40ffe55e3285b9246333814cba9fc39a2743b8fb8c64483063b0c3d6994；AWS、Azure、GCP 各自 fmt -check、init -backend=false、validate 通過。沒有進行實際 provisioning，因本次沒有部署這些模板。

私有知識庫

  • distributed-cache-runtime 快照提交已更新為 f51a7c219723b31a0690cee650dc2d021f441222。
  • SQLite 68/68 檢查通過；stale=0；無 WAL、SHM 或 tmp 殘留。
  • SQLite SHA-256：81d1fc37729a0ce91b7dcec03dcabd84949ecb3a79a4159d38f0cbc88d529fa7。
  • scoped inventory 的未初始化 CycloneDX 變數已修正；Build-VersionInventory.ps1 SHA-256：df68e2e27d4c31246d4f6d0a4da6c2da4882ed95e866d398aeb479d25fcec256。

發布位置

Loading

Distributed Cache Runtime 5.7.0-pasturestack.2

Distributed Cache Runtime 5.7.0-pasturestack.2

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 06 Aug 19:15
v5.7.0-pasturestack.2
49fea8e

PastureStack Distributed Cache Runtime 5.7.0-pasturestack.2

This release preserves the Hazelcast 5.7.0 API and upstream Git history while applying the reviewed PastureStack security-maintenance delta documented in SECURITY-MAINTENANCE.md.

PastureStack is an independent community project. It is not affiliated with or endorsed by Hazelcast, Inc. Upstream copyright, authorship, license files, notices, and file-level headers remain intact.

Security maintenance

  • Jackson 2 LTS 2.21.5 and Jackson 3 LTS 3.1.5
  • Netty 4.1.137.Final
  • gRPC Java 1.83.1
  • Aircompressor 2.0.3
  • Apache MINA 2.0.31
  • PostgreSQL JDBC 42.7.13
  • Tomcat Embed 11.0.24
  • Hibernate ORM 7.4.5.Final
  • LZ4 Java 1.11.2
  • Spring Boot 3.5.15 / 4.1.0 and Spring Framework 6.2.19 / 7.0.8
  • Maven Compiler Plugin 3.15.0 and Maven JAR Plugin 3.5.1 for standalone fixtures

Verification

  • Exactly one PastureStack maintenance commit follows the recorded upstream 5.7.0 boundary.
  • The clean artifact build, dependency convergence, banned-dependency checks, Checkstyle, 38 targeted tests, and three standalone fixture builds passed.
  • Final source and JAR scans reported zero Critical and zero High findings; the all-severity JAR scan reported zero findings.
  • The JAR retains the upstream LICENSE and NOTICE material.
  • The attached CycloneDX 1.7 SBOM contains 13 artifact components and no local filesystem or personal-account paths.
  • A JDK 21 runtime smoke test started and stopped a single node successfully with external discovery disabled.

Docker- and LocalStack-backed integration suites were not executed on the resource-sensitive production VM. Their sources compiled successfully; this limitation is not represented as a passed test.

Artifacts

  • hazelcast-5.7.0-pasturestack.2.jar
  • hazelcast-5.7.0-pasturestack.2.jar.sha256
  • distributed-cache-runtime-5.7.0-pasturestack.2.cdx.json
  • ghcr.io/pasturestack/distributed-cache-runtime:5.7.0-pasturestack.2

Use the version tag in operator-facing configuration. Integrity digests remain available through the registry and release evidence without being placed in UI image strings.

Loading