Skip to content

distributed-cache-runtime 5.7.3-pasturestack.3

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 26 Aug 06:17
· 3 commits to main since this release
Immutable release. Only release title and notes can be modified.
v5.7.3-pasturestack.3
c77582d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

distributed-cache-runtime 5.7.3-pasturestack.3

This release is built from commit c77582dfec3d89f9c46dc95580200a775a5920ad and the SSH-signed annotated tag v5.7.3-pasturestack.3 (tag object d0a8e40130024f545001e19d0c12fdcb224e8806).

Runtime baseline

  • Apache Kafka: 4.3.1
  • Spring Boot: 4.1.1
  • Spring Framework: 7.0.9
  • Elasticsearch Java Client: 9.5.1
  • Debezium: 3.6.1.Final
  • Hadoop: 3.5.0
  • Build and verification JDK: Eclipse Temurin 25.0.4.1 LTS
  • Spring Boot 3 / Spring Framework 6 compatibility lane: removed
  • Jetty artifacts in the resolved dependency graph: 0

Verified artifacts

  • JAR SHA-256: 68772edf34eff953be148b4ed50e9d12c5c1c23ff81000a79f6c36a281979a94
  • OCI archive SHA-256: a28fc6dcc206d64de03f22c2f8fa1d8c1b1fa225a35074fce6a834ec73c5cc6f
  • GHCR manifest digest: sha256:50f3cdfe3a5d69c2b18a1e0c0cee9cc1b52552cb8e341c5bfbd49cfee53a0692
  • Image config ID: c9c143314f8a915602eef3a2cbd7fec5f98e87a5898220d6777ca980fade9783
  • Image revision label: c77582dfec3d89f9c46dc95580200a775a5920ad
  • GHCR tags: 5.7.3-pasturestack.3 and 5.7.3

The OCI artifact is a scratch-based JAR carrier. The JAR copied from the image was byte-for-byte identical to the formal release JAR. It is not the PastureStack HTTP server image and must not replace the service on port 8080.

Validation

  • Security release gate: 38 suites, 385 tests, 0 failures, 0 errors, 0 skipped.
  • Source, artifact, dependency and secret scans: Critical 0, High 0.
  • Final Trivy image and JAR scans: Critical 0, High 0, Medium 0, Low 0, Unknown 0.
  • Formal CycloneDX image and JAR SBOMs: specification 1.7, serial numbers present, 23 components, 24 dependency nodes, 0 vulnerability records.
  • CI Maven dependency graph: 15 components, 16 dependency nodes, 0 vulnerability records. This graph is supporting evidence; the formal release SBOMs are the two CycloneDX 1.7 files above.
  • Default CodeQL workflow passed for Actions, C/C++, Java/Kotlin and Python; open code-scanning alerts: 0.
  • Security release gate: https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32934120101
  • CodeQL: https://github.com/PastureStack/distributed-cache-runtime/actions/runs/32934119786

Supply-chain controls

  • main requires the security gate and all four CodeQL checks, strict status checks, one approving review, CODEOWNERS, last-push approval, signed commits, administrator enforcement, conversation resolution and linear history.

  • Force pushes and branch deletion are disabled.

  • Repository immutable releases are enabled.

  • The release tag is SSH signed. Verify it with:

    git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=RELEASE-ALLOWED-SIGNERS tag -v v5.7.3-pasturestack.3

Honest limits

  • GitHub may display the commit or tag signature as unknown_key until the public SSH key is registered with GitHub as a signing key. Independent verification succeeds with RELEASE-ALLOWED-SIGNERS.
  • The Linux CI JAR and the formal Windows-host JAR differ at archive-byte level. The formal JAR carries the exact release commit, was independently scanned, and is the exact payload embedded in the published OCI image; no cross-platform byte-reproducibility claim is made.
  • GitHub SLSA provenance is not emitted by this release pipeline. The signed tag, immutable release, artifact hashes, SBOMs, Trivy results and CI evidence are the available provenance controls.
  • Cloud provisioning and multi-node production upgrade tests are conditional deployment checks and were not run because this release does not provision AWS, Azure or GCP infrastructure.
Assets 15
Loading