Skip to content

Host Provisioner 0.39.5

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 13 Aug 18:14
· 16 commits to main since this release
v0.39.5
0a1e607

Host Provisioner 0.39.5

This release preserves the upstream v0.39.4 history and adds one reviewed PastureStack maintenance commit.

Security and compatibility

  • Constrains machine state, stamp, cache, driver, and archive operations to reviewed storage roots.
  • Rejects path traversal, cross-machine archive entries, links, devices, special files, unsafe driver names, weak or missing driver checksums, and oversized driver payloads.
  • Parses driver tar, tar.gz, and zip archives in-process instead of invoking external extraction tools.
  • Preserves legitimate legacy machine identifiers, including spaces and non-ASCII text.
  • Retains Ubuntu 26.04, Go 1.26.5, and the checksum-pinned Docker 29.7.2 build tool.

Verification

  • Full tests, race tests, static validation, deterministic packaging, CodeQL, source/product secret scans, and supply-chain gates passed for source 0a1e607ca5cb08372457a50c68b2eba48448e24e.
  • The release archive includes the root license, origin record, and 19 preserved bundled-dependency legal files.
  • SHA-256: 08daefc5abb7966ab2861f5e5a75a6fb6f890bd59b8abbe336b68da17954ee1d

Production deployment remains a separate isolated-VM integration step; this release does not modify a running Server.

Assets 3
Loading