Skip to content

v0.2.5 - Go 1.27.3 security rebuild

Latest
Latest

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 21 Oct 22:34
Immutable release. Only release title and notes can be modified.
v0.2.5
188f53a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Per-Host Subnet v0.2.5

Security rebuild of the Windows 0.2.4 compatibility payload with official SHA256-verified Go 1.27.3, addressing GO-2026-6809 / CVE-2026-111943 in the previous Go runtime. The Go language minimum remains 1.26.0. Network/driver logic, CLI behavior, legal notices, and the exact rancher/per-host-subnet.exe plus startup_per-host-subnet.ps1 ZIP contract are unchanged.

The original Build and test run 39686844960 passed complete validation/race tests, both packages, Linux version smoke/govulncheck, and separate exact Linux ELF / Windows PE rootfs scans. Each scan has one positive gobinary target and zero vulnerabilities or secrets. The Windows PE was read/scanned, never executed; privileged Windows/two-host/upgrade/rollback validation remains outside this release evidence.

These are the original tested CI bytes, not a post-merge rebuild. PR head: 9001faf775833125a7ac0266fa10a740f5c7cd18; actual CI checkout/byte producer: e102e0bb38d84b0a9cbf87e5458cf1bc74d01904; signed integration main: 188f53ae35adf54eca7f357750a210cb2ab6edb8; all share tree a52a0786ee6eb9a60792aa232d377ee1d79e5f0c. The original -buildvcs=false contract embeds no VCS fields; provenance is bound through exact source/tree, original CI package identity and checksums.

SHA256SUMS covers the raw Linux binary, Linux archive and Windows ZIP. The ZIP retains the unchanged startup script SHA256 f22b41f18d1733c037babed4d2e0474efeedc6017a96849d4309dd864f5f86d1. Raw product scans and CycloneDX SBOMs accompany the packages. Earlier v0.2.7/v0.2.8 Linux prereleases remain unchanged historical evidence.

Assets 11
Loading