Resource Scheduler 0.8.22

Maintained resource scheduler runtime published from a pure numeric version, with tests, SBOM, package inventory, full vulnerability evidence, an explicit register of vendor-unfixed Low/Medium findings, checksums, and build provenance.

Resource Scheduler 0.8.21

Maintained resource scheduler runtime published from a pure numeric version, with tests, SBOM, package inventory, full vulnerability evidence, an explicit register of vendor-unfixed Low/Medium findings, checksums, and build provenance.

Resource Scheduler 0.8.20

Maintained resource scheduler runtime published from a pure numeric version, with tests, SBOM, package inventory, full vulnerability evidence, an explicit register of vendor-unfixed Low/Medium findings, checksums, and build provenance.

Resource Scheduler 0.8.19

Official dependency-only security refresh; scheduler algorithms, APIs, event/metadata contracts, and health behavior are unchanged.

• Go 1.27.2 and the fixed Canonical 20261020T000000Z snapshot, plus official security module updates for the disposable Docker CLI/Buildx builder.
• Signed source/tag: d1720ddb65a285ed615f1461ccb44e50c2ad67a7 / v0.8.19.
• Published runtime manifest: sha256:46dfecc72fc1fceab5c66f881f46449874b6a084a208f59c6ef1184a0d15c3f9.
• Actual released runtime: 0 HIGH/CRITICAL/UNKNOWN, 0 vendor-fixed findings, and 0 secrets. Its 4 LOW and 47 MEDIUM vendor-unfixed package findings remain under_investigation, not resolved, in the attached risk register and OpenVEX.
• All attached SHA256SUMS assets and image/SBOM GitHub build-provenance attestations were independently verified against the exact source commit, tag, release workflow, and GitHub-hosted runner. The SBOM/scan image ID matches the public registry manifest's config digest.

The native CI evidence separately retains raw disposable-builder findings: 8 CRITICAL and 192 HIGH Linux header source-package matches receive 200 exact-CVE/package/archive/installed-content not_affected statements. Another 2,600 vendor-unfixed package findings remain, including one UNKNOWN module advisory. The actual Buildx compilation graph contains zero golang.org/x/crypto/openpgp packages, but its module advisory remains recorded rather than represented as fixed. Official CNA/Canonical source hashes are preserved in the review ledger. This package-only applicability evidence makes no claim about any host kernel.

Reproducible builds, source/race/vet checks, reachable Go analysis, and isolated packaged-health checks passed (non-root port 80, readiness 200, dependency failure 503, liveness 200, zero restarts). These results do not qualify a managed-system upgrade or rollback.

Catalog version 5 is available in producer commit 71ec6b2; historical versions 1-4 remain unchanged.

Resource Scheduler 0.8.18

Maintained resource scheduler runtime published from a pure numeric version, with tests, SBOM, package inventory, full vulnerability evidence, an explicit register of vendor-unfixed Low/Medium findings, checksums, and build provenance.

Resource Scheduler 0.8.16

Resource Scheduler 0.8.16

This release keeps the scheduler process alive during a planned control-plane restart without replacing its container.

Changes

• Reconnect the control-plane event subscriber after a clean disconnect or an error.
• Restart the metadata watcher in place after an error or a recovered panic.
• Keep /healthcheck as process liveness and expose dependency status through /readiness.
• Add regression coverage for reconnection, panic recovery, and liveness/readiness separation.

Verification

• Go 1.26.5 unit tests and go vet passed.
• Linux race tests passed for all five packages.
• The package-script, build-policy, migration-policy, formatting, and history gates passed.
• A control-plane outage smoke test kept the same container ID running with restart count 0, returned HTTP 200 from /healthcheck, and returned HTTP 503 from /readiness while dependencies were unavailable.
• Trivy 0.73.0 reported zero Critical or High image vulnerabilities and no detected image secrets. The attached JSON reports and CycloneDX SBOM preserve the evidence.

Artifacts

• Container image: ghcr.io/pasturestack/resource-scheduler:v0.8.16
• OCI digest: sha256:7d7d39c43d4290161001e09220ef5e37abe2837f9109929ee87ce4ade47e4353
• Source commit: c54bc3afd9b83577be73049b88e63430488566b4

Use the numeric version tag in deployment configuration. Do not place the digest in the user-facing image field.

Resource Scheduler v0.8.15

This release keeps the scheduler running when a metadata long poll reaches
a transient response timeout. The timeout is retried without discarding
scheduler state, matching the established metadata-client behavior.

Operational image:

ghcr.io/pasturestack/resource-scheduler:v0.8.15

Deployment definitions must use the semantic version tag above. The image
digest is retained only as release-verification evidence.

Resource Scheduler v0.8.14

Resource Scheduler v0.8.14

This release fixes idempotent host-port allocation when the same workload allocation event is retried. A workload now recognizes its own existing reservation while reservations owned by other workloads remain protected from collisions.

Container image

ghcr.io/pasturestack/resource-scheduler:v0.8.14
sha256:82742768223b8e9284f02e629e831efc1809266a8f2e8fc2049821d142b5e600

The image is publicly pullable without GitHub authentication, targets linux/amd64, runs as the non-root user 10001:10001, and records source commit 09696440259c81b23f8bdec9b4cee98feebc8e26 in its OCI metadata.

Validation

• Full make ci from a clean checkout, including race-enabled Go tests and coverage checks
• Regression coverage for repeated allocation events and cross-workload port conflicts
• Anonymous pull and runtime version verification by immutable digest
• Isolated VM end-to-end validation: node agent active, four system stacks healthy, six system images verified, catalog workload healthy over HTTP, and successful recovery after a container restart
• Trivy scan: 0 HIGH and 0 CRITICAL findings
• CycloneDX and SPDX software bills of materials included with this release

SHA256SUMS verifies every downloadable asset. IMAGE-DIGESTS.txt binds the image tag, immutable manifest, image configuration, platform, and source commit.

Provenance and licensing

The repository retains its original upstream Git history and license. This release adds one downstream maintenance commit after the preserved upstream boundary; it does not replace upstream authorship or ownership.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.

Resource Scheduler v0.8.13

This is the first verified PastureStack runtime release of the resource scheduler component. It is an individual component release and does not by itself replace the complete control-plane stack.

Container image:

ghcr.io/pasturestack/resource-scheduler:v0.8.13

Immutable digest:

ghcr.io/pasturestack/resource-scheduler@sha256:9b788c22417b818aa2b18fdb88ccec9749df2f8b04ff51bfd47105b5349d2b52

Verification completed:

• Preserves the official upstream history through ad28c1d94b7f1b1814fa6404886398b4f4094d64, followed by one PastureStack maintenance commit.
• Two independent no-cache image builds were byte-identical.
• Race-enabled tests, go vet, formatting checks, package tests, and a live metadata contract test passed.
• The runtime uses the non-root identity 10001:10001; only the scheduler binary has cap_net_bind_service.
• Anonymous manifest, config, all nine layers, digest pull, and digest execution were verified.
• Trivy reported 0 HIGH or CRITICAL vulnerabilities in the Ubuntu runtime and Go binary. The attached full report retains lower-severity findings for auditability.
• CycloneDX and SPDX SBOMs, checksums, and immutable image metadata are attached.

Legacy protocol names required by the existing control-plane API remain intentionally supported and are documented in COMPATIBILITY.md.

PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.