Skip to content

WolfStack v23.10.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 May 17:58
· 1754 commits to master since this release
v23.10.7
7c54319

v23.10.7: fleet aggregation now reports the real failure reason per node

Operator's nc tests showed port 8553 OPEN on both "unreachable"
nodes — yet the aggregation reported "all transports failed". The
TCP connection succeeded; something at the HTTP/TLS/auth layer was
failing and the aggregation was swallowing the real cause.

Same fix as I applied to propagate_kernel_block_to_peers in v23.10.3:
capture the last error per attempt (HTTP code + body preview,
transport error, JSON parse error) and put it in the FleetNodeResult
so the new "Show which nodes didn't respond" collapsible (v23.10.5)
displays an actionable message instead of the opaque "all transports
failed".

After this lands, instead of mouse FAILED — all transports failed
the operator will see (e.g.):

  • "https://mouse:8553/api/... -> HTTP 403: {"error":"Invalid cluster secret"}"
    → cluster secret mismatch on that node
  • "https://mouse:8553/api/... -> HTTP 404: ..."
    → that node's binary is too old; doesn't have this endpoint
  • "https://mouse:8553/api/... -> transport: error sending request: connection closed"
    → TLS handshake / timeout / etc.
  • "https://mouse:8553/api/... -> 200 OK but JSON parse failed: ..."
    → response shape mismatch (very old WolfStack)

This is generic to fleet_fanout_get so it fixes the diagnostic for
EVERY fleet aggregation panel (lockouts, listening-ports, host-audit,
scan-detector) at once.

No backend logic change beyond error message capture; receivers
unaffected.

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 — static musl binaries (Linux x86_64 and ARM64 / Raspberry Pi 4+).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 7
Loading