Skip to content

WolfStack v25.20.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 07:25
· 26 commits to master since this release
v25.20.1
5512138

v25.20.1: an LXC backup can no longer leave the container frozen

The nightly backup froze legolas on wolfstack-3 for 70+ minutes. backup_lxc
ran lxc-freeze around the snapshot instant; on cgroup2 the freezer sits in
FREEZING forever when a task cannot be frozen — the classic case is a
container running its own FUSE mount, whose client tasks cannot freeze until
the FUSE daemon answers while the daemon is being frozen with them.
lxc-freeze waits for FROZEN with no timeout, so the backup thread blocked at
.output(), the unfreeze on the next line never ran, and a service restart
left both the paused container and the hung lxc-freeze client behind
(systemd's KillMode keeps unit children alive across a restart).

Snapshot backups no longer freeze at all. A ZFS/btrfs snapshot is atomic and
point-in-time without the freeze — taken hot it is crash-consistent, the
same guarantee the hot-tar fallback has always accepted — and the container
is never paused, not even for the snapshot instant. On storage without
snapshot support the freeze was already released before tar started, so it
bought nothing there; the Proxmox path (vzdump) never used this code.

A recovery sweep now runs at boot (immediately — a frozen container is a
live outage) and hourly: any hung lxc-freeze client found in /proc is
killed, and a container left FROZEN/FREEZING is thawed with a bounded,
verified, retried lxc-unfreeze. That self-heals nodes still carrying frozen
state from a pre-25.20.1 binary across the upgrade.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading