v0.6.3

A fix to where the usage page says its figures begin.

修正用法页上「数据从什么时候开始」的时间。

Changes

• since in /status.json is where the restored figures begin. v0.6.2 took the start of the first hour with data, so right after a fresh start (nothing saved yet, such as the upgrade from v0.6.1) the usage page said its figures began at the top of the hour, although they began when the service started. The service now notes the earliest minute of the counts and the earliest hour of the upstream probes it restored; since is that, or the start when nothing was restored.

Upgrading

No configuration changes. From v0.6.2 the figures are kept across this upgrade.

改动

• **/status.json 的 since 改为恢复出来的数据从哪里开始。**v0.6.2 取的是第一个有数据的小时的开头，所以刚启动、还没有保存过数据时（比如从 v0.6.1 升级上来），用法页会说数据从整点开始，实际上是从启动时开始的。现在服务会记下恢复出来的计数最早到哪一分钟、上游探测最早到哪一小时，since 就是它；什么都没恢复时就是启动时间。

升级

不用改配置。从 v0.6.2 升级时数据会保留。

Verifying

Binaries, the image and the chart are signed keylessly with cosign and carry GitHub build provenance; see Verifying releases.

v0.6.3-rc.1

Changelog

• 8a3e8ce: build: v0.6.3 references; chart 0.6.3 (@best)
• 702ba47: fix: since in /status.json is where the restored figures begin (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/registry-mirrors-relay:v0.6.3-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/registry-mirrors-relay:v0.6.3-rc.1 -R openlinkos/registry-mirrors-relay

# Helm chart (installs the image above by digest)
cosign verify ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.3-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.3-rc.1 -R openlinkos/registry-mirrors-relay
helm install registry-mirrors-relay oci://ghcr.io/openlinkos/charts/registry-mirrors-relay --version 0.6.3-rc.1 -n registry-mirror --create-namespace

v0.6.2

The service status, the console's charts and the accounts' last use now survive restarts and upgrades.

服务状态、后台图表和账号的最后使用时间在重启、升级后不再清空。

Changes

• Figures survive restarts. With writable operational data (admin.store.driver: bolt, the default), the per-minute counts behind the console's 24-hour charts, each client account's last use and the upstream probes behind the service status are saved every five minutes and on exit, and read back on start. Upgrading or restarting the service no longer empties the usage page's status table. The current hour's summary is continued after a restart within the hour instead of being overwritten. With read-only operational data nothing changes: the figures start again after a restart.
• /status.json has since, the start of the earliest hour with data. The usage page says where its figures begin only while they cover less than the 24 hours shown.
• Design system 0.5.1. @openlinkos/ui now keeps code clear of the copy button and drops the space under a toolbar that ends its box, so the console and the usage page no longer patch either.
• The base image is the latest distroless/static-debian13:nonroot.

Upgrading

No configuration changes. The upgrade from v0.6.1 or earlier starts the figures afresh one last time, since earlier versions did not save them; from then on they are kept.

改动

• **重启后数据还在。**运营数据可写时（admin.store.driver: bolt，默认），后台 24 小时图表用的每分钟计数、每个客户端账号的最后使用时间，以及服务状态用的上游探测结果，每五分钟和退出时各保存一次，启动时读回来。升级、重启不会再清空用法页的状态表。同一个小时内重启时，这个小时的汇总接着累计，不再被覆盖。运营数据只读时和以前一样，重启后从头统计。
• /status.json 新增 since：最早有数据的那个小时。用法页只在数据不满 24 小时的时候写明从什么时候开始。
• 设计系统 0.5.1：@openlinkos/ui 自己处理了复制按钮压住代码、工具栏在容器末尾多出下边距这两个问题，后台和用法页不用再各自补。
• 基础镜像更新到最新的 distroless/static-debian13:nonroot。

升级

不用改配置。从 v0.6.1 及更早版本升级这一次仍会从头统计，因为旧版本没有保存数据；之后就会保留。

Verifying

Binaries, the image and the chart are signed keylessly with cosign and carry GitHub build provenance; see Verifying releases.

v0.6.2-rc.1

Changelog

• 9493d26: build(deps): bump distroless/static-debian13 from d620678 to 18f4cc2 (@dependabot[bot])
• 51a0e84: build: @openlinkos/ui 0.5.1; drop the copy button and toolbar patches it now covers (@best)
• 1ae8070: build: v0.6.2 references; chart 0.6.2 (@best)
• a8ef248: feat: keep the last 24 hours of statistics and upstream probes across restarts (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/registry-mirrors-relay:v0.6.2-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/registry-mirrors-relay:v0.6.2-rc.1 -R openlinkos/registry-mirrors-relay

# Helm chart (installs the image above by digest)
cosign verify ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.2-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.2-rc.1 -R openlinkos/registry-mirrors-relay
helm install registry-mirrors-relay oci://ghcr.io/openlinkos/charts/registry-mirrors-relay --version 0.6.2-rc.1 -n registry-mirror --create-namespace

v0.6.1

Fixes to the console's entrance pages found after v0.6.0 went live.

v0.6.0 上线后发现的后台入口页问题的修复。

Changes

• Client configuration for entrances that require sign-in. An entrance's page no longer offers Docker's registry-mirrors when the entrance requires sign-in, since Docker sends no credentials to a mirror; pull through the domain after docker login instead. Its containerd hosts.toml now carries an authorization header, its k3s registries.yaml a configs section for the client account, and the Podman hint says to run podman login, as the usage page already did.
• Copy buttons no longer cover code. On narrow screens a long line in a code block without a label slid under its copy button; the code now scrolls inside a box that stops short of the button. This applies to the console and the usage page.

Upgrading

No configuration changes. See docs/deploy.md if you are coming from v0.5.

改动

• **要求登录的入口的客户端配置。**入口要求登录时，它的页面不再给出 Docker 的 registry-mirrors：Docker 不会把登录信息发给加速地址，应该 docker login 后直接用这个域名拉取。containerd 的 hosts.toml 加上了 authorization 头，k3s 的 registries.yaml 加上了填客户端账号的 configs，Podman 的说明写明先运行 podman login，和用法页一致。
• **复制按钮不再压住代码。**窄屏上，没有标签的代码块里，长的一行会滚到复制按钮下面；现在代码在按钮左侧的区域里滚动。后台和用法页都改了。

升级

不用改配置。从 v0.5 升级见 docs/zh/deploy.md。

Verifying

Binaries, the image and the chart are signed keylessly with cosign and carry GitHub build provenance; see Verifying releases.

v0.6.1-rc.1

Changelog

• b3e5f75: build: v0.6.1 references; chart 0.6.1 (@best)
• 1eba3ae: fix(admin): client configuration for entrances that require sign-in; keep code clear of the copy button (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/registry-mirrors-relay:v0.6.1-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/registry-mirrors-relay:v0.6.1-rc.1 -R openlinkos/registry-mirrors-relay

# Helm chart (installs the image above by digest)
cosign verify ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.1-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.1-rc.1 -R openlinkos/registry-mirrors-relay
helm install registry-mirrors-relay oci://ghcr.io/openlinkos/charts/registry-mirrors-relay --version 0.6.1-rc.1 -n registry-mirror --create-namespace

v0.6.0

A redesigned admin console and usage page, built on the OpenLinkOS design system: every setting on the page that uses it, a page per entrance and per client account, and a usage page with live status, in English and Chinese.

重新设计的管理后台和用法页，基于 OpenLinkOS 设计系统：每项设置在用到它的页面上改，每个入口、每个客户端账号各有一页；用法页带实时状态，中英文都有。

Changes

• The usage page is new. It is rendered from the configuration, with the brand's rings in its hero, a live status pill, numbered steps for Docker, containerd, k3s and RKE2, Podman and CRI-O and Kubernetes tools, an image address converter, a card per mirror with its health, a 24-hour status table and the questions people ask. It works out each upstream's address from the entrances (a fixed host, or a path prefix on a single-domain entrance) and starts with docker login where pulls require sign-in. English and Chinese are both in the page; the language follows ?lang=, the relay-lang cookie and the browser, and the menu in its header shows the language in use. Its stylesheet, script, fonts and marks are served from /assets/ under hashed names, and its Content-Security-Policy allows only its own files, with no inline script or style. It reads whole without JavaScript.
• site.brand gives the usage page and the console the colours and marks of an OpenLinkOS or LinkOS service (linkos-mirrors, for one). Without it both take a neutral look; the console no longer hard-codes LinkOS Mirrors. It can be set in the configuration or on the console's Usage page.
• The console is organised around where each setting is used.
  • Entrances have a list and a page each, with the client configuration for that entrance (and docker login when it requires sign-in) and its settings.
  • Usage page holds the site name, operator, brand, footer links and whether the status is shown.
  • Rate limits are changed on the Rate limits page, and an upstream's settings on its own page under Upstreams.
  • Configuration lists every change made in the console, links to where it is edited, and holds the manifest cache and upstream connections. Settings is gone; old addresses redirect.
• Client accounts: a list with search, a status filter and a menu per row (open, disable or enable, delete); a page to create one, which then shows how to sign in (and a generated password, once); and a page per account with its latest requests, limits and note, a password reset and deleting it. Requests can be filtered by account.
• Look and feel: the sidebar ends with a theme switch (Auto, Light, Dark) that never overflows and an account menu with My account, the language (each in its own words, the current one checked) and Sign out; the sign-in page has the same language menu. Success notices are toasts that leave by themselves; live figures flash when they change; charts, meters and status strips draw in; moving between pages cross-fades. All motion stops for users who prefer reduced motion.
• Design system: @openlinkos/ui 0.5.0, now shared by the console and the usage page, with every brand's marks from @openlinkos/vitepress-theme 0.5.0. Chart 0.6.0.

Upgrading

No configuration changes are needed. Things you may notice: the usage page is new and is English when the browser asks for neither Chinese nor English (the old page showed Chinese); the console's pages moved (old addresses redirect); without site.brand the console takes a neutral look. See docs/deploy.md.

改动

• **用法页是新的。**按配置渲染，首屏有品牌的圆环和实时状态，下面依次是 Docker、containerd、k3s 和 RKE2、Podman 和 CRI-O、Kubernetes 工具的分步配置，镜像地址转换，每个加速地址一张卡片（带健康状态），近 24 小时的服务状态表，以及常见问题。各上游的加速地址按入口推出（固定域名，或单域名入口上的路径前缀），要求登录的入口先给出 docker login。页面里中英文都有，语言依次按 ?lang=、relay-lang Cookie 和浏览器，顶部的菜单显示当前语言。样式、脚本、字体和标志在 /assets/ 下，文件名带哈希；Content-Security-Policy 只允许页面自己的文件，没有内联脚本和样式。没有 JavaScript 也能完整阅读。
• site.brand 让用法页和后台用 OpenLinkOS 或 LinkOS 服务的配色和标志（例如 linkos-mirrors）。不写时两者都是中性外观，后台不再写死 LinkOS Mirrors。可以写在配置里，也可以在后台的「用法页」里改。
• 后台按「设置在哪里用就在哪里改」重新组织。
  • 「入口」有列表，每个入口一页，包括这个入口的客户端配置（要求登录时还有 docker login）和它的设置。
  • 「用法页」管站点名称、运营者、品牌、页脚链接和是否显示状态。
  • 限流在「限流」页直接改，上游的设置在「上游」下每个上游自己的页面改。
  • 「配置」页列出后台做过的所有修改并链接到修改它的页面，同时负责 manifest 缓存和上游连接。「设置」页去掉了，旧地址会跳转。
• 客户端账号：列表可以搜索、按状态筛选，每行有操作菜单（打开、停用或启用、删除）；在单独的页面新建，建好后显示怎么登录（生成的口令只显示这一次）；每个账号一页，有最近的请求、限额和备注、重设口令和删除。请求记录可以按账号筛选。
• 外观和动效：侧栏底部是不会再撑破的配色开关（自动、浅色、深色）和账号菜单（我的账号、语言、退出登录；每种语言用它自己的文字写，当前的打勾），登录页也有同样的语言菜单。成功提示改成会自动消失的 toast；实时数字变化时闪一下；图表、进度条和状态条依次画出；切换页面时淡入淡出。系统设置了减少动态效果时，所有动效都停止。
• 设计系统：@openlinkos/ui 0.5.0，现在后台和用法页共用；各品牌的标志来自 @openlinkos/vitepress-theme 0.5.0。chart 0.6.0。

升级

不用改配置。会察觉到的变化：用法页是新的，浏览器既不要中文也不要英文时显示英文（旧页面默认中文）；后台的页面调整了（旧地址会跳转）；没写 site.brand 时后台是中性外观。见 docs/zh/deploy.md。

Verifying

Binaries, the image and the chart are signed keylessly with cosign and carry GitHub build provenance; see Verifying releases.

v0.6.0-rc.1

Changelog

• 45a8f03: build: v0.6.0 references and upgrade notes; chart 0.6.0 (@best)
• 01d09ce: build: vendor @openlinkos/ui and @openlinkos/vitepress-theme 0.5.0 from npm (@best)
• 52d4de5: feat(admin): redesign the console around where each setting is used (@best)
• feabecb: feat(web): rebuild the usage page on the design system (@best)
• 8898fa4: feat: share the design system between the console and the usage page, and add site.brand (@best)
• 8aadb94: fix: keep code clear of the copy button in blocks without a label (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/registry-mirrors-relay:v0.6.0-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/registry-mirrors-relay:v0.6.0-rc.1 -R openlinkos/registry-mirrors-relay

# Helm chart (installs the image above by digest)
cosign verify ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.0-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/charts/registry-mirrors-relay:0.6.0-rc.1 -R openlinkos/registry-mirrors-relay
helm install registry-mirrors-relay oci://ghcr.io/openlinkos/charts/registry-mirrors-relay --version 0.6.0-rc.1 -n registry-mirror --create-namespace

v0.5.0

registry-mirrors-relay admin password now works against a running service, a first password is generated on the first start, and messages follow the reader's language.

registry-mirrors-relay admin password 可以直接对运行中的服务操作，第一次启动自动生成口令，界面和错误信息按读者的语言显示。

Changes

• The admin command works while the service runs: docker exec -it relay registry-mirrors-relay admin password, kubectl exec -it sts/<name> -- registry-mirrors-relay admin password, or sudo registry-mirrors-relay admin password. It reaches the service through a local admin socket next to the operational database (mode 0600; on Linux and macOS only the service's own user or root may connect), so the change applies at once and signs that administrator out. With the service stopped it opens the database as before.
  • Without a name, admin password sets the only administrator's password, or creates admin when there is none. --generate makes a random password and prints it once. admin create NAME and admin list work the same way; -name still works.
• A generated first password: when a writable operational database has no administrator and the configuration names none, the service creates admin with a random password and writes it to the log once (docker logs relay 2>&1 | grep 'generated password'). It must be changed at the first sign-in. A password file (RELAY_ADMIN_PASSWORD_FILE) or admin.initial_admin still lets you choose the first password yourself.
• Messages in the reader's language: configuration problems, console errors and API errors are written in English in the code and translated to Chinese through a catalogue, so the Chinese console no longer shows English validation errors and the English console no longer shows Chinese ones. The language follows the browser (English when it asks for neither) until you choose one; the choice is the relay-lang cookie, shared with the usage page.
• API errors carry a stable code next to error, for example {"error": "...", "code": "store.readonly"}; error is English, or Chinese with Accept-Language: zh. The codes are listed in docs/api.md.
• English code and English-first docs: comments, logs, CLI output and the errors registry clients see are English. README.md and docs/ are English, README.zh-CN.md and docs/zh/ Chinese.
• The console answers HEAD like GET, for monitoring probes. The startup log shows whether the console is public. Chart 0.5.0; its notes say where the first password is and how to set one.

Upgrading

No configuration changes are needed. Things you may notice: API error messages, docker pull errors, CLI output and logs are English (alerts that match log messages need the English text; field names are unchanged), and API clients should match the new code instead of the message. See docs/deploy.md.

改动

• admin 命令在服务运行时也能用：docker exec -it relay registry-mirrors-relay admin password、kubectl exec -it sts/<名字> -- registry-mirrors-relay admin password，或 sudo registry-mirrors-relay admin password。命令经运营数据库旁边的本地管理 socket 交给服务去改（权限 0600；在 Linux 和 macOS 上只接受服务自己的用户和 root），立即生效，并让这个管理员的会话下线。服务停着时照旧直接打开数据库。
  • admin password 不写名字时设唯一那个管理员的口令，一个都没有就创建 admin。--generate 生成随机口令，只打印一次。admin create 名字、admin list 同样可用，-name 仍然认。
• 自动生成第一个口令：运营数据可写、没有管理员、配置里也没写时，服务创建 admin，生成随机口令，在日志里写一次（docker logs relay 2>&1 | grep 'generated password'），第一次登录后必须改。想自己定第一个口令，仍可用口令文件（RELAY_ADMIN_PASSWORD_FILE）或 admin.initial_admin。
• 按读者的语言显示：配置问题、后台和 API 的错误在代码里写英文，经词条翻译成中文。中文界面不再出现英文的校验错误，英文界面也不再出现中文。语言默认跟随浏览器（既不要中文也不要英文时用英文），手动选过之后记在 relay-lang Cookie 里，和用法页共用。
• API 错误带固定的 code，例如 {"error": "...", "code": "store.readonly"}；error 默认英文，带 Accept-Language: zh 时是中文。错误码见 docs/zh/api.md。
• 代码用英文，文档英文优先：注释、日志、命令行输出和 registry 客户端看到的错误都是英文。README.md、docs/ 是英文，README.zh-CN.md、docs/zh/ 是中文。
• 后台对 HEAD 请求按 GET 回应，方便监控探测。启动日志写出后台是否公开。chart 0.5.0，安装提示里写明第一个口令在哪、怎么重设。

升级

不用改配置。会察觉到的变化：API 的错误说明、docker pull 看到的错误、命令行输出和日志都是英文（按日志内容写的告警要改成英文，字段名不变）；API 的调用方请改为按新的 code 判断。见 docs/zh/deploy.md。

Verifying

Binaries, the image and the chart are signed keylessly with cosign and carry GitHub build provenance; see Verifying releases.

v0.5.0-rc.1

Changelog

• c462e88: build: scripts, deployment files and chart in English; v0.5.0 references (@best)
• 172db7f: feat: localised errors, an admin command that works while the service runs (@best)
• 89c0085: refactor: write comments, logs and internal errors in English (@best)

Verify

# Binaries: check the signature of SHA256SUMS, then the archive against it
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c SHA256SUMS

# Image
cosign verify ghcr.io/openlinkos/registry-mirrors-relay:v0.5.0-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/registry-mirrors-relay:v0.5.0-rc.1 -R openlinkos/registry-mirrors-relay

# Helm chart (installs the image above by digest)
cosign verify ghcr.io/openlinkos/charts/registry-mirrors-relay:0.5.0-rc.1 \
  --certificate-identity-regexp '^https://github.com/openlinkos/registry-mirrors-relay/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/openlinkos/charts/registry-mirrors-relay:0.5.0-rc.1 -R openlinkos/registry-mirrors-relay
helm install registry-mirrors-relay oci://ghcr.io/openlinkos/charts/registry-mirrors-relay --version 0.5.0-rc.1 -n registry-mirror --create-namespace