Skip to content

v1.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 22:48
v1.3.0
This tag was signed with the committer’s verified signature.
KrozT Matías Espinoza
SSH Key Fingerprint: c34rGWDOUkZbi+gnRSTpYWmCv74c3s4oJEJ9eGC3hMc
Verified
Learn about vigilant mode.
f1a2ab3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes since v1.2 make credential file permissions an explicit, reviewable
deployment choice while preserving the owner-only default.

Deploy this release

Point the Compose deployment at this controller digest and recreate
the container:

RUNPOOL_IMAGE=ghcr.io/rhobuild/runpool@sha256:943da33950688b4903c83507f4717d1466fe7aebb4ef73e910a68d302221ef74

The controller carries the capsule digest below stamped into it and
refuses any other, so there is one image to set. Read the
deployment guide
before a first installation, and
the runbook
before moving an existing one.

What changed

Security and deployment

  • Credential file permissions are an explicit deployment policy.
    credentials[].filePermissions is a ladder of four named policies,
    narrowest first: owner-only, the default, which refuses every group or
    other bit as before; allow-group-read; allow-world-read, for a platform
    that creates a world-readable mount; and ignore-mode-and-owner,
    which consults neither mode nor owner. Every policy above the default is
    warned by doctor and at startup. The two middle policies require the
    controller uid only when the file actually uses widened group or other
    bits, so every rung still accepts an operator-owned 0600 mount. A refusal
    names the narrowest policy that would accept the file. Independently of the
    selected rung, a credential must be a regular file no larger than 1 MiB.
    RUNPOOL_CREDENTIAL_FILE_PERMISSIONS sets the policy in Quick Start.

Provenance
Release-qualified commit f1a2ab328374b76d348cf4e7a010c1988e6cb290
Controller ghcr.io/rhobuild/runpool@sha256:943da33950688b4903c83507f4717d1466fe7aebb4ef73e910a68d302221ef74
Capsule ghcr.io/rhobuild/runpool/capsule@sha256:604f5301cfbc77fab6595c2ed6327cb680ef00a6f1300639b40b1f39b239d23a

Publication runs only after qualification passed against these exact
digests, so an attestation signed here says more than that GitHub
built it. Verify a digest before it reaches a deployment:

gh attestation verify oci://ghcr.io/rhobuild/runpool@sha256:943da33950688b4903c83507f4717d1466fe7aebb4ef73e910a68d302221ef74 \
  --repo rhobuild/runpool \
  --signer-workflow rhobuild/runpool/.github/workflows/release.yml \
  --source-ref refs/tags/v1.3.0 \
  --deny-self-hosted-runners

Attached: standalone linux/amd64 and linux/arm64 binaries with
checksums.txt, an SBOM for each image, and the qualification
record this release was authorized against.

Assets 9
Loading