Skip to content

WolfStack v25.6.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 13:26
v25.6.3
27ac384

v25.6.3: S3 mounts stop asking for keys you already configured, and finally say WHY they failed

Adding an S3 mount asked for the access key and secret every single time,
even on a host where the credentials were already configured, and offered no
way to see what was there. Worse, when the resulting mount failed it could
only report "the mount never came up" — s3fs daemonises, EXITS 0 on failure,
and writes the real reason to syslog, which nothing collects on a default
host (confirmed on wolfstack-2: a failed mount left zero journal lines).

Saved credentials ("remotes"):
• Add Mount → S3 gains a Saved credentials picker, merged from WolfStack's
own store, rclone.conf on the host, /etc/passwd-s3fs, and existing S3
mounts. Pick one and it lists that account's actual buckets to choose
from, instead of typing a bucket name and finding out it was wrong only
when the s3fs daemon fails its startup check.
• Secrets never reach the browser: the API serves a masked access-key hint
and the mount is created BY REFERENCE, resolved server-side.
• Optionally save credentials typed by hand for reuse on the next bucket.

The s3fs Settings editor now understands an rclone.conf pasted into it —
which is what it invites, and what s3fs silently ignores because that file is
access_key:secret_key, not INI. The remotes are imported and the proper
file written at 0600, which s3fs REQUIRES (it refuses a credentials file with
group/other permissions — the previous 0644 write could never have worked).

Real errors: s3fs now runs with -o logfile= -o dbglevel=err and a failed
mount reports what the provider actually said ("NoSuchBucket: The specified
bucket does not exist") instead of a paragraph of guesses.

Missing s3fs returns the MISSING_PACKAGE marker so the operator gets the
watch-it-happen terminal install already used for nfs-common/cifs-utils,
rather than a silent degrade to a read-only bind mount whose writes never
reach the bucket. The Providers page Install button uses that same live
terminal for nfs/sshfs/s3fs. Alpine package names added for all of them.

Fixes found in the same code:
• GET /api/storage/mounts handed every S3 secret and SMB password to the
browser. Both are now redacted with the sentinel the update path already
treats as "keep the stored value", so editing still round-trips.
• The s3fs cache pointed at /tmp — tmpfs on a systemd host, i.e. the same
RAM-fill that took out wolfstack-1's backup staging. Now the configured
cache dir.
• sync_to_s3 passed the endpoint through without a scheme, so a sync
against a bare hostname (the form WolfStack's own placeholder invites)
never reached the provider. Region/endpoint building is now one shared
definition used by the mount, sync and bucket-listing paths.
• The terminal-install flow always prepared and ran the install on the
LOCAL host, even when managing a remote node — it installed nothing
where it was needed and reported success.
• rclone import created one mount per remote with no bucket; such a mount
can never mount ("Bucket name is required"). It now imports remotes.
• IDrive e2 added to the provider list.

13 unit tests cover the parsing (using the exact rclone block that started
this) and the s3fs log extraction (using verbatim s3fs 1.95 failure output).

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading