From cf6322c368eb57a33240670e3bd3d348f27973f9 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 28 Aug 2026 09:50:15 +0800 Subject: [PATCH] release: consume reviewed cache runtime 5.7.3.4 --- .github/workflows/codeql-verification.yml | 2 +- .github/workflows/security-release-gate.yml | 4 +- README.md | 4 +- code/framework/api-pub-sub-jetty/pom.xml | 2 +- code/framework/api-pub-sub/pom.xml | 2 +- code/framework/api/pom.xml | 2 +- code/framework/archaius/pom.xml | 2 +- code/framework/async/pom.xml | 2 +- code/framework/auditing/pom.xml | 2 +- code/framework/db-loader/pom.xml | 2 +- code/framework/deferred/pom.xml | 2 +- code/framework/encryption/pom.xml | 2 +- code/framework/engine/pom.xml | 2 +- code/framework/eventing/pom.xml | 2 +- code/framework/events/pom.xml | 2 +- code/framework/extension-spring/pom.xml | 2 +- code/framework/extension/pom.xml | 2 +- code/framework/java-server/pom.xml | 2 +- code/framework/jmx/pom.xml | 2 +- code/framework/jooq/pom.xml | 2 +- code/framework/json/pom.xml | 2 +- code/framework/launcher/pom.xml | 2 +- code/framework/lock/pom.xml | 2 +- code/framework/logback/pom.xml | 2 +- code/framework/managed-context/pom.xml | 2 +- code/framework/metrics/pom.xml | 2 +- code/framework/module/pom.xml | 2 +- code/framework/object/pom.xml | 2 +- code/framework/pool/pom.xml | 2 +- code/framework/resource-monitor/pom.xml | 2 +- code/framework/schema/pom.xml | 2 +- code/framework/server/pom.xml | 2 +- code/framework/spring/pom.xml | 2 +- code/framework/system-task/pom.xml | 2 +- code/framework/token/pom.xml | 2 +- code/framework/utils/pom.xml | 2 +- code/iaas/agent-instance/pom.xml | 2 +- code/iaas/agent-server/pom.xml | 2 +- code/iaas/agent/pom.xml | 2 +- code/iaas/allocator/pom.xml | 2 +- code/iaas/api-logic/pom.xml | 2 +- code/iaas/archaius-management/pom.xml | 2 +- code/iaas/auth-logic/pom.xml | 2 +- code/iaas/bootstrap/pom.xml | 2 +- code/iaas/config-item/api/pom.xml | 2 +- code/iaas/config-item/common/pom.xml | 2 +- code/iaas/config-item/server/pom.xml | 2 +- code/iaas/engine-jooq/pom.xml | 2 +- code/iaas/events/pom.xml | 2 +- code/iaas/external-handler/pom.xml | 2 +- code/iaas/ha/pom.xml | 2 +- code/iaas/healthcheck/pom.xml | 2 +- code/iaas/labels/pom.xml | 2 +- code/iaas/logic-common/pom.xml | 2 +- code/iaas/logic/pom.xml | 2 +- code/iaas/metadata/pom.xml | 2 +- code/iaas/model/pom.xml | 2 +- code/iaas/resource-pool/pom.xml | 2 +- code/iaas/service-discovery/api/pom.xml | 2 +- code/iaas/service-discovery/server/pom.xml | 2 +- code/iaas/ssh-common/pom.xml | 2 +- code/iaas/storage-service/pom.xml | 2 +- code/iaas/task-jooq/pom.xml | 2 +- code/implementation/activity-log/pom.xml | 2 +- .../agent-instance-impl/pom.xml | 2 +- code/implementation/docker/api/pom.xml | 2 +- code/implementation/docker/common/pom.xml | 2 +- code/implementation/docker/compute/pom.xml | 2 +- code/implementation/docker/machine/pom.xml | 2 +- code/implementation/docker/storage/pom.xml | 6 +- code/implementation/extension-api/pom.xml | 2 +- code/implementation/hazelcast/common/pom.xml | 2 +- .../implementation/hazelcast/eventing/pom.xml | 2 +- code/implementation/hazelcast/lock/pom.xml | 2 +- code/implementation/host-api/pom.xml | 2 +- code/implementation/host-stats/pom.xml | 2 +- code/implementation/register/pom.xml | 2 +- code/implementation/sample-setup/pom.xml | 2 +- code/implementation/settings-api/pom.xml | 2 +- .../simulator/agent-connection/pom.xml | 2 +- code/implementation/simulator/storage/pom.xml | 2 +- code/implementation/system-stack/pom.xml | 2 +- code/implementation/vm/pom.xml | 2 +- code/meta-parent/pom.xml | 4 +- code/packaging/app-config/pom.xml | 2 +- code/packaging/app/pom.xml | 2 +- code/packaging/bundle/pom.xml | 2 +- .../platform/packaging/SafePathsTest.java | 2 +- code/packaging/dev/pom.xml | 2 +- code/packaging/meta/pom.xml | 2 +- code/parent/pom.xml | 2 +- pom.xml | 2 +- resources/pom.xml | 2 +- scripts/build | 2 +- scripts/check-cattle-dependency-hygiene | 14 +- scripts/check-pasturestack-source | 34 ++--- scripts/check-release-artifact | 2 +- scripts/install-patched-hazelcast | 134 ++++++------------ third-party/HAZELCAST.md | 30 ++-- .../hazelcast-5.7.0-archive-build.patch | 11 -- .../hazelcast-5.7.0-jackson-security.patch | 15 -- 101 files changed, 177 insertions(+), 261 deletions(-) delete mode 100644 third-party/hazelcast-5.7.0-archive-build.patch delete mode 100644 third-party/hazelcast-5.7.0-jackson-security.patch diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index c16c3bb669..0a64713c92 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -31,7 +31,7 @@ jobs: test -z "$(git status --porcelain)" git merge-base --is-ancestor origin/main HEAD test "$(git rev-list --count origin/main..HEAD)" -eq 1 - grep -Fxq ' 0.183.285' code/meta-parent/pom.xml + grep -Fxq ' 0.183.286' code/meta-parent/pom.xml - name: Initialize CodeQL uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 247678e4a5..0276918fc2 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -169,7 +169,9 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: orchestration-engine-security-${{ github.sha }} - path: evidence/ + path: | + dist/artifacts/cattle.jar + evidence/ if-no-files-found: error retention-days: 30 diff --git a/README.md b/README.md index cc2ab7d20d..790ab5e321 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status -This source tree produces engine version `0.183.285`. It retains the existing Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and runtime-hardening work from the maintained compatibility line. Release builds also compile a pinned Hazelcast `5.7.0` source revision as the numeric local artifact `5.7.2`, with the tracked Jackson security patch described in [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md); the patched artifact is never downloaded from an unverified binary source. +This source tree produces engine version `0.183.286`. It retains the existing Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and runtime-hardening work from the maintained compatibility line. Release builds consume the exact `5.7.3-pasturestack.4` runtime JAR published by [`distributed-cache-runtime`](https://github.com/PastureStack/distributed-cache-runtime/releases/tag/v5.7.3-pasturestack.4), verify its pinned SHA-256 and embedded dependency metadata, and install it only into the build-local Maven repository. Provenance and scope are documented in [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md). WebAuthn verification uses WebAuthn4J's maintained `tools.jackson` 3.2 dependency line. The existing platform JSON surface remains on @@ -56,7 +56,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK To create the complete release archive after the gate passes: ```sh -ENGINE_VERSION=0.183.285 bash scripts/build --release +ENGINE_VERSION=0.183.286 bash scripts/build --release bash scripts/check-release-artifact dist/artifacts/cattle.jar ``` diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml index f735f2d13d..6bcc731645 100644 --- a/code/framework/api-pub-sub-jetty/pom.xml +++ b/code/framework/api-pub-sub-jetty/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml index f4b8eb21ca..5440fdfd15 100644 --- a/code/framework/api-pub-sub/pom.xml +++ b/code/framework/api-pub-sub/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml index a9c51d13ea..f89f351f35 100644 --- a/code/framework/api/pom.xml +++ b/code/framework/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml index fde69e5dad..00e3404167 100644 --- a/code/framework/archaius/pom.xml +++ b/code/framework/archaius/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.285 + 0.183.286 ../../meta-parent/pom.xml diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml index 2490a14b4a..dc654902ec 100644 --- a/code/framework/async/pom.xml +++ b/code/framework/async/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml index dd866296e9..ff74c83737 100644 --- a/code/framework/auditing/pom.xml +++ b/code/framework/auditing/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml index dff42c1ee0..384abac5c5 100644 --- a/code/framework/db-loader/pom.xml +++ b/code/framework/db-loader/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml index d1c8abad35..058b0d6700 100644 --- a/code/framework/deferred/pom.xml +++ b/code/framework/deferred/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml index 7e5ae96044..95e6919f6f 100644 --- a/code/framework/encryption/pom.xml +++ b/code/framework/encryption/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml index 0aa1388798..098981a54e 100644 --- a/code/framework/engine/pom.xml +++ b/code/framework/engine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml index 33ed00a3a1..4d5ae64296 100644 --- a/code/framework/eventing/pom.xml +++ b/code/framework/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml index 31d1244c84..adc8fcd1da 100644 --- a/code/framework/events/pom.xml +++ b/code/framework/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml index 2d9844c549..f8fb576807 100644 --- a/code/framework/extension-spring/pom.xml +++ b/code/framework/extension-spring/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml index 562cebb39e..10d7ab282f 100644 --- a/code/framework/extension/pom.xml +++ b/code/framework/extension/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml index 59cf0834a1..786093228c 100644 --- a/code/framework/java-server/pom.xml +++ b/code/framework/java-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml index 0e51279aca..b2ae3399a2 100644 --- a/code/framework/jmx/pom.xml +++ b/code/framework/jmx/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml index 21c1a2c4dc..e14975a4bf 100644 --- a/code/framework/jooq/pom.xml +++ b/code/framework/jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml index 739b538830..bf887fa71a 100644 --- a/code/framework/json/pom.xml +++ b/code/framework/json/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml index 598effc21e..bfc50e34f3 100644 --- a/code/framework/launcher/pom.xml +++ b/code/framework/launcher/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml index 39cf4d4423..a43badd47e 100644 --- a/code/framework/lock/pom.xml +++ b/code/framework/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml index d1b7774ff6..1ad63eb376 100644 --- a/code/framework/logback/pom.xml +++ b/code/framework/logback/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.285 + 0.183.286 ../../meta-parent/pom.xml diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml index 907058181e..23b9c68742 100644 --- a/code/framework/managed-context/pom.xml +++ b/code/framework/managed-context/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml index f85b2966e3..c8ba4d3876 100644 --- a/code/framework/metrics/pom.xml +++ b/code/framework/metrics/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml index da91863d75..0abc3b4307 100644 --- a/code/framework/module/pom.xml +++ b/code/framework/module/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml index 7df6022a84..ef516d74ce 100644 --- a/code/framework/object/pom.xml +++ b/code/framework/object/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml index a4897b9612..9b7a1b05b1 100644 --- a/code/framework/pool/pom.xml +++ b/code/framework/pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml index 2c93e54bd3..65b0c734d1 100644 --- a/code/framework/resource-monitor/pom.xml +++ b/code/framework/resource-monitor/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml index 82ea33d3d0..09dd670867 100644 --- a/code/framework/schema/pom.xml +++ b/code/framework/schema/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml index c5e37588de..fb4e94d79d 100644 --- a/code/framework/server/pom.xml +++ b/code/framework/server/pom.xml @@ -4,7 +4,7 @@ cattle-meta-parent io.cattle - 0.183.285 + 0.183.286 ../../meta-parent/pom.xml diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml index 4d6b3de9b8..c0380155fe 100644 --- a/code/framework/spring/pom.xml +++ b/code/framework/spring/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml index a8ba4fde8d..2b67e5ccdb 100644 --- a/code/framework/system-task/pom.xml +++ b/code/framework/system-task/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml index 92240a30d1..73b1df1478 100644 --- a/code/framework/token/pom.xml +++ b/code/framework/token/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml index 4606b20732..d3acdfc0c4 100644 --- a/code/framework/utils/pom.xml +++ b/code/framework/utils/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml index 3534796a11..d480b7ae4f 100644 --- a/code/iaas/agent-instance/pom.xml +++ b/code/iaas/agent-instance/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml index 4f893263d8..4cc369ce5d 100644 --- a/code/iaas/agent-server/pom.xml +++ b/code/iaas/agent-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml index 9cf31848b2..33f27ee619 100644 --- a/code/iaas/agent/pom.xml +++ b/code/iaas/agent/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml index 4a6770a2ea..deafbb403c 100644 --- a/code/iaas/allocator/pom.xml +++ b/code/iaas/allocator/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml index 4e34be6afd..f0d477bd87 100644 --- a/code/iaas/api-logic/pom.xml +++ b/code/iaas/api-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml index 706826d34d..5e412f1c4a 100644 --- a/code/iaas/archaius-management/pom.xml +++ b/code/iaas/archaius-management/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml index e484416ab2..ae871174c4 100644 --- a/code/iaas/auth-logic/pom.xml +++ b/code/iaas/auth-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml index 81f26f0d34..ee649a8afe 100644 --- a/code/iaas/bootstrap/pom.xml +++ b/code/iaas/bootstrap/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml index 88e8922464..6857df6435 100644 --- a/code/iaas/config-item/api/pom.xml +++ b/code/iaas/config-item/api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml index 0ed1c1ab6c..c325f2f43d 100644 --- a/code/iaas/config-item/common/pom.xml +++ b/code/iaas/config-item/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml index eaf8fb28b0..e53b070d06 100644 --- a/code/iaas/config-item/server/pom.xml +++ b/code/iaas/config-item/server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml index 5ad404ce5c..c9e7eb552f 100644 --- a/code/iaas/engine-jooq/pom.xml +++ b/code/iaas/engine-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml index b952b1b150..8272f891a5 100644 --- a/code/iaas/events/pom.xml +++ b/code/iaas/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml index 32ff83a043..4298cc0de8 100644 --- a/code/iaas/external-handler/pom.xml +++ b/code/iaas/external-handler/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml index 1a03d1e3d5..d16c3a3d5a 100644 --- a/code/iaas/ha/pom.xml +++ b/code/iaas/ha/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml index 846d8f8967..665964c2fb 100644 --- a/code/iaas/healthcheck/pom.xml +++ b/code/iaas/healthcheck/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml index 7df7e0c878..ac78ee2587 100644 --- a/code/iaas/labels/pom.xml +++ b/code/iaas/labels/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml index ba019e8169..70656dded2 100644 --- a/code/iaas/logic-common/pom.xml +++ b/code/iaas/logic-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml index 20db002708..f892064350 100644 --- a/code/iaas/logic/pom.xml +++ b/code/iaas/logic/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml index b3a1cf0f1c..8b2c845d75 100644 --- a/code/iaas/metadata/pom.xml +++ b/code/iaas/metadata/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml index f647bf46c0..cd0321de56 100644 --- a/code/iaas/model/pom.xml +++ b/code/iaas/model/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml index 5e78690756..60e71ca084 100644 --- a/code/iaas/resource-pool/pom.xml +++ b/code/iaas/resource-pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml index b0458d156b..417578f14a 100644 --- a/code/iaas/service-discovery/api/pom.xml +++ b/code/iaas/service-discovery/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml index ea45ed3c20..017e1b0ef0 100644 --- a/code/iaas/service-discovery/server/pom.xml +++ b/code/iaas/service-discovery/server/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml index 4d653cb707..937ae5a0e3 100644 --- a/code/iaas/ssh-common/pom.xml +++ b/code/iaas/ssh-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml index 438a02349c..062307f5f7 100644 --- a/code/iaas/storage-service/pom.xml +++ b/code/iaas/storage-service/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml index 6f2992bed4..fdb34716df 100644 --- a/code/iaas/task-jooq/pom.xml +++ b/code/iaas/task-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml index b7fbd4b98a..652e105157 100644 --- a/code/implementation/activity-log/pom.xml +++ b/code/implementation/activity-log/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml index cd7a8a53a2..95e3524bf5 100644 --- a/code/implementation/agent-instance-impl/pom.xml +++ b/code/implementation/agent-instance-impl/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml cattle-agent-instance-impl diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml index cf2bd7ee49..880faa92ee 100644 --- a/code/implementation/docker/api/pom.xml +++ b/code/implementation/docker/api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml index 7cfa110c2e..0a4945a923 100644 --- a/code/implementation/docker/common/pom.xml +++ b/code/implementation/docker/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml index b4a29d5101..4892927cbb 100644 --- a/code/implementation/docker/compute/pom.xml +++ b/code/implementation/docker/compute/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml index 6e8efaaa9b..1b6f5b1165 100644 --- a/code/implementation/docker/machine/pom.xml +++ b/code/implementation/docker/machine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml index afdc5f9c33..01cb24145f 100644 --- a/code/implementation/docker/storage/pom.xml +++ b/code/implementation/docker/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml @@ -21,12 +21,12 @@ io.cattle cattle-docker-common - 0.183.285 + 0.183.286 io.cattle cattle-iaas-allocator - 0.183.285 + 0.183.286 diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml index cc61926833..72de0f3630 100644 --- a/code/implementation/extension-api/pom.xml +++ b/code/implementation/extension-api/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml cattle-extension-api diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml index 26dd65e94b..b981a52ae4 100644 --- a/code/implementation/hazelcast/common/pom.xml +++ b/code/implementation/hazelcast/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml index 54379f3c9e..e01e235a3f 100644 --- a/code/implementation/hazelcast/eventing/pom.xml +++ b/code/implementation/hazelcast/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml index 2da908af9b..faff79ca7f 100644 --- a/code/implementation/hazelcast/lock/pom.xml +++ b/code/implementation/hazelcast/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml index 2752a11f69..ee02e8b765 100644 --- a/code/implementation/host-api/pom.xml +++ b/code/implementation/host-api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml index 2d210f80da..f29970ff05 100644 --- a/code/implementation/host-stats/pom.xml +++ b/code/implementation/host-stats/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml index 1a1daca89b..30dd584973 100644 --- a/code/implementation/register/pom.xml +++ b/code/implementation/register/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml index 29072360e0..5518d854e1 100644 --- a/code/implementation/sample-setup/pom.xml +++ b/code/implementation/sample-setup/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml index 2177e6c509..b71f2a42d3 100644 --- a/code/implementation/settings-api/pom.xml +++ b/code/implementation/settings-api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml index 1fa09d4b06..72282ae872 100644 --- a/code/implementation/simulator/agent-connection/pom.xml +++ b/code/implementation/simulator/agent-connection/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml index 6477d5786f..20f842ac50 100644 --- a/code/implementation/simulator/storage/pom.xml +++ b/code/implementation/simulator/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../../parent/pom.xml diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml index fc39c57950..fc2acfa61a 100644 --- a/code/implementation/system-stack/pom.xml +++ b/code/implementation/system-stack/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml index 70194688ac..3f2739dc33 100644 --- a/code/implementation/vm/pom.xml +++ b/code/implementation/vm/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml cattle-vm diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml index 911b4bc758..e0e6539ac6 100644 --- a/code/meta-parent/pom.xml +++ b/code/meta-parent/pom.xml @@ -9,7 +9,7 @@ 4.0.0 io.cattle cattle-meta-parent - 0.183.285 + 0.183.286 pom PastureStack Orchestration Engine Compatibility orchestration engine for the PastureStack server. @@ -47,7 +47,7 @@ 2.22 7.0.9 4.2.39 - 5.7.2 + 5.7.3-pasturestack.4 3.33.0-GA 3.7.1 1.6.3 diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml index caeef03378..a775a3abe2 100644 --- a/code/packaging/app-config/pom.xml +++ b/code/packaging/app-config/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml jar diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml index 2abdddb78f..7ec326efca 100644 --- a/code/packaging/app/pom.xml +++ b/code/packaging/app/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml war diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml index f975a3ee56..4698ac8ba3 100644 --- a/code/packaging/bundle/pom.xml +++ b/code/packaging/bundle/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/packaging/bundle/src/test/java/io/cattle/platform/packaging/SafePathsTest.java b/code/packaging/bundle/src/test/java/io/cattle/platform/packaging/SafePathsTest.java index a097d38695..312f827a56 100644 --- a/code/packaging/bundle/src/test/java/io/cattle/platform/packaging/SafePathsTest.java +++ b/code/packaging/bundle/src/test/java/io/cattle/platform/packaging/SafePathsTest.java @@ -63,7 +63,7 @@ public void rejectsRootResourcePrefixCollision() throws Exception { @Test public void acceptsNumericMaintenanceVersion() throws Exception { - assertEquals("0.183.285", SafePaths.version("0.183.285")); + assertEquals("0.183.286", SafePaths.version("0.183.286")); } @Test diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml index e1109c6ea4..d3f9ff766a 100644 --- a/code/packaging/dev/pom.xml +++ b/code/packaging/dev/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml index 3307e686fb..99d56e523b 100644 --- a/code/packaging/meta/pom.xml +++ b/code/packaging/meta/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../../parent/pom.xml diff --git a/code/parent/pom.xml b/code/parent/pom.xml index 3e61195482..91085105cb 100644 --- a/code/parent/pom.xml +++ b/code/parent/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-meta-parent ../meta-parent/pom.xml - 0.183.285 + 0.183.286 pom diff --git a/pom.xml b/pom.xml index 75b3fd1390..3d3c09dd38 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ io.cattle cattle-parent - 0.183.285 + 0.183.286 code/parent/pom.xml cattle diff --git a/resources/pom.xml b/resources/pom.xml index 47e0cb9b9d..2b3b3b713d 100644 --- a/resources/pom.xml +++ b/resources/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.285 + 0.183.286 ../code/parent/pom.xml diff --git a/scripts/build b/scripts/build index 55aab65deb..57705d1973 100755 --- a/scripts/build +++ b/scripts/build @@ -16,7 +16,7 @@ fi SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)} SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} -ENGINE_VERSION=${ENGINE_VERSION:-0.183.285} +ENGINE_VERSION=${ENGINE_VERSION:-0.183.286} case "$SOURCE_REVISION" in ''|*[!0-9a-f]*) diff --git a/scripts/check-cattle-dependency-hygiene b/scripts/check-cattle-dependency-hygiene index cdab230fed..8136e4e6b2 100755 --- a/scripts/check-cattle-dependency-hygiene +++ b/scripts/check-cattle-dependency-hygiene @@ -6681,8 +6681,8 @@ import xml.etree.ElementTree as ET from pathlib import Path NS = {"m": "http://maven.apache.org/POM/4.0.0"} -FLOOR = (5, 7, 0) -FLOOR_TEXT = "5.7.0" +FLOOR = (5, 7, 3) +FLOOR_TEXT = "5.7.3" UNREVIEWED_QUALIFIER = re.compile(r"(?:^|[.-])(alpha|beta|snapshot|rc|b\d+|m\d+|mr|milestone)(?:[.-]|\d|$)", re.IGNORECASE) def local_name(tag): @@ -6756,7 +6756,7 @@ sys.exit(0) PY ) if [ -n "$hazelcast_floor_dependencies" ]; then - echo "Blocked Hazelcast dependency outside reviewed stable floor found in Maven POMs; keep com.hazelcast:hazelcast 5.7.0+ on the reviewed 5.7.x Java 25 line without unreviewed qualifiers" >&2 + echo "Blocked Hazelcast dependency outside reviewed stable floor found in Maven POMs; keep com.hazelcast:hazelcast 5.7.3+ on the reviewed 5.7.x Java 25 line without unreviewed qualifiers" >&2 echo "$hazelcast_floor_dependencies" >&2 fail=1 fi @@ -6767,8 +6767,8 @@ import re import sys from pathlib import Path -FLOOR = (5, 7, 0) -FLOOR_TEXT = "5.7.0" +FLOOR = (5, 7, 3) +FLOOR_TEXT = "5.7.3" UNREVIEWED_QUALIFIER = re.compile(r"(?:^|[.-])(alpha|beta|snapshot|rc|b\d+|m\d+|mr|milestone)(?:[.-]|\d|$)", re.IGNORECASE) root = Path("code/packaging/app/target") failures = [] @@ -6797,7 +6797,7 @@ sys.exit(0) PY ) if [ -n "$hazelcast_floor_jars" ]; then - echo "Blocked Hazelcast jar outside reviewed stable floor packaged in app; keep com.hazelcast:hazelcast 5.7.0+ on the reviewed 5.7.x Java 25 line without unreviewed qualifiers" >&2 + echo "Blocked Hazelcast jar outside reviewed stable floor packaged in app; keep com.hazelcast:hazelcast 5.7.3+ on the reviewed 5.7.x Java 25 line without unreviewed qualifiers" >&2 echo "$hazelcast_floor_jars" >&2 fail=1 fi @@ -6817,7 +6817,7 @@ echo "- Jakarta Servlet API stays provided/test scoped and cannot leak into pack echo "Resolved in the Docker client compatibility slice:" echo "- docker-java artifacts stay on reviewed stable 3.7.x at 3.7.1+; unreviewed qualifiers require explicit Docker API compatibility review, and old Java EE transitives remain excluded by the Jakarta boundary." echo "Resolved in the Hazelcast Java 25 compatibility slice:" -echo "- Hazelcast core stays on reviewed stable 5.7.x at 5.7.0+; unreviewed qualifiers require explicit clustering/SPI compatibility review, and retired hazelcast-client metadata and packaged jars are blocked." +echo "- Hazelcast core stays on reviewed stable 5.7.x at 5.7.3+; unreviewed qualifiers require explicit clustering/SPI compatibility review, and retired hazelcast-client metadata and packaged jars are blocked." echo "Resolved in the JAX-RS runtime compatibility slice:" echo "- Legacy Jersey 1.x com.sun.jersey dependencies, imports, and packaged jars are blocked; maintained Jakarta REST/JDK client paths own REST integration." echo "Resolved in the HTTP client compatibility slice:" diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source index 80834b0efb..4a56be0b2c 100755 --- a/scripts/check-pasturestack-source +++ b/scripts/check-pasturestack-source @@ -41,7 +41,7 @@ fi project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1) [[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version -require_line code/meta-parent/pom.xml ' 0.183.285' +require_line code/meta-parent/pom.xml ' 0.183.286' require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine' require_line Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b' require_line Dockerfile.dapper 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b' @@ -97,7 +97,7 @@ fi require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'supported.docker.range=~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || v29.4.1 || v29.7.2' require_line code/packaging/app-config/src/main/resources/META-INF/cattle/api-server/defaults.properties 'newest.docker.version=v29.7.2' require_line code/meta-parent/pom.xml ' 2.22.2' -require_line code/meta-parent/pom.xml ' 5.7.2' +require_line code/meta-parent/pom.xml ' 5.7.3-pasturestack.4' require_line code/meta-parent/pom.xml ' 12.1.12' require_line code/meta-parent/pom.xml ' 3.21.7' require_line code/meta-parent/pom.xml ' 3.33.0-GA' @@ -133,22 +133,18 @@ require_line scripts/build ' MAVEN_ARGS="$MAVEN_ARGS" SOURCE_DATE_EPOCH="$SOU require_line scripts/build ' scripts/install-patched-hazelcast "$maven_cmd"' require_line scripts/build ' PATH="${JAVA_HOME}/bin:${PATH}"' require_line scripts/build ' export PATH' -require_line scripts/install-patched-hazelcast 'upstream_commit=60c31e3750cbad64f5720e2e02f0a9830973193c' -require_line scripts/install-patched-hazelcast 'source_sha256=e44d7ebeb6400309a7b672f2190180925f81cdbedab44f2247cd266d03f4fa88' -require_line scripts/install-patched-hazelcast 'patched_version=5.7.2' -require_line scripts/install-patched-hazelcast 'jackson3_version=3.2.1' -require_line scripts/install-patched-hazelcast 'jackson2_version=2.22.1' -require_line scripts/install-patched-hazelcast ' -Dassembly.skipAssembly=true \' -require_line scripts/install-patched-hazelcast ' -Dmaven.test.skip=true \' -require_line scripts/install-patched-hazelcast ' -DskipTests \' -require_line scripts/install-patched-hazelcast 'jar --create --file "$canonical_jar" --no-manifest --date="$canonical_date" \' -require_line scripts/install-patched-hazelcast 'GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace --check "$patch_file"' -require_line scripts/install-patched-hazelcast 'GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace "$patch_file"' -require_line scripts/install-patched-hazelcast 'archive_build_patch_file="$repo_root/third-party/hazelcast-5.7.0-archive-build.patch"' -require_line scripts/install-patched-hazelcast 'GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace --check "$archive_build_patch_file"' -require_line scripts/install-patched-hazelcast 'GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace "$archive_build_patch_file"' -require_line third-party/hazelcast-5.7.0-jackson-security.patch '+ 3.2.1' -require_line third-party/hazelcast-5.7.0-jackson-security.patch '+ 2.22.1' +require_line scripts/install-patched-hazelcast 'runtime_version=5.7.3-pasturestack.4' +require_line scripts/install-patched-hazelcast 'release_tag=v5.7.3-pasturestack.4' +require_line scripts/install-patched-hazelcast 'release_commit=daab0b34f0fce46e5be79c56e80dab769183aa83' +require_line scripts/install-patched-hazelcast 'release_sha256=9fa751998ce3cc1f17692e21933b24646c39a7142ca387af772e43f49dc77764' +require_line scripts/install-patched-hazelcast 'jackson3_version=3.2.2' +require_line scripts/install-patched-hazelcast 'jackson2_version=2.22.2' +require_line scripts/install-patched-hazelcast 'release_url="https://github.com/PastureStack/distributed-cache-runtime/releases/download/${release_tag}/hazelcast-${runtime_version}.jar"' +require_line scripts/install-patched-hazelcast 'curl --proto '\''=https'\'' --tlsv1.2 --fail --silent --show-error --location \' +require_line scripts/install-patched-hazelcast 'printf '\''%s %s\n'\'' "$release_sha256" "$runtime_jar" | sha256sum -c -' +require_line scripts/install-patched-hazelcast '"$maven_cmd" ${MAVEN_ARGS:-} org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file \' +test ! -e third-party/hazelcast-5.7.0-jackson-security.patch || fail obsolete_hazelcast_patch_present +test ! -e third-party/hazelcast-5.7.0-archive-build.patch || fail obsolete_hazelcast_patch_present require_line code/implementation/docker/machine/src/main/java/io/cattle/platform/docker/machine/launch/CatalogLauncher.java ' String pinnedCommit;' require_line code/implementation/docker/machine/src/main/java/io/cattle/platform/docker/machine/launch/CatalogLauncher.java ' public String getPinnedCommit() {' require_line code/implementation/docker/machine/src/test/java/io/cattle/platform/docker/machine/launch/CatalogLauncherSettingsTest.java ' assertEquals(pinnedCommit, fields.getCatalogs().get("library").getPinnedCommit());' @@ -304,4 +300,4 @@ fi require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.' require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`' -printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.285 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.2 docker=29.7.2 credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=authoritative volume_preflight_project_schema=authorized volume_preflight_type_set=registered\n' +printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.286 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.3-pasturestack.4 docker=29.7.2 credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=authoritative volume_preflight_project_schema=authorized volume_preflight_type_set=registered\n' diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact index 4c2473acdd..55b05d9962 100755 --- a/scripts/check-release-artifact +++ b/scripts/check-release-artifact @@ -4,7 +4,7 @@ set -euo pipefail cd "$(dirname "$0")/.." artifact=${1:-dist/artifacts/cattle.jar} -expected_version=${EXPECTED_ENGINE_VERSION:-0.183.285} +expected_version=${EXPECTED_ENGINE_VERSION:-0.183.286} test -f "$artifact" artifact=$(realpath "$artifact") diff --git a/scripts/install-patched-hazelcast b/scripts/install-patched-hazelcast index 2d9eb63122..71068ecb79 100755 --- a/scripts/install-patched-hazelcast +++ b/scripts/install-patched-hazelcast @@ -5,23 +5,14 @@ repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd) cd "$repo_root" maven_cmd=${1:-mvn} -hazelcast_version=5.7.0 -patched_version=5.7.2 -upstream_commit=60c31e3750cbad64f5720e2e02f0a9830973193c -source_sha256=e44d7ebeb6400309a7b672f2190180925f81cdbedab44f2247cd266d03f4fa88 -jackson3_version=3.2.1 -jackson2_version=2.22.1 -source_date_epoch=${SOURCE_DATE_EPOCH:-} -patch_file="$repo_root/third-party/hazelcast-5.7.0-jackson-security.patch" -archive_build_patch_file="$repo_root/third-party/hazelcast-5.7.0-archive-build.patch" -work_root="$repo_root/target/third-party/hazelcast-${patched_version}" - -case "$source_date_epoch" in - ''|*[!0-9]*) - echo "SOURCE_DATE_EPOCH must be an integer" >&2 - exit 1 - ;; -esac +runtime_version=5.7.3-pasturestack.4 +release_tag=v5.7.3-pasturestack.4 +release_commit=daab0b34f0fce46e5be79c56e80dab769183aa83 +release_sha256=9fa751998ce3cc1f17692e21933b24646c39a7142ca387af772e43f49dc77764 +jackson3_version=3.2.2 +jackson2_version=2.22.2 +release_url="https://github.com/PastureStack/distributed-cache-runtime/releases/download/${release_tag}/hazelcast-${runtime_version}.jar" +work_root="$repo_root/target/third-party/hazelcast-${runtime_version}" case "$work_root" in "$repo_root"/target/third-party/*) ;; @@ -32,93 +23,54 @@ case "$work_root" in esac rm -rf "$work_root" -mkdir -p "$work_root/source" - -source_archive="$work_root/source.tar.gz" -source_url="https://codeload.github.com/hazelcast/hazelcast/tar.gz/${upstream_commit}" -curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 600 \ - -o "$source_archive" "$source_url" -echo "${source_sha256} ${source_archive}" | sha256sum -c - - -if tar -tzf "$source_archive" | grep -E '(^/|(^|/)\.\.(/|$))' >/dev/null; then - echo "Unsafe Hazelcast source archive" >&2 - exit 1 -fi -tar -xzf "$source_archive" -C "$work_root/source" --strip-components=1 - -GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace --check "$patch_file" -GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace "$patch_file" -GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace --check "$archive_build_patch_file" -GIT_CEILING_DIRECTORIES="$work_root" git -C "$work_root/source" apply --ignore-whitespace "$archive_build_patch_file" -tr -d '\r' <"$work_root/source/hazelcast-parent/pom.xml" \ - | grep -Fx " ${jackson3_version}" >/dev/null -tr -d '\r' <"$work_root/source/hazelcast-parent/pom.xml" \ - | grep -Fx " ${jackson2_version}" >/dev/null -grep -A12 -F 'git-commit-id-plugin' \ - "$work_root/source/hazelcast/pom.xml" | grep -F 'true' >/dev/null +mkdir -p "$work_root/metadata" -"$maven_cmd" -f "$work_root/source/pom.xml" \ - ${MAVEN_ARGS:-} \ - -Dassembly.skipAssembly=true \ - -Dmaven.compiler.failOnWarning=false \ - -Dmaven.test.skip=true \ - -DskipTests \ - -DskipITs \ - -Dcheckstyle.skip=true \ - -Dskip.public.api.check=true \ - -pl hazelcast -am package +runtime_jar="$work_root/hazelcast-${runtime_version}.jar" +curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ + --retry 5 --retry-all-errors --retry-delay 2 --connect-timeout 10 --max-time 600 \ + --output "$runtime_jar" "$release_url" +printf '%s %s\n' "$release_sha256" "$runtime_jar" | sha256sum -c - -patched_jar="$work_root/source/hazelcast/target/hazelcast-${hazelcast_version}.jar" -test -s "$patched_jar" -if jar -tf "$patched_jar" | grep -E '(^/|(^|/)\.\.(/|$))' >/dev/null; then +if jar -tf "$runtime_jar" | grep -E '(^/|(^|/)\.\.(/|$))' >/dev/null; then echo "Unsafe Hazelcast JAR member" >&2 exit 1 fi -canonical_root="$work_root/canonical" -canonical_jar="$work_root/hazelcast-${hazelcast_version}-canonical.jar" -canonical_date=$(date -u -d "@${source_date_epoch}" '+%Y-%m-%dT%H:%M:%SZ') -mkdir -p "$canonical_root" -( - cd "$canonical_root" - jar -xf "$patched_jar" -) -jar --create --file "$canonical_jar" --no-manifest --date="$canonical_date" \ - -C "$canonical_root" . -test -s "$canonical_jar" -mv "$canonical_jar" "$patched_jar" -rm -rf "$canonical_root" +jar -tf "$runtime_jar" | grep -Fxq META-INF/LICENSE +jar -tf "$runtime_jar" | grep -Fxq META-INF/NOTICE -embedded_root="$work_root/embedded" -mkdir -p "$embedded_root" ( - cd "$embedded_root" - jar -xf "$patched_jar" META-INF/maven/com.hazelcast/hazelcast/pom.xml + cd "$work_root/metadata" + jar -xf "$runtime_jar" \ + META-INF/maven/com.hazelcast/hazelcast/pom.properties \ + META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties \ + META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.properties \ + META-INF/maven/tools.jackson.core/jackson-core/pom.properties \ + META-INF/maven/tools.jackson.core/jackson-databind/pom.properties ) -embedded_pom="$embedded_root/META-INF/maven/com.hazelcast/hazelcast/pom.xml" -test -s "$embedded_pom" -grep -A2 -F 'jackson-core' "$embedded_pom" \ - | grep -F "${jackson3_version}" >/dev/null -grep -A2 -F 'jackson-databind' "$embedded_pom" \ - | grep -F "${jackson3_version}" >/dev/null -grep -A2 -F 'jackson-core' "$embedded_pom" \ - | grep -F "${jackson2_version}" >/dev/null -grep -A2 -F 'jackson-databind' "$embedded_pom" \ - | grep -F "${jackson2_version}" >/dev/null -if grep -Eq '(3\.1\.2|3\.1\.5|2\.21\.2|2\.21\.5)' "$embedded_pom"; then - echo "Hazelcast still contains superseded Jackson coordinates" >&2 - exit 1 -fi +metadata_root="$work_root/metadata/META-INF/maven" +test "$(sed -n 's/^version=//p' "$metadata_root/com.hazelcast/hazelcast/pom.properties")" = "$runtime_version" +test "$(sed -n 's/^version=//p' "$metadata_root/com.fasterxml.jackson.core/jackson-core/pom.properties")" = "$jackson2_version" +test "$(sed -n 's/^version=//p' "$metadata_root/com.fasterxml.jackson.core/jackson-databind/pom.properties")" = "$jackson2_version" +test "$(sed -n 's/^version=//p' "$metadata_root/tools.jackson.core/jackson-core/pom.properties")" = "$jackson3_version" +test "$(sed -n 's/^version=//p' "$metadata_root/tools.jackson.core/jackson-databind/pom.properties")" = "$jackson3_version" + +javap -classpath "$runtime_jar" -constants com.hazelcast.instance.GeneratedBuildProperties \ + > "$work_root/generated-build-properties.txt" +grep -Fq 'VERSION = "5.7.3";' "$work_root/generated-build-properties.txt" +grep -Fq "REVISION = \"${release_commit:0:7}\";" "$work_root/generated-build-properties.txt" +grep -Fq "COMMIT_ID = \"${release_commit}\";" "$work_root/generated-build-properties.txt" "$maven_cmd" ${MAVEN_ARGS:-} org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file \ - -Dfile="$patched_jar" \ + -Dfile="$runtime_jar" \ -DgroupId=com.hazelcast \ -DartifactId=hazelcast \ - -Dversion="$patched_version" \ + -Dversion="$runtime_version" \ -Dpackaging=jar \ -DgeneratePom=true mkdir -p "$repo_root/dist/evidence" -sha256sum "$patched_jar" >"$repo_root/dist/evidence/hazelcast-${patched_version}.jar.sha256" -printf 'PATCHED_HAZELCAST_OK upstream=%s commit=%s version=%s jackson3=%s jackson2=%s sha256=%s\n' \ - "$hazelcast_version" "$upstream_commit" "$patched_version" "$jackson3_version" "$jackson2_version" \ - "$(sha256sum "$patched_jar" | awk '{print $1}')" +printf '%s hazelcast-%s.jar\n' "$release_sha256" "$runtime_version" \ + > "$repo_root/dist/evidence/hazelcast-${runtime_version}.jar.sha256" +printf 'PATCHED_HAZELCAST_OK source=%s tag=%s commit=%s version=%s jackson3=%s jackson2=%s sha256=%s\n' \ + 'PastureStack/distributed-cache-runtime' "$release_tag" "$release_commit" "$runtime_version" \ + "$jackson3_version" "$jackson2_version" "$release_sha256" diff --git a/third-party/HAZELCAST.md b/third-party/HAZELCAST.md index 41b0ff2715..c756c09b9d 100644 --- a/third-party/HAZELCAST.md +++ b/third-party/HAZELCAST.md @@ -1,28 +1,20 @@ -# Patched Hazelcast Build +# PastureStack Hazelcast Runtime -The orchestration engine uses Hazelcast as an embedded third-party dependency. Release builds reproduce a patched artifact locally instead of publishing or trusting an opaque replacement binary. +The orchestration engine embeds the reviewed runtime produced by the dedicated `distributed-cache-runtime` repository. It does not rebuild a second, diverging Hazelcast fork during every orchestration build. ## Provenance -- Upstream project: [`hazelcast/hazelcast`](https://github.com/hazelcast/hazelcast) -- Upstream version: `5.7.0` -- Pinned upstream commit: `60c31e3750cbad64f5720e2e02f0a9830973193c` -- Source archive SHA-256: `e44d7ebeb6400309a7b672f2190180925f81cdbedab44f2247cd266d03f4fa88` -- Local artifact version: `5.7.2` +- Source project: [`PastureStack/distributed-cache-runtime`](https://github.com/PastureStack/distributed-cache-runtime) +- Signed release tag: `v5.7.3-pasturestack.4` +- Source commit: `daab0b34f0fce46e5be79c56e80dab769183aa83` +- Runtime artifact: `hazelcast-5.7.3-pasturestack.4.jar` +- Artifact SHA-256: `9fa751998ce3cc1f17692e21933b24646c39a7142ca387af772e43f49dc77764` +- Embedded Jackson 3 / Jackson 2: `3.2.2` / `2.22.2` -The build downloads the archive for the exact commit, verifies its SHA-256 checksum and safe paths, applies [`hazelcast-5.7.0-jackson-security.patch`](hazelcast-5.7.0-jackson-security.patch) with cross-platform line-ending tolerance, verifies the exact resulting dependency coordinates, builds the Hazelcast core module, normalizes JAR metadata to the release source timestamp, and installs the result only into the build-local Maven repository. +The source project owns the Java 25 build, focused legitimate and malicious regression suite, SBOM, source and artifact scanning, and release artifact. This repository downloads that exact release asset over HTTPS, verifies the pinned bytes, safe JAR paths, license and notice, Maven identities, Jackson versions, and embedded source revision before installing it into the build-local Maven repository. -Because a GitHub source archive intentionally contains no `.git` directory, the reproducible build also applies [`hazelcast-5.7.0-archive-build.patch`](hazelcast-5.7.0-archive-build.patch). That build-only patch disables the obsolete Git metadata Mojo which otherwise attempts to inspect a repository that is not present. It does not change runtime code, dependency coordinates, attribution, or license material; the pinned upstream commit is recorded and verified independently above. - -## Patch scope - -The runtime security patch changes only Hazelcast's pinned Jackson versions: - -- Jackson 3: `3.1.2` to `3.2.1` -- Jackson 2: `2.21.2` to `2.22.1` - -It does not remove upstream attribution, authorship, notices, or licensing information. +This removes the former duplicate source-download, patch, and rebuild path. Dependency changes are reviewed and tested once in the source project; orchestration consumes only the corresponding pinned release bytes. ## License -Hazelcast remains third-party software licensed by its upstream authors under Apache License 2.0. The original license and notice materials are preserved in the built artifact and in the Server runtime license bundle. PastureStack claims authorship only for the tracked compatibility and security patch. +Hazelcast remains third-party software licensed by its upstream authors under Apache License 2.0. The original license and notice materials are preserved in the release artifact and in the Server runtime license bundle. PastureStack claims authorship only for its compatibility and security changes. diff --git a/third-party/hazelcast-5.7.0-archive-build.patch b/third-party/hazelcast-5.7.0-archive-build.patch deleted file mode 100644 index b890e16f66..0000000000 --- a/third-party/hazelcast-5.7.0-archive-build.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff --git a/hazelcast/pom.xml b/hazelcast/pom.xml ---- a/hazelcast/pom.xml -+++ b/hazelcast/pom.xml -@@ -51,6 +51,7 @@ - - - -+ true - false - ${project.basedir}/.git - false diff --git a/third-party/hazelcast-5.7.0-jackson-security.patch b/third-party/hazelcast-5.7.0-jackson-security.patch deleted file mode 100644 index 9618502518..0000000000 --- a/third-party/hazelcast-5.7.0-jackson-security.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff --git a/hazelcast-parent/pom.xml b/hazelcast-parent/pom.xml ---- a/hazelcast-parent/pom.xml -+++ b/hazelcast-parent/pom.xml -@@ -99,9 +99,9 @@ - 1.9.8.Final - 3.1.3.Final - 1.73.0 - 3.4.3 -- 3.1.2 -- 2.21.2 -+ 3.2.1 -+ 2.22.1 - 2.21 - 3.30.9 - 0.13