diff --git a/VERSION b/VERSION index a8edb160c..acf57f928 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.2.0-rc.1 +6.2.0-rc.2 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index f3bf124b3..a537a1436 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker monitoring agent. type: application -version: 6.2.0-rc.1 -appVersion: "6.2.0-rc.1" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.1/docs/images/pulse-logo.svg +version: 6.2.0-rc.2 +appVersion: "6.2.0-rc.2" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.2/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.1/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.2/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 879c0e657..a4553681f 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.2.0-rc.1](https://img.shields.io/badge/Version-6.2.0--rc.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.0-rc.1](https://img.shields.io/badge/AppVersion-6.2.0--rc.1-informational?style=flat-square) +![Version: 6.2.0-rc.2](https://img.shields.io/badge/Version-6.2.0--rc.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.0-rc.2](https://img.shields.io/badge/AppVersion-6.2.0--rc.2-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index 0cceeabf8..7c3c717ff 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.1} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.2} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index daba69880..1be5323ee 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -7,6 +7,10 @@ For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` For the current v6 support release candidate packet, see: +- `docs/releases/RELEASE_NOTES_v6.2.0-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.2.0-rc.2.md` + +For historical v6.2 support release candidate packets, see: - `docs/releases/RELEASE_NOTES_v6.2.0-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.2.0-rc.1.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index 734948bc1..141d25293 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -4,6 +4,11 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current v6 support release candidate packet, see: +- `docs/releases/RELEASE_NOTES_v6.2.0-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.2.0-rc.2.md` + +For historical v6.2 support release candidate packets, see: + - `docs/releases/RELEASE_NOTES_v6.2.0-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.2.0-rc.1.md` diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index dc7a944b4..7660dbe7b 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -9229,13 +9229,13 @@ ], "work_claims": [ { - "id": "release-operator-v620rc1-release-gate-single-build-release-promotion-path", - "agent_id": "release-operator-v620rc1", - "summary": "Prepare and publish v6.2.0-rc.1 through the governed exact-SHA promotion workflow", + "id": "release-operator-v620rc2-release-gate-single-build-release-promotion-path", + "agent_id": "release-operator-v620rc2", + "summary": "Prepare and publish v6.2.0-rc.2 through the governed exact-SHA promotion workflow", "target_id": "v6-product-lane-expansion", - "claimed_at": "2026-07-27T12:45:00Z", - "heartbeat_at": "2026-07-27T12:45:00Z", - "expires_at": "2026-07-27T20:45:00Z", + "claimed_at": "2026-07-28T14:59:51Z", + "heartbeat_at": "2026-07-28T14:59:51Z", + "expires_at": "2026-07-28T22:59:51Z", "work_item": { "kind": "release-gate", "id": "single-build-release-promotion-path" diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 3c6761faa..796b2261f 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -1136,28 +1136,34 @@ host-local redirect contract as runtime token minting and exchange. Proof input must reject absolute, scheme-relative, backslash-authority, encoded-separator, and control-character targets before constructing the handoff request. -The active support prerelease `v6.2.0-rc.1` cut sets the repo-root `VERSION`, +The active support prerelease `v6.2.0-rc.2` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` -fallback, and Helm chart release metadata to the same `6.2.0-rc.1` release +fallback, and Helm chart release metadata to the same `6.2.0-rc.2` release version. This support prerelease keeps `rollback_version=v6.1.2`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases. Stable install pointers stay on `v6.1.2`, whose active stable cut is recorded below and -continues to govern the stable line until this candidate is promoted. The first -`v6.2.0` candidate introduces the Pulse Pro External Probes feature that runs -assigned availability checks from a connected agent outside the monitored site, -completes the multi-site Proxmox identity-isolation trilogy across connection -consolidation, same-name node aggregation, and the first-poll unclassified-node -window, adds host-agent identity-collapse detection for cloned machine-ids, -restores service availability after a failed unattended update, follows -same-host TrueNAS handshake redirects, and makes Pulse Intelligence outcome -telemetry verified and complete. The exact `main` SHA must pass the integrated -release checks and immutable-candidate build before the single-build workflow -crosses its public mutation boundary. -The `v6.2.0-rc.1` server cut is classified `no-mobile-impact`; no companion +continues to govern the stable line until this candidate is promoted. The second +`v6.2.0` candidate is a hardening and bugfix cut that supersedes `v6.2.0-rc.1` +without dropping anything it carried: it restores unattended-update reliability +including in-place repair of already-deployed update units, corrects PBS backup +attribution across multiple Proxmox clusters, repairs Proxmox installer +registration including per-canonical-type bootstrap grants on combined hosts, +hardens the Patrol readiness streaming transport and gates readiness on a +completed verdict, ends discovery-policy DNS and SSH retry churn, adds explicit +per-metric threshold off toggles, derives SSO callback URLs from the request +that reached Pulse, and documents Entra ID SSO integration. The exact `main` SHA +must pass the integrated release checks and immutable-candidate build before the +single-build workflow crosses its public mutation boundary. +The `v6.2.0-rc.2` server cut is classified `no-mobile-impact`; no companion build upload is part of this cut. The existing mobile candidate programme remains separate, and the release packet must not describe a public store rollout. +The preceding `v6.2.0-rc.1` candidate used the same support-prerelease path +with `rollback_version=v6.1.2` and pinned the same four install surfaces to +`6.2.0-rc.1`. It is superseded by this cut and no longer governs the install +pins; its packet stays in `docs/releases/` as the historical candidate record +for the `v6.2.0` line. Authenticode signing through SignPath is the canonical Windows signing backend for the `v6.2.0` line. The owner-approved unsigned-Windows exception is bounded to `v6.1.0`, `v6.1.1`, and `v6.1.2` and does not extend to any `v6.2.0` @@ -1307,11 +1313,14 @@ For the active stable `v6.1.2` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the governed `VERSION` is that stable cut. The stable promotion guard remains in force and rejects leftover `-rc.` defaults. -For the active support prerelease `v6.2.0-rc.1` cut, the repo-root compose -default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.1` +For the active support prerelease `v6.2.0-rc.2` cut, the repo-root compose +default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.2` until the next governed stable cut moves them forward. The stable promotion guard remains in force and must reject leftover `-rc.` defaults when the -governed `VERSION` returns to a stable release. +governed `VERSION` returns to a stable release. Each new candidate on the +`v6.2.0` line moves these two pins together with the repo-root `VERSION` and +the Helm chart metadata in the same commit; a candidate that leaves any of the +four on the superseded `6.2.0-rc.1` value is a release-packet blocker. The RC7 packet refresh records `fc10de9b5477613316473267b72b05b6b2b7aaff` as the current validation-risk commit. That head includes the earlier Docker-default correction plus the follow-on capacity-forecast and Patrol diff --git a/docs/releases/RELEASE_NOTES_v6.2.0-rc.2.md b/docs/releases/RELEASE_NOTES_v6.2.0-rc.2.md new file mode 100644 index 000000000..cf42155ef --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.2.0-rc.2.md @@ -0,0 +1,143 @@ +# Pulse v6.2.0-rc.2 Release Notes + +`v6.2.0-rc.2` is a release candidate for the next Pulse v6 minor line. It +follows stable `v6.1.2` and supersedes `v6.2.0-rc.1`. It is a hardening and +bugfix candidate: it closes the highest-impact defects reported against +v6.1.x — nightly service outages from the unattended updater, missing PBS +backups on multi-cluster estates, broken Proxmox agent installs, and a DNS +query flood — and carries the fixes from an adversarial review pass over every +change since the previous candidate. + +## Highlights + +- Unattended updates no longer stop Pulse in the night. The update timer fired + twice per day and a failed update left the service down until someone + restarted it; the timer now runs once, failures always restart the service, + and already-deployed installations repair their own stale update units on + the next update cycle. +- PBS backups are attributed to the right guest on estates with more than one + Proxmox cluster. VMIDs that exist on both clusters no longer show "no + backup" or an ancient backup age when the real backups are in the root + namespace (#1639). +- Installing the agent on a Proxmox host from **Settings → Infrastructure** + works again, including combined PVE+PBS hosts, and failures are reported + loudly in the installer output instead of a buried journal warning (#1644). +- The Patrol model readiness check survives reverse proxies with short read + timeouts, reports an interrupted check neutrally instead of blaming the + model, and never renders a proxy's HTML error page into the results (#1640). +- Pulse no longer floods the local resolver. A discovery-policy check that + resolved every cluster node's hostname on every 10-second poll now uses the + shared DNS cache, cutting hundreds of thousands of daily queries to a + handful (#1638). + +## Fixed + +- **Auto-update reliability.** The generated `pulse-update.timer` carried two + `OnCalendar` lines and attempted two updates per day; it now runs once + daily in the 02:00–06:00 window. Asset staging is guarded: a failed copy or + write can no longer install a broken helper or a truncated systemd unit + while reporting success. Existing installations whose hardened update unit + cannot rewrite its own files migrate automatically through a transient + `systemd-run` unit on their next update; if the migration cannot run, the + update itself still completes as before. +- **PBS backup attribution across clusters** (#1639). Snapshot-to-guest + matching now uses each cluster's own view of its PBS storage and a + submission-source learner that only trusts evidence when every candidate + cluster is visible, so shared tokens or synced datastores cannot attribute + one cluster's backups to another. Evidence survives partial poll failures + instead of flapping. Backup-age alerts no longer cross-match a PBS + connection name against a similarly named node. +- **Proxmox agent installation** (#1644). Install tokens minted from the main + installer can now register the PVE or PBS source the installer detects — + one registration per product type, bound to the first presenting hostname, + and only within 24 hours of minting. A refused registration aborts the + install visibly. The API setup script's closing message points at + **Settings → Infrastructure** instead of a page that no longer exists, and + its error branch reports invalid or expired setup tokens instead of + claiming success. The post-install check waits for the agent's first report + instead of warning two seconds in. +- **Patrol readiness checks** (#1640). The readiness endpoint streams + keepalive bytes from the first moment of the run, so proxies with 30-second + read timeouts see a live connection for the full multi-probe evaluation. A + connection cut mid-run is classified as interrupted, keeps the evidence + from completed scenarios, and shows a neutral "check did not complete" + banner; readiness is only reported from a completed verdict, and an + interrupted check never blocks Patrol from running. A crash inside a + provider integration now fails the check instead of the whole process, and + the browser client no longer prints raw non-JSON error bodies into the UI. +- **DNS and SSH churn** (#1638). The cluster endpoint discovery-policy check + resolves hostnames through the shared cached resolver instead of a raw + lookup per node per poll, and the link-local blocklist is enforced against + the same resolver view the connection dial uses. Failed SSH temperature + probes and host-key scans back off with decay instead of retrying every 10 + seconds, and the backoff clears when the SSH key changes or settings are + saved. +- **Alert threshold editors** (#1642). Each metric now has an explicit On/Off + toggle in the per-resource override editor, the global defaults row, and + the bulk edit dialog — no more typing -1. Values disabled under older + guidance that said to use 0 render consistently as Off everywhere, turning + a metric back on always produces a working threshold, and the toggle is + reachable by keyboard. +- **SSO callback URLs.** OIDC provider cards show the provider's callback / + redirect URL with a copy button, and all SSO URLs are derived from the + configured public URL or, when none is set, from the request that reached + Pulse — never a `localhost` guess that fails at the identity provider. +- LXC memory metrics fall back to the cluster-resources listing again when + per-guest RRD data is unavailable, restoring memory readings lost on some + PVE configurations. +- Agent command execution honors the configuration gate at channel admission, + closing a window where a disabled command channel could still admit an + agent. + +## Changed + +- Platform table metric bars are colored from the configured alert thresholds + rather than fixed cutoffs. +- The unused `autoUpdateTime` and `autoUpdateCheckInterval` settings were + removed from the system settings API and UI; they were stored but never + drove the update schedule. Existing configurations containing them load + unchanged, and API clients that still send them are accepted. + +## Docs + +- New Microsoft Entra ID (Azure AD) SSO integration guide covering app + registration, group claims by Object ID, role mapping, the `AADSTS650053` + scope pitfall, and group-overage protection (#1635), contributed by + @drgimpfen and expanded. + +## Upgrade Notes + +Use the normal v6 install or update flow for `v6.2.0-rc.2` only when you are +comfortable testing an RC. The rollback target is `v6.1.2`. + +The exact rollback reinstall command is: + +```bash +./scripts/install.sh --version v6.1.2 +``` + +Installations already running the hardened unattended-update unit repair their +own timer and helper on the next update cycle, so no manual step is needed to +pick up the once-daily schedule. If that in-place migration cannot run, the +update itself still completes and the repair is retried on the following +cycle. + +Everything `v6.2.0-rc.1` introduced is still in this candidate, including +External Probes for Pulse Pro. External Probes need the `external_probe` Pulse +Pro entitlement on the Pulse server, and ICMP probes use the system `ping` +binary, so a probe host running in a container or a hardened service unit needs +`CAP_NET_RAW`; prefer TCP or HTTP checks there, or grant the capability. See +`docs/UNIFIED_AGENT.md`. + +This server candidate has no mobile compatibility change and does not require a +companion build upload. No public mobile-store rollout is part of this RC. + +Windows Unified Agent binaries in this candidate keep checksum and +detached-signature verification, but they are not yet Authenticode-signed and +Windows may show an unknown-publisher warning. No unsigned-Windows exception +applies to any `v6.2.0` release: the owner-approved exception was bounded to +`v6.1.0`, `v6.1.1`, and `v6.1.2`, and stable `v6.2.0` must publish Windows +agents through the mandatory SignPath Authenticode path. + +Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the +private download page and private runtime image for paid runtime features. diff --git a/docs/releases/V6_CHANGELOG_v6.2.0-rc.2.md b/docs/releases/V6_CHANGELOG_v6.2.0-rc.2.md new file mode 100644 index 000000000..283d871a9 --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.2.0-rc.2.md @@ -0,0 +1,109 @@ +# Pulse v6.2.0-rc.2 + +_This changelog describes the changes since `v6.2.0-rc.1`. +`v6.2.0-rc.2` remains a prerelease and rolls back to stable `v6.1.2`._ + +## Added + +- Explicit per-metric off toggles in the per-resource override editor, the + global defaults row, and the bulk edit dialog, replacing the `-1` sentinel + operators had to type by hand (#1642). +- OIDC provider cards show the provider's callback / redirect URL with a copy + button so it can be registered at the identity provider without guesswork. +- Recorded PVE RRD fixtures and decode-alignment tests pin the guest RRD + decode path against real Proxmox payloads. + +## Changed + +- Platform table metric bars are colored from the configured alert thresholds + rather than fixed cutoffs. +- SSO callback, SP metadata, and ACS URLs are derived from the configured + public URL or, when none is set, from the request that reached Pulse, + instead of a hardcoded `localhost` base that fails at the identity provider. + When neither source resolves a host the fields are omitted and the panel + points at the public URL setting. +- The unused `autoUpdateTime` and `autoUpdateCheckInterval` system settings + were removed from the settings API and UI; stored values load unchanged and + API clients that still send them are accepted. +- Dead cache-aware RRD fields were removed from the guest RRD path. + +## Fixed + +- The generated `pulse-update.timer` carried two `OnCalendar` lines and + attempted two updates per day; it now runs once daily in the 02:00-06:00 + window. +- Auto-update asset staging is guarded, so a failed copy or write can no + longer install a broken helper or a truncated systemd unit while reporting + success. +- Deployed installations whose hardened update unit cannot rewrite its own + files migrate through a transient `systemd-run` unit on the next update + cycle, and the update still completes when that migration cannot run. +- PBS backup attribution for VMIDs shared across clusters uses each cluster's + own view of its PBS storage, so a guest no longer shows "no backup" or a + stale backup age when its real backups sit in the root namespace (#1639). +- PBS submission-source learning only trusts evidence when every candidate + cluster is visible, survives partial poll failures instead of flapping, and + backup-age alerts no longer cross-match a PBS connection name against a + similarly named node (#1639). +- Proxmox host-token installs register the source the installer detects, with + one registration per canonical product type, a shared first-use hostname + bind, and the 24-hour mint-age bound, so combined PVE and PBS hosts complete + both legs from a single install token (#1644). +- A refused Proxmox registration aborts the install visibly, the API setup + script points at Settings then Infrastructure instead of a page that no + longer exists, its error branch reports invalid or expired setup tokens, and + the post-install check waits for the agent's first report (#1644). +- The Patrol readiness endpoint commits its response header and streams + keepalive bytes from the start of the run, so proxies with short read + timeouts keep the connection open for the full multi-probe evaluation + (#1640). +- A Patrol readiness run cut mid-flight is classified as interrupted, keeps + evidence from completed scenarios, and renders a neutral banner instead of + blaming the model (#1640). +- Patrol readiness is reported only from a completed overall verdict, an + unassessed snapshot falls back to the base-config classifier capped at a + warning, and an interrupted check never blocks Patrol from running (#1640). +- A panic inside provider streaming or validation is recovered into an + ordinary readiness result carrying an internal-error cause instead of + taking the process down, and the browser client no longer renders raw + non-JSON error bodies (#1640). +- The cluster endpoint discovery-policy check resolves hostnames through the + shared cached resolver instead of a raw lookup per node per poll, and the + link-local blocklist is enforced against the same resolver view the + connection dial uses (#1638). +- Failed SSH temperature probes and host-key scans back off with decay instead + of retrying every poll cycle, and the backoff clears when the SSH key + changes or system settings are saved (#1638). +- Thresholds disabled under the older guidance that said to use 0 render + consistently as off, turning a metric back on always produces a working + threshold, and the toggle is reachable by keyboard (#1642). +- LXC memory metrics fall back to the cluster-resources listing when per-guest + RRD data is unavailable, restoring memory readings lost on some PVE + configurations. +- Agent command execution honors the configuration gate at channel admission, + closing a window where a disabled command channel could still admit an + agent. + +## Docs + +- New Microsoft Entra ID (Azure AD) SSO integration guide covering app + registration, group claims by Object ID, role mapping, the `AADSTS650053` + scope pitfall, and group-overage protection (#1635). + +## Release Metadata + +- Version: `v6.2.0-rc.2` +- Previous candidate: `v6.2.0-rc.1` +- Previous stable: `v6.1.2` +- Rollback target: `v6.1.2` +- Rollback command: `./scripts/install.sh --version v6.1.2` +- Promotion path: exact-SHA single-build release candidate from `main`, + published as a support prerelease that does not move stable or latest + install pointers +- Windows signing decision: Authenticode through SignPath is the mandatory + signing backend and no unsigned-Windows exception applies to any `v6.2.0` + release; this candidate publishes Windows agents under the standing + prerelease path with exact-SHA, checksum, and detached-signature + verification +- Mobile decision: `no-mobile-impact`; no companion build upload or public + store rollout is part of this candidate diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index 952ebdc74..05c64ca60 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.1" +CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.2" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 21de086ba..1e597ded2 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -406,25 +406,26 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "`v"+version+"` is a release candidate", "## Highlights", "stable `v"+previous+"`", - "External Probes (Pulse Pro)", - "run from a connected Pulse agent outside the monitored site", - "assigned to a connected Pulse agent through the new **Run from** control", - "travel over the signed agent configuration channel", - "per-target source attribution", - "Only the currently assigned agent's results are accepted", - "an assigned check never also runs locally", - "surface as indeterminate", - "resumes local execution automatically if the entitlement lapses", - "Local availability checks remain free and unchanged in every edition", - "cloned `/etc/machine-id`", - "`availability_probe_targets`", - "`availability_probe_agents`", - "disclosed in `docs/PRIVACY.md`", - "Contradicting captured TLS certificate fingerprints now veto the merge", - "same TLS identity doctrine as connection consolidation", - "positive same-machine evidence before it can fold into a named cluster", - "no longer leaves the service down", - "same-host HTTP-to-HTTPS redirect", + "supersedes `v6.2.0-rc.1`", + "Unattended updates no longer stop Pulse in the night", + "the timer now runs once, failures always restart the service", + "already-deployed installations repair their own stale update units", + "PBS backups are attributed to the right guest on estates with more than one Proxmox cluster", + "combined PVE+PBS hosts", + "survives reverse proxies with short read timeouts", + "never renders a proxy's HTML error page into the results", + "now uses the shared DNS cache", + "`pulse-update.timer`", + "submission-source learner that only trusts evidence when every candidate cluster is visible", + "one registration per product type, bound to the first presenting hostname", + "streams keepalive bytes from the first moment of the run", + "A connection cut mid-run is classified as interrupted", + "an interrupted check never blocks Patrol from running", + "resolves hostnames through the shared cached resolver", + "back off with decay", + "explicit On/Off toggle", + "never a `localhost` guess that fails at the identity provider", + "Microsoft Entra ID (Azure AD) SSO integration guide", "`CAP_NET_RAW`", "no mobile compatibility change", "No public mobile-store rollout", @@ -434,27 +435,29 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { ) assertFileContainsAllNormalized(t, changelogPath, "Version: `v"+version+"`", + "Previous candidate: `v6.2.0-rc.1`", "Previous stable: `v"+previous+"`", "Rollback target: `v"+previous+"`", "Promotion path: exact-SHA single-build release candidate from `main`", - "External Probes (Pulse Pro)", - "gated by the `external_probe` entitlement at assignment time", - "delivered to their agent over the signed agent-config channel", - "skipped by the local poller", - "accepted only from the currently assigned agent", - "derive to indeterminate at read time when reports go stale", - "Host-agent identity-collapse detection for cloned `/etc/machine-id`", - "Telemetry counts `availability_probe_targets` and `availability_probe_agents`", - "Availability probe execution moved into a shared package", - "`postcss` build tooling is updated to `8.5.23`", - "remain isolated when TLS identity evidence contradicts", - "closing the first-poll window where an unclassified node could be folded into another site's cluster slot", - "Failed unattended updates restart a previously active Pulse service", - "follow safe same-host HTTPS redirects", + "This changelog describes the changes since `v6.2.0-rc.1`", + "Explicit per-metric off toggles in the per-resource override editor", + "OIDC provider cards show the provider's callback / redirect URL with a copy button", + "carried two `OnCalendar` lines", + "Auto-update asset staging is guarded", + "migrate through a transient `systemd-run` unit on the next update cycle", + "PBS backup attribution for VMIDs shared across clusters", + "one registration per canonical product type", + "The Patrol readiness endpoint commits its response header and streams keepalive bytes", + "Patrol readiness is reported only from a completed overall verdict", + "resolves hostnames through the shared cached resolver", + "back off with decay instead of retrying every poll cycle", + "LXC memory metrics fall back to the cluster-resources listing", + "Agent command execution honors the configuration gate at channel admission", + "derived from the configured public URL or, when none is set, from the request that reached Pulse", + "Microsoft Entra ID (Azure AD) SSO integration guide", "Windows signing decision: Authenticode through SignPath is the mandatory signing backend", "Mobile decision: `no-mobile-impact`", "no companion build upload or public store rollout", - "the license-server entitlement catalog carrying `external_probe` was deployed on 2026-07-27, before this cut", ) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), "docs/releases/RELEASE_NOTES_v"+version+".md", diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 42b322be6..1152cde16 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -128,7 +128,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T) want string }{ {version: "6.0.5-rc.4", want: "6.0.4"}, - {version: "6.2.0-rc.1", want: "6.1.2"}, + {version: "6.2.0-rc.2", want: "6.1.2"}, } for _, test := range tests { @@ -336,7 +336,8 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) { assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), "The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", "This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.", - "introduces the Pulse Pro External Probes feature that runs assigned availability checks from a connected agent outside the monitored site, completes the multi-site Proxmox identity-isolation trilogy across connection consolidation, same-name node aggregation, and the first-poll unclassified-node window, adds host-agent identity-collapse detection for cloned machine-ids, restores service availability after a failed unattended update, follows same-host TrueNAS handshake redirects, and makes Pulse Intelligence outcome telemetry verified and complete", + "is a hardening and bugfix cut that supersedes `v6.2.0-rc.1` without dropping anything it carried: it restores unattended-update reliability including in-place repair of already-deployed update units, corrects PBS backup attribution across multiple Proxmox clusters, repairs Proxmox installer registration including per-canonical-type bootstrap grants on combined hosts, hardens the Patrol readiness streaming transport and gates readiness on a completed verdict, ends discovery-policy DNS and SSH retry churn, adds explicit per-metric threshold off toggles, derives SSO callback URLs from the request that reached Pulse, and documents Entra ID SSO integration", + "The preceding `v6.2.0-rc.1` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.1`.", "The `v"+version+"` server cut is classified `no-mobile-impact`; no companion build upload is part of this cut. The existing mobile candidate programme remains separate, and the release packet must not describe a public store rollout.", "Authenticode signing through SignPath is the canonical Windows signing backend for the `v6.2.0` line.", "For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",