mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-09 18:15:50 +00:00
Prepare v6.2.0-rc.10 release
This commit is contained in:
rcourtman
@@ -2,9 +2,9 @@ apiVersion: v2
|
||||
name: pulse
|
||||
description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
type: application
|
||||
version: 6.2.0-rc.9
|
||||
appVersion: "6.2.0-rc.9"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.9/docs/images/pulse-logo.svg
|
||||
version: 6.2.0-rc.10
|
||||
appVersion: "6.2.0-rc.10"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.10/docs/images/pulse-logo.svg
|
||||
keywords:
|
||||
- monitoring
|
||||
- proxmox
|
||||
@@ -32,7 +32,7 @@ annotations:
|
||||
description: Smoke tests with kind cluster deployment
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.9/docs/KUBERNETES.md
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.10/docs/KUBERNETES.md
|
||||
- name: Support
|
||||
url: https://github.com/rcourtman/Pulse/discussions
|
||||
artifacthub.io/maintainers: |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# pulse
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@ version: '3.8'
|
||||
|
||||
services:
|
||||
pulse:
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.9}
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.10}
|
||||
container_name: pulse
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
|
||||
@@ -7,10 +7,12 @@ For historical v4 notes that previously lived in this repo, see:
|
||||
`docs/releases/RELEASE_NOTES_v4.md`
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.8.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.7.md`
|
||||
|
||||
+4
-2
@@ -4,11 +4,13 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.8.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.7.md`
|
||||
|
||||
@@ -1338,21 +1338,23 @@ host-local redirect contract as runtime token minting and exchange. Proof input
|
||||
must reject absolute, scheme-relative, backslash-authority, encoded-separator,
|
||||
and control-character targets before constructing the handoff request.
|
||||
|
||||
The active support prerelease `v6.2.0-rc.9` cut sets the repo-root `VERSION`,
|
||||
The active support prerelease `v6.2.0-rc.10` cut sets the repo-root `VERSION`,
|
||||
repo-root `docker-compose.yml` image default, `scripts/install-docker.sh`
|
||||
fallback, and Helm chart release metadata to the same `6.2.0-rc.9` release
|
||||
fallback, and Helm chart release metadata to the same `6.2.0-rc.10` release
|
||||
version. This support prerelease keeps `rollback_version=v6.1.2`, publishes a
|
||||
versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and
|
||||
does not move stable/latest install pointers or stable semver aliases. Stable
|
||||
install pointers stay on `v6.1.2`, whose active stable cut is recorded below and
|
||||
continues to govern the stable line until this candidate is promoted. The ninth
|
||||
`v6.2.0` candidate is a monitoring-correctness, deployment-safety, security,
|
||||
and responsive-interface cut that supersedes `v6.2.0-rc.8`: it corrects alert
|
||||
delivery and infrastructure state, hardens agent install and update behavior,
|
||||
tightens authorization and dependency boundaries, and keeps operational
|
||||
controls usable across narrow layouts. The exact `main` SHA must pass the
|
||||
integrated release checks and immutable-candidate build before the single-build
|
||||
workflow crosses its public mutation boundary.
|
||||
continues to govern the stable line until this candidate is promoted. The tenth
|
||||
`v6.2.0` candidate is a security-boundary, role-correct access, live-state
|
||||
recovery, and release-operations cut that supersedes `v6.2.0-rc.9`: it validates
|
||||
request-derived origins, verifies legacy-cleanup SSH hosts, aligns Settings and
|
||||
resource reads with session authority, recovers oversized WebSocket state,
|
||||
converges agent and PBS lifecycle behavior, restores the deliberate self-hosted
|
||||
commercial opt-in posture, and closes the historical credential-containment
|
||||
gate. The exact `main` SHA must pass the integrated release checks and
|
||||
immutable-candidate build before the single-build workflow crosses its public
|
||||
mutation boundary.
|
||||
Every release cut, including a prerelease, now gates that mutation boundary on
|
||||
the complete frontend unit suite, frontend type-checking, and a deterministic
|
||||
render smoke against the verified frontend bundle. The smoke must render
|
||||
@@ -1363,13 +1365,18 @@ diagnostics. The same release workflow also executes the generated self-signed
|
||||
and custom-CA Windows installer commands through Windows PowerShell 5.1 before
|
||||
release assembly, so the first HTTPS fetch is release proof rather than a
|
||||
string-shape assertion.
|
||||
The `v6.2.0-rc.9` server cut is classified
|
||||
The `v6.2.0-rc.10` server cut is classified
|
||||
`existing-mobile-build-compatible`. The synchronized Pulse Mobile 1.0.0 iOS
|
||||
build 12 and Android versionCode 9 candidates, both using runtime version 2,
|
||||
remain distributed to the existing beta cohort through TestFlight and Play
|
||||
open testing. The changes since RC8 do not alter mobile relay payloads, pairing,
|
||||
approvals, authentication, or onboarding contracts; no additional companion
|
||||
upload or public store rollout is part of RC9.
|
||||
open testing. The changes since RC9 preserve the checked-in mobile API, Relay,
|
||||
pairing, approval, push, authentication, and onboarding contracts; no additional
|
||||
companion upload or public store rollout is part of RC10.
|
||||
The preceding `v6.2.0-rc.9` candidate used the same support-prerelease path
|
||||
with `rollback_version=v6.1.2` and pinned the same four install surfaces to
|
||||
`6.2.0-rc.9`. It is superseded by this cut and no longer governs the install
|
||||
pins; its packet stays in `docs/releases/` as the historical candidate record
|
||||
for the `v6.2.0` line.
|
||||
The preceding `v6.2.0-rc.8` candidate used the same support-prerelease path
|
||||
with `rollback_version=v6.1.2` and pinned the same four install surfaces to
|
||||
`6.2.0-rc.8`. It is superseded by this cut and no longer governs the install
|
||||
@@ -1560,20 +1567,22 @@ For the active stable `v6.1.2` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the
|
||||
governed `VERSION` is that stable cut. The stable promotion guard remains in
|
||||
force and rejects leftover `-rc.` defaults.
|
||||
For the active support prerelease `v6.2.0-rc.9` cut, the repo-root compose
|
||||
default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.9`
|
||||
For the active support prerelease `v6.2.0-rc.10` cut, the repo-root compose
|
||||
default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.10`
|
||||
until the next governed stable cut moves them forward. The stable promotion
|
||||
guard remains in force and must reject leftover `-rc.` defaults when the
|
||||
governed `VERSION` returns to a stable release. Each new candidate on the
|
||||
`v6.2.0` line moves these two pins together with the repo-root `VERSION` and
|
||||
the Helm chart metadata in the same commit; a candidate that leaves any of the
|
||||
four on a superseded `6.2.0-rc.*` value is a release-packet blocker.
|
||||
The RC9 packet records `99407ee74ccaf24962713636e733eeff44228acb` as
|
||||
the code-backed validation-risk head. That head includes the post-RC8 alert,
|
||||
monitoring, agent lifecycle, installer, security, resource-read, and responsive
|
||||
interface changes. The release-link and metadata-only release-preparation
|
||||
commits may be the workflow dispatch head because they do not change that
|
||||
code-backed release-risk range.
|
||||
The RC10 packet records `5ff0855882cdbcfc9d4c8f8d87a1ffa3972db818` as
|
||||
the code-backed validation-risk head. That head covers 61 commits and 226 files
|
||||
since RC9 across request-origin and SSH trust, settings RBAC and responsive
|
||||
layout, WebSocket recovery and resource deltas, agent and PBS lifecycle,
|
||||
commercial-surface rollback, release-control hardening, and customer artifact
|
||||
promotion. The credential-containment record and metadata-only
|
||||
release-preparation commits may be the workflow dispatch head because they do
|
||||
not change that code-backed release-risk range.
|
||||
|
||||
`internal/updates/` is the live deployment and upgrade planner. It owns
|
||||
deployment-type detection, update-plan generation, adapter selection, server
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
# Pulse v6.2.0-rc.10 Release Notes
|
||||
|
||||
`v6.2.0-rc.10` is a release candidate for the next Pulse v6 minor line. It
|
||||
follows stable `v6.1.2` and supersedes `v6.2.0-rc.9`. This candidate focuses on
|
||||
security boundaries, role-correct settings and resource access, resilient live
|
||||
state recovery, and safer release operations.
|
||||
|
||||
## Highlights
|
||||
|
||||
- Installer, diagnostic, and sign-in URLs reject untrusted origins; proxy
|
||||
cleanup verifies SSH hosts; historical credentials are contained.
|
||||
- Settings, resource links, update polling, health, and oversized WebSocket
|
||||
recovery preserve role boundaries and clean live state.
|
||||
- Agent/PBS lifecycle fixes, opt-in commerce, secret scanning, worktree
|
||||
isolation, and convergent promotion improve operations.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Rejected hostile request-host, forwarded-host, and configured-public-URL
|
||||
values before they can enter copied installer commands, hosted diagnostics,
|
||||
or magic-link responses.
|
||||
- Hid administrator-only System and infrastructure settings from viewer
|
||||
sessions, stopped viewer polling of privileged endpoints, and kept
|
||||
viewer-safe workload health available without offering inaccessible routes.
|
||||
- Recovered from WebSocket frames above the inbound guard without accepting an
|
||||
oversized baseline, and applied subsequent resource deltas to canonical raw
|
||||
server state.
|
||||
- Prevented update-status polling outside the routes that own update authority
|
||||
and reduced routine authorization-denial log noise without weakening abuse
|
||||
signals.
|
||||
- Stopped repeated PBS node-name fetches, corrected retry classification, and
|
||||
preserved configured alert intent for agents merged with Proxmox nodes.
|
||||
- Corrected responsive Settings panel clipping and restored architecture tests
|
||||
that keep desktop, tablet, and phone navigation coherent.
|
||||
- Restored release staging before publication, exact-version paid-customer
|
||||
promotion order, verifiable MSP evaluation delivery, and dependency-audit
|
||||
enforcement for the shipped frontend.
|
||||
|
||||
## Release Qualification
|
||||
|
||||
- The v6 control plane reports all 44 readiness assertions and all 26 release
|
||||
gates passed, including complete provider closure and replacement or
|
||||
retirement evidence for every historically reachable credential identity.
|
||||
- The post-RC9 code-backed risk range contains 61 commits across 226 files and
|
||||
ends at `5ff0855882cdbcfc9d4c8f8d87a1ffa3972db818`; the containment record and
|
||||
release-packet commits are metadata-only successors.
|
||||
- Targeted proof covers request-origin validation, SSH host-key enforcement,
|
||||
settings RBAC and responsive layout, WebSocket recovery, resource deltas,
|
||||
PBS polling, agent update convergence, release promotion, dependency audits,
|
||||
and mobile API compatibility.
|
||||
- Release publication builds and validates one immutable `main` SHA before
|
||||
publishing the GitHub prerelease, Docker image, Helm chart, and private Pro
|
||||
packet.
|
||||
|
||||
## Upgrade Notes
|
||||
|
||||
Use the normal v6 install or update flow for `v6.2.0-rc.10` only when you are
|
||||
comfortable testing an RC. The rollback target is stable `v6.1.2`.
|
||||
|
||||
The exact rollback reinstall command is:
|
||||
|
||||
```bash
|
||||
./scripts/install.sh --version v6.1.2
|
||||
```
|
||||
|
||||
Existing configurations remain valid and no manual data migration is required.
|
||||
|
||||
This server candidate is compatible with the current Pulse Mobile 1.0.0 beta
|
||||
candidates. iOS build 12 is distributed through the TestFlight public beta link,
|
||||
and Android versionCode 9 remains available through Play open testing; both use
|
||||
runtime version 2. The changes since RC9 preserve the checked-in mobile API,
|
||||
Relay, pairing, approval, push, authentication, and onboarding contracts. No
|
||||
public mobile-store rollout is part of this RC.
|
||||
|
||||
Windows Unified Agent binaries in this candidate keep checksum and
|
||||
detached-signature verification, but they are not yet Authenticode-signed and
|
||||
Windows may show an unknown-publisher warning. No unsigned-Windows exception
|
||||
applies to any `v6.2.0` release. Stable `v6.2.0` must publish Windows agents
|
||||
through the mandatory SignPath Authenticode path.
|
||||
|
||||
Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
|
||||
private download page and private runtime image for paid runtime features.
|
||||
@@ -0,0 +1,61 @@
|
||||
# Pulse v6.2.0-rc.10
|
||||
|
||||
_This changelog describes the changes since `v6.2.0-rc.9`.
|
||||
`v6.2.0-rc.10` remains a prerelease and rolls back to stable `v6.1.2`._
|
||||
|
||||
## Added
|
||||
|
||||
- Typed prerelease containment records for historically reachable credentials,
|
||||
backed by provider-observed closure and replacement or retirement evidence.
|
||||
- Fail-closed origin validation for hosted sign-in, diagnostics, and copied
|
||||
installer command surfaces.
|
||||
- Canonical worktree claim helpers and conflict-aware release-control routing
|
||||
for concurrent maintainers.
|
||||
|
||||
## Improved
|
||||
|
||||
- Viewer-safe Settings and workload navigation, including responsive panels
|
||||
and role-aware update-status polling.
|
||||
- Oversized WebSocket snapshot recovery through authenticated REST resync while
|
||||
retaining raw-state delta correctness.
|
||||
- Unified Agent update convergence, PBS node identity reuse, and merged-resource
|
||||
alert intent handling.
|
||||
- Release artifact staging, customer promotion convergence, frontend dependency
|
||||
audits, historical secret scanning, and provider-MSP evaluation delivery.
|
||||
- Self-hosted commercial opt-in posture and plan-selection upgrade routing.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Blocked untrusted request-derived hosts and schemes from installer, hosted
|
||||
diagnostics, and magic-link responses.
|
||||
- Enforced SSH host-key verification during legacy sensor-proxy cleanup.
|
||||
- Removed inaccessible admin routes and background requests from viewer
|
||||
sessions while preserving authorized health summaries.
|
||||
- Prevented oversized WebSocket snapshots from becoming a corrupt recovery
|
||||
baseline and applied later deltas to canonical raw server state.
|
||||
- Corrected repeated PBS node-name reads, retry classification, and responsive
|
||||
Settings clipping.
|
||||
- Removed the reverted proactive commercial prompt, telemetry, and checkout
|
||||
attribution cluster from the final candidate.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.2.0-rc.10`
|
||||
- Previous candidate: `v6.2.0-rc.9`
|
||||
- Previous stable: `v6.1.2`
|
||||
- Rollback target: `v6.1.2`
|
||||
- Rollback command: `./scripts/install.sh --version v6.1.2`
|
||||
- Promotion path: exact-SHA single-build release candidate from `main`,
|
||||
published as a support prerelease that does not move stable or latest
|
||||
install pointers
|
||||
- Code-backed validation-risk head:
|
||||
`5ff0855882cdbcfc9d4c8f8d87a1ffa3972db818` (61 commits and 226 changed files
|
||||
since `v6.2.0-rc.9`)
|
||||
- Windows signing decision: Authenticode through SignPath is the mandatory
|
||||
signing backend and no unsigned-Windows exception applies to any `v6.2.0`
|
||||
release
|
||||
- Mobile decision: `existing-mobile-build-compatible`; Pulse Mobile 1.0.0 iOS
|
||||
build 12 is distributed through the TestFlight public beta link and Android
|
||||
versionCode 9 remains on Play open testing, both using runtime version 2. The
|
||||
checked-in mobile compatibility proof passes for this server revision. No
|
||||
public store rollout is part of this candidate
|
||||
@@ -4,11 +4,13 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.8.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.7.md`
|
||||
|
||||
@@ -6,7 +6,7 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
|
||||
DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.9"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.10"
|
||||
|
||||
resolve_default_pulse_version() {
|
||||
if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then
|
||||
|
||||
@@ -644,14 +644,11 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"`v"+version+"` is a release candidate",
|
||||
"## Highlights",
|
||||
"stable `v"+previous+"`",
|
||||
"supersedes `v6.2.0-rc.8`",
|
||||
"Alert delivery preserves configured ntfy metadata and acknowledgement state",
|
||||
"Certificate-expiry monitoring, QNAP RAID bitmap parsing, real vCenter tags",
|
||||
"Agent install and update paths reject older served binaries",
|
||||
"Provider-hosted restore writes and automatic agent identity matching",
|
||||
"Phone and narrow-screen layouts retain workload identity",
|
||||
"Tenant resource stores close cleanly during offboarding and shutdown",
|
||||
"Targeted regressions cover the alert, monitoring, agent-install",
|
||||
"supersedes `v6.2.0-rc.9`",
|
||||
"Installer, diagnostic, and sign-in URLs reject untrusted origins",
|
||||
"Settings, resource links, update polling, health",
|
||||
"Agent/PBS lifecycle fixes",
|
||||
"Targeted proof covers request-origin validation, SSH host-key enforcement",
|
||||
"iOS build 12 is distributed through the TestFlight public beta link",
|
||||
"Android versionCode 9 remains available through Play open testing",
|
||||
"No public mobile-store rollout is part of this RC",
|
||||
@@ -661,17 +658,17 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
)
|
||||
assertFileContainsAllNormalized(t, changelogPath,
|
||||
"Version: `v"+version+"`",
|
||||
"Previous candidate: `v6.2.0-rc.8`",
|
||||
"Previous candidate: `v6.2.0-rc.9`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: exact-SHA single-build release candidate from `main`",
|
||||
"This changelog describes the changes since `v6.2.0-rc.8`",
|
||||
"Certificate-validity monitoring and alerting",
|
||||
"Shared generation-bound resource views across API requests",
|
||||
"Canonical agent auto-registration identity matching",
|
||||
"Preserved configured ntfy metadata, provider incidents",
|
||||
"Refused to serve agent binaries older than the server",
|
||||
"Closed the outstanding CodeQL findings",
|
||||
"This changelog describes the changes since `v6.2.0-rc.9`",
|
||||
"Typed prerelease containment records",
|
||||
"Fail-closed origin validation",
|
||||
"Viewer-safe Settings and workload navigation",
|
||||
"Oversized WebSocket snapshot recovery",
|
||||
"Unified Agent update convergence",
|
||||
"Self-hosted commercial opt-in posture",
|
||||
"Windows signing decision: Authenticode through SignPath is the mandatory signing backend",
|
||||
"Mobile decision: `existing-mobile-build-compatible`",
|
||||
"iOS build 12 is distributed through the TestFlight public beta link",
|
||||
@@ -710,7 +707,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
"The `v"+version+"` server cut is classified `existing-mobile-build-compatible`.",
|
||||
"The changes since RC8 do not alter mobile relay payloads, pairing, approvals, authentication, or onboarding contracts; no additional companion upload or public store rollout is part of RC9.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC10.",
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -134,6 +134,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T)
|
||||
{version: "6.2.0-rc.7", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.8", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.9", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.10", want: "6.1.2"},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
@@ -341,7 +342,8 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"is a monitoring-correctness, deployment-safety, security, and responsive-interface cut that supersedes `v6.2.0-rc.8`: it corrects alert delivery and infrastructure state, hardens agent install and update behavior, tightens authorization and dependency boundaries, and keeps operational controls usable across narrow layouts",
|
||||
"is a security-boundary, role-correct access, live-state recovery, and release-operations cut that supersedes `v6.2.0-rc.9`: it validates request-derived origins, verifies legacy-cleanup SSH hosts, aligns Settings and resource reads with session authority, recovers oversized WebSocket state, converges agent and PBS lifecycle behavior, restores the deliberate self-hosted commercial opt-in posture, and closes the historical credential-containment gate",
|
||||
"The preceding `v6.2.0-rc.9` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.9`.",
|
||||
"The preceding `v6.2.0-rc.8` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.8`.",
|
||||
"The preceding `v6.2.0-rc.7` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.7`.",
|
||||
"The preceding `v6.2.0-rc.6` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.6`.",
|
||||
@@ -352,7 +354,7 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
|
||||
"The preceding `v6.2.0-rc.1` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.1`.",
|
||||
"The `v"+version+"` server cut is classified `existing-mobile-build-compatible`.",
|
||||
"Pulse Mobile 1.0.0 iOS build 12 and Android versionCode 9 candidates, both using runtime version 2, remain distributed to the existing beta cohort through TestFlight and Play open testing.",
|
||||
"The changes since RC8 do not alter mobile relay payloads, pairing, approvals, authentication, or onboarding contracts; no additional companion upload or public store rollout is part of RC9.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC10.",
|
||||
"Authenticode signing through SignPath is the canonical Windows signing backend for the `v6.2.0` line.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user