mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
chore(release): prepare v6.2.0-rc.11
This commit is contained in:
Richard Courtman
@@ -2,9 +2,9 @@ apiVersion: v2
|
||||
name: pulse
|
||||
description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
type: application
|
||||
version: 6.2.0-rc.10
|
||||
appVersion: "6.2.0-rc.10"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.10/docs/images/pulse-logo.svg
|
||||
version: 6.2.0-rc.11
|
||||
appVersion: "6.2.0-rc.11"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0-rc.11/docs/images/pulse-logo.svg
|
||||
keywords:
|
||||
- monitoring
|
||||
- proxmox
|
||||
@@ -32,7 +32,7 @@ annotations:
|
||||
description: Smoke tests with kind cluster deployment
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.10/docs/KUBERNETES.md
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.2.0-rc.11/docs/KUBERNETES.md
|
||||
- name: Support
|
||||
url: https://github.com/rcourtman/Pulse/discussions
|
||||
artifacthub.io/maintainers: |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# pulse
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@ version: '3.8'
|
||||
|
||||
services:
|
||||
pulse:
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.10}
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0-rc.11}
|
||||
container_name: pulse
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
|
||||
@@ -7,10 +7,12 @@ For historical v4 notes that previously lived in this repo, see:
|
||||
`docs/releases/RELEASE_NOTES_v4.md`
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.11.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
|
||||
+4
-2
@@ -4,11 +4,13 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.11.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
|
||||
@@ -1338,23 +1338,25 @@ host-local redirect contract as runtime token minting and exchange. Proof input
|
||||
must reject absolute, scheme-relative, backslash-authority, encoded-separator,
|
||||
and control-character targets before constructing the handoff request.
|
||||
|
||||
The active support prerelease `v6.2.0-rc.10` cut sets the repo-root `VERSION`,
|
||||
The active support prerelease `v6.2.0-rc.11` cut sets the repo-root `VERSION`,
|
||||
repo-root `docker-compose.yml` image default, `scripts/install-docker.sh`
|
||||
fallback, and Helm chart release metadata to the same `6.2.0-rc.10` release
|
||||
fallback, and Helm chart release metadata to the same `6.2.0-rc.11` release
|
||||
version. This support prerelease keeps `rollback_version=v6.1.2`, publishes a
|
||||
versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and
|
||||
does not move stable/latest install pointers or stable semver aliases. Stable
|
||||
install pointers stay on `v6.1.2`, whose active stable cut is recorded below and
|
||||
continues to govern the stable line until this candidate is promoted. The tenth
|
||||
`v6.2.0` candidate is a security-boundary, role-correct access, live-state
|
||||
recovery, and release-operations cut that supersedes `v6.2.0-rc.9`: it validates
|
||||
continues to govern the stable line until this candidate is promoted. The
|
||||
eleventh `v6.2.0` candidate is a security-boundary, role-correct access,
|
||||
live-state recovery, and release-operations cut that supersedes
|
||||
`v6.2.0-rc.9`: it validates
|
||||
request-derived origins, verifies legacy-cleanup SSH hosts, aligns Settings and
|
||||
resource reads with session authority, recovers oversized WebSocket state,
|
||||
converges agent and PBS lifecycle behavior, restores the deliberate self-hosted
|
||||
commercial opt-in posture, and closes the historical credential-containment
|
||||
gate. The exact `main` SHA must pass the integrated release checks and
|
||||
immutable-candidate build before the single-build workflow crosses its public
|
||||
mutation boundary.
|
||||
commercial opt-in posture, closes the historical credential-containment gate,
|
||||
and retries GET when Proxmox reports HTTP 405 or 501 for unsupported HEAD
|
||||
availability probes. The exact `main` SHA must pass the integrated release
|
||||
checks and immutable-candidate build before the single-build workflow crosses
|
||||
its public mutation boundary.
|
||||
Every release cut, including a prerelease, now gates that mutation boundary on
|
||||
the complete frontend unit suite, frontend type-checking, and a deterministic
|
||||
render smoke against the verified frontend bundle. The smoke must render
|
||||
@@ -1365,13 +1367,22 @@ diagnostics. The same release workflow also executes the generated self-signed
|
||||
and custom-CA Windows installer commands through Windows PowerShell 5.1 before
|
||||
release assembly, so the first HTTPS fetch is release proof rather than a
|
||||
string-shape assertion.
|
||||
The `v6.2.0-rc.10` server cut is classified
|
||||
The `v6.2.0-rc.11` server cut is classified
|
||||
`existing-mobile-build-compatible`. The synchronized Pulse Mobile 1.0.0 iOS
|
||||
build 12 and Android versionCode 9 candidates, both using runtime version 2,
|
||||
remain distributed to the existing beta cohort through TestFlight and Play
|
||||
open testing. The changes since RC9 preserve the checked-in mobile API, Relay,
|
||||
pairing, approval, push, authentication, and onboarding contracts; no additional
|
||||
companion upload or public store rollout is part of RC10.
|
||||
companion upload or public store rollout is part of RC11.
|
||||
The preceding `v6.2.0-rc.10` attempt used the same support-prerelease path with
|
||||
`rollback_version=v6.1.2`, but it is an abandoned partial candidate rather than
|
||||
the current public-testing identity. Run `31267947317` staged its annotated tag,
|
||||
unpublished draft and exact-version release assets, public Docker images, public
|
||||
OCI Helm chart, and private Pro runtime from
|
||||
`76e07be290892ed8453bbed942855c1e7f673232` before install smoke failed. Because
|
||||
those immutable-looking versioned artifacts escaped the draft boundary, RC10
|
||||
must not be retargeted to another source revision; RC11 provides the clean
|
||||
successor identity while the RC10 evidence remains available for audit.
|
||||
The preceding `v6.2.0-rc.9` candidate used the same support-prerelease path
|
||||
with `rollback_version=v6.1.2` and pinned the same four install surfaces to
|
||||
`6.2.0-rc.9`. It is superseded by this cut and no longer governs the install
|
||||
@@ -1567,22 +1578,22 @@ For the active stable `v6.1.2` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the
|
||||
governed `VERSION` is that stable cut. The stable promotion guard remains in
|
||||
force and rejects leftover `-rc.` defaults.
|
||||
For the active support prerelease `v6.2.0-rc.10` cut, the repo-root compose
|
||||
default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.10`
|
||||
For the active support prerelease `v6.2.0-rc.11` cut, the repo-root compose
|
||||
default and `scripts/install-docker.sh` fallback must both pin `6.2.0-rc.11`
|
||||
until the next governed stable cut moves them forward. The stable promotion
|
||||
guard remains in force and must reject leftover `-rc.` defaults when the
|
||||
governed `VERSION` returns to a stable release. Each new candidate on the
|
||||
`v6.2.0` line moves these two pins together with the repo-root `VERSION` and
|
||||
the Helm chart metadata in the same commit; a candidate that leaves any of the
|
||||
four on a superseded `6.2.0-rc.*` value is a release-packet blocker.
|
||||
The RC10 packet records `5ff0855882cdbcfc9d4c8f8d87a1ffa3972db818` as
|
||||
the code-backed validation-risk head. That head covers 61 commits and 226 files
|
||||
The RC11 packet records `2018aa8a9a965d693982e260f525f6cc4f49aa41` as
|
||||
the code-backed validation-risk head. That head covers 68 commits and 241 files
|
||||
since RC9 across request-origin and SSH trust, settings RBAC and responsive
|
||||
layout, WebSocket recovery and resource deltas, agent and PBS lifecycle,
|
||||
commercial-surface rollback, release-control hardening, and customer artifact
|
||||
promotion. The credential-containment record and metadata-only
|
||||
release-preparation commits may be the workflow dispatch head because they do
|
||||
not change that code-backed release-risk range.
|
||||
commercial-surface rollback, Proxmox availability fallback, release-control
|
||||
hardening, and customer artifact promotion. The monitoring-contract correction
|
||||
and metadata-only release-preparation commits may be the workflow dispatch head
|
||||
because they do not change that code-backed release-risk range.
|
||||
|
||||
`internal/updates/` is the live deployment and upgrade planner. It owns
|
||||
deployment-type detection, update-plan generation, adapter selection, server
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
# Pulse v6.2.0-rc.11 Release Notes
|
||||
|
||||
`v6.2.0-rc.11` is a release candidate for the next Pulse v6 minor line. It
|
||||
follows stable `v6.1.2`, replaces the abandoned partial `v6.2.0-rc.10`
|
||||
candidate, and supersedes `v6.2.0-rc.9` for public prerelease testing. This
|
||||
candidate focuses on security boundaries, role-correct settings and resource
|
||||
access, resilient live state recovery, accurate Proxmox availability, and safer
|
||||
release operations.
|
||||
|
||||
## Highlights
|
||||
|
||||
- Security hardening blocks untrusted installer, diagnostic, sign-in, and SSH cleanup origins.
|
||||
- Role-correct Settings and resilient recovery keep viewer access and live resource state coherent.
|
||||
- Proxmox availability retries GET when a server rejects HEAD with HTTP 405 or 501.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Rejected hostile request-host, forwarded-host, and configured-public-URL
|
||||
values before they can enter copied installer commands, hosted diagnostics,
|
||||
or magic-link responses.
|
||||
- Hid administrator-only System and infrastructure settings from viewer
|
||||
sessions, stopped viewer polling of privileged endpoints, and kept
|
||||
viewer-safe workload health available without offering inaccessible routes.
|
||||
- Recovered from WebSocket frames above the inbound guard without accepting an
|
||||
oversized baseline, and applied subsequent resource deltas to canonical raw
|
||||
server state.
|
||||
- Prevented update-status polling outside the routes that own update authority
|
||||
and reduced routine authorization-denial log noise without weakening abuse
|
||||
signals.
|
||||
- Stopped repeated PBS node-name fetches, corrected retry classification, and
|
||||
preserved configured alert intent for agents merged with Proxmox nodes.
|
||||
- Retried HTTP and HTTPS availability probes with GET when a target reports
|
||||
that HEAD is unsupported through HTTP 405 or 501, while retaining failures
|
||||
for other server errors.
|
||||
- Corrected responsive Settings panel clipping and restored architecture tests
|
||||
that keep desktop, tablet, and phone navigation coherent.
|
||||
- Restored authenticated draft-asset access for release install smoke and gave
|
||||
the Windows TLS fixture a bounded setup window on cold hosted runners.
|
||||
- Restored release staging before publication, exact-version paid-customer
|
||||
promotion order, verifiable MSP evaluation delivery, and dependency-audit
|
||||
enforcement for the shipped frontend.
|
||||
|
||||
## Release Qualification
|
||||
|
||||
- The v6 control plane reports all 44 readiness assertions and all 26 release
|
||||
gates passed, including complete provider closure and replacement or
|
||||
retirement evidence for every historically reachable credential identity.
|
||||
- The post-RC9 code-backed validation-risk range contains 68 commits across 241
|
||||
files and ends at `2018aa8a9a965d693982e260f525f6cc4f49aa41`; the monitoring
|
||||
contract and RC11 packet commits are metadata-only successors.
|
||||
- RC10 is not reused: an earlier failed attempt staged exact-version registry
|
||||
artifacts from `76e07be290892ed8453bbed942855c1e7f673232`, so RC11 provides a
|
||||
new immutable version identity for the corrected candidate.
|
||||
- Targeted proof covers request-origin validation, SSH host-key enforcement,
|
||||
settings RBAC and responsive layout, WebSocket recovery, resource deltas,
|
||||
PBS polling, Proxmox HTTP probe fallback, agent update convergence, release
|
||||
promotion, dependency audits, Windows install-command execution, and mobile
|
||||
API compatibility.
|
||||
- Release publication builds and validates one immutable `main` SHA before
|
||||
publishing the GitHub prerelease, Docker image, Helm chart, and private Pro
|
||||
packet.
|
||||
|
||||
## Upgrade Notes
|
||||
|
||||
Use the normal v6 install or update flow for `v6.2.0-rc.11` only when you are
|
||||
comfortable testing an RC. The rollback target is stable `v6.1.2`.
|
||||
|
||||
The exact rollback reinstall command is:
|
||||
|
||||
```bash
|
||||
./scripts/install.sh --version v6.1.2
|
||||
```
|
||||
|
||||
Existing configurations remain valid and no manual data migration is required.
|
||||
|
||||
This server candidate is compatible with the current Pulse Mobile 1.0.0 beta
|
||||
candidates. iOS build 12 is distributed through the TestFlight public beta link,
|
||||
and Android versionCode 9 remains available through Play open testing; both use
|
||||
runtime version 2. The changes since RC9 preserve the checked-in mobile API,
|
||||
Relay, pairing, approval, push, authentication, and onboarding contracts. No
|
||||
public mobile-store rollout is part of this RC.
|
||||
|
||||
Windows Unified Agent binaries in this candidate keep checksum and
|
||||
detached-signature verification, but they are not yet Authenticode-signed and
|
||||
Windows may show an unknown-publisher warning. No unsigned-Windows exception
|
||||
applies to any `v6.2.0` release. Stable `v6.2.0` must publish Windows agents
|
||||
through the mandatory SignPath Authenticode path.
|
||||
|
||||
Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
|
||||
private download page and private runtime image for paid runtime features.
|
||||
@@ -0,0 +1,66 @@
|
||||
# Pulse v6.2.0-rc.11
|
||||
|
||||
_This changelog describes the changes since `v6.2.0-rc.9` and replaces the
|
||||
abandoned partial `v6.2.0-rc.10` candidate. `v6.2.0-rc.11` remains a
|
||||
prerelease and rolls back to stable `v6.1.2`._
|
||||
|
||||
## Added
|
||||
|
||||
- Typed prerelease containment records for historically reachable credentials,
|
||||
backed by provider-observed closure and replacement or retirement evidence.
|
||||
- Fail-closed origin validation for hosted sign-in, diagnostics, and copied
|
||||
installer command surfaces.
|
||||
- Canonical worktree claim helpers and conflict-aware release-control routing
|
||||
for concurrent maintainers.
|
||||
|
||||
## Improved
|
||||
|
||||
- Viewer-safe Settings and workload navigation, including responsive panels
|
||||
and role-aware update-status polling.
|
||||
- Oversized WebSocket snapshot recovery through authenticated REST resync while
|
||||
retaining raw-state delta correctness.
|
||||
- Unified Agent update convergence, PBS node identity reuse, merged-resource
|
||||
alert intent handling, and Proxmox availability fallback when HEAD is not
|
||||
supported.
|
||||
- Release artifact staging, authenticated draft install smoke, cold-runner
|
||||
Windows TLS proof, customer promotion convergence, frontend dependency
|
||||
audits, historical secret scanning, and provider-MSP evaluation delivery.
|
||||
- Self-hosted commercial opt-in posture and plan-selection upgrade routing.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Blocked untrusted request-derived hosts and schemes from installer, hosted
|
||||
diagnostics, and magic-link responses.
|
||||
- Enforced SSH host-key verification during legacy sensor-proxy cleanup.
|
||||
- Removed inaccessible admin routes and background requests from viewer
|
||||
sessions while preserving authorized health summaries.
|
||||
- Prevented oversized WebSocket snapshots from becoming a corrupt recovery
|
||||
baseline and applied later deltas to canonical raw server state.
|
||||
- Corrected repeated PBS node-name reads, retry classification, responsive
|
||||
Settings clipping, and HTTP 501 availability false-down reports.
|
||||
- Removed the reverted proactive commercial prompt, telemetry, and checkout
|
||||
attribution cluster from the final candidate.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.2.0-rc.11`
|
||||
- Previous public candidate: `v6.2.0-rc.9`
|
||||
- Abandoned partial candidate: `v6.2.0-rc.10` at
|
||||
`76e07be290892ed8453bbed942855c1e7f673232`
|
||||
- Previous stable: `v6.1.2`
|
||||
- Rollback target: `v6.1.2`
|
||||
- Rollback command: `./scripts/install.sh --version v6.1.2`
|
||||
- Promotion path: exact-SHA single-build release candidate from `main`,
|
||||
published as a support prerelease that does not move stable or latest
|
||||
install pointers
|
||||
- Code-backed validation-risk head:
|
||||
`2018aa8a9a965d693982e260f525f6cc4f49aa41` (68 commits and 241 changed files
|
||||
since `v6.2.0-rc.9`)
|
||||
- Windows signing decision: Authenticode through SignPath is the mandatory
|
||||
signing backend and no unsigned-Windows exception applies to any `v6.2.0`
|
||||
release
|
||||
- Mobile decision: `existing-mobile-build-compatible`; Pulse Mobile 1.0.0 iOS
|
||||
build 12 is distributed through the TestFlight public beta link and Android
|
||||
versionCode 9 remains on Play open testing, both using runtime version 2. The
|
||||
checked-in mobile compatibility proof passes for this server revision. No
|
||||
public store rollout is part of this candidate
|
||||
@@ -4,11 +4,13 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current v6 support release candidate packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.11.md`
|
||||
|
||||
For historical v6.2 support release candidate packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.10.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.10.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.9.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0-rc.9.md`
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0-rc.8.md`
|
||||
|
||||
@@ -6,7 +6,7 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
|
||||
DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.10"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.2.0-rc.11"
|
||||
|
||||
resolve_default_pulse_version() {
|
||||
if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then
|
||||
|
||||
@@ -649,9 +649,9 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"## Highlights",
|
||||
"stable `v"+previous+"`",
|
||||
"supersedes `v6.2.0-rc.9`",
|
||||
"Installer, diagnostic, and sign-in URLs reject untrusted origins",
|
||||
"Settings, resource links, update polling, health",
|
||||
"Agent/PBS lifecycle fixes",
|
||||
"Security hardening blocks untrusted installer, diagnostic, sign-in, and SSH cleanup origins",
|
||||
"Role-correct Settings and resilient recovery keep viewer access and live resource state coherent",
|
||||
"Proxmox availability retries GET when a server rejects HEAD with HTTP 405 or 501",
|
||||
"Targeted proof covers request-origin validation, SSH host-key enforcement",
|
||||
"iOS build 12 is distributed through the TestFlight public beta link",
|
||||
"Android versionCode 9 remains available through Play open testing",
|
||||
@@ -662,7 +662,8 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
)
|
||||
assertFileContainsAllNormalized(t, changelogPath,
|
||||
"Version: `v"+version+"`",
|
||||
"Previous candidate: `v6.2.0-rc.9`",
|
||||
"Previous public candidate: `v6.2.0-rc.9`",
|
||||
"Abandoned partial candidate: `v6.2.0-rc.10`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: exact-SHA single-build release candidate from `main`",
|
||||
@@ -711,7 +712,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
"The `v"+version+"` server cut is classified `existing-mobile-build-compatible`.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC10.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC11.",
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -135,6 +135,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T)
|
||||
{version: "6.2.0-rc.8", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.9", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.10", want: "6.1.2"},
|
||||
{version: "6.2.0-rc.11", want: "6.1.2"},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
@@ -342,7 +343,8 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"is a security-boundary, role-correct access, live-state recovery, and release-operations cut that supersedes `v6.2.0-rc.9`: it validates request-derived origins, verifies legacy-cleanup SSH hosts, aligns Settings and resource reads with session authority, recovers oversized WebSocket state, converges agent and PBS lifecycle behavior, restores the deliberate self-hosted commercial opt-in posture, and closes the historical credential-containment gate",
|
||||
"is a security-boundary, role-correct access, live-state recovery, and release-operations cut that supersedes `v6.2.0-rc.9`: it validates request-derived origins, verifies legacy-cleanup SSH hosts, aligns Settings and resource reads with session authority, recovers oversized WebSocket state, converges agent and PBS lifecycle behavior, restores the deliberate self-hosted commercial opt-in posture, closes the historical credential-containment gate, and retries GET when Proxmox reports HTTP 405 or 501 for unsupported HEAD availability probes.",
|
||||
"The preceding `v6.2.0-rc.10` attempt used the same support-prerelease path with `rollback_version=v6.1.2`, but it is an abandoned partial candidate rather than the current public-testing identity.",
|
||||
"The preceding `v6.2.0-rc.9` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.9`.",
|
||||
"The preceding `v6.2.0-rc.8` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.8`.",
|
||||
"The preceding `v6.2.0-rc.7` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.7`.",
|
||||
@@ -354,7 +356,7 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) {
|
||||
"The preceding `v6.2.0-rc.1` candidate used the same support-prerelease path with `rollback_version=v6.1.2` and pinned the same four install surfaces to `6.2.0-rc.1`.",
|
||||
"The `v"+version+"` server cut is classified `existing-mobile-build-compatible`.",
|
||||
"Pulse Mobile 1.0.0 iOS build 12 and Android versionCode 9 candidates, both using runtime version 2, remain distributed to the existing beta cohort through TestFlight and Play open testing.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC10.",
|
||||
"The changes since RC9 preserve the checked-in mobile API, Relay, pairing, approval, push, authentication, and onboarding contracts; no additional companion upload or public store rollout is part of RC11.",
|
||||
"Authenticode signing through SignPath is the canonical Windows signing backend for the `v6.2.0` line.",
|
||||
"For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
)
|
||||
|
||||
@@ -4116,6 +4116,7 @@ class SubsystemLookupTest(unittest.TestCase):
|
||||
"self-hosted-paid-surface-classification",
|
||||
"self-hosted-core-monitoring-free",
|
||||
"self-hosted-commercial-scope-support-contract",
|
||||
"self-hosted-commercial-surfaces-opt-in-posture",
|
||||
"self-hosted-commercial-transition-contract",
|
||||
"self-hosted-paid-extras-packaging",
|
||||
"stable-release-promotion-model",
|
||||
|
||||
Reference in New Issue
Block a user