Release Server v1.6.355 authentication update

Author: chen21019

.github/workflows/publish-port-preflight-runtime-patch.yml

@@ -5,7 +5,10 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  attestations: write
   packages: write
+  artifact-metadata: write
 
 concurrency:
   group: server-port-preflight-runtime-patch
@@ -105,6 +108,96 @@ jobs:
             "$SOURCE_SHA" "$RELEASE_TAG" "$payload_a" "$image_a" "$image_b" |
             tee "$RUNNER_TEMP/reproducibility.txt"
 
+      - name: Verify scanner and enforce image security gates
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          trivy_version=0.73.0
+          trivy_sha256=2edd39da482bb4e9831962487b68f68e3928ec3137794757f54d00383d79547b
+          trivy_source_sha=40c73e5d6166dcc0346a1ab4e94499d1572854e4
+          trivy_root="${RUNNER_TEMP}/trivy-${trivy_version}"
+          trivy_asset="${trivy_root}/trivy_${trivy_version}_Linux-64bit.tar.gz"
+          mkdir -p "$trivy_root"
+
+          curl --fail --show-error --silent --location \
+            "https://github.com/aquasecurity/trivy/releases/download/v${trivy_version}/trivy_${trivy_version}_Linux-64bit.tar.gz" \
+            --output "$trivy_asset"
+          printf '%s  %s\n' "$trivy_sha256" "$trivy_asset" | sha256sum --check
+          trivy_attestation_status=verified
+          attestation_error="${trivy_root}/attestation-error.txt"
+          if ! gh attestation verify "$trivy_asset" \
+            --repo aquasecurity/trivy \
+            --signer-workflow aquasecurity/trivy/.github/workflows/reusable-release.yaml \
+            --source-ref "refs/tags/v${trivy_version}" \
+            --source-digest "$trivy_source_sha" \
+            --signer-digest "$trivy_source_sha" \
+            --deny-self-hosted-runners \
+            2>"$attestation_error"; then
+            if grep -Fq 'organization has an IP allow list enabled' \
+              "$attestation_error"; then
+              trivy_attestation_status=unavailable-source-ip-allow-list
+              printf '::warning::Trivy provenance API is unavailable because the source organization rejects this hosted-runner IP. Exact asset SHA-256 verification remains mandatory.\n'
+            else
+              cat "$attestation_error" >&2
+              exit 1
+            fi
+          fi
+          tar -xzf "$trivy_asset" -C "$trivy_root"
+          test "$("${trivy_root}/trivy" --version | awk '/^Version:/ {print $2}')" = \
+            "$trivy_version"
+
+          "${trivy_root}/trivy" image \
+            --cache-dir "${RUNNER_TEMP}/trivy-cache" \
+            --scanners vuln,secret \
+            --format json \
+            --output "${RUNNER_TEMP}/server-security-scan.json" \
+            "$TARGET_IMAGE"
+          jq -e '.SchemaVersion == 2 and (.Results | type == "array")' \
+            "${RUNNER_TEMP}/server-security-scan.json" >/dev/null
+          jq -r '
+            .Results[]?
+            | .Target as $target
+            | .Vulnerabilities[]?
+            | select(.Severity == "CRITICAL" or .Severity == "HIGH")
+            | [.Severity, .VulnerabilityID, .PkgName, .InstalledVersion,
+               (.FixedVersion // ""), ($target // "")]
+            | @tsv
+          ' "${RUNNER_TEMP}/server-security-scan.json" |
+            LC_ALL=C sort -u >"${RUNNER_TEMP}/server-critical-high.tsv"
+          jq -r '
+            .Results[]?
+            | .Target as $target
+            | .Secrets[]?
+            | [.RuleID, .Category, .Severity, (.Title // ""), ($target // "")]
+            | @tsv
+          ' "${RUNNER_TEMP}/server-security-scan.json" |
+            LC_ALL=C sort -u >"${RUNNER_TEMP}/server-secrets.tsv"
+          test ! -s "${RUNNER_TEMP}/server-critical-high.tsv"
+          test ! -s "${RUNNER_TEMP}/server-secrets.tsv"
+
+          "${trivy_root}/trivy" image \
+            --cache-dir "${RUNNER_TEMP}/trivy-cache" \
+            --format cyclonedx \
+            --output "${RUNNER_TEMP}/server.cdx.json" \
+            "$TARGET_IMAGE"
+          jq -e '
+            .bomFormat == "CycloneDX"
+            and ((.specVersion | type) == "string")
+            and ((.components | type) == "array")
+            and ((.components | length) > 0)
+          ' "${RUNNER_TEMP}/server.cdx.json" >/dev/null
+          printf '%s\n' "$trivy_attestation_status" \
+            >"${RUNNER_TEMP}/trivy-attestation-verification.txt"
+          "${trivy_root}/trivy" --version >"${RUNNER_TEMP}/trivy-version.txt"
+          sha256sum \
+            "${RUNNER_TEMP}/server-security-scan.json" \
+            "${RUNNER_TEMP}/server-critical-high.tsv" \
+            "${RUNNER_TEMP}/server-secrets.tsv" \
+            "${RUNNER_TEMP}/server.cdx.json" \
+            "${RUNNER_TEMP}/trivy-attestation-verification.txt" \
+            "${RUNNER_TEMP}/trivy-version.txt" \
+            >"${RUNNER_TEMP}/server-security-evidence.sha256"
+
       - name: Publish public semantic-version image
         id: publish
         shell: bash
@@ -133,7 +226,23 @@ jobs:
             tee "$RUNNER_TEMP/published.txt"
           printf 'digest=%s\n' "$digest" >>"$GITHUB_OUTPUT"
 
+      - name: Attest published image provenance
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-name: ghcr.io/pasturestack/server
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          push-to-registry: true
+
+      - name: Attest published image SBOM
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-name: ghcr.io/pasturestack/server
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          sbom-path: ${{ runner.temp }}/server.cdx.json
+          push-to-registry: true
+
       - name: Retain publication evidence
+        if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: server-${{ env.RELEASE_TAG }}-publication-evidence
@@ -144,6 +253,13 @@ jobs:
             ${{ runner.temp }}/push.log
             ${{ runner.temp }}/image-inspect.txt
             ${{ runner.temp }}/published.txt
+            ${{ runner.temp }}/server-security-scan.json
+            ${{ runner.temp }}/server-critical-high.tsv
+            ${{ runner.temp }}/server-secrets.tsv
+            ${{ runner.temp }}/server.cdx.json
+            ${{ runner.temp }}/server-security-evidence.sha256
+            ${{ runner.temp }}/trivy-attestation-verification.txt
+            ${{ runner.temp }}/trivy-version.txt
           if-no-files-found: error
           retention-days: 30
           compression-level: 9

README.md

@@ -11,8 +11,9 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 This is a compatibility-focused modernization project. Existing Ubuntu 26.04,
 Java 25, MariaDB, modern Docker, non-root runtime, artifact-integrity,
 authentication, WebSocket, backup/restore, and test work is retained. Server
-`v1.6.355` combines Orchestration Engine `0.183.281`, Node Agent `0.13.22`, and
-the reviewed Ember 6.12 LTS Web Console `1.6.66`.
+`v1.6.355` combines Orchestration Engine `0.183.281`, Node Agent `0.13.22`,
+Authentication Service `0.4.35`, and the reviewed Ember 6.12 LTS Web Console
+`1.6.68`.
 
 Authoritative host-port and volume preflight protects create and upgrade
 operations without weakening project ownership checks. Managed-network checks
@@ -59,12 +60,18 @@ The Web Console formats schema-validation field names without legacy String
 prototype extensions, so a missing localized field label cannot leave a
 container or service form stuck in the saving state.
 
-Web Console `1.6.66` gives the loading overlay a deterministic lifecycle and a
+Web Console `1.6.68` gives the loading overlay a deterministic lifecycle and a
 distinct rectangular PastureStack stack-panel loading state. Only the newest
 route transition may change its state; successful, rejected, aborted, and overlapping transitions
 release it safely, with a 30-second watchdog as a final recovery path. The
 retired grass, celestial-body, and orbit scene is rejected by the packaged
-image gate.
+image gate. Reduced-motion mode retains a low-displacement layer pulse and
+progress-colour cycle instead of leaving the overlay visually frozen.
+
+Authentication Service `0.4.35` is installed from its checksum-verified public
+release without replacing the established launch wrapper. The packaged image
+requires the reviewed archive digest, extracted-binary digest, exact source
+commit, static binary, and exact version output before publication.
 
 The embedded Catalog snapshot is pinned to commit
 `bc446236c16f1170eb9130b4901af3d57dd82db4`. It retains prior immutable

docs/releases/server-1.6.355.md

@@ -1,8 +1,9 @@
 # PastureStack Server v1.6.355
 
-Server v1.6.355 packages Web Console `1.6.66`, the reviewed Catalog snapshot,
-and the Resource Scheduler catalog revision without changing the established
-Orchestration Engine or Node Agent runtime coordinates.
+Server v1.6.355 packages Authentication Service `0.4.35`, Web Console `1.6.68`,
+the reviewed Catalog snapshot, and the Resource Scheduler catalog revision
+without changing the established Orchestration Engine or Node Agent runtime
+coordinates.
 
 ## Runtime components
 
@@ -11,10 +12,17 @@ Orchestration Engine or Node Agent runtime coordinates.
 - Orchestration Engine artifact SHA-256:
   `da2a8a51562ed16e296f7e29e99482bb44042ff0834cca679bbe01d951ba1682`
 - Node Agent: `0.13.22`
-- Web Console: `1.6.66`
-- Web Console source: `dd5f6428ae2bebbc3b427569906be43b419c2c99`
+- Authentication Service: `0.4.35`
+- Authentication Service source:
+  `b5f50c57407fcc1b789bff680084226fba2e3171`
+- Authentication Service archive SHA-256:
+  `17c10c2d907d75cc2ead63b9b7ec7c3535b9d45e812afede94c0df799251172b`
+- Authentication Service binary SHA-256:
+  `a49f60048d841b5e164a3f9d60f52f125e8d6b663f337b4aafb7a20b4e4034dd`
+- Web Console: `1.6.68`
+- Web Console source: `bcd2e28ef63878be5d3d38c06119395d09a0211f`
 - Web Console artifact SHA-256:
-  `826f68413598f1fcc8c6983f487cb357a4a1a46af2b65e7059f7c5c8d335054f`
+  `3f98339b378e2a77a86d3078ba3f1f1448030f58d5ef96b9c6bbfcb13b3f9a24`
 - Catalog snapshot: `bc446236c16f1170eb9130b4901af3d57dd82db4`
 - Resource Scheduler catalog release: `v0.8.16`
 
@@ -28,6 +36,17 @@ and aborted transitions all release the overlay, and a 30-second watchdog
 prevents an unresolved transition from blocking the interface indefinitely.
 The image gate requires the project mark, three stack layers, and progress rail,
 and rejects the retired grass, celestial-body, orbit, and rotating-ring scenes.
+Reduced-motion mode retains a low-displacement layer pulse and progress-colour
+cycle, so an operating-system accessibility preference does not leave the
+transition visually frozen.
+
+Authentication Service `0.4.35` preserves the established route, token,
+identity, encrypted-provider configuration, SAML callback, and launch-wrapper
+contracts while adding the reviewed provider-neutral OpenID Connect flow and
+identity-link proof. Assembly verifies both the release archive and extracted
+static binary by SHA-256, rejects unexpected archive members or links, and
+requires the exact version output before replacing only
+`/usr/bin/authentication-service.real`.
 
 The Catalog snapshot retains every prior immutable Resource Scheduler template
 revision and adds `v0.8.16` as a new revision. Its public image reference is
@@ -50,14 +69,18 @@ visible.
 
 ## Validation
 
-The exact Web Console source passed its source, dependency, workspace,
-focused transition, production-build, reproducible-artifact, and visible DOM
-gates. Server assembly verifies the public release checksum, archive root,
-version marker, required licenses, branded loading markers, and absence of the
-retired scene before producing the image. Live deployment acceptance also
-checks `/ping`, login, authenticated route navigation, overlay dismissal,
-Catalog revision discovery, Resource Scheduler continuity, container restart
-count, and rollback readiness.
+The exact Web Console source passed 340 Chrome 151 browser tests plus source,
+dependency, workspace, focused-transition, production-build,
+reproducible-artifact, and visible-DOM gates. The Authentication Service release
+passed its full race-enabled suite, two byte-identical builds, zero applicable
+Critical or High findings, CycloneDX 1.7 SBOM gate, OpenVEX review, and GitHub
+SLSA and SBOM attestation verification. Server assembly verifies the public
+release checksums, archive roots, version markers, required licenses, branded
+loading markers, and absence of the retired scene before producing the image.
+Live deployment acceptance also checks `/ping`, local login, OpenID Connect,
+MFA, authenticated route navigation, overlay dismissal, Catalog revision
+discovery, Resource Scheduler continuity, container restart count, and rollback
+readiness.
 
 PastureStack is an independent community effort to preserve, audit, and
 modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by