41 lines
3.0 KiB
Markdown
41 lines
3.0 KiB
Markdown
# REPORT — controller v0.345.1: cloudflared 2026.10.3 (security), 2026-10-26 evening (attended)
|
||
|
||
> A sibling of `REPORT.md`, not an overwrite: the night session (D53, R-1218/1219/1220) owns `REPORT.md` tonight and
|
||
> writes into this repo at the same time.
|
||
|
||
## In plain words
|
||
|
||
- **What:** Cloudflare said on 2026-10-20 that cloudflared before 2026.10.2 trusts eight bad certificate issuers
|
||
(eMudhra, weak keys). Every Felhom box ran cloudflared 2026.9.3 in its guest. Controller **0.345.1** = the released
|
||
0.345.0 + only the new cloudflared pin `2026.10.3`. Nothing from tonight's `main` is in it.
|
||
- **Did it work:** yes. Every box with a tunnel (Tester 1, demo-hp, demo-felhom) runs controller 0.345.1 and cloudflared
|
||
2026.10.3, healthy; the hub says „running (connected)" for all three; all 29 public names still redirect http → https.
|
||
Tester4 moved to 0.345.1 by the global floor (it has no tunnel). Tester 2 has no box.
|
||
- **Gaps:** the tunnel was down about 2 s (Tester 1), 4 s (demo-felhom) and 11 s (demo-hp) while cloudflared restarted.
|
||
|
||
## What changed
|
||
|
||
| Where | What |
|
||
|---|---|
|
||
| tag `v0.345.1` = `f3204024` (on `6bfb784`) | `infra.CloudflaredImage` → `cloudflare/cloudflared:2026.10.3`; test `TestEnsureCloudflared_ANewImageRecreatesTheTunnel`; CHANGELOG entry |
|
||
| `main` `a1c65b3d` | the same change, plus `build.sh`: a `--push` may build from the pushed tag `v<VERSION>` when it is HEAD (operator's yes, this session); 4 new cases in `scripts/test_build_push_once.sh` |
|
||
|
||
- Red-proofs: the new reconcile test failed with the „compose changed" check removed; the build cases failed both ways
|
||
(tag branch accepting anything: 4 of 20 fail; tag branch removed: 1 of 20 fails).
|
||
- Gates `--fast` green on both commits; `go test ./...` green on the tag commit (`internal/stacks` 450 s under the night
|
||
session's load). CI by commit: `a1c65b3d` job 2392 success; `f3204024` job 2393 success (run_attempt 1 each).
|
||
- Image `gitea.dooplex.hu/admin/felhom-controller:0.345.1` (and `:latest`) digest
|
||
`sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6`, built from `f3204024`.
|
||
- cloudflared image index digest `sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39`.
|
||
- How a box takes it: `controller/internal/stacks/infra.go` `ensureCloudflared` — the rendered compose differs (the
|
||
`image:` line) → `compose up -d` recreates the container. Seen on all three boxes: `[infra] cloudflared compose
|
||
changed … recreating cloudflared` 1–2 s after `[selfupdate] Post-update startup: update successful (0.345.0 → 0.345.1)`.
|
||
|
||
## For the night session
|
||
|
||
`main` carries the bump (`a1c65b3d`). Your next release from `main` keeps cloudflared 2026.10.3 — no action needed.
|
||
Your CHANGELOG „Unreleased" block is unchanged; the v0.345.1 section sits between it and v0.345.0.
|
||
|
||
Evidence: felhom.eu `documentation/audits/cloudflared-2026.10.3-2026-10-26/`. Register: R-1300 (closed), R-1301
|
||
(opened). Full session report: felhom.eu `REPORT-cloudflared-2026-10-26.md`.
|