admin
a7e86fd273
Closed: R-1354, R-1347, R-1348, R-1339, R-1351, R-1323, R-1302, R-1352, R-1331, R-1356, R-1359 (235 -> 224). R-548 and R-1361 carry today's readings.
Golden 0.350.0 — bake + publish, 2026-11-03 (release brief, Part 2; it replaces 0.349.0)
Why: golden 0.349.0 (../golden-0.349.0-2026-11-03/, baked the same morning, never vouched) still holds Traefik v3.7.16,
which has GHSA-xv5x-242w-7hf7 (R-1354). The operator: „Do not vouch 0.349.0." Procedure: 0.349.0's README, the same
recipe. Controller 0.350.0 was already the global floor (07:18:16 UTC, MinAgent 0.158.1).
Previous (../golden-0.349.0-2026-11-03/) |
This bake | |
|---|---|---|
build-golden.sh |
v3.2.0, 645b3b65… |
same file |
| Controller | felhom-controller:0.349.0 |
felhom-controller:0.350.0 (MinAgent 0.158.1, image sha256:9ee53908…) |
| Traefik baked | v3.7.16 | v3.7.17 |
| Docker engine | os-docker-20261026-190351 |
same six pairs |
| Template | debian-13-standard_13.6-1_amd64.tar.zst |
same |
| Token | from sec, file → file |
same |
Pass markers (from bake.log, this folder)
[golden] build-golden.sh v3.2.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.350.0
[golden] Docker engine set PINNED to the approved release: containerd.io=2.4.2-3~debian.13~trixie … docker-compose-plugin=5.6.1-1~debian.13~trixie
docker OK (overlay2; data-root /var/lib/docker)
[golden] baking infra images (4): traefik:v3.7.17 cloudflare/cloudflared:2026.10.4 gtstef/filebrowser:1.5.8-stable gitea.dooplex.hu/admin/felhom-samba:1.2.0 …
INFO: including mount point rootfs ('/') in backup
INFO: including mount point mp0 ('/var/lib/felhom') in backup
[golden] upload OK (HTTP 201)
GOLDEN_VERSION=0.350.0
GOLDEN_SHA256=082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b
No excluding, no FATAL, no GOLDEN_DOCKER_PKGS not set; the unit deactivated successfully. Round trip: the registry's
file downloaded and hashed = the bake's sha, 639,545,403 bytes (02-round-trip.txt). Token: the unit's properties grep = 0;
the committed log grep = 0, with a working control (= 1). The bake's one WARNING is docker's own line about the login in the
build guest; the script removes the login before it archives, and a listing of the archive for .docker/config.json reads 0 on
both the bake's file and the registry's copy. Teardown: 03-teardown.txt. No controller push after the bake.
The fresh install
../../audits/release-2026-11-03/part2/README.md.
Vouch — done by the operator, 10:18:10 CET
- golden 0.350.0, sha256
082e2e040de5615300da3ec8bc48fe6761ee0e6375dcc732e5cba82086e5e06b - agent 0.172.0, sha256
2c0222cd01713f65c627d6d17c18b4a8b2b1e0c39881db0df7ccb17de48e24c7, bundlecc34b0bc3346ffd6a4ba80fe9269852dced8c56c9503c8b14a50d9ded2961cce - min_agent 0.158.1 (unchanged)