From 5a865820a6e48ff479e487fe95ccaac9dfefda86 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Mon, 10 Aug 2026 00:54:43 +0100 Subject: [PATCH] Prepare v6.2.1 emergency patch release --- VERSION | 2 +- deploy/helm/pulse/Chart.yaml | 8 +-- deploy/helm/pulse/README.md | 2 +- docker-compose.yml | 2 +- docs/RELEASE_NOTES.md | 4 ++ docs/UPGRADE_v6.md | 5 ++ .../subsystems/deployment-installability.md | 32 ++++++++--- docs/releases/RELEASE_NOTES_v6.2.1.md | 55 +++++++++++++++++++ docs/releases/V6_CHANGELOG_v6.2.1.md | 35 ++++++++++++ scripts/install-docker.sh | 2 +- .../installtests/build_release_assets_test.go | 22 +++----- .../installtests/install_docker_sh_test.go | 6 +- 12 files changed, 143 insertions(+), 32 deletions(-) create mode 100644 docs/releases/RELEASE_NOTES_v6.2.1.md create mode 100644 docs/releases/V6_CHANGELOG_v6.2.1.md diff --git a/VERSION b/VERSION index 6abaeb2f9..024b066c0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.2.0 +6.2.1 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index d50e77ff6..90e8c80f8 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. type: application -version: 6.2.0 -appVersion: "6.2.0" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.0/docs/images/pulse-logo.svg +version: 6.2.1 +appVersion: "6.2.1" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.1/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.2.0/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.2.1/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 50df7e7b8..56d8501a9 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.2.0](https://img.shields.io/badge/Version-6.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.0](https://img.shields.io/badge/AppVersion-6.2.0-informational?style=flat-square) +![Version: 6.2.1](https://img.shields.io/badge/Version-6.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.1](https://img.shields.io/badge/AppVersion-6.2.1-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index 6ef84f2e0..253eb4fe7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.0} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.1} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 42baed1ad..48bd8069c 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -7,6 +7,10 @@ For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` For the current stable v6 packet, see: +- `docs/releases/RELEASE_NOTES_v6.2.1.md` +- `docs/releases/V6_CHANGELOG_v6.2.1.md` + +For earlier stable v6.2 packets, see: - `docs/releases/RELEASE_NOTES_v6.2.0.md` - `docs/releases/V6_CHANGELOG_v6.2.0.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index 2d14d7421..a312c1284 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -4,6 +4,11 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current stable v6 packet, see: +- `docs/releases/RELEASE_NOTES_v6.2.1.md` +- `docs/releases/V6_CHANGELOG_v6.2.1.md` + +For earlier stable v6.2 packets, see: + - `docs/releases/RELEASE_NOTES_v6.2.0.md` - `docs/releases/V6_CHANGELOG_v6.2.0.md` diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 4bc4387a7..e03b95113 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -1363,7 +1363,7 @@ host-local redirect contract as runtime token minting and exchange. Proof input must reject absolute, scheme-relative, backslash-authority, encoded-separator, and control-character targets before constructing the handoff request. -The active stable `v6.2.0` cut sets the repo-root `VERSION`, repo-root +The preceding stable `v6.2.0` cut set the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `6.2.0` release version. This stable minor release uses `promoted_from_tag=v6.2.0-rc.11`, @@ -1393,6 +1393,23 @@ diagnostics. The same release workflow also executes the generated self-signed and custom-CA Windows installer commands through Windows PowerShell 5.1 before release assembly, so the first HTTPS fetch is release proof rather than a string-shape assertion. +The active stable `v6.2.1` cut sets the repo-root `VERSION`, repo-root +`docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and +Helm chart release metadata to the same `6.2.1` release version. This emergency +patch uses the integrated exact-SHA candidate and definitive release verdict +because the release range repairs active customer +harm in agent download preflight, Agent Doctor credential recovery, strict +subscription-provider tool schemas, and fresh Pro activation discovery. The +installer/updater risk boundary requires the explicit patch hotfix reason even +though the workflow performs the normal immutable-candidate checks before its +publication boundary. Windows executables must be Authenticode-signed through +SignPath; no unsigned-Windows exception is authorized for `v6.2.1`. The mobile +decision is `no-mobile-impact` because the patch does not change the checked-in +mobile API, Relay, pairing, approval, push, authentication, or onboarding +contracts. +This patch release uses the stable hotfix path with +`rollback_version=v6.2.0`, `hotfix_exception=true`, a release-owner reason, and +no fabricated same-version RC tag. The stable server cut is classified `existing-mobile-build-compatible`. The synchronized Pulse Mobile 1.0.0 iOS build 12 and Android versionCode 9 candidates, both using runtime version 2, @@ -1623,13 +1640,12 @@ For the active stable `v6.1.2` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the governed `VERSION` is that stable cut. The stable promotion guard remains in force and rejects leftover `-rc.` defaults. -For the active stable `v6.2.0` cut, the repo-root compose default and -`scripts/install-docker.sh` fallback must both pin `6.2.0` until the next -governed release moves them forward. The stable promotion guard remains in -force and rejects leftover `-rc.` defaults. Each new release moves these two -pins together with the repo-root `VERSION` and the Helm chart metadata in the -same commit; a cut that leaves any of the four on a superseded value is a -release-packet blocker. +For the active stable `v6.2.1` cut, the repo-root compose default and +`scripts/install-docker.sh` fallback must both pin `6.2.1`. The stable +promotion guard remains in force and rejects leftover `-rc.` defaults. Each +new release moves these two pins together with the repo-root `VERSION` and the +Helm chart metadata in the same commit; a cut that leaves any of the four on a +superseded value is a release-packet blocker. The RC11 packet records `2018aa8a9a965d693982e260f525f6cc4f49aa41` as the code-backed validation-risk head. That head covers 68 commits and 241 files since RC9 across request-origin and SSH trust, settings RBAC and responsive diff --git a/docs/releases/RELEASE_NOTES_v6.2.1.md b/docs/releases/RELEASE_NOTES_v6.2.1.md new file mode 100644 index 000000000..df445c00f --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.2.1.md @@ -0,0 +1,55 @@ +# Pulse v6.2.1 Release Notes + +`v6.2.1` is a stable patch release following `v6.2.0`. It is promoted through +the emergency hotfix path because it repairs active customer failures in agent +installation and subscription-backed automation, and makes license activation +discoverable on fresh Pulse Pro installs. + +## Highlights + +- Agent download preflight follows redirects and validates final checksum and + signature headers. +- Agent Doctor recovers stale credentials; subscription-backed Patrol tools use + strict provider schemas. +- Fresh Pro installs expose activation; compiled Pro builds show commercial + context outside demo and white-label modes. + +## Fixed + +- Redirecting agent artifact endpoints no longer lose the final response + headers needed for checksum and signature preflight (#1696). +- Agent Doctor repairs stale local agent credentials through the governed + recovery flow instead of leaving the agent unable to report. +- Subscription-provider tools no longer send schemas rejected for missing + strict object-field requirements (#1697). +- New Pro deployments can reach Plans & Billing before activation and keep the + expected commercial navigation after activation. +- Demo state converges after successful activation instead of retaining stale + pre-activation presentation. + +## Upgrade Notes + +Use the normal v6 install or update flow for `v6.2.1`. + +This is an emergency hotfix because the agent download issue crosses the +installer/updater risk boundary and causes active customer harm. The governed +release workflow still requires the integrated exact-SHA candidate checks, +immutable artifacts, published-digest verification, and definitive release +verdict. + +Windows Unified Agent binaries in `v6.2.1` are required to be +Authenticode-signed through SignPath. No unsigned-Windows exception is +authorized for this release. + +The rollback target is `v6.2.0`. The exact rollback reinstall command is: + +```bash +./scripts/install.sh --version v6.2.0 +``` + +The server/mobile decision is `no-mobile-impact`. No mobile-facing API, Relay, +pairing, approval, push, authentication, or onboarding contract changed, so no +companion build upload or mobile-store rollout is required. + +Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the +private download page and private runtime image for paid runtime features. diff --git a/docs/releases/V6_CHANGELOG_v6.2.1.md b/docs/releases/V6_CHANGELOG_v6.2.1.md new file mode 100644 index 000000000..c02aa8b0c --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.2.1.md @@ -0,0 +1,35 @@ +# Pulse v6.2.1 + +_This changelog describes stable `v6.2.1` compared with stable `v6.2.0`._ + +## Changed + +- The compiled Pro edition now supplies commercial presentation context even + before a license is activated, while demo and white-label suppression remains + authoritative. +- Fresh Pro setup points operators directly to license activation. + +## Fixed + +- Agent artifact preflight follows redirects and validates the checksum and + signature headers on the final response (#1696). +- Agent Doctor repairs stale installed-agent reporting credentials. +- Subscription-backed Patrol tools use strict provider-compatible JSON + schemas (#1697). +- Activation completion clears stale demo presentation state. + +## Release Metadata + +- Version: `v6.2.1` +- Previous stable: `v6.2.0` +- Rollback target: `v6.2.0` +- Rollback command: `./scripts/install.sh --version v6.2.0` +- Promotion path: emergency stable patch from `main`, using the integrated + exact-SHA candidate and definitive release verdict +- Emergency reason: active customer harm in agent download preflight, + installed-agent credential recovery, subscription-backed tool execution, and + fresh Pro activation discovery +- Windows signing decision: Authenticode is required through SignPath; no + unsigned-Windows exception is authorized for `v6.2.1` +- Mobile decision: `no-mobile-impact`; no companion build upload or public + store rollout is required diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index 7954e098b..bfcde7e68 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.2.0" +CANONICAL_DEFAULT_PULSE_VERSION="6.2.1" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index b5dd6a389..a2e907778 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -511,23 +511,19 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) { assertFileContainsAllNormalized(t, releaseNotesPath, "`v"+version+"` is a stable patch release", "`v"+previous+"`", - "Proxmox monitoring is more authoritative", - "TrueNAS monitoring uses the supported JSON-RPC transport", - "QNAP and Unraid installs now fail early", - "not Authenticode-signed", - "Unknown Publisher", + "Use the normal v6 install or update flow", + "integrated exact-SHA candidate checks", + "Authenticode-signed through SignPath", + "No unsigned-Windows exception is authorized", "`no-mobile-impact`", - "rollback target for this patch release is `v"+previous+"`", + "rollback target is `v"+previous+"`", ) - assertFileContainsAll(t, changelogPath, + assertFileContainsAllNormalized(t, changelogPath, "Version: `v"+version+"`", "Rollback target: `v"+previous+"`", - "Promotion path: stable patch hotfix from `"+releaseBranch+"`", - "Proxmox and PBS monitoring", - "TrueNAS uses its supported JSON-RPC transport", - "Unified Agent installs on constrained QNAP and Unraid roots", - "`v6.1.2`-only", - "Unknown Publisher", + "Promotion path: emergency stable patch from `"+releaseBranch+"`", + "Windows signing decision: Authenticode is required through SignPath", + "no unsigned-Windows exception is authorized for `v"+version+"`", "Mobile decision: `no-mobile-impact`", ) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index ea78a1c06..6deeccb8b 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -295,10 +295,10 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) { assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), "The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", "This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.", - "agent lifecycle, operator-state, and security fixes", + "active customer harm", "`no-mobile-impact`", - "version-bound unsigned-Windows exception", - "Unknown Publisher disclosure", + "Windows executables must be Authenticode-signed through SignPath", + "no unsigned-Windows exception is authorized for `v"+version+"`", "For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`", ) }