serve.zone/spark
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

5 Releases 36 Tags

RSS Feed
  • v1.9.1 eda2851191
    Compare

    SPARK v1.9.1
    Release / build-and-release (push) Successful in 3m44s
    Details
    Stable

    jkunz released this 2026-08-12 01:20:58 +00:00 | -4 commits to main since this release

    2026-08-12 - 1.9.1

    Security

    • Add durable Swarm-authoritative Coreflow ownership with exact node projection, secure host marker and session lock, authority-gated resource mutations, safe legacy adoption, persistent state placement, and fail-closed service, secret, and network reconciliation.
    • Pin Coreflow to one manager-owned replica with exact Docker socket, persistent state, placement, secret target, and network shape while allowing its known webgateway and read-only cgroup self-maintenance additions.
    • Create Coreflow at zero replicas, prove the complete stopped service shape, and only then start it; failed creation proofs remove the exact newly created service or secret.
    • Verify downloaded release binaries against the exact published SHA256 entry before stopping services or replacing an installation.

    Fixes

    • Pull managed mutable image tags through the Docker 7.9 provenance API, serialize the exact requested tag, and fence Coreflow stop operations by fresh service version and authority labels.
    • Roll back partially started daemon subsystems and task schedules, release the Coreflow session lock only after reconciliation settles, drain failed Cloudly responses, and terminate host-update and node-action process trees on command failure or daemon signals.
    • Defer Cloudly node actions until initial reconciliation completes, share overlapping service-update requests, and report non-owner skips as failed actions.
    • Bound and cancel self-update requests, drain scheduled updates during shutdown, and terminate heartbeat metric subprocesses before their tracked collection settles.
    • Retain versioned release assets, fail publication on Gitea API or asset validation errors, and keep new releases private until every asset is uploaded.
    Downloads