Modernize PastureStack Compose compatibility

Author: chen21019

.drone.yml

@@ -0,0 +1 @@
+* text=auto eol=lf

.gitattributes

@@ -0,0 +1,248 @@
+name: Security release gate
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'verification/compose-cli-*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: compose-cli-security-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build-test-scan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 75
+    env:
+      DAPPER_IMAGE: pasturestack/compose-cli-dapper:${{ github.sha }}
+      TRIVY_IMAGE: aquasec/trivy:0.73.0@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c
+      VERSION_OVERRIDE: v0.14.32
+      PLATFORM_COMPAT_JAR_URL: https://github.com/PastureStack/server/releases/download/v1.6.346/orchestration-engine-0.183.276.jar
+      PLATFORM_COMPAT_JAR_SHA256: 64bc18a1654b73116dce89f29ede7b4c629a8c5af236b482ef95f50a78ed6376
+
+    steps:
+      - name: Check out candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Record candidate identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -z "$(git status --porcelain)"
+          mkdir -p evidence
+          git rev-parse HEAD > evidence/source-revision.txt
+          sha256sum Dockerfile.dapper ubuntu-apt.lock vendor.conf > evidence/source-locks.sha256
+
+      - name: Build, test, validate, and package twice
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build \
+            --build-arg DAPPER_HOST_ARCH=amd64 \
+            --tag "$DAPPER_IMAGE" \
+            --file Dockerfile.dapper \
+            .
+
+          source_path="$GITHUB_WORKSPACE"
+          run_ci() {
+            docker run --rm \
+              --volume "${source_path}:/go/src/github.com/PastureStack/compose-cli" \
+              --volume /var/run/docker.sock:/var/run/docker.sock \
+              --env "DAPPER_UID=$(id -u)" \
+              --env "DAPPER_GID=$(id -g)" \
+              --env "GOCACHE=/tmp/go-build-cache-${GITHUB_RUN_ID}" \
+              --env "XDG_CONFIG_HOME=/tmp/go-config-${GITHUB_RUN_ID}" \
+              --env "GIT_CONFIG_GLOBAL=/tmp/gitconfig-${GITHUB_RUN_ID}" \
+              --env "VERSION_OVERRIDE=$VERSION_OVERRIDE" \
+              --env "SKIP_INTEGRATION=true" \
+              --env "PLATFORM_COMPAT_JAR_URL=$PLATFORM_COMPAT_JAR_URL" \
+              --env "PLATFORM_COMPAT_JAR_SHA256=$PLATFORM_COMPAT_JAR_SHA256" \
+              "$DAPPER_IMAGE" ci
+          }
+
+          run_ci
+          artifact="dist/artifacts/compose-executor-0.14.32-linux-amd64.gz"
+          test -s "$artifact"
+          cp "$artifact" /tmp/compose-executor-first.gz
+
+          rm -rf bin build dist
+          run_ci
+          cmp /tmp/compose-executor-first.gz "$artifact"
+          ./scripts/check-pasturestack-source
+
+          mkdir -p evidence/product
+          gzip -cd "$artifact" > evidence/product/compose-executor
+          chmod +x evidence/product/compose-executor
+          evidence/product/compose-executor --version | grep -F '0.14.32' >/dev/null
+          sha256sum "$artifact" > evidence/compose-executor.gz.sha256
+          docker run --rm --entrypoint go \
+            --volume "$PWD:/work:ro" \
+            "$DAPPER_IMAGE" \
+            version -m /work/evidence/product/compose-executor \
+            > evidence/product-go-version.txt
+
+      - name: Record resolved build inputs
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker inspect "$DAPPER_IMAGE" > evidence/dapper-image-inspect.json
+          docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
+            "printf 'package\\tversion\\n'; dpkg-query -W -f='\${binary:Package}\\t\${Version}\\n' | LC_ALL=C sort" \
+            > evidence/dapper-dpkg.tsv
+          cp vendor.conf evidence/vendor.conf
+
+      - name: Scan source, product, and build image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker pull "$TRIVY_IMAGE"
+          trivy_cache="$RUNNER_TEMP/trivy-cache"
+          source_tree="$(mktemp -d)"
+          trap 'rm -rf "$source_tree"' EXIT
+          mkdir -p "$trivy_cache"
+          git archive --format=tar HEAD | tar -xf - -C "$source_tree"
+
+          docker run --rm \
+            -v "$source_tree:/scan:ro" \
+            -v "$PWD/evidence:/evidence" \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" fs \
+            --scanners vuln,secret --format json \
+            --output /evidence/source-security.json /scan
+          docker run --rm \
+            -v "$PWD/evidence:/evidence" \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" rootfs \
+            --scanners vuln,secret --format json \
+            --output /evidence/product-security.json /evidence/product
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD:/work" -w /work \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" image \
+            --scanners vuln,secret --format json \
+            --output /work/evidence/dapper-image-raw.json "$DAPPER_IMAGE"
+
+          jq -r '
+            .Results[]?.Vulnerabilities[]?
+            | select(.Severity == "CRITICAL" or .Severity == "HIGH")
+            | [.VulnerabilityID, .PkgIdentifier.PURL]
+            | @tsv
+          ' evidence/dapper-image-raw.json | LC_ALL=C sort -u \
+            > /tmp/dapper-critical-high.tsv
+          jq -r '
+            .statements[]?
+            | select(
+                .status == "not_affected"
+                and .justification == "vulnerable_code_not_present"
+              )
+            | .vulnerability.name as $id
+            | .products[]?
+            | [$id, .["@id"]]
+            | @tsv
+          ' security/dapper.openvex.json | LC_ALL=C sort -u \
+            > /tmp/dapper-vex.tsv
+          test -s /tmp/dapper-critical-high.tsv
+          diff -u /tmp/dapper-critical-high.tsv /tmp/dapper-vex.tsv
+          test "$(jq '.statements | length' security/dapper.openvex.json)" \
+            -eq "$(wc -l < /tmp/dapper-vex.tsv)"
+          jq -e '
+            all(
+              .statements[];
+              .status == "not_affected"
+              and .justification == "vulnerable_code_not_present"
+              and ((.impact_statement | type) == "string")
+              and ((.impact_statement | length) > 0)
+            )
+          ' security/dapper.openvex.json >/dev/null
+          grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null
+          if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' evidence/dapper-dpkg.tsv; then
+            printf 'Unexpected Linux kernel runtime package in Dapper image\n' >&2
+            exit 1
+          fi
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD:/work" -w /work \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" image \
+            --scanners vuln,secret \
+            --vex /work/security/dapper.openvex.json --show-suppressed \
+            --format json \
+            --output /work/evidence/dapper-image-applicable.json "$DAPPER_IMAGE"
+          docker run --rm \
+            -v "$source_tree:/scan:ro" \
+            -v "$PWD/evidence:/evidence" \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" fs \
+            --format cyclonedx --output /evidence/source.cdx.json /scan
+          docker run --rm \
+            -v "$PWD/evidence:/evidence" \
+            -v "$trivy_cache:/root/.cache/trivy" \
+            "$TRIVY_IMAGE" rootfs \
+            --format cyclonedx --output /evidence/product.cdx.json /evidence/product
+
+      - name: Summarize and enforce candidate security
+        shell: bash
+        run: |
+          set -euo pipefail
+          count() {
+            jq "$2" "$1"
+          }
+          source_secrets=$(count evidence/source-security.json '[.Results[]?.Secrets[]?] | length')
+          source_critical=$(count evidence/source-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
+          source_high=$(count evidence/source-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
+          product_secrets=$(count evidence/product-security.json '[.Results[]?.Secrets[]?] | length')
+          product_critical=$(count evidence/product-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
+          product_high=$(count evidence/product-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
+          dapper_raw_critical=$(count evidence/dapper-image-raw.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
+          dapper_raw_high=$(count evidence/dapper-image-raw.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
+          dapper_applicable_critical=$(count evidence/dapper-image-applicable.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" and .Status != "not_affected")] | length')
+          dapper_applicable_high=$(count evidence/dapper-image-applicable.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH" and .Status != "not_affected")] | length')
+          dapper_secrets=$(count evidence/dapper-image-applicable.json '[.Results[]?.Secrets[]?] | length')
+          {
+            printf 'source_secrets=%s\n' "$source_secrets"
+            printf 'source_critical=%s\n' "$source_critical"
+            printf 'source_high=%s\n' "$source_high"
+            printf 'product_secrets=%s\n' "$product_secrets"
+            printf 'product_critical=%s\n' "$product_critical"
+            printf 'product_high=%s\n' "$product_high"
+            printf 'dapper_raw_critical=%s\n' "$dapper_raw_critical"
+            printf 'dapper_raw_high=%s\n' "$dapper_raw_high"
+            printf 'dapper_applicable_critical=%s\n' "$dapper_applicable_critical"
+            printf 'dapper_applicable_high=%s\n' "$dapper_applicable_high"
+            printf 'dapper_secrets=%s\n' "$dapper_secrets"
+          } | tee evidence/security-summary.txt
+
+          test "$source_secrets" -eq 0
+          test "$product_secrets" -eq 0
+          test "$product_critical" -eq 0
+          test "$product_high" -eq 0
+          test "$dapper_applicable_critical" -eq 0
+          test "$dapper_applicable_high" -eq 0
+          test "$dapper_secrets" -eq 0
+
+      - name: Upload review evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: compose-cli-security-${{ github.sha }}
+          path: evidence/
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Clean runner resources
+        if: always()
+        shell: bash
+        run: |
+          set +e
+          docker rm -f $(docker ps -aq --filter ancestor="$DAPPER_IMAGE") 2>/dev/null
+          docker image rm -f "$DAPPER_IMAGE" "$TRIVY_IMAGE" 2>/dev/null
+          docker builder prune --all --force >/dev/null 2>&1
+          rm -rf bin build dist evidence/product

.github/workflows/security-release-gate.yml

@@ -0,0 +1,13 @@
+# Compatibility Contract
+
+The migration preserves Docker Compose parsing, stack event names, generated stack fields, service labels, catalog question data, upgrade and rollback payloads, and compatibility API behavior.
+
+The archived external Compose implementation is no longer a build dependency. The conversion, collection-copy, logger, and Compose configuration-hash contracts still required by this compatibility client are implemented locally and covered by behavior tests. This does not expand or silently reinterpret the accepted Compose document format.
+
+`platform-compose.yml`, `PLATFORM_URL`, `PLATFORM_ACCESS_KEY`, and `PLATFORM_SECRET_KEY` are preferred. The historical companion filename, legacy CLI alias, `RANCHER_*` and `CATTLE_*` variables, `io.rancher.*` labels, generated `RancherCompose` and `RancherClient` types, legacy service-image identifiers, and vendored `github.com/rancher/*` paths remain only as wire, data, or dependency contracts.
+
+At startup the maintained executor also removes an active `rancher-compose-executor` event-handler registration before installing the canonical `compose-executor` handler. This exact historical identifier is retained only as a one-way upgrade cleanup key. Without that cleanup, an upgraded database can dispatch each stack action to both executors and leave upgrades waiting on the stale handler.
+
+Operator messages support `en-US` and `zh-TW`. Compose documents, catalog questions, API payloads, stack names, labels, and remote errors are not translated.
+
+Before release, validate create, up, render, upgrade, finish-upgrade, rollback, service hashing, sidekicks, load balancers, secrets, volumes, legacy companion-file fallback, and real event execution.

COMPATIBILITY.md

@@ -1,17 +1,94 @@
-FROM golang:1.9.7-stretch
-RUN go get github.com/rancher/trash
-RUN go get golang.org/x/lint/golint
-RUN curl -sL https://get.docker.com/builds/Linux/x86_64/docker-17.03.1-ce.tgz | tar xzf - -C /usr/bin --strip-components=1 && \
-    chmod +x /usr/bin/docker
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends default-jre python-pip python-setuptools zip xz-utils rsync
-RUN pip install --upgrade pip==6.0.3 tox==1.8.1 virtualenv==12.0.4
-ENV PATH /go/bin:$PATH
-ENV DAPPER_SOURCE /go/src/github.com/rancher/rancher-compose-executor
-ENV DAPPER_OUTPUT bin dist
-ENV DAPPER_DOCKER_SOCKET true
-ENV DAPPER_ENV TAG REPO CROSS
-ENV TRASH_CACHE ${DAPPER_SOURCE}/.trash-cache
+FROM ubuntu:26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03
+
+COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
+ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
+
+ARG GO_VERSION=1.26.5
+ARG GO_SHA256_amd64=5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053
+ARG GO_SHA256_arm64=fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49
+ARG DAPPER_HOST_ARCH=amd64
+ARG DOCKER_VERSION=29.6.2
+ARG DOCKER_SHA256_amd64=d6204aea92238e2453d5445c885b9d2e5eb8f82915568ec50edf9dbe12a3ac74
+ARG DOCKER_SHA256_arm64=8d16d8b3b158c132a9fb9963d4b4345746f925e287e154c9ed880ac257baf292
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    GOPATH=/go \
+    GO111MODULE=off \
+    GOCACHE=/tmp/go-build-cache \
+    GOTELEMETRY=off \
+    XDG_CONFIG_HOME=/tmp/go-config \
+    PATH=/go/bin:/usr/local/go/bin:${PATH}
+
+RUN set -eux; \
+    . /licenses/ubuntu-apt.lock; \
+    rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
+    rm -rf /tmp/ca-bootstrap; \
+    mkdir -p /tmp/ca-bootstrap /etc/ssl/certs; \
+    dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap; \
+    find /tmp/ca-bootstrap/usr/share/ca-certificates -type f -name '*.crt' \
+        | LC_ALL=C sort \
+        | while IFS= read -r certificate; do sed -e '$a\' "${certificate}"; done \
+        > /etc/ssl/certs/ca-certificates.crt; \
+    test -s /etc/ssl/certs/ca-certificates.crt; \
+    printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute resolute-updates resolute-backports resolute-security\nComponents: main universe restricted multiverse\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
+        "${UBUNTU_APT_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-snapshot.sources; \
+    printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\nAcquire::http::Pipeline-Depth "0";\nAcquire::https::CaInfo "/etc/ssl/certs/ca-certificates.crt";\nAcquire::https::Verify-Peer "true";\nAcquire::https::Verify-Host "true";\nAcquire::AllowInsecureRepositories "false";\nAPT::Get::AllowUnauthenticated "false";\n' > /etc/apt/apt.conf.d/80pasturestack-retries; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends \
+        bash="${UBUNTU_APT_BASH_VERSION}" \
+        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        curl="${UBUNTU_APT_CURL_VERSION}" \
+        default-jre="${UBUNTU_APT_DEFAULT_JRE_VERSION}" \
+        gcc="${UBUNTU_APT_GCC_VERSION}" \
+        git="${UBUNTU_APT_GIT_VERSION}" \
+        gzip="${UBUNTU_APT_GZIP_VERSION}" \
+        libc6-dev="${UBUNTU_APT_LIBC6_DEV_VERSION}" \
+        make="${UBUNTU_APT_MAKE_VERSION}" \
+        python3="${UBUNTU_APT_PYTHON3_VERSION}" \
+        python3-virtualenv="${UBUNTU_APT_PYTHON3_VIRTUALENV_VERSION}" \
+        rsync="${UBUNTU_APT_RSYNC_VERSION}" \
+        tar="${UBUNTU_APT_TAR_VERSION}" \
+        tox="${UBUNTU_APT_TOX_VERSION}" \
+        xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}" \
+        zip="${UBUNTU_APT_ZIP_VERSION}"; \
+    { \
+        printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; \
+        dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; \
+    } > /licenses/COMPOSE-CLI-UBUNTU-APT-PACKAGES.tsv; \
+    apt-get clean; \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble
+
+RUN git config --system --add safe.directory '*'
+
+RUN case "${DAPPER_HOST_ARCH}" in \
+        amd64) go_arch=amd64; go_sha="${GO_SHA256_amd64}" ;; \
+        arm64) go_arch=arm64; go_sha="${GO_SHA256_arm64}" ;; \
+        *) echo "unsupported DAPPER_HOST_ARCH=${DAPPER_HOST_ARCH}" >&2; exit 1 ;; \
+    esac && \
+    curl -fsSL -o /tmp/go.tgz "https://go.dev/dl/go${GO_VERSION}.linux-${go_arch}.tar.gz" && \
+    echo "${go_sha}  /tmp/go.tgz" | sha256sum -c - && \
+    tar -C /usr/local -xzf /tmp/go.tgz && \
+    rm -f /tmp/go.tgz && \
+    go version
+
+RUN case "${DAPPER_HOST_ARCH}" in \
+        amd64) docker_arch=x86_64; docker_sha="${DOCKER_SHA256_amd64}" ;; \
+        arm64) docker_arch=aarch64; docker_sha="${DOCKER_SHA256_arm64}" ;; \
+        *) echo "unsupported DAPPER_HOST_ARCH=${DAPPER_HOST_ARCH}" >&2; exit 1 ;; \
+    esac && \
+    curl -fsSL -o /tmp/docker.tgz \
+        "https://download.docker.com/linux/static/stable/${docker_arch}/docker-${DOCKER_VERSION}.tgz" && \
+    echo "${docker_sha}  /tmp/docker.tgz" | sha256sum -c - && \
+    tar xzf /tmp/docker.tgz -C /usr/bin --strip-components=1 docker/docker && \
+    rm -f /tmp/docker.tgz && \
+    chmod +x /usr/bin/docker && \
+    docker --version
+
+ENV DAPPER_SOURCE=/go/src/github.com/PastureStack/compose-cli
+ENV DAPPER_OUTPUT="bin dist"
+ENV DAPPER_DOCKER_SOCKET=true
+ENV DAPPER_ENV="TAG REPO CROSS VERSION_OVERRIDE SKIP_INTEGRATION PLATFORM_COMPAT_JAR_URL PLATFORM_COMPAT_JAR_SHA256 CATTLE_JAR_URL"
+
 WORKDIR ${DAPPER_SOURCE}
 ENTRYPOINT ["./scripts/entry"]
 CMD ["ci"]