v4.17 [August 2026]¶

• Release Date: August 2026
• Release Updates: Change History

Release Themes: Role-Based UX, Content Archive GA, Pipeline Reliability, Replication Scalability

Executive Summary¶

Digital Rebar v4.17 builds on the platform investments introduced in v4.16 with new capabilities across usability, packaging, and scalability.

This release introduces Role-Based UX, adding an Operator role to the Digital Rebar interface to clarify role-based responsibilities, with additional roles planned for future releases.

Content Archive, introduced as a Technical Preview in v4.16, reaches General Availability in v4.17.

Engineering continued modernizing DRP's pipeline infrastructure this cycle, further improving the reliability and flexibility of automated workflows across the platform. v4.17 introduces restartable provisioning pipelines, allowing a failed pipeline to resume from the phase where it stopped rather than restarting the machine, giving teams faster recovery at scale.

The Manager Replication Refactoring is completed in v4.17, including a shift to an on-demand, cached replication model that improves memory footprint and performance for large-scale, multi-site deployments.

Eikon, the native image deployment engine positioned to replace Curtin, reaches production readiness in v4.17, and the Curtin-based image-deploy plugin is now deprecated.

The RackN Portal receives a visual refresh in v4.17, including a new Dark Theme and general polish across the interface.

For customers using an external secret store such as Vault, AWS Secrets Manager, or Azure Key Vault, drpcli set now rotates secrets directly in that store instead of overwriting them with an inline copy, preserving the reference secret.

Overall, v4.17 rounds out the usability, packaging, and scalability investments introduced in v4.16.

Important Notices¶

Release Information¶

New for this release:

• v4.17 Role-Based UX
• v4.17 Content Archive - General Availability
• v4.17 Pipeline Enhancements
• v4.17 Manager Replication Refactoring - Frontend Completion
• v4.17 Eikon - Production Ready
• v4.17 Portal Visuals Refresh
• v4.17 Writable External Secrets
• v4.17 List Command Default Limit
• v4.17 Deprecated OS Version Removals
• v4.17.3 Open-World Claim Matching
• v4.17.3 Image Builder: OS-Agnostic Build Workflow
• v4.17.3 Secure Parameter Authorization
• v4.17.3 Scope and Action Registration
• v4.17.3 User Authentication Method Is Fixed At Creation

See other release notes for previous Release Information. All the incremental fixes to previous releases. See Change History

Vulnerabilities¶

Golang Updates¶

In order to reduce and attempt to prevent supply-chain attacks, RackN watches that golang security streams and updates the components that have issues. This release continues those updates.

Secure Parameter Authorization¶

Several routes allowed a principal that could write a secure parameter to read it back, or allowed a secure value to be returned decrypted without the getSecure action. All of them are closed in this release.

• Secure values are no longer converted to plaintext without authorization. The routine that reconciles a stored value against its parameter definition's Secure flag guarded only the plaintext-to-sealed direction. The reverse direction -- which both writes and reveals plaintext -- now requires updateSecure and getSecure on the object, and additionally only converts a value that was already stored as a secure value. The second check is independent of any claim, so a caller can no longer hand the endpoint an arbitrary sealed blob and have it decrypted with the target object's key.
• aggregate=true no longer implies decryption. The generic object GET decrypted whenever aggregate or decode was set, while only decode is authorized -- making aggregate=true an unauthorized decode. Decryption now follows decode alone. This matches the /<prefix>/<id>/params route, which has always behaved this way.
• A token minted for a user no longer counts as that user when reading that user's own secure parameters. users:token:<name> produces a token carrying <name>'s identity, so ownership now additionally requires that the token was obtained by that user, which only a sign-in produces.

Operators reading secure values out of an aggregated response need to add decode=true and hold getSecure. See the note in Important Notices.

Scope and Action Registration¶

Asking whether a principal is allowed an action that was not registered for its scope returned true rather than false, so any authorization check written against an unregistered scope or action was satisfied by any claim at all. This affected two groups:

• Seven scopes guarded live routes without being registered: connections, consensus, content_archives, debug, events, logs and static. The most significant is consensus, which gates the cluster membership APIs.
• getSecure and updateSecure were registered for only a subset of object types, so the secure parameter checks above were inert on the remainder -- including users, subnets, blueprints, reservations and work_orders.

Both are now registered, and the secure actions are derived from whether an object can carry parameters at all, so a new object type is covered automatically.

Because a role granting * expands to whatever actions exist, superuser and wildcard roles are unaffected. Roles that enumerate actions, or that name one of the seven scopes above, should be audited: a grant that was silently permitted may now be refused. Note also that these grants could not previously be saved at all -- role validation rejected them -- so registering them is what makes the correct grant expressible.

User Authentication Method Is Fixed At Creation¶

A user's auth-method metadata records how the account came into being -- saml, ad-auth, or absent for a local user -- and is consulted when deciding whether a superuser is exempt from the last-local-superuser deletion guard and whether to consult an authentication plugin. It was freely writable, so a principal able to edit a user could mark the last local superuser as externally managed and then delete it.

It is now set when the user is created and cannot be changed afterwards. Relatedly, SAML now refuses to sign in a username that already exists as a non-SAML user, matching the behavior authentication plugins have always had. A username belongs to exactly one authentication method.

Deployments that pre-create local users and expect SAML to adopt them on first sign-in must let SAML create the user instead. A SAML-adopted account had its roles replaced from group mapping in any case, so pre-creation contributed only the name.

Deprecations¶

OS Version Deprecation¶

Support for many of the operating system versions that are referenced in the various content packs are being marked as deprecated and will be removed in a future release.

These deprecations are based upon unsupported minor releases or end-of-life statements by the vendors.

The bootenvs are annotated in their documentation and descriptions.
See more information at RackN Provided Bootenv Lifecycle.

Image-deploy Plugin¶

The image-deploy plugin (Curtin) is deprecated as of v4.17 and will be removed in a future release, with no removal version set yet. With Eikon now production-ready, it's the recommended engine for all new image deployments, and operators should start planning their move rather than waiting for a removal announcement -- migration is a simple, reversible application profile swap, and RackN continues to collect feedback on Eikon usage and issues.

Removals¶

Deprecated OS Version Removals¶

Support for the operating system versions deprecated in v4.15 (see OS Version Deprecation) have been removed, covering superseded point releases and vendor end-of-life OS versions.

FEATURES¶

Role-Based UX¶

Digital Rebar v4.17 introduces the Operator Role into the Digital Rebar interface. This marks an important step in maturing DRP's user experience, giving organizations clearer separation of responsibilities and more granular control over platform access and configuration. Additional roles are planned for future releases.

Content Archive - General Availability¶

The Content Archive packaging format, introduced in v4.16 as a Technical Preview, reaches General Availability in v4.17. Content Archives simplify packaging and distribution by bundling object definitions, artifacts, and plugin extensions into self-contained, atomically upgradable packages while reducing on-disk overhead. This release completes full integration with the Content Catalog, UX interface, and Manager tools, building on operator feedback gathered since the v4.16 Technical Preview.

Pipeline Enhancements¶

With v4.17, DRP introduces restartable provisioning pipelines. A machine moves through the full pipeline in distinct phases for prepare, discover, hardware, operating system, and application, and if a pipeline fails, it resumes from the phase where it stopped rather than starting the machine over. Every run is queued and tracked phase by phase, so as teams adopt it, they gain faster recovery and less manual intervention when provisioning at scale.

Manager Replication Refactoring - Frontend Completion¶

Building on the backend redesign delivered in v4.16, v4.17 completes the corresponding frontend improvements for Manager Replication. This work directly addresses scalability requirements for RackN's largest enterprise deployments, extending the robustness and performance gains of the refactored replication backend to the operator-facing experience.

Multi-site manager (MSM) replication has been inverted, switching from an eager, streamed database model to an on-demand, cached model. This vastly improves the memory footprint in MSM systems of all sizes and is carefully optimized to ensure similar (or better) performance and latency for common operations, such as UX navigation, making MSM a much more tangible feature for large-scale systems.

Eikon - Production Ready¶

Eikon, the native image deployment engine positioned to replace Curtin, reaches production readiness in v4.17 and is now the recommended engine for image deployment. Additional information is available in Eikon Image Deploy and Eikon Architecture.

Major improvements to Eikon include:

• Deploys vendor cloud images -- including QCOW2 -- as either a whole-disk image or a rootfs archive onto a declarative storage layout with LVM, software RAID, and stable device identifiers
• Generates a UUID-based /etc/fstab so deployments boot reliably regardless of disk enumeration
• Consolidated bootloader handling across Debian and RHEL (UEFI and BIOS)
• Version-agnostic Windows deployment across Server 2019-2025 and Windows 10/11
• Support for airgap and authenticated (basic-auth/mTLS) image sources

Because Eikon shares Curtin's image-deploy parameters within the same workflow, switching engines -- or rolling back -- is simply a profile swap. With Eikon production-ready, the image-deploy plugin (Curtin) is deprecated in v4.17 and will be removed in a future release.

Portal Visuals Refresh¶

Sport the new Dark Theme while enjoying cleaner visuals across the RackN Portal. Theming options are available in the UX Config view, including high contrast and primary color preferences. This upgrade also includes new polish to the Catalog, the License Manager, and Notifications.

Writable External Secrets¶

Setting a secure parameter that resolves to a LookupUri now writes the value into the external store -- Vault, AWS Secrets Manager, or Azure Key Vault -- instead of replacing the reference with an inline-encrypted value. Rotating an externally stored secret via the normal drpcli set now works, and the reference stays intact. The reference can live on the object or be inherited from a profile; either is followed. Pass --no-write-through to write the object's own copy instead.

Open-World Claim Matching¶

Role Claims are now matched as patterns rather than looked up against a fixed registry of known scopes. A request is allowed only if some Claim in a single role positively covers it, and anything not positively covered is denied.

Previously an unrecognised scope or action was silently satisfied by any claim at all, because it compiled to an empty requirement that every claim vacuously met. The same scopes could not be granted either -- they were rejected at role save -- so there was no way to author a Claim that closed the gap.

What changes for an existing deployment. Three things, and only one narrows access anyone currently holds:

The event-type row is the one most likely to be met as a mystery rather than an error, because event delivery has no way to report a filtered subscription. drpcli info get | jq .scopes does not list these three either -- whether an event type should be an object scope at all is under review in rackn/product-backlog#1673 -- so grant them by name if a subscription stops arriving.

Most of this transition arrived earlier in the v4.17 line, which registered seven scopes that were checked but never declared -- connections, consensus, content_archives, debug, events, logs and static. Those began requiring real grants at that point. jobArchive is the one that remained.

Claim content is no longer validated. A Role saves even if a scope or action is unrecognised; the server reports an advisory diagnostic instead. Nothing about a Claim's content can make a Role unusable, which also removes a startup hazard: a Role naming a scope that a plugin registers later is no longer invalid before that plugin loads.

drpcli info get reports a more accurate scope list. It is generated from the authorization checks the server actually performs rather than a hand-maintained table, and covers substantially more scopes and actions than before. It remains advisory -- a Claim naming something absent from it still saves and is still enforced. The web UI's scope and action pickers offer these values while also accepting free-form entry, so a scope the endpoint has not advertised can still be granted.

See How Claims Are Matched for the full semantics.

Other Items of Note¶

None known

List Command Default Limit¶

To prevent accidental full-table scans on large systems, drpcli <object> list commands and the Python SDK (drppy_client) list_* methods now default to a page size of 1000 instead of unlimited (-1).

• CLI: drpcli machines list returns up to 1000 machines by default; pass --limit -1 to retrieve all.
• SDK: api.list_machines() returns up to 1000 machines by default; pass limit=-1 to retrieve all.

Operators relying on full-set returns from list commands or SDK calls should audit their scripts and explicitly set --limit -1 / limit=-1 (or paginate) where required.

References: provision-server#646, provision!1394, drppy_client!14.

Image Builder: OS-Agnostic Build Workflow¶

The image-builder content pack now ships a single image-builder-universal workflow that builds a gold image of any supported Linux distribution, replacing the seven per-OS workflows. Select the OS at runtime by setting linux/install-bootenv (for example alma-9.8-min, rocky-10, or ubuntu-24.04) — the same linux-selector mechanism used by universal-linux-install.

Update any automation referencing the removed workflow names (image-builder-alma8, -centos8, -centos, -rhel8-server, -rhel-server, -rocky8, -ubuntu-bionic). RHEL images that need subscription registration inject redhat-subscription-register via image-builder/pre-builder-flexiflow.

References: product-backlog#1615.

Bug Fixes and Minor Improvements¶

Each component's version will move independently of other components. See Change History for more details.

v4.17.263800 (2026-09-17)¶

24 of 58 components moved. DRP v4.17.4, DRP UX v4.17.2.

Vulnerabilities

• ad-auth Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• bios Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• cmdvault Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• docker-context Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• drp build: update for golang vuln
• drp-ux chore(deps): patch-bump the vulnerable transitive dependencies
• drppy_client Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• endpoint-exec Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• event-router Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• filebeat Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• kubevirt-ipmi Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• rack Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• raid Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• tower Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings
• triggers Bump golang.org/x/{net,text,crypto} to clear govulncheck CALLED findings

Features

• docker-context v4.17.2 feat: apply host-level startup options from plugin Config
• docker-context v4.17.2 feat: read container startup options from context/startup-options
• docker-context v4.17.2 feat: extract the startContainer core behind a containerRequest
• docker-context v4.17.2 feat: add stopContainer and execContainer
• docker-context v4.17.2 feat: add generic containerStart/containerStop/containerExec actions
• drp v4.17.3 feat(content-archives): feature flag for plugin provider support via content archive apis
• drp v4.17.3 feat: add the actionTokenTTL preference
• drp v4.17.3 feat: Auth can produce a token carrying the request's authority
• drp v4.17.3 feat: RunAction stamps the caller's token and principal
• drp v4.17.3 feat(guac): parse the console query param on the tunnel URL
• drp v4.17.3 feat(guac): map a console descriptor onto the guacd handshake
• drp v4.17.3 feat(guac): resolve the console server side via the console-info action
• drp v4.17.3 feat(guac): give every console type a server-side credential path
• drp v4.17.3 feat(authz): parse scope and specific element sets
• drp v4.17.3 feat(authz): parse action terms and define the covering relation
• drp v4.17.3 feat(authz): parse action fields into term sets
• drp v4.17.3 feat(authz): add grants, requests and the evaluation algebra
• drp v4.17.3 feat(authz): reserve the @(...) production and split on brackets
• drp v4.17.3 feat(authz): add subsumption, and fuzz the two engines against each other
• drp v4.17.3 feat(authz): give Requirement an explicit HasCmd
• drp v4.17.3 feat(guac): advertise the console-resolver feature flag
• drp v4.17.3 feat(backend): register a user's profile references
• drp v4.17.3 feat(backend): only the user may decrypt their own secure params
• drp v4.17.3 feat(datastack): cache authz grants beside role claims
• drp v4.17.3 feat(authz): parse the wanted side from a call site's three strings
• drp v4.17.3 feat(backend): build an authz Authority beside the claims list
• drp v4.17.3 feat(backend): evaluate authz beside models and log divergences
• drp v4.17.3 feat(backend): give divergence logs a shape and payload, guard nil, de-vacuum tests
• drp v4.17.3 feat(frontend): route the assure facade through the shadow comparison
• drp v4.17.3 feat(authz): make authz the only claim engine, and enforce
• drp v4.17.3 feat(frontend): derive the scope registry from the code that enforces it
• drp v4.17.3 feat(authz): grant an action against one plugin, plus review follow-ups
• drp v4.17.3 feat(authz): resolve the action provider before authorizing, add action::*
• drp v4.17.3 feat(version): advertise the user-params feature flag
• drp v4.17.3 feat(backend,frontend): wire up the ComponentSet object
• drp v4.17.3 feat(backend): publish components.changed on real hardware changes
• drp v4.17.3 feat(docs): Update reference doc maintenance skill, add doc full-verify.
• drp v4.17.3 feat(backend,frontend): add the Delegation model and absorb the pin bump
• drp v4.17.3 feat(backend): only the named user may author a delegation
• drp v4.17.3 feat(backend): derive the delegation authorizing a request
• drp v4.17.3 feat(backend): fan a trigger out across its delegations
• drp v4.17.3 feat(frontend): add GET /api/v3/delegated_params
• drp v4.17.3 feat(version): advertise user-delegations, and fill in the component_sets goldens
• drp v4.17.4 feat(license): grant ai-agent in the unit-test license
• drp v4.17.4 feat(license): require an ai-agent entitlement to run the plugin
• drp v4.17.4 feat(version): add the ai-agent-license feature flag
• drp v4.17.4 feat(console): give the SSH console its own credential params
• drp-community-content v4.17.2 feat: add the context/startup-options param
• drp-community-content v4.17.3 feat(ux_views): register delegations in reference and readonly
• drp-community-content v4.17.3 feat(bootstrap-ssh): opt-in dedicated console keypair for the remote SSH console
• drp-ux v4.17.1 feat(pipelines): give each phase its own section in the editor
• drp-ux v4.17.1 feat(jobs,work_orders): identify runs by what they ran, not by UUID
• drp-ux v4.17.1 feat(pipelines): run pipelines from the editor and the activity view
• drp-ux v4.17.1 feat(pipelines): add hooks for an object's pipeline and its phase state
• drp-ux v4.17.1 feat(roles): allow free-form scope and action entry in the claim editor
• drp-ux v4.17.1 feat(a11y): add cmd key support
• drp-ux v4.17.1 feat(guac): reach machine consoles from the sidebar
• drp-ux v4.17.2 feat: add a Delegations table under Endpoint Admin
• drp-ux v4.17.2 feat(flags): add the user-delegations feature flag
• ipmi v4.17.1 feat(ipmi): pure console descriptor builder for BMC KVM/SOL
• ipmi v4.17.1 feat(ipmi): add console-info machine action for BMC console discovery
• ipmi v4.17.1 feat(ipmi): add ipmi/console-url and ipmi/console-vnc-port params
• ipmi v4.17.1 feat(console): require the console-resolver endpoint feature
• ipmi v4.17.2 feat(ipmi): add ipmi/console-vnc-password param for the BMC VNC service
• ipmi v4.17.2 feat(tools): console-probe hardware capture script
• openshift feat: mount tmpfs over /root/cluster in openshift-client-runner context
• openshift feat: openshift/scrub-secrets flag to keep secrets at rest while debugging
• task-library v4.17.2 feat: add local-users-create task
• universal v4.17.1 feat(pipelines): create idle pipeline

Fixes

• dell-support fix(dell-dsu-base-url): dell redirect to https, causes yum/dnf to error
• docker-context v4.17.2 fix: give the host startup-option layer its own param name
• docker-context v4.17.2 fix: defer RS_ENDPOINTS to create-time, harden the per-container lock
• docker-context v4.17.2 fix: restore best-effort removal across duplicate containers
• docker-context v4.17.2 fix: correct container/image docs, drop stray Meta.type from container/name
• docker-context v4.17.2 fix: bound containerExec output, honor an empty entrypoint, document the rest
• docker-context v4.17.2 fix: delete engineTimeout, now that engineExec has taken its only caller
• docker-context v4.17.2 fix: close six defects the generic-container-actions review found
• drp v4.17.2 fix(catalog): skip unknown items instead of failing the build
• drp v4.17.3 fix(contents): remove the persisted contents object when a layer is removed
• drp v4.17.3 fix: preserve Principal in RunAction's Clean() no-redaction fallback
• drp v4.17.3 fix: redact the action published from the action-job path
• drp v4.17.3 fix: make Job.Action server-owned so Principal cannot be forged
• drp v4.17.3 fix: make the sealed action token revocable; guard the Bearer path
• drp v4.17.3 fix: keep actionTokenTTL discoverable while keeping one default
• drp v4.17.3 fix: stop corrupting an HA join token that starts with a dash
• drp v4.17.3 fix: reject a non-positive actionTokenTTL instead of ignoring it
• drp v4.17.3 fix: give service-principal action tokens a revocation lever
• drp v4.17.3 fix: default Auth's logger so it does not depend on middleware ordering
• drp v4.17.3 fix: make manager forwarding actually send its grantor secret
• drp v4.17.3 fix(contents): keep an archive file that another layer still uses
• drp v4.17.3 fix: stop Principal() double-prefixing an already-qualified identity
• drp v4.17.3 fix: let service principals through the guards that allow users
• drp v4.17.3 fix(staticfs): stop re-prefixing already-absolute archive paths
• drp v4.17.3 fix(datastack): name versions and trim feature in RequiredFeatures rejection
• drp v4.17.3 fix(guac): silence gosec G101 on the console credential param table
• drp v4.17.3 fix(guac): tell the browser why a console was refused
• drp v4.17.3 fix(guac): close the guacd connection when the handshake fails
• drp v4.17.3 fix(tools): clean up the client repo copy on every exit path
• drp v4.17.3 fix(contents, plugin_providers, content_archives): unifying all calls to support content archives
• drp v4.17.3 fix(backend): make User Meta auth-method immutable after create
• drp v4.17.3 fix(frontend): make every login self-granted so GrantorId is truthful
• drp v4.17.3 fix(backend): require getSecure to convert a secure param to plaintext
• drp v4.17.3 fix(backend): only convert params that were already secure in the store
• drp v4.17.3 fix(backend): repair secureShaped asymmetry, fix docs on #1644 fix wave
• drp v4.17.3 fix(authz): stop three-part action terms from widening non-update grants
• drp v4.17.3 fix(authz): pin star-smuggling safety and tighten ParseClaim diagnostics
• drp v4.17.3 fix(authz): use a trailing element so the star-smuggling test bites
• drp v4.17.3 fix(authz): pin the new engine's own answers, not just its divergence from models
• drp v4.17.3 fix(frontend): test the error rt.Create and rt.Update actually returned
• drp v4.17.3 fix(guac): give the console action the caller's own authority
• drp v4.17.3 fix(guac): count the error instruction the way the browser does
• drp v4.17.3 fix(frontend): stop aggregate=true from decrypting without getSecure
• drp v4.17.3 fix(backend): keep the global profile out of user param aggregation
• drp v4.17.3 fix(backend): strengthen owner-only secure param test, fix comment claims
• drp v4.17.3 fix(backend): validate User params and release its references on delete
• drp v4.17.3 fix(backend): require a self-granted token to own a user's secure params
• drp v4.17.3 fix(backend): stop GenClaim funding the two-hop re-mint of a minted token
• drp v4.17.3 fix(backend): block profile deletion while a user references it
• drp v4.17.3 fix(authz): tighten the fail-closed test, trim action, document reduction
• drp v4.17.3 fix(backend): make the divergence counter atomic and fix Auth's concurrency doc
• drp v4.17.3 fix(frontend): pin the Request each seam caller builds, restore trace, single-parse patch
• drp v4.17.3 fix(backend,frontend): export Auth.Divergences and use it in the seam tests
• drp v4.17.3 fix(authz): trim the wanted scope, keep specific verbatim
• drp v4.17.3 fix(authz): mirror csm() fully on the wanted Specific, delete RequirementFor
• drp v4.17.3 fix(authz,backend,frontend): pin the deny->allow direction, add route coverage for migrate-token, raise divergence log to Warn
• drp v4.17.3 fix(frontend): a test-only patch must ask for update, not for nothing
• drp v4.17.3 fix(frontend): a patch that changes nothing asks for get, not update
• drp v4.17.3 fix(scope-registry): resolve r.Prefix per site, walk backend, advertise bare verbs
• drp v4.17.3 fix(test): BuildCurrentDRP returns the repo bin directory after building
• drp v4.17.3 fix(package): zero ownership with flags GNU tar actually has
• drp v4.17.3 fix(ci): prune tftpboot so the rest of after_script still runs
• drp v4.17.3 fix(backend): skip content fixup for a provider that ships none
• drp v4.17.3 fix(consensus): stop failover from hanging commits under load
• drp v4.17.3 fix(endpoints): expose prometheus caching metrics
• drp v4.17.3 fix(consensus): stop a barrier timeout from parking the active node election
• drp v4.17.3 fix(docs): Repair reflow script failure modes found in MR 1684 review.
• drp v4.17.3 fix(backend): distinguish dangling-reference and job-state refusals
• drp v4.17.3 fix(backend,frontend): close delegated-read escalation, ciphertext leak
• drp v4.17.3 fix(backend,frontend): close migrate-route Delegation injection, allow clearing
• drp v4.17.3 fix(backend): close delegated-read escalation at the chokepoint, not per-route
• drp v4.17.3 fix(backend): bind delegated reads to the machine that owns the work order
• drp v4.17.3 fix(backend): make WorkOrder.Machine assign-once
• drp v4.17.3 fix(backend): require a Delegation's Trigger to exist; correct a misleading boundary comment
• drp v4.17.3 fix(frontend): declare the DelegatedParamsResponse swagger type; ref-docs pass
• drp v4.17.3 fix(backend): skip bundled delegations at fan-out; verify trigger at read time
• drp v4.17.4 fix(test): close the content endpoint's API client on cleanup
• drp v4.17.4 fix(work_orders): only validate WorkOrders in incomplete states
• drp v4.17.4 fix(raftStore): Pull in latest raftStore.
• drp v4.17.4 fix(backend): validate Delegations on load
• drp v4.17.4 fix(backend): derive a delegated read from the running WorkOrder
• drp v4.17.4 fix(backend): treat an unset WorkOrder.CurrentJob as no job, and fix frontend fixtures
• drp v4.17.4 fix(backend): keep validate load-callable, gate consent in beforeSave
• drp v4.17.4 fix(backend): index the work-order lookup, keep the diagnostics distinct
• drp v4.17.4 fix(test): give mkDT a job log directory
• drp v4.17.4 fix(jobs): purge jobs abandoned in the incomplete state
• drp v4.17.4 fix(console): read a VNC-specific password for bmc-kvm with ipmi/password fallback
• drp v4.17.4 fix(actions): run an action on a plugin that can answer it
• drp-community-content v4.17.1 fix(stages): restore removed EOL install stages as inert stubs
• drp-community-content v4.17.3 fix(bootenvs): repair dead install media URLs and stop depending on redirects
• drp-community-content v4.17.3 fix(package-repositories): debian-11 backports moved to archive.debian.org
• drp-community-content v4.17.3 fix(ubuntu): install ubuntu-pro-client on 20.04 so unattended-upgrades exits 0
• drp-community-content v4.17.3 fix(bootenvs): remove debian-11.6.0-dvd-nonfree, which cannot netboot
• drp-docs v4.17.3 fix(build): serialise the ref map with a JSON encoder
• drp-ux v4.17.1 fix(catalog): upgrade content packs in one transaction
• drp-ux v4.17.1 fix(catalog): gate bulk installs on the plugin-provider feature flag
• drp-ux v4.17.1 fix(system): cap the preference dropdown menus so long lists scroll
• drp-ux v4.17.1 fix(system): clear the preference dropdown when no default is chosen
• drp-ux v4.17.1 fix(theme): confine the readonly hatch to a fading top band
• drp-ux v4.17.1 fix(operator): give the job log accordion a real scroll viewport
• drp-ux v4.17.1 fix(catalog): fix the filter row layout and make maintenance mode a switch
• drp-ux v4.17.1 fix(machines): keep Apply on the machine and reveal the run on demand
• drp-ux v4.17.1 fix(machines): rank the last-run blueprint instead of preselecting it
• drp-ux v4.17.1 fix(catalog): give a lone ContentArchive its own transaction
• drp-ux v4.17.1 fix(api): bound the statusless retry instead of dropping it
• drp-ux v4.17.1 fix(plugins): remove clone/delete util btns
• drp-ux v4.17.2 fix(nav): let portal content paint over the top nav
• drp-ux v4.17.2 fix: stop the Delegations editor re-rendering without end
• drp-ux v4.17.2 fix(delegations): render Go zero time as blank, and test it
• drp-ux v4.17.2 fix(delegations): RFC3339 shape gate, both glob warnings, help dictionary
• drp-ux v4.17.2 fix(console): point the SSH console checklist at the console params
• ipmi v4.17.1 fix(ci): reset the cached tools remote URL, not just the clone
• ipmi v4.17.2 fix(ipmi): pick the Redfish manager deliberately and set the vendor SOL entry command
• openshift fix: remove kubeadmin-password file after capturing it to the param
• openshift fix: drop local PXE artifacts after ISO upload (embed pull secret)
• openshift fix: scrub node SSH private keys on exit in wait-for tasks
• openshift fix: scrub private keys and hub kubeconfig on task exit
• openshift fix: scrub installer state file after install-complete outputs are captured
• openshift fix: self-heal kubeconfig in cluster prelude and declare refresh prerequisites
• openshift fix: serialize kubeconfig object with toJson in prelude self-heal
• openshift fix: require ssh-key-pub too before skipping keygen (vault LookupUri makes ssh-key always exist)
• openshift fix: keep kubeadmin-password file until install-complete (installer reads it at wait-for)
• openshift fix: scrub kubeconfig at task exit so idle containers hold no secrets
• openshift fix: refresh-kubeconfig scrubs its working copy at exit (idle guarantee for all job tails)
• openshift fix: fold label-machines TMPDIR into the shared scrub trap (bash traps replace, not stack)
• openshift fix: rematerialize kubeconfig in wait-for-install and harden scrub windows (mid-install ordering)
• openshift fix: dedupe KUBECONFIG export, correct label-machines doc order, cover self-heal in fixtures
• openshift fix: trap lint in CI, rendezvous-IP quoting, key material off argv, pxe profile yaml cleanup
• openshift-cluster-acm fix: declare refresh-kubeconfig prerequisite in kubeconfig-consuming tasks
• openshift-cluster-ocpv v4.17.1 fix(ci): add missing coreos and openshift prerequisite content packs
• openshift-cluster-ocpv v4.17.2 fix: declare refresh-kubeconfig prerequisite in kubeconfig-consuming tasks
• openshift-cluster-ocpv v4.17.2 fix: retry virtctl download until the CLI download route is ready
• openshift-cluster-ocpv v4.17.2 fix(test): refresh stale render snapshots and cover untested templates
• raid v4.17.2 fix(raid): correct mvcli install, drop redundant chmods, restore Dell source URLs
• task-library v4.17.1 fix(workflows): restore removed EOL base workflows
• tower v4.17.2 fix(test): give docker compose a unique project name
• triggers v4.17.2 fix(test): give docker compose a unique project name
• universal v4.17.1 fix(profiles): drop universal-application-debian-11.6.0-dvd-nonfree
• universal v4.17.2 fix(pipeline): Don't clear pipeline when already clear