patches: add v1.11.0 series and retire v1.10.0

Upstream released v1.11.0 (e42ae7a, 2026-11-06): 42 commits, mostly fixes, plus two WebUI features that add ~415 lines to explorer.html (on-demand bucket size calculation, restore archived objects). The series needed no content changes — the regenerated patches differ from the v1.10.0 ones only in their `index <blob>..<blob>` lines, since the de-brand edits sit above the regions upstream touched. Regenerating them is still worthwhile: the v1.10.0 patches' pre-image blobs do not exist in a v1.11.0 clone, so `git am --3way` could not use its 3-way fallback and was silently applying them directly. Verified before committing: - round-trips from a clean clone to tree 8d509fe - residual branding identical to the patched v1.10.0 tree (23 occurrences, same per-file spread, no regressions) - all 5 light-mode Tailwind classes in the new explorer markup are overridden in theme.css - series touches only webui/; file count 1049 -> 1051 - goreleaser builds all 8 targets plus deb/rpm - matrix accepts v1.11.0, refuses v1.10.0, PATCH_DIR still rebuilds the archived series v1.10.0 moves to patches/archive/ as *superseded*, not vulnerable: it is the release carrying upstream's CVE-2026-111943 notice, and that fix comes from the Go toolchain (>= 1.26.10 / 1.27.3) rather than from the tag. The archive README and the top-level README now say so, instead of implying every archived series predates a security fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-11-08 11:34:09 -06:00
1 parent 73d5d2f3f1
commit 4852777c57
@@ -10,7 +10,7 @@ on:
  workflow_dispatch:
    inputs:
      tag:
-        description: "Upstream versitygw tag to build (must be listed in ci/support-matrix.yaml, e.g. v1.10.0)"
+        description: "Upstream versitygw tag to build (must be listed in ci/support-matrix.yaml, e.g. v1.11.0)"
        required: true

 jobs:
@@ -38,10 +38,11 @@ s3-gateway/
 │   ├── publish-release.sh    # upload dist/* to a Gitea release
 │   └── run.sh                # local end-to-end: clone + patch + build one tag
 ├── patches/
-│   ├── v1.10.0/              # the supported series
+│   ├── v1.11.0/              # the supported series
 │   │   ├── 0001-webui-debrand.patch
 │   │   └── 0002-webui-dark-theme.patch
 │   └── archive/              # superseded; kept, not built
+│       ├── v1.10.0/
 │       ├── v1.8.0/
 │       ├── v1.7.0/
 │       ├── v1.6.0/
@@ -56,18 +57,18 @@ Prerequisites: `git`, `go`, and [`goreleaser`](https://goreleaser.com).

 ```bash
 # Build one upstream tag end-to-end → artifacts in src/dist/
-VGW_TAG=v1.10.0 bash ci/run.sh
+VGW_TAG=v1.11.0 bash ci/run.sh

 # Fast offline build against a local upstream clone:
-VGW_REPO_URL="/path/to/versitygw" VGW_TAG=v1.10.0 bash ci/run.sh
+VGW_REPO_URL="/path/to/versitygw" VGW_TAG=v1.11.0 bash ci/run.sh
 ```

 Or run the steps individually:

 ```bash
-VGW_TAG=v1.10.0 bash ci/clone-source.sh   # → src/
-VGW_TAG=v1.10.0 bash ci/apply-patches.sh  # git am the series onto src/
-VGW_TAG=v1.10.0 bash ci/build.sh          # goreleaser → src/dist/
+VGW_TAG=v1.11.0 bash ci/clone-source.sh   # → src/
+VGW_TAG=v1.11.0 bash ci/apply-patches.sh  # git am the series onto src/
+VGW_TAG=v1.11.0 bash ci/build.sh          # goreleaser → src/dist/
 ```

 `src/` and `src/dist/` are gitignored.
@@ -87,14 +88,20 @@ Currently maintained:

 | Upstream tag | Patch set     | Contents                                                  |
 |--------------|---------------|-----------------------------------------------------------|
-| `v1.10.0`    | `v1.10.0/`    | `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |
+| `v1.11.0`    | `v1.11.0/`    | `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |

-**v1.10.0 is the only supported version.** It carries upstream CVE
-fixes, so the older series — `v1.8.0`, `v1.7.0`, `v1.6.0` and `v1.5.0`
-— are no longer built. Their patches are kept under
+**v1.11.0 is the only supported version.** It supersedes `v1.10.0`
+with 42 further upstream fixes, so the older series — `v1.10.0`,
+`v1.8.0`, `v1.7.0`, `v1.6.0` and `v1.5.0` — are no longer built.
+Their patches are kept under
 [`patches/archive/`](patches/archive/) for reference and for a
 deliberate rebuild; see that directory's README.

+Note that protection against CVE-2026-111943 (the Go `crypto/x509`
+eMudhra distrust, announced in upstream's v1.10.0 release notes)
+comes from the **Go toolchain** these binaries are built with, not
+from the upstream tag. Build with Go 1.26.10 / 1.27.3 or later.
+
 ### What the de-brand patch does

 - Sidebar/login logos → a plain **"S3 Gateway"** wordmark.
@@ -132,7 +139,7 @@ shared asset files plus bundled fonts:

 The only markup change is the login page's light background gradient,
 which becomes a solid dark surface. It is part of the supported
-`v1.10.0` series, and of every archived set except `v1.5.0`.
+`v1.11.0` series, and of every archived set except `v1.5.0`.

 ## Adding / refreshing a version

@@ -3,12 +3,12 @@
 # Runs the same ci/ steps CI does, in a single shell so VGW_* env flows
 # between them.
 #
-#   VGW_TAG=v1.10.0 bash ci/run.sh
+#   VGW_TAG=v1.11.0 bash ci/run.sh
 #
 # Optional: point VGW_REPO_URL at a local clone for fast offline builds.
 set -euo pipefail

-: "${VGW_TAG:?set VGW_TAG, e.g. VGW_TAG=v1.10.0 bash ci/run.sh}"
+: "${VGW_TAG:?set VGW_TAG, e.g. VGW_TAG=v1.11.0 bash ci/run.sh}"
 export VGW_TAG
 export VGW_SRC_DIR="${VGW_SRC_DIR:-src}"

@@ -19,5 +19,5 @@
 #   patches  directory under patches/ to apply (defaults to `tag`)

 versitygw:
-  - tag: v1.10.0
-    patches: v1.10.0
+  - tag: v1.11.0
+    patches: v1.11.0
@@ -45,8 +45,8 @@ Each build is four steps, run for a single upstream tag:

 ```yaml
 versitygw:
-  - tag: v1.10.0
-    patches: v1.10.0
+  - tag: v1.11.0
+    patches: v1.11.0
 ```

 - `tag` — upstream git tag.
@@ -156,6 +156,6 @@ PATCH_DIR=patches/archive/v1.8.0 VGW_TAG=v1.8.0 bash ci/apply-patches.sh
 ## Release tagging

 Releases are created in this repo with the **upstream** tag name
-(`v1.10.0`). If you need to ship a rebuild of the same upstream version
+(`v1.11.0`). If you need to ship a rebuild of the same upstream version
 (e.g. a patch fix), set `RELEASE_TAG` in `ci/publish-release.sh`'s
-environment to something like `v1.10.0-acg2` to avoid clobbering.
+environment to something like `v1.11.0-acg2` to avoid clobbering.
@@ -6,6 +6,7 @@ they are safe to ship.

 | Patch set | Contents                                                  |
 |-----------|-----------------------------------------------------------|
+| `v1.10.0/`| `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |
 | `v1.8.0/` | `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |
 | `v1.7.0/` | `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |
 | `v1.6.0/` | `0001-webui-debrand.patch`, `0002-webui-dark-theme.patch` |
@@ -13,12 +14,19 @@ they are safe to ship.

 ## Why these are not built

-`v1.10.0` carries upstream CVE fixes that these releases predate.
-Building them would publish known-vulnerable gateways under this
-project's release name, so their tags were removed from
-`ci/support-matrix.yaml`. That matrix is an allowlist —
-`ci/apply-patches.sh` refuses a tag it does not list, so neither a tag
-push nor a workflow dispatch can rebuild one by accident.
+Two different reasons, worth keeping straight:
+
+- `v1.5.0` through `v1.8.0` **predate** the upstream CVE fixes
+  announced in v1.10.0. Building them would publish known-vulnerable
+  gateways under this project's release name.
+- `v1.10.0` is archived only because it is **superseded** by
+  `v1.11.0`, which carries 42 further upstream fixes. It is not
+  vulnerable in the way the older sets are.
+
+Either way their tags were removed from `ci/support-matrix.yaml`.
+That matrix is an allowlist — `ci/apply-patches.sh` refuses a tag it
+does not list, so neither a tag push nor a workflow dispatch can
+rebuild one by accident.

 Releases already published for these versions are **not** removed by
 archiving the patches. Delete them by hand in Gitea if they should no