0003-owner-scoped-access.patch changes authorization, applied after the
de-brand and dark-theme patches:
- a bucket's ACL and policy may name only the owner's keys (accounts on
the owner's UserID), whoever writes them, root included;
- public access is read-only: all-users READ, and "*" allowed only
s3:GetObject and s3:ListBucket;
- the bucket policy never denies the owner's key;
- DeleteBucket, PutBucketVersioning, PutObjectLockConfiguration and
PutBucketOwnershipControls are reserved to root and admins;
- an ACL with the all-users READ grant can be written back unchanged.
docs/owner-scoped-access.md has the rules, what v1.11.0 already did,
and the leil-rig proof procedure with its 2026-11-10 result: 63 of 63
on the patched build, 29 of 63 failing on stock v1.11.0.
tests/owner-scope/ holds the proof script and a stdlib-only SigV4
request helper. README and the pipeline doc list the patch and how to
re-verify it after a rebase.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Toasts blended into whatever sat behind them: one landing over the
Explorer's Upload button showed the button straight through it.
Two separate causes, both in the override layer:
- The status tints map bg-*-50 to rgba(..., 0.13). That is right for
inline banners, which sit on a solid panel, but a toast floats over
page content, so 13% left it see-through.
- text-*-800 was never re-pointed. The lifts covered 600/700 only, so
Tailwind's near-black green/red/yellow/blue 800s stayed put — and
the toast label, every inline warning and info box ("This action
cannot be undone", the bucket-policy status line, v1.11.0's new
bucket-size readout) rendered dark-on-dark. 25 call sites.
Scope matches each cause. The text lift is global, since the inline
boxes are just as unreadable as the toasts. The opaque surface is
scoped to #toast-container, because the inline boxes should keep their
translucent tint — they have a panel behind them.
Toasts now get #1a1a2e with the status tint composited back on top as a
background-image layer, a hairline on the three non-accent edges (the
4px border-l-* keeps its status colour), and a shadow deep enough to
read on a dark page, where shadow-lg is invisible.
Also lifts hover:text-gray-600, which the base layer missed the same way
it missed the uploads-tray Cancel link: the toast close button, the
secret-key reveal and the login endpoint dropdowns all dimmed to
Tailwind's #4b5563 on hover instead of lifting.
Verified in the patched UI served over HTTP: all four toast types render
opaque over a bright button placed behind them, computed background
rgb(26, 26, 46) with the tint layer, label colour rgb(74, 222, 128).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Upstream released v1.11.0 (e42ae7a, 2026-11-06): 42 commits, mostly
fixes, plus two WebUI features that add ~415 lines to explorer.html
(on-demand bucket size calculation, restore archived objects).
The series needed no content changes — the regenerated patches differ
from the v1.10.0 ones only in their `index <blob>..<blob>` lines, since
the de-brand edits sit above the regions upstream touched. Regenerating
them is still worthwhile: the v1.10.0 patches' pre-image blobs do not
exist in a v1.11.0 clone, so `git am --3way` could not use its 3-way
fallback and was silently applying them directly.
Verified before committing:
- round-trips from a clean clone to tree 8d509fe
- residual branding identical to the patched v1.10.0 tree (23
occurrences, same per-file spread, no regressions)
- all 5 light-mode Tailwind classes in the new explorer markup are
overridden in theme.css
- series touches only webui/; file count 1049 -> 1051
- goreleaser builds all 8 targets plus deb/rpm
- matrix accepts v1.11.0, refuses v1.10.0, PATCH_DIR still rebuilds
the archived series
v1.10.0 moves to patches/archive/ as *superseded*, not vulnerable: it is
the release carrying upstream's CVE-2026-111943 notice, and that fix
comes from the Go toolchain (>= 1.26.10 / 1.27.3) rather than from the
tag. The archive README and the top-level README now say so, instead of
implying every archived series predates a security fix.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
v1.10.0 carries upstream CVE fixes that the older releases predate, so
stop building them. Their series move to patches/archive/<tag>/ rather
than being deleted — still available for a deliberate rebuild, just not
shipped — and ci/support-matrix.yaml now lists v1.10.0 alone.
Dropping the matrix entries was not enough on its own. Two gaps made
"not built" untrue:
* apply-patches.sh only consulted the matrix `if command -v yq`, and the
stock golang CI container has no yq — so in CI the registry was never
actually read. The tag fell through to patches/<tag> every time.
* An empty or missing patch directory was a warning and exit 0, i.e.
"building vanilla upstream". Archiving the directories would therefore
have made a dispatch for v1.8.0 publish an un-de-branded, unpatched,
CVE-vulnerable build under this project's release name — the exact
outcome we are trying to prevent.
So the matrix is now an enforced allowlist: a tag it does not list exits
1, as does a patch directory with no patches in it. It is parsed with yq
when present and with a small awk parse otherwise, so the allowlist holds
in the CI container too. If the parse ever broke, an unmatched tag is
refused rather than built, so the failure mode stays closed.
PATCH_DIR remains the one bypass, and is now the documented way to
rebuild an archived series on purpose. That path also needed a fix: the
patch list is globbed before we cd into the source tree, so a relative
PATCH_DIR — the form the new error message suggests — globbed fine and
then failed in git am. PATCH_DIR is now resolved to an absolute path,
with a missing directory reported as such.
Also re-pointed the runnable examples in README.md, ci/run.sh and the
workflow's dispatch hint from v1.5.0 to v1.10.0; following them verbatim
would now hit the refusal.
Verified by exercising every branch: v1.10.0 applies; v1.8.0 is refused
with exit 1; PATCH_DIR=patches/archive/v1.8.0 rebuilds the archived
series; an empty directory and a nonexistent one are both refused. The
awk parser was checked against defaulted `patches:` fields, several tags
sharing one directory, and comment lines containing decoy `- tag:` text.
All seven archived patch files are recorded as pure renames.
Note: existing published releases for the retired versions stay
downloadable until deleted by hand in Gitea.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebase the de-brand + dark-theme series onto upstream v1.10.0 and make it
the highest entry in the support matrix. v1.9.0 is skipped — nothing
needs it, and the matrix only lists versions we want builds of.
Both patches applied to v1.10.0 with no conflicts and no 3-way fallback.
The de-brand patch is in fact unchanged hunk-for-hunk from the v1.8.0
series — only the three blob hashes for the files upstream touched
(dashboard.html, explorer.html, iam-oidc.html) differ — because every
v1.9/v1.10 webui edit lands outside the regions it rewrites. No new
admin pages this time, so its scope is unchanged.
The dark theme needed two new rules, both for the upload-progress tray
v1.10.0 adds to the Explorer:
* .text-gray-800 — the tray titles its panel with text-gray-800, which
is near-black and so effectively invisible on the dark panel. Lifted
to the primary text shade, continuing the gray-600/700 progression.
* .hover\:text-red-700:hover — the tray's Cancel link is text-red-600
hover:text-red-700. The existing rules lift the rest state to #f87171,
but Tailwind's red-700 (#b91c1c) is darker than that, so hovering
dimmed the link instead of lifting it. Lifted one shade brighter,
matching how hover:text-accent-600 behaves.
Left as-is: the tray's failed-upload progress fill uses bg-red-400,
which is already #f87171 — the same red the theme lifts its text to —
and reads clearly as a solid fill on the dark track. Also unchanged are
the utilities that are uncovered but already used by shipped pages
(text-gray-400/500, text-*-800 status text); re-pointing those would
restyle existing releases, which is a theme change rather than a rebase.
Verified: ci/clone-source.sh + ci/apply-patches.sh apply the exported
series to a pristine v1.10.0 producing a tree byte-identical to the one
developed here (1019 files = the tag's 1017, plus favicon.svg and four
fonts, less three Versity PNGs); the series touches webui/ only;
./cmd/versitygw builds; and go test ./webui/... passes, including the
webserver_test.go added in v1.10.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebase the de-brand + dark-theme series onto upstream v1.8.0 and make it
the highest entry in the support matrix.
v1.8.0 adds an IAM section to the admin UI — iam.html, iam-users.html,
iam-roles.html, iam-oidc.html and js/iam-ui.js — and rewrites much of the
existing pages, so the series needed real work rather than a clean replay:
* Sidebar conflict (buckets/dashboard/explorer/users). Upstream inserted
an "Identity & Access" nav group exactly where the de-brand patch
deletes the "Resources" block, so all four pages conflicted. Resolved
by keeping the new IAM nav and dropping Resources, along with the
divider that only existed to separate the two — matching the original
patch, which likewise left no trailing rule at the end of the nav.
* The four new IAM pages carry full Versity branding and were not covered
by the old series. Extended the de-brand patch to give them the same
treatment: tab title, favicon, sidebar wordmark, page heading, and
removal of the Resources links. The OIDC client-ID placeholder
sts.versity.local becomes sts.example.local, matching the neutral
token.example.com placeholder upstream already uses in that same form.
* Dark theme needed one new rule. Audited every color utility in the new
IAM markup against the override layer: all were already covered except
group-hover:bg-gray-200 on the IAM overview cards' icon chip, which
would flash near-white on card hover. Added it next to the existing
hover:bg-gray-200 override.
Left alone deliberately: internal JS identifiers and code comments
(class VersityAPI, "Maximum parts allowed by VersityGW"), which are not
visible branding and which the series has never touched; and the
per-file Apache-2.0 headers, kept for license compliance.
The series touches webui/ only — 961 files after apply, which is v1.8.0's
959 plus favicon.svg and four font files, less the three Versity PNGs.
Verified: ci/clone-source.sh + ci/apply-patches.sh apply the exported
series to a pristine v1.8.0 with no 3-way fallback, producing a tree
byte-identical to the one developed here, and ./cmd/versitygw (the
goreleaser target) builds clean from it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebases the v1.6.0 de-brand + dark-theme patch series onto upstream
v1.7.0, which applied with no conflicts. Sanity-built locally: clean
git am, and goreleaser produced binaries/archives for all platforms
(including linux) from src/dist.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Each Explorer row's action icons (Info, Download, Generate URL, Delete)
tint themselves on hover via Tailwind hover:bg-*-50 / hover:text-charcoal
utilities, but the dark-mode override layer only re-pointed the non-hover
utilities. The hover: variants fell through to Tailwind's light defaults:
Generate URL (hover:bg-blue-50) and Delete (hover:bg-red-50) flashed a
near-white box (#eff6ff / #fef2f2), and Info (hover:text-charcoal) drove
the icon to the near-black charcoal DEFAULT (#12121a), vanishing on the
dark page. Download looked fine only because its hover:bg-accent-50 maps
to the custom dark accent-50 (#172554).
Re-point the four hover variants to the same translucent 0.13-alpha tints
used elsewhere, and lift text-red-500 (the delete icons' rest colour) to
the themed red-400 #f87171 like the other reds. These are utility-class
overrides, so they also fix the bucket / folder / version delete icons and
the modal close buttons. Folded into 0002-webui-dark-theme.patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
getStorageClassColor() in explorer.html tags each object's storage
class with a Tailwind bg-*-50/text-*-700 pair, but the dark-mode
override layer only re-pointed the green/blue/red/yellow/gray
utilities. Cyan (GLACIER, GLACIER_IR), purple (INTELLIGENT_TIERING)
and indigo (DEEP_ARCHIVE) fell through, so those badges kept their
light bg-*-50 fill on the dark page.
Extend the override layer with the three missing families, reusing the
status-tint recipe: a translucent 0.13-alpha fill plus text lifted to
the 400 shade (indigo lands on the kanrisha primary-400 #818cf8).
Folded into 0002-webui-dark-theme.patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Native checkboxes render as a light box regardless of accent-color, so
they stood out against the dark theme. Restyle input[type=checkbox]
with appearance:none to mirror the kanrisha web UI: an outlined box
that becomes an indigo-tinted box with a light indigo tick when checked
(plus an indeterminate dash and focus ring).
Sizing is left to the existing w-4/h-4 classes so the hidden
toggle-switch input is untouched. Folded into 0002-webui-dark-theme.patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add patches/v1.6.0/0002-webui-dark-theme.patch, a cosmetic patch that
re-skins the de-branded admin UI to match the kanrisha web app's dark
theme — near-black base-900 page, base-800 panels/sidebar, indigo
(#6366f1) primary and blue (#3b82f6) accent, lifted status colors, and
self-hosted Inter + JetBrains Mono.
The retheme lives entirely in tailwind-config.js (token remap) and
theme.css (a utility-override layer), plus bundled variable woff2
fonts, so versitygw's HTML is left untouched apart from the login
page's light gradient becoming a solid dark surface.
Verified: the full series (0001 + 0002) replays cleanly from the bare
v1.6.0 tag, and the login, dashboard, and modal surfaces render dark
in a browser. Applied to v1.6.0 only; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rebase the webui de-brand patch onto upstream versitygw v1.6.0 (clean
git am --3way, no conflicts). The de-branded HTML files are unchanged
between v1.5.0 and v1.6.0, so the series is byte-identical apart from
blob hashes; verified the result on a fresh v1.6.0 checkout (titles,
wordmark, removed logos/favicon all correct).
- patches/v1.6.0/0001-webui-debrand.patch (--binary export)
- ci/support-matrix.yaml: v1.6.0 added as the top/latest entry
- README.md: layout tree + maintained-versions table updated
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The v1.5.0 de-brand patch now also strips the visible "Versity Software
Inc." copyright footer from the login page (webui/web/index.html). The
upstream copyright is still retained via the Apache-2.0 license-header
comment at the top of each file and the NOTICE file, so this removes the
trademark/branding without affecting copyright compliance.
Update the README to document the removal and adjust the "deliberately
kept" note.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
runs-on is now ubuntu-latest (any Linux runner with Docker; toolchain comes from the golang container). The workflow builds one version per run, triggered by a v* tag push or manual workflow_dispatch with a tag input - no scheduled builds. Removes the static matrix (and ci/matrix.sh) and hardens clone-source.sh tag detection to use GITHUB_REF. Docs/README updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ScoutFS-Build-style pipeline that pulls upstream versitygw release tags, applies the web-UI de-brand patch series, and builds GoReleaser releases (binaries + deb/rpm) for publishing to Gitea. Artifact names stay versitygw; only the embedded admin UI is rebranded to S3 Gateway.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
57_WolveandClaude Opus 5.5
William GillandClaude Opus 4.8