Upstream released v1.11.0 (e42ae7a, 2026-11-06): 42 commits, mostly
fixes, plus two WebUI features that add ~415 lines to explorer.html
(on-demand bucket size calculation, restore archived objects).
The series needed no content changes — the regenerated patches differ
from the v1.10.0 ones only in their `index <blob>..<blob>` lines, since
the de-brand edits sit above the regions upstream touched. Regenerating
them is still worthwhile: the v1.10.0 patches' pre-image blobs do not
exist in a v1.11.0 clone, so `git am --3way` could not use its 3-way
fallback and was silently applying them directly.
Verified before committing:
- round-trips from a clean clone to tree 8d509fe
- residual branding identical to the patched v1.10.0 tree (23
occurrences, same per-file spread, no regressions)
- all 5 light-mode Tailwind classes in the new explorer markup are
overridden in theme.css
- series touches only webui/; file count 1049 -> 1051
- goreleaser builds all 8 targets plus deb/rpm
- matrix accepts v1.11.0, refuses v1.10.0, PATCH_DIR still rebuilds
the archived series
v1.10.0 moves to patches/archive/ as *superseded*, not vulnerable: it is
the release carrying upstream's CVE-2026-111943 notice, and that fix
comes from the Go toolchain (>= 1.26.10 / 1.27.3) rather than from the
tag. The archive README and the top-level README now say so, instead of
implying every archived series predates a security fix.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
v1.10.0 carries upstream CVE fixes that the older releases predate, so
stop building them. Their series move to patches/archive/<tag>/ rather
than being deleted — still available for a deliberate rebuild, just not
shipped — and ci/support-matrix.yaml now lists v1.10.0 alone.
Dropping the matrix entries was not enough on its own. Two gaps made
"not built" untrue:
* apply-patches.sh only consulted the matrix `if command -v yq`, and the
stock golang CI container has no yq — so in CI the registry was never
actually read. The tag fell through to patches/<tag> every time.
* An empty or missing patch directory was a warning and exit 0, i.e.
"building vanilla upstream". Archiving the directories would therefore
have made a dispatch for v1.8.0 publish an un-de-branded, unpatched,
CVE-vulnerable build under this project's release name — the exact
outcome we are trying to prevent.
So the matrix is now an enforced allowlist: a tag it does not list exits
1, as does a patch directory with no patches in it. It is parsed with yq
when present and with a small awk parse otherwise, so the allowlist holds
in the CI container too. If the parse ever broke, an unmatched tag is
refused rather than built, so the failure mode stays closed.
PATCH_DIR remains the one bypass, and is now the documented way to
rebuild an archived series on purpose. That path also needed a fix: the
patch list is globbed before we cd into the source tree, so a relative
PATCH_DIR — the form the new error message suggests — globbed fine and
then failed in git am. PATCH_DIR is now resolved to an absolute path,
with a missing directory reported as such.
Also re-pointed the runnable examples in README.md, ci/run.sh and the
workflow's dispatch hint from v1.5.0 to v1.10.0; following them verbatim
would now hit the refusal.
Verified by exercising every branch: v1.10.0 applies; v1.8.0 is refused
with exit 1; PATCH_DIR=patches/archive/v1.8.0 rebuilds the archived
series; an empty directory and a nonexistent one are both refused. The
awk parser was checked against defaulted `patches:` fields, several tags
sharing one directory, and comment lines containing decoy `- tag:` text.
All seven archived patch files are recorded as pure renames.
Note: existing published releases for the retired versions stay
downloadable until deleted by hand in Gitea.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebase the de-brand + dark-theme series onto upstream v1.10.0 and make it
the highest entry in the support matrix. v1.9.0 is skipped — nothing
needs it, and the matrix only lists versions we want builds of.
Both patches applied to v1.10.0 with no conflicts and no 3-way fallback.
The de-brand patch is in fact unchanged hunk-for-hunk from the v1.8.0
series — only the three blob hashes for the files upstream touched
(dashboard.html, explorer.html, iam-oidc.html) differ — because every
v1.9/v1.10 webui edit lands outside the regions it rewrites. No new
admin pages this time, so its scope is unchanged.
The dark theme needed two new rules, both for the upload-progress tray
v1.10.0 adds to the Explorer:
* .text-gray-800 — the tray titles its panel with text-gray-800, which
is near-black and so effectively invisible on the dark panel. Lifted
to the primary text shade, continuing the gray-600/700 progression.
* .hover\:text-red-700:hover — the tray's Cancel link is text-red-600
hover:text-red-700. The existing rules lift the rest state to #f87171,
but Tailwind's red-700 (#b91c1c) is darker than that, so hovering
dimmed the link instead of lifting it. Lifted one shade brighter,
matching how hover:text-accent-600 behaves.
Left as-is: the tray's failed-upload progress fill uses bg-red-400,
which is already #f87171 — the same red the theme lifts its text to —
and reads clearly as a solid fill on the dark track. Also unchanged are
the utilities that are uncovered but already used by shipped pages
(text-gray-400/500, text-*-800 status text); re-pointing those would
restyle existing releases, which is a theme change rather than a rebase.
Verified: ci/clone-source.sh + ci/apply-patches.sh apply the exported
series to a pristine v1.10.0 producing a tree byte-identical to the one
developed here (1019 files = the tag's 1017, plus favicon.svg and four
fonts, less three Versity PNGs); the series touches webui/ only;
./cmd/versitygw builds; and go test ./webui/... passes, including the
webserver_test.go added in v1.10.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebase the de-brand + dark-theme series onto upstream v1.8.0 and make it
the highest entry in the support matrix.
v1.8.0 adds an IAM section to the admin UI — iam.html, iam-users.html,
iam-roles.html, iam-oidc.html and js/iam-ui.js — and rewrites much of the
existing pages, so the series needed real work rather than a clean replay:
* Sidebar conflict (buckets/dashboard/explorer/users). Upstream inserted
an "Identity & Access" nav group exactly where the de-brand patch
deletes the "Resources" block, so all four pages conflicted. Resolved
by keeping the new IAM nav and dropping Resources, along with the
divider that only existed to separate the two — matching the original
patch, which likewise left no trailing rule at the end of the nav.
* The four new IAM pages carry full Versity branding and were not covered
by the old series. Extended the de-brand patch to give them the same
treatment: tab title, favicon, sidebar wordmark, page heading, and
removal of the Resources links. The OIDC client-ID placeholder
sts.versity.local becomes sts.example.local, matching the neutral
token.example.com placeholder upstream already uses in that same form.
* Dark theme needed one new rule. Audited every color utility in the new
IAM markup against the override layer: all were already covered except
group-hover:bg-gray-200 on the IAM overview cards' icon chip, which
would flash near-white on card hover. Added it next to the existing
hover:bg-gray-200 override.
Left alone deliberately: internal JS identifiers and code comments
(class VersityAPI, "Maximum parts allowed by VersityGW"), which are not
visible branding and which the series has never touched; and the
per-file Apache-2.0 headers, kept for license compliance.
The series touches webui/ only — 961 files after apply, which is v1.8.0's
959 plus favicon.svg and four font files, less the three Versity PNGs.
Verified: ci/clone-source.sh + ci/apply-patches.sh apply the exported
series to a pristine v1.8.0 with no 3-way fallback, producing a tree
byte-identical to the one developed here, and ./cmd/versitygw (the
goreleaser target) builds clean from it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rebases the v1.6.0 de-brand + dark-theme patch series onto upstream
v1.7.0, which applied with no conflicts. Sanity-built locally: clean
git am, and goreleaser produced binaries/archives for all platforms
(including linux) from src/dist.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Native checkboxes render as a light box regardless of accent-color, so
they stood out against the dark theme. Restyle input[type=checkbox]
with appearance:none to mirror the kanrisha web UI: an outlined box
that becomes an indigo-tinted box with a light indigo tick when checked
(plus an indeterminate dash and focus ring).
Sizing is left to the existing w-4/h-4 classes so the hidden
toggle-switch input is untouched. Folded into 0002-webui-dark-theme.patch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add patches/v1.6.0/0002-webui-dark-theme.patch, a cosmetic patch that
re-skins the de-branded admin UI to match the kanrisha web app's dark
theme — near-black base-900 page, base-800 panels/sidebar, indigo
(#6366f1) primary and blue (#3b82f6) accent, lifted status colors, and
self-hosted Inter + JetBrains Mono.
The retheme lives entirely in tailwind-config.js (token remap) and
theme.css (a utility-override layer), plus bundled variable woff2
fonts, so versitygw's HTML is left untouched apart from the login
page's light gradient becoming a solid dark surface.
Verified: the full series (0001 + 0002) replays cleanly from the bare
v1.6.0 tag, and the login, dashboard, and modal surfaces render dark
in a browser. Applied to v1.6.0 only; README updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rebase the webui de-brand patch onto upstream versitygw v1.6.0 (clean
git am --3way, no conflicts). The de-branded HTML files are unchanged
between v1.5.0 and v1.6.0, so the series is byte-identical apart from
blob hashes; verified the result on a fresh v1.6.0 checkout (titles,
wordmark, removed logos/favicon all correct).
- patches/v1.6.0/0001-webui-debrand.patch (--binary export)
- ci/support-matrix.yaml: v1.6.0 added as the top/latest entry
- README.md: layout tree + maintained-versions table updated
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The v1.5.0 de-brand patch now also strips the visible "Versity Software
Inc." copyright footer from the login page (webui/web/index.html). The
upstream copyright is still retained via the Apache-2.0 license-header
comment at the top of each file and the NOTICE file, so this removes the
trademark/branding without affecting copyright compliance.
Update the README to document the removal and adjust the "deliberately
kept" note.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
runs-on is now ubuntu-latest (any Linux runner with Docker; toolchain comes from the golang container). The workflow builds one version per run, triggered by a v* tag push or manual workflow_dispatch with a tag input - no scheduled builds. Removes the static matrix (and ci/matrix.sh) and hardens clone-source.sh tag detection to use GITHUB_REF. Docs/README updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ScoutFS-Build-style pipeline that pulls upstream versitygw release tags, applies the web-UI de-brand patch series, and builds GoReleaser releases (binaries + deb/rpm) for publishing to Gitea. Artifact names stay versitygw; only the embedded admin UI is rebranded to S3 Gateway.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
57_WolveandClaude Opus 5
William GillandClaude Opus 4.8