Seven minors in sequence as the documentation requires, each rolled out and
verified before the next was pushed: three deployments on the new version and
fifteen certificates Ready every time. Measured on the target images first, so
the point was known before the work: eight critical findings become zero and a
hundred and twenty-eight high become twenty-four.
Two candidates were measured and deliberately left alone. Wiki.js runs a
floating tag that points at a newer build than the release tags that look newer
by number — upgrading to 2.5.277 would have tripled its critical findings from
twelve to forty. Draupnir has no newer release at all, which sharpens what pile
A means: a package having a fix is not the same as an image existing that
carries it.
The mirror outage gets its own review. Between step one and two the pipeline
stood for an hour because git.lab could not reach the operating host on 443
while its firewall was being changed. The cluster never noticed, because the
CoreDNS pointer added yesterday sends the name down the private path — the
design doc warned about the opposite failure, and the mirror image of it is what
happened.
Thore Cimbal
13aecc8da0