Orchestration Engine provides the metadata, process, API, scheduling, storage, networking, and lifecycle coordination layer for the preserved control platform.
PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
Upstream: rancher/cattle. This GitHub fork preserves upstream history, authorship, dates, tags, licenses, and bundled dependency notices. PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.
This source tree produces engine version 0.183.271. It retains the existing Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and runtime-hardening work from the maintained compatibility line. Release builds also compile a pinned Hazelcast 5.7.0 source revision with the tracked Jackson security patch described in third-party/HAZELCAST.md; the patched artifact is never downloaded from an unverified binary source.
WebAuthn verification uses WebAuthn4J's maintained tools.jackson 3.1
dependency line. The existing platform JSON surface remains on
com.fasterxml.jackson 2.22. Packaging gates admit only the reviewed,
version-pinned pair and verify that their class namespaces are disjoint.
Host compatibility is evidence-based. The default policy recognizes the preserved legacy ranges plus only the modern Docker Engine releases that have completed the PastureStack host matrix: 24.0.9, 29.4.1, and 29.6.2. It does not imply support for untested intervening releases.
Product-facing names use PastureStack terminology. Established Java packages, Maven coordinates, database identifiers, settings, API schemas, event names, Docker labels, and executable aliases remain where changing them would break compatible installations.
Authentication keeps a platform account as the stable authorization principal. Local credentials and external identities are explicit login links; provider changes do not recreate accounts. External OpenID Connect identities are matched by exact issuer and subject rather than username or email. System-administrator workflows support verified identity reassignment, permission transfer, disabled-account restoration, safe provider switching, and MFA-protected local recovery.
Interactive MFA supports RFC 6238 six-digit TOTP, WebAuthn passkeys including Windows Hello, phones, and hardware security keys, hashed single-use recovery codes, and verified email account recovery. Email is not treated as an MFA factor. Passkey limits, enforcement, WebAuthn relying-party settings, and encrypted SMTP configuration are administrator-controlled. Enrollment, recovery-code generation, and recovery-address verification require the account holder's authenticated session. Administrators can inspect and revoke another account's security material, but cannot create factors or retrieve recovery codes on that account holder's behalf.
Run the complete JDK 25 package gate before publishing an engine artifact or Server image:
bash scripts/check-cattle-jdk25-full-packageThe gate performs dependency-hygiene checks, builds every Maven module with JDK 25, rejects retired packaged libraries, verifies class-file major version 69, and starts the standalone application against an isolated H2 database.
To create the complete release archive after the gate passes:
ENGINE_VERSION=0.183.271 bash scripts/build --release
bash scripts/check-release-artifact dist/artifacts/cattle.jarRelease packaging uses the exact Git revision and commit timestamp as reproducible build inputs. The selector accepts only a complete web application containing the launcher, Runtime resources, authentication logic, and WEB-INF/web.xml.
Database-backed and full-stack suites require isolated MariaDB/MySQL and companion-service fixtures. See COMPATIBILITY.md, SECURITY.md, and ORIGIN.md.
User-facing translations are supplied by the PastureStack web console. API field names, persisted values, event names, identifiers, and remote error payloads are compatibility data and are not translated.
The inherited project remains licensed under Apache License 2.0. Copyright and attribution for inherited work and bundled dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.