chore(release): finish 1.0.4 customer image and chart publication #2230

Complete customer distribution for the exact umbrella 1.0.4 selection under #2432. Candidate and QA are tracked in #2492; the complete baseline delta is #2823; all selected charts are tracked in #2843.

Current selection

The refreshed release-nvcf/1.0.4 candidate at 077248a76580307ad823e2a9601187dca10099d1 selects Self-Managed 1.0.7, Compute Plane 1.0.3 and Observability 1.0.0. Candidate assembly passed. Stack-resource and umbrella customer publication remain held for revised QA.

All four selected image catalog reviews are merged: NICLLS 2.118.2, Samba 1.0.8 and both collectors 0.160.0-nv-0.2.9. Publish and Verify Published passed. All consumer PRs are merged. API maintenance chart 1.27.4 is customer-downloadable and consumed by Self-Managed 1.0.7.

Customer access verified - October 26 UTC

The selected image access defect is resolved. Grouped visibility MR !10504 was merged by the user, and automatic main pipeline 76658129, Publish 509256195, and Verify Published 509256205 passed.

At 03:28:56 UTC, the same external account verified Samba 1.0.8 and both collectors 0.160.0-nv-0.2.9: readable public catalog metadata, a repository pull grant, exact producer/staging index digest, both amd64/arm64 child manifests and config blob hashes/platforms. Visibility is public/searchable with guest access disabled and no product restriction; anonymous manifest reads remain denied. NICLLS 2.118.2 passed the same control at 03:25:23 UTC. No image or tag was rebuilt or republished. Registry/catalog propagation initially returned403 after Publish; the later actual customer readback is the acceptance evidence.

Historical cause: update_version discards public/searchable options and executes --version-only, while the old Verify Published tolerated unavailable visibility metadata. Before correction the three repositories returned empty pull grants and Not a catalog artifact; prior private entitlement values were unreadable and were never inferred. The repository-wide visibility-only correction retained public:true, guest_access:false, searchable:true and also applies to older tags.

The prevention change is a separate follow-up and is not a 1.0.4 QA-handoff gate. It is ready for review in nvpublish MR !141, tracked by nvpublish #34. CI 76658683 passed. The bounded change requires readable visibility and an external pull grant before public image version-only submissions, adds exact customer image readback, and reports merged config intent accurately. Its 2.0.0 migration requires NGC_EXTERNAL_API_KEY and the config_merged outcome. Broader first-publication orchestration/shared verification stays separately tracked in nvpublish #35.

The nvpublish workspace owns this publication/access fix. No manual CI action or merge was performed by the nvpublish agent. Stack-resource and umbrella publication remain held for revised QA; capricorn retains BDD testing and umbrella qualification.

Earlier producer-route BDD runs are historical; single-02 was interrupted. The BDD owner now runs the exact bundle with mandatory public customer URL/image namespace inputs, selected versions and default resource/security settings, single-cluster followed by multi-cluster. Results are pending under #2492. Sample fixture access remains a separate prerequisite.

Remaining work

• Review/adopt nvpublish MR !141 with its documented external credential and handoff migration; keep broader automation in nvpublish [FEA][sync-test] Temporary clone-disabled validation #35. The selected image visibility correction and customer readback are complete.
• Preserve remaining OpenBao signing/artifact-association follow-up under Qualify OpenBao 0.19.9 catalog publication and stack consumption #2630 and exact source/platform discrepancies under Reconcile Self-Managed 1.0.2 immutable image digests and state-metrics platforms #2848. Do not rebuild published versions for cleanup.
• Confirm required security associations for the selected artifacts; Clear replacement-scan and numeric-user gates for the umbrella patch #2640 is historical baseline evidence and Implement selected collector, Samba and NICLLS CVE fixes for 1.0.4 #2797 retains deferred findings.
• Qualify the manifest-selected combination through chore(release): publish the consolidated NVCF umbrella 1.0.4 candidate #2492, then publish and verify the three selected stack resources and umbrella. test(release): qualify the NVCF 1.0.4 release branch #2074/test(release): qualify the supported 1.0.4 branch upgrade #2457 retain baseline QA/upgrade evidence and the procedure for revised acceptance.

Preserved baseline

The earlier 28 maintained-image selections had source-bound producers, both-platform consumer readback and numeric users. Baseline selections included API 1.18.1, Task API 1.66.1, NVCA 3.10.3, Cassandra migrations 0.17.7, ESS Agent 1.4.4, ESS API 0.5.4, Notary 1.14.5, ICMS 0.7.6 and Stargate/Pylon 0.18.3. Their existing chart/source checks and runtime evidence remain intact. These findings are baseline evidence, not fresh verification of every replacement or all third-party images.

Secondary staging copies, producer deduplication, runner migration and unused derivative publishers remain follow-up under #2798. Heavy Cassandra/OpenBao upgrades, Samba root-runtime redesign, state-metrics and unselected CVEs remain deferred.