A compact, non-exhaustive reference for the values that appear across the notes. Prefer the linked source for the authoritative rule; these tables are memory aids.
HTTP status codes used in release checks#
| Code | Meaning | Used for |
|---|
| 200 OK | The resource exists and the representation is returned | baseline for a healthy route |
| 301 Moved Permanently | The URI changed permanently | deciding between : old_uri and : new_uri in logs |
| 308 Permanent Redirect | Non-GET methods keep their method across the redirect | the redirects-and-status-codes note |
| 206 Partial Content | A range request was honored | the http-range-requests note |
| 304 / 412 | Validators drive conditional requests | the http-cache-headers note |
| 404 | Not found | the handle_errors page in the Caddyfile |
| 500 / 502 / 503 | Origin or proxy failure | release smoke tests and restart loops |
| Header | A short version of the policy |
|---|
Content-Security-Policy | default-src 'self'; script-src 'none' keeps the page script-free |
Strict-Transport-Security | max-age=31536000; includeSubDomains forces HTTPS for a year |
X-Content-Type-Options | nosniff stops MIME-type guessing |
X-Frame-Options | DENY prevents framing |
Referrer-Policy | strict-origin-when-cross-origin limits referrers |
Digest commands for a released artifact#
# per file
sha256sum <file>
# plain-text check available in the operator kit
check-http-headers.sh https://www.xbcatm.com/
check-tls-expiry.sh www.xbcatm.com 30
Sources#