chen21019 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -1,13 +1,24 @@
 name: Security release gate
 
 on:
+  pull_request:
+    branches: [main]
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: New immutable numeric tag; empty runs verification only
+        required: false
+        default: ''
+        type: string
   push:
     branches:
       - 'verification/external-dns-sync-*'
 
 permissions:
-  contents: read
+  contents: write
+  packages: write
+  id-token: write
+  attestations: write
 
 concurrency:
   group: external-dns-sync-security-${{ github.ref }}
@@ -30,6 +41,29 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Validate manual release request
+        if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REF" = refs/heads/main
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "$RELEASE_TAG" = 'v0.8.1'
+          test -z "$(git status --porcelain)"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA"
+          tags="$(gh api --paginate "repos/$GITHUB_REPOSITORY/tags" --jq '.[].name')"
+          if grep -Fxq "$RELEASE_TAG" <<<"$tags"; then
+            echo 'The release tag already exists; refusing to overwrite it' >&2
+            exit 1
+          fi
+          gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs" --jq '
+            [.check_runs[] | select(.name == "Analyze (go)" or .name == "Analyze (actions)")]
+            | group_by(.name) | length == 2 and all(any(.conclusion == "success"))' | grep -Fx true
+
       - name: Record candidate identity and source gates
         shell: bash
         run: |
@@ -113,7 +147,7 @@ jobs:
           docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
             'docker --version; go version -m /usr/bin/docker' \
             > evidence/docker-cli-version.txt
-          grep -F 'Docker version 29.7.2' evidence/docker-cli-version.txt >/dev/null
+          grep -F 'Docker version 29.9.2' evidence/docker-cli-version.txt >/dev/null
           test -f package/third-party-licenses/github.com/aws/aws-sdk-go-v2/LICENSE.txt
           test -f package/third-party-licenses/github.com/aws/aws-sdk-go-v2/NOTICE.txt
           test -f package/third-party-licenses/github.com/alibabacloud-go/alidns-20150109/v5/LICENSE
@@ -205,7 +239,7 @@ jobs:
 
           # The reviewed package is only user-space Linux API headers inside
           # the disposable builder; no kernel image or modules can be present.
-          grep -F $'linux-libc-dev:amd64\t7.0.0-29.29' evidence/dapper-dpkg.tsv >/dev/null
+          grep -F $'linux-libc-dev:amd64\t7.0.0-38.38' evidence/dapper-dpkg.tsv >/dev/null
           if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' evidence/dapper-dpkg.tsv; then
             printf 'Unexpected Linux kernel runtime package in Dapper image\n' >&2
             exit 1
@@ -290,6 +324,58 @@ jobs:
           test "$dapper_applicable_critical" -eq 0
           test "$dapper_applicable_high" -eq 0
 
+      - name: Publish the tested image once
+        id: publish
+        if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          TESTED_IMAGE: ghcr.io/pasturestack/external-dns-sync:v0.8.1
+        run: |
+          set -euo pipefail
+          test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA"
+          remote="ghcr.io/pasturestack/external-dns-sync:$RELEASE_TAG"
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          if docker manifest inspect "$remote" > /dev/null 2> evidence/registry-preflight.txt; then
+            echo 'Image tag already exists; refusing to overwrite it' >&2
+            exit 1
+          fi
+          grep -Ei 'manifest unknown|no such manifest|not found' evidence/registry-preflight.txt
+          docker tag "$TESTED_IMAGE" "$remote"
+          docker push "$remote"
+          reference="$(docker image inspect --format '{{index .RepoDigests 0}}' "$remote")"
+          digest="${reference#*@}"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          printf 'digest=%s\n' "$digest" >> "$GITHUB_OUTPUT"
+          printf 'image=%s\ndigest=%s\nproducer=%s\n' "$remote" "$digest" "$GITHUB_SHA" > evidence/published.txt
+          (cd evidence && sha256sum published.txt > published.sha256)
+
+      - name: Attest the published image
+        if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-name: ghcr.io/pasturestack/external-dns-sync
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          push-to-registry: true
+
+      - name: Record the immutable source and release
+        if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          tag_sha="$(gh api --method POST "repos/$GITHUB_REPOSITORY/git/tags" \
+            -f tag="$RELEASE_TAG" -f object="$GITHUB_SHA" -f type=commit \
+            -f message="Security refresh $RELEASE_TAG" --jq .sha)"
+          gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
+            -f ref="refs/tags/$RELEASE_TAG" -f sha="$tag_sha" >/dev/null
+          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --title "$RELEASE_TAG" --notes-file evidence/published.txt \
+            evidence/published.txt evidence/published.sha256 evidence/*.json
+
       - name: Upload review evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

@@ -4,15 +4,18 @@ FROM ${UBUNTU_IMAGE}
 # Modified by PastureStack contributors for independent maintenance and rebranding.
 
 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
-ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
+COPY security/install-ubuntu-security-updates.sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh
+COPY security/ubuntu-security-packages.lock /usr/share/pasturestack/ubuntu-security-packages.lock
+
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb
 
 ARG DAPPER_HOST_ARCH=amd64
-ARG GO_VERSION=1.27.0
-ARG DOCKER_VERSION=29.7.2
-ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG GO_LINUX_ARM64_SHA256=51798d2c42d0e1c6ed7fd9f48728b4193abac9e8aad6dbac2fe96a81f5909bda
-ARG DOCKER_LINUX_AMD64_SHA256=803d433f226db4776e1768fd319fc6c6e4935a456acf84fcc0080818b854bc8f
-ARG DOCKER_LINUX_ARM64_SHA256=43d143448adf2c2787704e7d7704fd6d62d367a54c5edaef0a3f75509cb0938d
+ARG GO_VERSION=1.27.3
+ARG DOCKER_VERSION=29.9.2
+ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG GO_LINUX_ARM64_SHA256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
+ARG DOCKER_LINUX_AMD64_SHA256=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb
+ARG DOCKER_LINUX_ARM64_SHA256=873b3e0207857c3b2f28392fb922f3ea6efe37620c16d4d4aaf2fef409c90b73
 ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -33,7 +36,7 @@ RUN set -eux; \
     apt-get update && \
     apt-get install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
-        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        /tmp/ca-certificates.deb \
         curl="${UBUNTU_APT_CURL_VERSION}" \
         file="${UBUNTU_APT_FILE_VERSION}" \
         gcc="${UBUNTU_APT_GCC_VERSION}" \
@@ -44,6 +47,9 @@ RUN set -eux; \
         make="${UBUNTU_APT_MAKE_VERSION}" \
         tar="${UBUNTU_APT_TAR_VERSION}" \
         xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = "${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; \
+    sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \
+    dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
     { \
         printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; \
         dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; \

@@ -1,5 +1,7 @@
 <!-- Modified by PastureStack contributors for independent maintenance and rebranding. -->
 
+Current source builds use Go 1.27.3 with Go language minimum 1.26.0, selected `golang.org/x/net` v0.60.0 and its required `golang.org/x/sys` v0.48.0. The Ubuntu 26.04 builder pins CA package 20260816ubuntu0.26.04.1 without advancing other package snapshots; the Alpine 3.23 runtime pins CA package 20261020-r0. These inputs apply to newly built artifacts.
+
 # External DNS Sync
 
 > PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
@@ -85,7 +87,7 @@ precedence for new deployments.
 
 ## Local build and test
 
-The project uses a containerized Go 1.27.0 module build with a committed
+The project uses a containerized Go 1.27.3 module build with a committed
 `vendor/modules.txt` dependency lock. Route 53 uses AWS SDK for Go v2
 `v1.65.10`; AliDNS uses Alibaba Cloud's maintained V2.0 SDK `v5.6.0`.
 The end-of-life AWS SDK for Go v1, Aliyungo, and the legacy `vendor.conf`
@@ -142,3 +144,5 @@ PastureStack has not replaced the license. Upstream copyright notices and the
 license and notice files of vendored dependencies must be preserved. The local
 packaging step copies discovered vendored legal files into
 `/licenses/third-party/` in the runtime image.
+
+Security micro-updates are constrained by `security/ubuntu-security-packages.lock` to the signed Ubuntu 26.04 snapshot of 2026-10-23; the general package snapshot remains unchanged. Builds record the resulting package versions in `/usr/share/pasturestack/ubuntu-security-packages.tsv`. Existing runtime and firewall contracts are unchanged.
@@ -49,9 +49,9 @@ socket to build and package the runtime image. It must not be deployed as a
 production service.
 
 The build image uses a digest-pinned Ubuntu 26.04 base, the
-`20260808T000000Z` snapshot, Go 1.27.0, and Docker CLI 29.7.2 from
+`20260808T000000Z` snapshot, Go 1.27.3, and Docker CLI 29.9.2 from
 SHA-256-verified official archives. The runtime uses a digest-pinned Alpine
-3.23 base with only exact Bash and CA-certificate packages.
+3.23 base with exact Bash, CA-certificate, musl, zlib, and OpenSSL-library security pins.
 Builds run in Go module vendor mode with network dependency resolution disabled.
 Route 53 uses AWS SDK for Go v2 and AliDNS uses Alibaba Cloud's maintained V2.0
 SDK; the end-of-life AWS SDK for Go v1, Aliyungo, and `vendor.conf` must not

@@ -2,7 +2,7 @@ module github.com/PastureStack/external-dns-sync
 
 go 1.26.0
 
-toolchain go1.27.0
+toolchain go1.27.3
 
 require (
 	github.com/alibabacloud-go/alidns-20150109/v5 v5.6.0
@@ -24,7 +24,7 @@ require (
 	github.com/sirupsen/logrus v1.10.2
 	github.com/valyala/fasttemplate v1.2.2
 	github.com/waynz0r/go-powerdns v1.1.1
-	golang.org/x/net v0.58.0
+	golang.org/x/net v0.60.0
 	golang.org/x/oauth2 v0.36.0
 )
 
@@ -58,7 +58,7 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gopkg.in/ini.v1 v1.67.3 // indirect
 )
@@ -252,6 +252,8 @@ golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -288,6 +290,8 @@ golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -312,6 +316,7 @@ golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

@@ -9,7 +9,12 @@ COPY ubuntu-apt.lock /licenses/ubuntu-build-apt.lock
 
 RUN apk add --no-cache \
         bash=5.3.3-r1 \
-        ca-certificates=20260611-r0 && \
+        ca-certificates=20261020-r0 \
+        libcrypto3=3.5.9-r0 \
+        libssl3=3.5.9-r0 \
+        musl=1.2.5-r24 \
+        musl-utils=1.2.5-r24 \
+        zlib=1.3.2-r1 && \
     apk info -v | LC_ALL=C sort > /licenses/EXTERNAL-DNS-SYNC-RUNTIME-ALPINE-PACKAGES.tsv && \
     addgroup -S -g 10001 pasturestack && \
     adduser -S -D -h /home/pasturestack -s /sbin/nologin -G pasturestack -u 10001 pasturestack

@@ -26,24 +26,27 @@ reject_marker() {
   fi
 }
 
-require_marker Dockerfile.dapper 'ARG GO_VERSION=1.27.0' EXTERNAL_DNS_GO_VERSION_NOT_CURRENT
+require_marker Dockerfile.dapper 'ARG GO_VERSION=1.27.3' EXTERNAL_DNS_GO_VERSION_NOT_CURRENT
 require_marker Dockerfile.dapper 'GO111MODULE=on' EXTERNAL_DNS_GO_MODULE_MODE_MISSING
 require_marker Dockerfile.dapper 'GOTOOLCHAIN=local' EXTERNAL_DNS_GO_TOOLCHAIN_NOT_LOCAL
 require_marker Dockerfile.dapper 'GOPROXY=off' EXTERNAL_DNS_GO_NETWORK_BUILD_NOT_DISABLED
 reject_marker Dockerfile.dapper 'GO111MODULE=off' EXTERNAL_DNS_LEGACY_GOPATH_MODE_PRESENT
-require_marker Dockerfile.dapper 'ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' EXTERNAL_DNS_GO_AMD64_SHA_MISSING
-require_marker Dockerfile.dapper 'ARG GO_LINUX_ARM64_SHA256=51798d2c42d0e1c6ed7fd9f48728b4193abac9e8aad6dbac2fe96a81f5909bda' EXTERNAL_DNS_GO_ARM64_SHA_MISSING
-require_marker Dockerfile.dapper 'ARG DOCKER_VERSION=29.7.2' EXTERNAL_DNS_DOCKER_VERSION_NOT_CURRENT
-require_marker Dockerfile.dapper 'ARG DOCKER_LINUX_AMD64_SHA256=803d433f226db4776e1768fd319fc6c6e4935a456acf84fcc0080818b854bc8f' EXTERNAL_DNS_DOCKER_AMD64_SHA_MISSING
-require_marker Dockerfile.dapper 'ARG DOCKER_LINUX_ARM64_SHA256=43d143448adf2c2787704e7d7704fd6d62d367a54c5edaef0a3f75509cb0938d' EXTERNAL_DNS_DOCKER_ARM64_SHA_MISSING
+require_marker Dockerfile.dapper 'ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' EXTERNAL_DNS_GO_AMD64_SHA_MISSING
+require_marker Dockerfile.dapper 'ARG GO_LINUX_ARM64_SHA256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49' EXTERNAL_DNS_GO_ARM64_SHA_MISSING
+require_marker Dockerfile.dapper 'ARG DOCKER_VERSION=29.9.2' EXTERNAL_DNS_DOCKER_VERSION_NOT_CURRENT
+require_marker Dockerfile.dapper 'ARG DOCKER_LINUX_AMD64_SHA256=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb' EXTERNAL_DNS_DOCKER_AMD64_SHA_MISSING
+require_marker Dockerfile.dapper 'ARG DOCKER_LINUX_ARM64_SHA256=873b3e0207857c3b2f28392fb922f3ea6efe37620c16d4d4aaf2fef409c90b73' EXTERNAL_DNS_DOCKER_ARM64_SHA_MISSING
 require_marker Dockerfile.dapper 'echo "${docker_sha}  /tmp/docker.tgz" | sha256sum -c -' EXTERNAL_DNS_DOCKER_SHA_NOT_CHECKED
 reject_marker Dockerfile.dapper 'curl -fsSL "https://download.docker.com' EXTERNAL_DNS_DOCKER_DOWNLOAD_UNBOUNDED
 require_marker package/Dockerfile 'USER 10001:10001' EXTERNAL_DNS_RUNTIME_NOT_NON_ROOT
 require_marker ubuntu-apt.lock "UBUNTU_APT_SNAPSHOT='20260808T000000Z'" EXTERNAL_DNS_APT_SNAPSHOT_MISSING
-require_marker Dockerfile.dapper 'ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}"' EXTERNAL_DNS_BUILD_APT_LOCK_MISSING
+require_marker Dockerfile.dapper '/tmp/ca-certificates.deb \' EXTERNAL_DNS_BUILD_CA_PACKAGE_MISSING
+require_marker Dockerfile.dapper 'test "$(dpkg-query -W -f=' EXTERNAL_DNS_BUILD_CA_READBACK_MISSING
 require_marker package/Dockerfile 'ARG ALPINE_IMAGE=alpine:3.23@sha256:1beb0dc0a51de7ff38e3b5274078a2e0b81113ba5c7535e1a03d5913a5edbda3' EXTERNAL_DNS_RUNTIME_BASE_NOT_PINNED
 require_marker package/Dockerfile 'bash=5.3.3-r1' EXTERNAL_DNS_RUNTIME_BASH_NOT_PINNED
-require_marker package/Dockerfile 'ca-certificates=20260611-r0' EXTERNAL_DNS_RUNTIME_CA_NOT_PINNED
+require_marker package/Dockerfile 'ca-certificates=20261020-r0' EXTERNAL_DNS_RUNTIME_CA_NOT_PINNED
+require_marker package/Dockerfile 'libcrypto3=3.5.9-r0' EXTERNAL_DNS_RUNTIME_CRYPTO_NOT_PATCHED
+require_marker package/Dockerfile 'libssl3=3.5.9-r0' EXTERNAL_DNS_RUNTIME_SSL_NOT_PATCHED
 reject_marker package/Dockerfile 'apt-get' EXTERNAL_DNS_RUNTIME_APT_PRESENT
 require_marker package/Dockerfile 'org.opencontainers.image.version="${VERSION}"' EXTERNAL_DNS_OCI_VERSION_MISSING
 require_marker package/Dockerfile 'org.opencontainers.image.revision="${REVISION}"' EXTERNAL_DNS_OCI_REVISION_MISSING
@@ -52,7 +55,7 @@ require_marker scripts/version 'plain numeric semantic version' EXTERNAL_DNS_NUM
 require_marker scripts/package 'test "${legal_count}" -eq 59' EXTERNAL_DNS_LEGAL_COUNT_GATE_MISSING
 require_marker scripts/package 'mkdir -p ../dist' EXTERNAL_DNS_DIST_DIRECTORY_GATE_MISSING
 require_marker go.mod 'go 1.26.0' EXTERNAL_DNS_GO_MODULE_COMPATIBILITY_VERSION_MISSING
-require_marker go.mod 'toolchain go1.27.0' EXTERNAL_DNS_GO_TOOLCHAIN_VERSION_MISSING
+require_marker go.mod 'toolchain go1.27.3' EXTERNAL_DNS_GO_TOOLCHAIN_VERSION_MISSING
 require_marker go.mod 'github.com/aws/aws-sdk-go-v2/service/route53 v1.65.10' EXTERNAL_DNS_AWS_SDK_V2_ROUTE53_MISSING
 require_marker go.mod 'github.com/alibabacloud-go/alidns-20150109/v5 v5.6.0' EXTERNAL_DNS_ALIDNS_V5_MISSING
 require_marker vendor/modules.txt '# github.com/aws/aws-sdk-go-v2/service/route53 v1.65.10' EXTERNAL_DNS_AWS_SDK_V2_VENDOR_MISSING
@@ -173,5 +176,5 @@ if [ "$failure_count" -ne 0 ]; then
   exit 1
 fi
 
-printf 'EXTERNAL_DNS_SOURCE_GATES_OK go_min=1.26.0 toolchain=1.27.0 build=ubuntu-26.04 runtime=alpine-3.23 non_root=1 legal_files=%s endpoint_override=bounded\n' \
+printf 'EXTERNAL_DNS_SOURCE_GATES_OK go_min=1.26.0 toolchain=1.27.3 build=ubuntu-26.04 runtime=alpine-3.23 non_root=1 legal_files=%s endpoint_override=bounded\n' \
   "$legal_count"