From 6e8a50dd4b0214a1fed261ecd8222b843afed7b3 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 06:43:14 +0800 Subject: [PATCH 1/2] Pin shared Ubuntu security backports for v0.17.14 Integrate only existing runtime packages and preserve raw scans, native OpenVEX, producer checksum verification and strict vulnerability policy. Shared OCI producer: 59f4ec1f31e510361c4635023c08fcf2a2b2133c. OCI completion and final-image gates remain pending; this source commit does not publish a release. --- .github/workflows/runtime-security.yml | 46 ++++++++++++++++++++++---- README.md | 18 +++++----- package/linux/amd64/Dockerfile | 17 ++++++++++ 3 files changed, 65 insertions(+), 16 deletions(-) diff --git a/.github/workflows/runtime-security.yml b/.github/workflows/runtime-security.yml index 4c59366..69f11ec 100644 --- a/.github/workflows/runtime-security.yml +++ b/.github/workflows/runtime-security.yml @@ -48,6 +48,7 @@ jobs: set -euo pipefail test "$GITHUB_REF" = refs/heads/main [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] + test "$RELEASE_TAG" = 'v0.17.14' test -z "$(git status --porcelain)" test "$(git rev-parse HEAD)" = "$GITHUB_SHA" test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA" @@ -75,6 +76,8 @@ jobs: trap 'docker rm "$container" >/dev/null' EXIT docker cp "$container:/usr/bin/internal-dns" evidence/product docker cp "$container:/usr/share/pasturestack/ubuntu-security-packages.tsv" evidence/ubuntu-security-packages.tsv + docker cp "$container:/usr/share/pasturestack/security/ubuntu-backports" evidence/ubuntu-backports + (cd evidence/ubuntu-backports && sha256sum --check SHA256SUMS) docker cp "$container:/etc/ssl/certs/ca-certificates.crt" evidence/ca-certificates.crt go version -m evidence/product | tee evidence/product-go-version.txt grep -F 'go1.27.3' evidence/product-go-version.txt @@ -90,15 +93,46 @@ jobs: TESTED_IMAGE: local/internal-dns:${{ inputs.release_tag || 'dev' }} run: | set -euo pipefail - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/evidence:/evidence" \ - "$TRIVY_IMAGE" image --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \ + cache="$RUNNER_TEMP/ubuntu-backports-trivy-cache" + mkdir -p "$cache" + docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only + # Retain the untouched all-severity raw report and the actual image SBOM. + docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ + -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \ + image --skip-db-update --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \ --exit-code 0 --format json --output /evidence/image-security.json "$TESTED_IMAGE" - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/evidence:/evidence" \ - "$TRIVY_IMAGE" image --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE" + docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ + -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \ + image --skip-db-update --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE" + bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' + mkdir -p evidence/bundle-tools + bundle_container=$(docker create "$bundle_image" unused) + trap 'docker rm "$bundle_container" >/dev/null' EXIT + docker cp "$bundle_container:/out/verify-consumer-evidence.py" evidence/bundle-tools/verify-consumer-evidence.py + docker cp "$bundle_container:/out/SHA256SUMS" evidence/bundle-tools/SHA256SUMS + docker rm "$bundle_container" >/dev/null + trap - EXIT + (cd evidence/bundle-tools && \ + test "$(grep -Ec '^[0-9a-f]{64} verify-consumer-evidence\.py$' SHA256SUMS)" -eq 1 && \ + grep -E '^[0-9a-f]{64} verify-consumer-evidence\.py$' SHA256SUMS | sha256sum --check -) + python3 evidence/bundle-tools/verify-consumer-evidence.py \ + --evidence-dir evidence/ubuntu-backports --sbom evidence/image.cdx.json \ + --bundle-checksums evidence/bundle-tools/SHA256SUMS \ + --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json + # Only native Trivy interprets the exact qualified OpenVEX statements. + docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ + -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \ + image --skip-db-update --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \ + --vex /evidence/ubuntu-backports/openvex.json --exit-code 0 --format json \ + --output /evidence/image-security.effective.json "$TESTED_IMAGE" PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/test_runtime_vulnerability_policy.py python3 .github/scripts/enforce-runtime-vulnerabilities.py \ - evidence/image-security.json .github/runtime-unfixed.json \ + evidence/image-security.effective.json .github/runtime-unfixed.json \ --repository "$GITHUB_REPOSITORY" + tar -cf evidence/ubuntu-backports-evidence.tar -C evidence ubuntu-backports + sha256sum evidence/image-security.json evidence/image-security.effective.json \ + evidence/image.cdx.json evidence/ubuntu-backports-validation.json \ + evidence/ubuntu-backports-evidence.tar >> evidence/SHA256SUMS - name: Publish the tested image once id: publish @@ -150,7 +184,7 @@ jobs: -f ref="refs/tags/$RELEASE_TAG" -f sha="$tag_sha" >/dev/null gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \ --title "$RELEASE_TAG" --notes-file evidence/published.txt \ - evidence/published.txt evidence/published.sha256 evidence/*.json + evidence/published.txt evidence/published.sha256 evidence/*.json evidence/ubuntu-backports-evidence.tar - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() diff --git a/README.md b/README.md index 4240deb..6f4671f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # Internal DNS -Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package with only officially fixed, already-installed packages advanced by the reviewed security overlay. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts. +Linux candidate **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. It is unpublished; the last published Linux release is [v0.17.13](https://github.com/PastureStack/internal-dns/releases/tag/v0.17.13). + +Build and image examples below target the candidate. Publication requires completed bundle provenance and the normal final-image release gates. The image retains bundle manifests, source inputs and install/verify receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. Internal DNS serves metadata-derived service discovery records, client-specific search paths, recursive forwarding, and DNS response caching for PastureStack environments. @@ -26,15 +28,11 @@ make validate make build ``` -`scripts/build` also cross-compiles `windows/amd64`. The current published Linux -release is [v0.17.13](https://github.com/PastureStack/internal-dns/releases/tag/v0.17.13), -and the Catalog uses `ghcr.io/pasturestack/internal-dns:v0.17.13`. -The Windows Server 2022 image remains -`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`; it was not rebuilt or -revalidated by this Linux release. That Windows coordinate is an exact manifest -alias of the already reviewed build -(`sha256:91d5147cc9ec20a8b9f8cc91745d620cc916b730645b8064a7c49f5f6a0d5c90`), -so the naming correction did not change image bytes. +`scripts/build` also cross-compiles `windows/amd64`. After publication, the Linux candidate image is +`ghcr.io/pasturestack/internal-dns:v0.17.14`; Catalog selection follows its release and integration gates. +The separately versioned Windows Server 2022 image remains +`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. This Linux preparation +does not rebuild or revalidate that Windows image. Linux integration tests require `bats`, `dig`, free local TCP/UDP port 15353, and controlled recursive DNS access: diff --git a/package/linux/amd64/Dockerfile b/package/linux/amd64/Dockerfile index 578bb54..71b4b1d 100644 --- a/package/linux/amd64/Dockerfile +++ b/package/linux/amd64/Dockerfile @@ -1,4 +1,5 @@ # syntax=docker/dockerfile:1.7 +FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b ARG UBUNTU_SNAPSHOT=20260825T000000Z @@ -43,5 +44,21 @@ COPY LICENSES/ /licenses/dependencies/ RUN chmod 0755 /usr/bin/internal-dns /usr/bin/platform-entrypoint.sh /usr/bin/update-platform-ca +# Install only qualified packages already present after the final Ubuntu update. +# This read-only build mount leaves no installer, archive or extra runtime tool. +RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ubuntu-security-backports,ro \ + set -eux; \ + evidence=/usr/share/pasturestack/security/ubuntu-backports; \ + mkdir -p "${evidence}"; \ + /opt/pasturestack/ubuntu-security-backports/install-existing-backports --install-in-docker-build > "${evidence}/install.json"; \ + /opt/pasturestack/ubuntu-security-backports/install-existing-backports --verify-installed > "${evidence}/verify.json"; \ + for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \ + cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \ + done; \ + printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \ + (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \ + dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ + rm -f /var/cache/ldconfig/aux-cache + ENTRYPOINT ["/usr/bin/tini", "-s", "--", "/usr/bin/platform-entrypoint.sh"] CMD ["internal-dns"] From 9073cc1a430d5e4c0e275171c81118173dcc7a91 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 06:56:52 +0800 Subject: [PATCH 2/2] Align runtime README for v0.17.14 README only. Preserve runtime and verification source exactly from 6e8a50dd4b0214a1fed261ecd8222b843afed7b3. Describe the release version without obsolete candidate or previous-release notes. --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 6f4671f..adbf219 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Internal DNS -Linux candidate **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. It is unpublished; the last published Linux release is [v0.17.13](https://github.com/PastureStack/internal-dns/releases/tag/v0.17.13). +Linux runtime **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. -Build and image examples below target the candidate. Publication requires completed bundle provenance and the normal final-image release gates. The image retains bundle manifests, source inputs and install/verify receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. +The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. Internal DNS serves metadata-derived service discovery records, client-specific search paths, recursive forwarding, and DNS response caching for PastureStack environments. @@ -28,7 +28,7 @@ make validate make build ``` -`scripts/build` also cross-compiles `windows/amd64`. After publication, the Linux candidate image is +`scripts/build` also cross-compiles `windows/amd64`. The Linux image is `ghcr.io/pasturestack/internal-dns:v0.17.14`; Catalog selection follows its release and integration gates. The separately versioned Windows Server 2022 image remains `ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. This Linux preparation