Integrate Ubuntu runtime security backports for v0.17.14

.github/workflows/runtime-security.yml

@@ -48,6 +48,7 @@ jobs:
           set -euo pipefail
           test "$GITHUB_REF" = refs/heads/main
           [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "$RELEASE_TAG" = 'v0.17.14'
           test -z "$(git status --porcelain)"
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA"
@@ -75,6 +76,8 @@ jobs:
           trap 'docker rm "$container" >/dev/null' EXIT
           docker cp "$container:/usr/bin/internal-dns" evidence/product
           docker cp "$container:/usr/share/pasturestack/ubuntu-security-packages.tsv" evidence/ubuntu-security-packages.tsv
+          docker cp "$container:/usr/share/pasturestack/security/ubuntu-backports" evidence/ubuntu-backports
+          (cd evidence/ubuntu-backports && sha256sum --check SHA256SUMS)
           docker cp "$container:/etc/ssl/certs/ca-certificates.crt" evidence/ca-certificates.crt
           go version -m evidence/product | tee evidence/product-go-version.txt
           grep -F 'go1.27.3' evidence/product-go-version.txt
@@ -90,15 +93,46 @@ jobs:
           TESTED_IMAGE: local/internal-dns:${{ inputs.release_tag || 'dev' }}
         run: |
           set -euo pipefail
-          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/evidence:/evidence" \
-            "$TRIVY_IMAGE" image --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
+          cache="$RUNNER_TEMP/ubuntu-backports-trivy-cache"
+          mkdir -p "$cache"
+          docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only
+          # Retain the untouched all-severity raw report and the actual image SBOM.
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
+            image --skip-db-update --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
             --exit-code 0 --format json --output /evidence/image-security.json "$TESTED_IMAGE"
-          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/evidence:/evidence" \
-            "$TRIVY_IMAGE" image --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE"
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
+            image --skip-db-update --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE"
+          bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
+          mkdir -p evidence/bundle-tools
+          bundle_container=$(docker create "$bundle_image" unused)
+          trap 'docker rm "$bundle_container" >/dev/null' EXIT
+          docker cp "$bundle_container:/out/verify-consumer-evidence.py" evidence/bundle-tools/verify-consumer-evidence.py
+          docker cp "$bundle_container:/out/SHA256SUMS" evidence/bundle-tools/SHA256SUMS
+          docker rm "$bundle_container" >/dev/null
+          trap - EXIT
+          (cd evidence/bundle-tools && \
+            test "$(grep -Ec '^[0-9a-f]{64}  verify-consumer-evidence\.py$' SHA256SUMS)" -eq 1 && \
+            grep -E '^[0-9a-f]{64}  verify-consumer-evidence\.py$' SHA256SUMS | sha256sum --check -)
+          python3 evidence/bundle-tools/verify-consumer-evidence.py \
+            --evidence-dir evidence/ubuntu-backports --sbom evidence/image.cdx.json \
+            --bundle-checksums evidence/bundle-tools/SHA256SUMS \
+            --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json
+          # Only native Trivy interprets the exact qualified OpenVEX statements.
+          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
+            image --skip-db-update --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
+            --vex /evidence/ubuntu-backports/openvex.json --exit-code 0 --format json \
+            --output /evidence/image-security.effective.json "$TESTED_IMAGE"
           PYTHONDONTWRITEBYTECODE=1 python3 .github/scripts/test_runtime_vulnerability_policy.py
           python3 .github/scripts/enforce-runtime-vulnerabilities.py \
-            evidence/image-security.json .github/runtime-unfixed.json \
+            evidence/image-security.effective.json .github/runtime-unfixed.json \
             --repository "$GITHUB_REPOSITORY"
+          tar -cf evidence/ubuntu-backports-evidence.tar -C evidence ubuntu-backports
+          sha256sum evidence/image-security.json evidence/image-security.effective.json \
+            evidence/image.cdx.json evidence/ubuntu-backports-validation.json \
+            evidence/ubuntu-backports-evidence.tar >> evidence/SHA256SUMS
 
       - name: Publish the tested image once
         id: publish
@@ -150,7 +184,7 @@ jobs:
             -f ref="refs/tags/$RELEASE_TAG" -f sha="$tag_sha" >/dev/null
           gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
             --title "$RELEASE_TAG" --notes-file evidence/published.txt \
-            evidence/published.txt evidence/published.sha256 evidence/*.json
+            evidence/published.txt evidence/published.sha256 evidence/*.json evidence/ubuntu-backports-evidence.tar
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()

README.md

@@ -1,6 +1,8 @@
 # Internal DNS
 
-Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package with only officially fixed, already-installed packages advanced by the reviewed security overlay. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts.
+Linux runtime **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+
+The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`.
 
 Internal DNS serves metadata-derived service discovery records, client-specific search paths, recursive forwarding, and DNS response caching for PastureStack environments.
 
@@ -26,15 +28,11 @@ make validate
 make build
 ```
 
-`scripts/build` also cross-compiles `windows/amd64`. The current published Linux
-release is [v0.17.13](https://github.com/PastureStack/internal-dns/releases/tag/v0.17.13),
-and the Catalog uses `ghcr.io/pasturestack/internal-dns:v0.17.13`.
-The Windows Server 2022 image remains
-`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`; it was not rebuilt or
-revalidated by this Linux release. That Windows coordinate is an exact manifest
-alias of the already reviewed build
-(`sha256:91d5147cc9ec20a8b9f8cc91745d620cc916b730645b8064a7c49f5f6a0d5c90`),
-so the naming correction did not change image bytes.
+`scripts/build` also cross-compiles `windows/amd64`. The Linux image is
+`ghcr.io/pasturestack/internal-dns:v0.17.14`; Catalog selection follows its release and integration gates.
+The separately versioned Windows Server 2022 image remains
+`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. This Linux preparation
+does not rebuild or revalidate that Windows image.
 
 Linux integration tests require `bats`, `dig`, free local TCP/UDP port 15353, and controlled recursive DNS access:
 

package/linux/amd64/Dockerfile

@@ -1,4 +1,5 @@
 # syntax=docker/dockerfile:1.7
+FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 ARG UBUNTU_SNAPSHOT=20260825T000000Z
@@ -43,5 +44,21 @@ COPY LICENSES/ /licenses/dependencies/
 
 RUN chmod 0755 /usr/bin/internal-dns /usr/bin/platform-entrypoint.sh /usr/bin/update-platform-ca
 
+# Install only qualified packages already present after the final Ubuntu update.
+# This read-only build mount leaves no installer, archive or extra runtime tool.
+RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ubuntu-security-backports,ro \
+    set -eux; \
+    evidence=/usr/share/pasturestack/security/ubuntu-backports; \
+    mkdir -p "${evidence}"; \
+    /opt/pasturestack/ubuntu-security-backports/install-existing-backports --install-in-docker-build > "${evidence}/install.json"; \
+    /opt/pasturestack/ubuntu-security-backports/install-existing-backports --verify-installed > "${evidence}/verify.json"; \
+    for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
+        cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \
+    done; \
+    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
+    (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
+    dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
+    rm -f /var/cache/ldconfig/aux-cache
+
 ENTRYPOINT ["/usr/bin/tini", "-s", "--", "/usr/bin/platform-entrypoint.sh"]
 CMD ["internal-dns"]