From e1fd8ce7acc484776575c9f68c97dca447bd7ac5 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:16:39 +0800 Subject: [PATCH] Consume qualified Brotli security backport for v0.14.42 --- .github/workflows/codeql-verification.yml | 2 +- .github/workflows/release.yml | 36 ++++++++++----------- .github/workflows/security-release-gate.yml | 14 ++++---- README.md | 10 +++--- package/Dockerfile | 4 +-- 5 files changed, 34 insertions(+), 32 deletions(-) diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index 2dab840..a5b397c 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -53,7 +53,7 @@ jobs: cd "$GITHUB_WORKSPACE" go test -run '^$' ./... go test -run '^$' -tags=integration ./store - VERSION_OVERRIDE=0.14.41 ./scripts/build + VERSION_OVERRIDE=0.14.42 ./scripts/build - name: Analyze without publishing temporary alerts uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cc6432e..c6e6e52 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,6 @@ name: Release IPsec overlay -# A release is dispatched from main only after an annotated v0.14.41 tag and +# A release is dispatched from main only after an annotated v0.14.42 tag and # successful, same-commit Security release gate and CodeQL verification runs. # GHCR, registry attestations, and GitHub Releases are not an atomic transaction. # All source/product/runtime gates precede the image push. A later failure may @@ -9,11 +9,11 @@ on: workflow_dispatch: inputs: release_tag: - description: Existing annotated, numeric v0.14.41 tag at main HEAD + description: Existing annotated, numeric v0.14.42 tag at main HEAD required: true type: choice options: - - v0.14.41 + - v0.14.42 security_run_id: description: Successful same-SHA Security release gate run ID required: true @@ -35,7 +35,7 @@ permissions: attestations: write concurrency: - group: ipsec-vxlan-overlay-release-v0.14.41 + group: ipsec-vxlan-overlay-release-v0.14.42 cancel-in-progress: false jobs: @@ -48,8 +48,8 @@ jobs: CODEQL_RUN_ID: ${{ inputs.codeql_run_id }} RESUME_DIGEST: ${{ inputs.resume_digest }} GH_TOKEN: ${{ github.token }} - SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 - LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.41 + SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.42 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 GOFLAGS: -mod=vendor GOWORK: off @@ -67,7 +67,7 @@ jobs: run: | set -euo pipefail test "$GITHUB_REF" = refs/heads/main - test "$RELEASE_TAG" = v0.14.41 + test "$RELEASE_TAG" = v0.14.42 [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] [[ "$SECURITY_RUN_ID" =~ ^[0-9]+$ ]] [[ "$CODEQL_RUN_ID" =~ ^[0-9]+$ ]] @@ -163,15 +163,15 @@ jobs: shell: bash run: | set -euo pipefail - VERSION_OVERRIDE=0.14.41 ./scripts/build + VERSION_OVERRIDE=0.14.42 ./scripts/build sha256sum --check evidence/product.sha256 if [ -z "$RESUME_DIGEST" ]; then - VERSION_OVERRIDE=0.14.41 TAG=0.14.41 REPO=local/pasturestack \ + VERSION_OVERRIDE=0.14.42 TAG=0.14.42 REPO=local/pasturestack \ IMAGE_REVISION="$SOURCE_SHA" ./scripts/package test "$(wc -l < dist/images)" -eq 1 grep -Fx "$LOCAL_IMAGE" dist/images test "$(docker image inspect "$LOCAL_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.41 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.42 test "$(docker image inspect "$LOCAL_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" docker tag "$LOCAL_IMAGE" "$SERVICE_IMAGE" @@ -189,7 +189,7 @@ jobs: docker pull "$SERVICE_IMAGE@$RESUME_DIGEST" docker tag "$SERVICE_IMAGE@$RESUME_DIGEST" "$SERVICE_IMAGE" test "$(docker image inspect "$SERVICE_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.41 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.42 test "$(docker image inspect "$SERVICE_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" verification_container="$(docker create "$SERVICE_IMAGE")" @@ -242,7 +242,7 @@ jobs: python3 evidence/bundle-tools/verify-consumer-evidence.py \ --evidence-dir "$release_dir/ubuntu-backports" --sbom "$release_dir/image-sbom.cdx.json" \ --bundle-checksums evidence/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "$release_dir/ubuntu-backports-validation.json" + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "$release_dir/ubuntu-backports-validation.json" docker run --rm --network none -v /var/run/docker.sock:/var/run/docker.sock \ -v "$cache:/root/.cache/trivy" -v "$release_dir:/release" "$TRIVY_IMAGE" \ image --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \ @@ -351,7 +351,7 @@ jobs: run: | set -euo pipefail release_dir="dist/release" - product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.41-linux-amd64" + product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.42-linux-amd64" mkdir -p "$product_dir" cp bin/ipsec-vxlan-overlay-network bin/ipsec-vxlan-overlay-topology bin/pasture-cni-resolver \ LICENSE ORIGIN.md SECURITY.md THIRD_PARTY_NOTICES.md "$product_dir/" @@ -363,11 +363,11 @@ jobs: find "$product_dir" -exec touch -h -d "@$source_epoch" {} + tar --sort=name --mtime="@$source_epoch" --owner=0 --group=0 \ --numeric-owner -C "$release_dir" \ - -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.41-linux-amd64.tar.xz" \ - ipsec-vxlan-overlay-network-0.14.41-linux-amd64 + -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.42-linux-amd64.tar.xz" \ + ipsec-vxlan-overlay-network-0.14.42-linux-amd64 ( cd "$release_dir" - sha256sum ipsec-vxlan-overlay-network-0.14.41-linux-amd64.tar.xz \ + sha256sum ipsec-vxlan-overlay-network-0.14.42-linux-amd64.tar.xz \ source-sbom.cdx.json image-sbom.cdx.json product.sha256 \ runtime-security.json runtime-security.effective.json ubuntu-backports-evidence.tar \ gate-security-summary.txt image-digest.txt \ @@ -392,9 +392,9 @@ jobs: run: | set -euo pipefail gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \ - --title 'IPsec Overlay v0.14.41' \ + --title 'IPsec Overlay v0.14.42' \ --notes "Source ${SOURCE_SHA}; Security gate run ${SECURITY_RUN_ID}; CodeQL run ${CODEQL_RUN_ID}. GHCR image ${SERVICE_IMAGE}@$(cat dist/release/image-digest.txt | sed 's/^.*@//')." \ - dist/release/ipsec-vxlan-overlay-network-0.14.41-linux-amd64.tar.xz \ + dist/release/ipsec-vxlan-overlay-network-0.14.42-linux-amd64.tar.xz \ dist/release/source-sbom.cdx.json \ dist/release/image-sbom.cdx.json \ dist/release/product.sha256 \ diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 02187f9..2396acb 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -20,12 +20,12 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 120 env: - CANDIDATE_VERSION: 0.14.41 - VERSION_OVERRIDE: 0.14.41 - TAG: 0.14.41 + CANDIDATE_VERSION: 0.14.42 + VERSION_OVERRIDE: 0.14.42 + TAG: 0.14.42 IMAGE_REVISION: ${{ github.sha }} REPO: local/pasturestack - IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.41 + IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.42 GO_VERSION: 1.27.3 GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 @@ -226,7 +226,7 @@ jobs: "$TRIVY_IMAGE" image --cache-dir /root/.cache/trivy \ --skip-db-update --offline-scan --format cyclonedx \ --output /work/evidence/runtime-sbom.cdx.json "$IMAGE" - bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' + bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' mkdir -p evidence/bundle-tools bundle_container=$(docker create "$bundle_image" unused) trap 'docker rm "$bundle_container" >/dev/null' EXIT @@ -240,7 +240,7 @@ jobs: python3 evidence/bundle-tools/verify-consumer-evidence.py \ --evidence-dir evidence/ubuntu-backports --sbom evidence/runtime-sbom.cdx.json \ --bundle-checksums evidence/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > evidence/ubuntu-backports-validation.json docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$TRIVY_CACHE:/root/.cache/trivy" -v "$PWD:/work" -w /work "$TRIVY_IMAGE" \ image --cache-dir /root/.cache/trivy --skip-db-update --offline-scan --scanners vuln,secret \ @@ -326,7 +326,7 @@ jobs: impact_statement:$impact }] | { "@context":"https://openvex.dev/ns/v0.2.0", - "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.41", + "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.42", author:"PastureStack Security", timestamp:$timestamp, version:1, diff --git a/README.md b/README.md index b5fd8a3..93b5089 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # PastureStack IPsec/VXLAN Overlay Network -Linux runtime **`v0.14.41`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. +Linux runtime **`v0.14.42`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. + +The shared bundle includes the official Brotli decoder fix for CVE-2026-111497. The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. @@ -10,7 +12,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Release status -Select `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` through the infrastructure +Select `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42` through the infrastructure Catalog. Security and CodeQL checks, the release scan and immutable publication must pass first. Image publication, Catalog selection and managed-host acceptance are separate. @@ -52,8 +54,8 @@ The build is containerized and requires Docker on a Linux AMD64 host: ```sh make test make validate -VERSION_OVERRIDE=0.14.41 make build -TAG=0.14.41 make package +VERSION_OVERRIDE=0.14.42 make build +TAG=0.14.42 make package ``` The package build downloads dependencies anonymously, verifies every standalone binary with SHA-256, pins the Ubuntu base image by digest, resolves packages from Canonical snapshot `20260808T000000Z` with the exact versions in `ubuntu-apt.lock`, and includes the corresponding strongSwan source archives in the image. The build also retains the checksum-pinned OpenSSL triplet (`openssl`, `libssl3t64`, `openssl-provider-legacy`) at `3.5.5-1ubuntu3.6` from snapshot `20260930T000000Z`, fixing CVE-2026-84782 in both Dapper and runtime without changing other package locks or the kernel-header review boundary. Go dependencies are declared in `go.mod`, checksum-bound by `go.sum`, and committed in the standard module-aware `vendor` tree for offline builds. diff --git a/package/Dockerfile b/package/Dockerfile index 043b9ac..fb68c3c 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:1.7 -FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports +FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock @@ -168,7 +168,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \ cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \ done; \ - printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \ + printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \ (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ . /licenses/ubuntu-apt.lock; \