From 46912875a1436551569653f506ecaaf1b2c620b2 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:16:32 +0800 Subject: [PATCH] Consume qualified Brotli security backport for v0.9.21 --- .github/scripts/check-image-policies.sh | 4 ++-- .github/workflows/security-release-gate.yml | 2 +- README.md | 8 +++++--- package/Dockerfile | 4 ++-- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/scripts/check-image-policies.sh b/.github/scripts/check-image-policies.sh index 92fb762..f8719a5 100644 --- a/.github/scripts/check-image-policies.sh +++ b/.github/scripts/check-image-policies.sh @@ -32,7 +32,7 @@ for binary in helm kubectl kubectl-service; do .Type == "gobinary" and (.Target | split("/") | last) == $binary and (.Packages | length > 0))' dist/kubectl-service.security-raw.json >/dev/null done -bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' +bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' mkdir -p dist/bundle-tools bundle_container=$(docker create "$bundle_image" unused) if docker cp "$bundle_container:/out/verify-consumer-evidence.py" dist/bundle-tools/verify-consumer-evidence.py && \ @@ -48,7 +48,7 @@ fi python3 dist/bundle-tools/verify-consumer-evidence.py \ --evidence-dir dist/ubuntu-backports --sbom dist/kubectl-service.cdx.json \ --bundle-checksums dist/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > dist/ubuntu-backports-validation.json + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > dist/ubuntu-backports-validation.json tar -cf dist/ubuntu-backports-evidence.tar -C dist ubuntu-backports ubuntu-backports-validation.json python3 .github/scripts/enforce-runtime-vulnerabilities.py --phase runtime --repository "$GITHUB_REPOSITORY" run_scan fs --cache-dir /tmp/trivy-cache --skip-db-update --scanners secret --exit-code 1 /workspace diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 16664e0..376dee0 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -24,7 +24,7 @@ jobs: env: DAPPER_IMAGE: pasturestack-kubectl-service-dapper:security-gate DAPPER_TRIVY_CACHE: /tmp/pasturestack-trivy-cache - VERSION_OVERRIDE: v0.9.20 + VERSION_OVERRIDE: v0.9.21 steps: - name: Check out the complete source history uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/README.md b/README.md index df3c872..28eeae3 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # PastureStack Kubectl Service -Linux runtime **`v0.9.20`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. +Linux runtime **`v0.9.21`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. + +The shared bundle includes the official Brotli decoder fix for CVE-2026-111497. The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. @@ -12,7 +14,7 @@ PastureStack is an independent community project and is not affiliated with Rancher Labs or SUSE. The repository preserves the history and Apache-2.0 license of the upstream `rancher/kubectld` project. -Select `ghcr.io/pasturestack/kubectl-service:v0.9.20` through the reviewed Catalog +Select `ghcr.io/pasturestack/kubectl-service:v0.9.21` through the reviewed Catalog package. OCI labels, SBOM and release attestations bind the published bytes. ## Runtime contract @@ -40,7 +42,7 @@ WebSocket, and `x/sys` are pinned by `go.mod` and `go.sum`. ```sh make test make validate -make package IMAGE_NAME=local/pasturestack/kubectl-service TAG=v0.9.20 +make package IMAGE_NAME=local/pasturestack/kubectl-service TAG=v0.9.21 ``` Packaging verifies both source archives and licenses, the upstream Git commits, diff --git a/package/Dockerfile b/package/Dockerfile index 1086e15..7c48d26 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:1.7 -FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports +FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports FROM docker:29.7.2-cli@sha256:000bb62ff495f986c9f5578eb67cc2cb98b91138eda81d7762d5371eb8a497fe AS snapshot-ca-certificates FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS helm-builder @@ -206,7 +206,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \ cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \ done; \ - printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \ + printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \ (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ . /licenses/ubuntu-apt.lock; \