fix(server): apply official Ubuntu DBI security fix before522 publication

docs/releases/server-1.6.522.md

@@ -49,6 +49,14 @@ normal publication CI output and is still pending.
 
 ## Publication prerequisites
 
+The final image also uses Ubuntu's official `libdbi-perl`
+`1.647-1ubuntu0.26.04.4`, addressing
+[USN-8912-1](https://ubuntu.com/security/notices/USN-8912-1).
+The original `.deb` is SHA256-pinned to
+`3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e`;
+package identity, runtime bytes and loading are checked. Other dated Ubuntu
+inputs and the strict vulnerability/VEX/vendor-pending policy are unchanged.
+
 The formal recipe, builder defaults and coordinate assertions must use the
 released component identities above and the verified Engine schema hashes.
 An uncommitted local build checksum or integration image is not an official

scripts/check-server-api-explorer-patch.sh

@@ -1754,8 +1754,10 @@ for release_curl_security_marker in \
         SERVER_INCREMENTAL_CURL_SECURITY_REFRESH_MISSING
 done
 for release_libdbi_security_marker in \
-    'ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.3' \
-    'apt-get download "libdbi-perl=${LIBDBI_PERL_PACKAGE_VERSION}"' \
+    'ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4' \
+    'ADD --checksum=sha256:3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e' \
+    'https://security.ubuntu.com/ubuntu/pool/main/libd/libdbi-perl/libdbi-perl_1.647-1ubuntu0.26.04.4_amd64.deb' \
+    'cp /tmp/libdbi-perl.deb "/out/packages/libdbi-perl_${LIBDBI_PERL_PACKAGE_VERSION}_amd64.deb"' \
     'dpkg-deb --extract "${package_file}" /tmp/libdbi-perl-runtime' \
     'usr/lib/x86_64-linux-gnu/perl5/5.40/DBI.pm' \
     'usr/lib/x86_64-linux-gnu/perl5/5.40/auto/DBI/DBI.so' \
@@ -1766,7 +1768,7 @@ for release_libdbi_security_marker in \
         SERVER_LIBDBI_PERL_OFFICIAL_SECURITY_REFRESH_MISSING
 done
 for runtime_libdbi_security_marker in \
-    'PASTURESTACK_LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.3' \
+    'PASTURESTACK_LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4' \
     'sha256sum -c /usr/share/pasturestack/security/libdbi-perl-runtime.sha256' \
     'test "$(wc -l < /usr/share/pasturestack/security/libdbi-perl-runtime.sha256)" -eq 2' \
     'Unexpected DBI runtime version'; do

scripts/test-current-server-packaging-contract.py

@@ -508,6 +508,22 @@ def previous_gate(gate=GATE):
 
 
 class Tests(unittest.TestCase):
+    def test_official_dbi_security_update_is_isolated_and_hash_pinned(self):
+        recipe, builder = FILES[DOCKER], FILES[BUILD]
+        digest = '3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e'
+        url = 'https://security.ubuntu.com/ubuntu/pool/main/libd/libdbi-perl/libdbi-perl_1.647-1ubuntu0.26.04.4_amd64.deb'
+        self.assertIn('ADD --checksum=sha256:' + digest, recipe)
+        self.assertIn(url, recipe)
+        self.assertEqual(recipe.count('ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4'), 2)
+        self.assertNotIn('apt-get download "libdbi-perl=', recipe)
+        self.assertIn('cp /tmp/libdbi-perl.deb "/out/packages/libdbi-perl_${LIBDBI_PERL_PACKAGE_VERSION}_amd64.deb"', recipe)
+        self.assertIn('PASTURESTACK_LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4', builder)
+        self.assertIn('ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z', recipe)
+        self.assertNotIn('1.647-1ubuntu0.26.04.3', recipe + builder + GATE)
+        for marker in ('Package)" = libdbi-perl', 'Architecture)" = amd64', 'Version)" = "${LIBDBI_PERL_PACKAGE_VERSION}"',
+                       'sha256sum -c /usr/share/pasturestack/security/libdbi-perl-runtime.sha256', 'Unexpected DBI runtime version'):
+            self.assertIn(marker, recipe)
+
     def test_runtime_aggregate_keeps_exact_ten_binaries_six_legal_dirs_and_two_copies(self):
         verify_runtime_layout(FILES)
         self.assertEqual(len(RUNTIME_BINARIES), 10)

server/Dockerfile.web-compose-release

@@ -462,7 +462,7 @@ FROM ${UBUNTU_SECURITY_IMAGE} AS runtime_security_packages
 ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z
 ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7
 ARG OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7
-ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.3
+ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4
 ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2
 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1
 ENV DEBIAN_FRONTEND=noninteractive
@@ -476,6 +476,9 @@ ADD --checksum=sha256:6d7d532b7d0c57639deb3b228f1f0d786cf5305d613ef7df9ba76c776a
 ADD --checksum=sha256:f24a7f7c0428d74e33ea934696987b7336ec0962f212535185f0493792e7536e \
     https://security.ubuntu.com/ubuntu/pool/main/libp/libpng1.6/libpng16-16t64_1.6.57-1ubuntu0.1_amd64.deb \
     /tmp/libpng16.deb
+ADD --checksum=sha256:3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e \
+    https://security.ubuntu.com/ubuntu/pool/main/libd/libdbi-perl/libdbi-perl_1.647-1ubuntu0.26.04.4_amd64.deb \
+    /tmp/libdbi-perl.deb
 RUN set -eux; \
     mkdir -p /tmp/ca-bootstrap /etc/ssl/certs; \
     dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap; \
@@ -533,7 +536,7 @@ RUN set -eux; \
       test "$(dpkg-deb -f "${package_file}" Architecture)" = amd64; \
       dpkg-deb --extract "${package_file}" /tmp/openssl-runtime; \
     done; \
-    apt-get download "libdbi-perl=${LIBDBI_PERL_PACKAGE_VERSION}"; \
+    cp /tmp/libdbi-perl.deb "/out/packages/libdbi-perl_${LIBDBI_PERL_PACKAGE_VERSION}_amd64.deb"; \
     package_file="$(find . -maxdepth 1 -type f -name 'libdbi-perl_*.deb' -print)"; \
     test -n "${package_file}"; \
     test "$(printf '%s\n' "${package_file}" | wc -l)" -eq 1; \
@@ -580,7 +583,7 @@ ARG NODE_AGENT_ARCHIVE_SHA256=a16ae6be5fb72fa2ba38bd1076fd3b9e0536c48e70995ffa49
 ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z
 ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7
 ARG OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7
-ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.3
+ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4
 ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2
 ARG LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1
 ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4

server/build-api-explorer-patch-image.sh

@@ -360,7 +360,7 @@ for marker in \
     PASTURESTACK_GLIBC_CVE_2026_18374_FIX=not-in-execute-path \
     PASTURESTACK_GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4 \
     PASTURESTACK_PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3 \
-    PASTURESTACK_LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.3 \
+    PASTURESTACK_LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4 \
     PASTURESTACK_FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2 \
     PASTURESTACK_LIBPNG_PACKAGE_VERSION=1.6.57-1ubuntu0.1 \
     PASTURESTACK_COREUTILS_PROVIDER=gnu \
@@ -892,7 +892,7 @@ EOF
     cd /
     test "$(wc -l < /usr/share/pasturestack/security/openssl-runtime.sha256)" -eq 7
     sha256sum -c /usr/share/pasturestack/security/openssl-runtime.sha256
-    test "$(dpkg-query -W -f='"'"'${Version}'"'"' libdbi-perl)" = 1.647-1ubuntu0.26.04.3
+    test "$(dpkg-query -W -f='"'"'${Version}'"'"' libdbi-perl)" = 1.647-1ubuntu0.26.04.4
     test "$(wc -l < /usr/share/pasturestack/security/libdbi-perl-runtime.sha256)" -eq 2
     sha256sum -c /usr/share/pasturestack/security/libdbi-perl-runtime.sha256
     test "$(dpkg-query -W -f='"'"'${Version}'"'"' libfreetype6)" = 2.14.2+dfsg-1ubuntu0.2