From 51d968c468da9b33d44b029ab64887d982c189cf Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 29 Oct 2026 18:57:49 +0800 Subject: [PATCH] fix: include qualified Go security releases in Server 1.6.554 --- README.md | 3 +- docs/releases/server-1.6.554.md | 17 ++++++--- scripts/check-server-api-explorer-patch.sh | 16 ++++----- .../test-current-server-packaging-contract.py | 28 +++++++-------- scripts/test-server-component-candidate.py | 1 + server/Dockerfile.web-compose-release | 36 +++++++++---------- server/build-api-explorer-patch-image.sh | 22 ++++++------ server/security/check_scan_coverage.py | 8 ++--- server/security/openvex.json | 7 ++-- server/security/test_scan_coverage.py | 3 +- 10 files changed, 77 insertions(+), 64 deletions(-) diff --git a/README.md b/README.md index 1e657f9528..97202baa23 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,8 @@ Server `v1.6.554` is a prepared source candidate, not a published image. It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional, scoped AI collaboration. New pages start with tools off. Upgrade execution requires an authenticated owner's separate confirmation; ordinary API Keys -retain their existing permissions. See the [candidate note](docs/releases/server-1.6.554.md). +retain their existing permissions. It also includes qualified security updates +for secret delivery and host provisioning. See the [candidate note](docs/releases/server-1.6.554.md). The previous published release is [Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553), diff --git a/docs/releases/server-1.6.554.md b/docs/releases/server-1.6.554.md index aa01e5e8b3..cc74067b4c 100644 --- a/docs/releases/server-1.6.554.md +++ b/docs/releases/server-1.6.554.md @@ -10,12 +10,18 @@ revision only after its required checks pass. archive SHA256 `4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa`. - Engine `v0.183.355`: producer `9ea138d1db1718cf65157c9564c379e62bafe9a0`, `cattle.jar` SHA256 `a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f`. +- Secret Delivery API `v0.3.4`: producer `705589989f542669b7e60e1fdab8ae2694ed5d5d`, + archive SHA256 `941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010`. +- Machine Driver Bundle `v0.16.6`: producer `d5bade2722a788f54fe7f3a25af6245336a1e841`, + archive SHA256 `82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d`. This release integrates Web Console `1.6.196` and Engine `v0.183.355` for optional AI collaboration. Engine uses official Guava `33.7.2-jre` for `CVE-2026-102554`; assembly verifies the exact nested artifact and rejects older -or additional Guava jars. Other component versions and the existing security backport -baseline are retained. The build recipe pins component commits, archive hashes +or additional Guava jars. The release also updates the secret-delivery and +machine-driver transports to the qualified Go security dependencies. Remaining +component versions and the existing security backport baseline are retained. +The build recipe pins component commits, archive hashes and the Web Console runtime SBOM; the bridge has a separate source archive and SBOM because its Node.js process is not part of the browser bundle. @@ -35,9 +41,10 @@ the stricter retired-instance path does not add a general delete grant. The isolated candidate completed two consecutive scoped-Key image upgrades and return to its original image, a weak-model upgrade through human confirmation, -and an ordinary GENERAL/FULL Key upgrade as a control. Launch settings and -mounted data were retained; retired instances and their live ports were gone. -Server restart and browser refresh retained service state and data. Native +and an ordinary GENERAL/FULL Key upgrade as a control. Launch settings were +retained; retired instances and their live ports were gone. Mounted-data +persistence is a separate deployment check using a random marker generated +only when the mounted file is absent, verified across upgrade and restart. Native tool registration, explicit off/read-only/enabled modes, role/scope rejection, conditional-description conflicts and per-Key audit were checked separately. diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh index d9e16077a1..34290863c0 100755 --- a/scripts/check-server-api-explorer-patch.sh +++ b/scripts/check-server-api-explorer-patch.sh @@ -742,10 +742,10 @@ for incremental_producer_marker in \ 'ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba' \ 'ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661' \ 'ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff' \ - 'ARG SECRET_DELIVERY_API_VERSION=0.3.3' \ - 'ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69' \ - 'ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699' \ - 'ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665' \ + 'ARG SECRET_DELIVERY_API_VERSION=0.3.4' \ + 'ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d' \ + 'ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010' \ + 'ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c' \ 'ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4' \ 'ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628' \ 'ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866' \ @@ -760,10 +760,10 @@ for incremental_producer_build_marker in \ 'host_provisioner_commit=${HOST_PROVISIONER_COMMIT:-d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba}' \ 'host_provisioner_archive_sha256=${HOST_PROVISIONER_ARCHIVE_SHA256:-fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661}' \ 'host_provisioner_binary_sha256=${HOST_PROVISIONER_BINARY_SHA256:-92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff}' \ - 'secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.3}' \ - 'secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-da196acba539fe7a0c04539f6f7537cdfb2d8d69}' \ - 'secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699}' \ - 'secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665}' \ + 'secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.4}' \ + 'secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-705589989f542669b7e60e1fdab8ae2694ed5d5d}' \ + 'secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010}' \ + 'secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c}' \ 'usage_telemetry_agent_version=${USAGE_TELEMETRY_AGENT_VERSION:-0.4.4}' \ 'usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}' \ 'usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}' \ diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py index a9bc727908..705c1f60c6 100644 --- a/scripts/test-current-server-packaging-contract.py +++ b/scripts/test-current-server-packaging-contract.py @@ -146,10 +146,10 @@ "ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba", "ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661", "ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff", - "ARG SECRET_DELIVERY_API_VERSION=0.3.3", - "ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69", - "ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699", - "ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665", + "ARG SECRET_DELIVERY_API_VERSION=0.3.4", + "ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d", + "ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010", + "ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c", "ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4", "ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628", "ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866", @@ -166,10 +166,10 @@ "host_provisioner_commit=${HOST_PROVISIONER_COMMIT:-d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba}", "host_provisioner_archive_sha256=${HOST_PROVISIONER_ARCHIVE_SHA256:-fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661}", "host_provisioner_binary_sha256=${HOST_PROVISIONER_BINARY_SHA256:-92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff}", - "secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.3}", - "secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-da196acba539fe7a0c04539f6f7537cdfb2d8d69}", - "secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699}", - "secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665}", + "secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.4}", + "secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-705589989f542669b7e60e1fdab8ae2694ed5d5d}", + "secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010}", + "secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c}", "usage_telemetry_agent_version=${USAGE_TELEMETRY_AGENT_VERSION:-0.4.4}", "usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}", "usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}", @@ -949,7 +949,7 @@ def test_new_producer_binary_alias_version_and_legal_commands_fail_closed(self): verify_incremental_contract(dict(FILES, **{DOCKER: FILES[DOCKER].replace(marker, replacement)})) for upper, version, digest, binary in ( ('HOST_PROVISIONER', '0.39.10', '92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff', '/usr/bin/host-provisioner.real'), - ('SECRET_DELIVERY_API', '0.3.3', 'e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665', '/usr/bin/secret-delivery-api'), + ('SECRET_DELIVERY_API', '0.3.4', '1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c', '/usr/bin/secret-delivery-api'), ('USAGE_TELEMETRY_AGENT', '0.4.4', '90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be', '/usr/bin/usage-telemetry-agent'), ): self.assertIn(digest + ' ' + binary, FILES[BUILD]) @@ -1606,11 +1606,11 @@ def test_current_readme_keeps_install_and_upgrade_contract(self): def test_machine_actual_binary_package_and_retired_boundary_are_verified(self): for name, value in ( - ('MACHINE_DRIVER_BUNDLE_VERSION', '0.16.5'), - ('MACHINE_DRIVER_BUNDLE_COMMIT', 'f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21'), - ('MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256', 'd9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b'), - ('MACHINE_DRIVER_BINARY_SHA256', '9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31'), - ('PACKET_DRIVER_BINARY_SHA256', 'b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100'), + ('MACHINE_DRIVER_BUNDLE_VERSION', '0.16.6'), + ('MACHINE_DRIVER_BUNDLE_COMMIT', 'd5bade2722a788f54fe7f3a25af6245336a1e841'), + ('MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256', '82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d'), + ('MACHINE_DRIVER_BINARY_SHA256', '8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c'), + ('PACKET_DRIVER_BINARY_SHA256', 'a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79'), ): self.assertEqual(2, FILES[DOCKER].count('ARG ' + name + '=' + value)) self.assertIn(name.lower() + '=${' + name + ':-' + value + '}', FILES[BUILD]) diff --git a/scripts/test-server-component-candidate.py b/scripts/test-server-component-candidate.py index 12149f695b..cdae5581c4 100644 --- a/scripts/test-server-component-candidate.py +++ b/scripts/test-server-component-candidate.py @@ -58,6 +58,7 @@ def fixture_environment(): "API_EXPLORER_ARTIFACT": "api-explorer-1.1.19.tar.gz", "WEBSOCKET_PROXY_VERSION": "0.23.17", "HOST_API_VERSION": "0.38.7", "NODE_AGENT_VERSION": "0.13.31", "HOST_PROVISIONER_VERSION": "0.39.9", + "SECRET_DELIVERY_API_VERSION": "0.3.3", "USAGE_TELEMETRY_AGENT_VERSION": "0.4.3", "CATALOG_SERVICE_VERSION": "0.20.14", "AUTHENTICATION_SERVICE_VERSION": "0.4.44", "COMPOSE_EXECUTOR_VERSION": "0.14.38", "MACHINE_DRIVER_BUNDLE_VERSION": "0.16.5"} diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release index c89ba24a0b..27ed09d4fa 100644 --- a/server/Dockerfile.web-compose-release +++ b/server/Dockerfile.web-compose-release @@ -135,21 +135,21 @@ ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661 ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff ARG SECRET_DELIVERY_API_RELEASE_BASE_URL=https://github.com/PastureStack/secret-delivery-api/releases/download -ARG SECRET_DELIVERY_API_VERSION=0.3.3 -ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69 -ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699 -ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665 +ARG SECRET_DELIVERY_API_VERSION=0.3.4 +ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d +ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010 +ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c ARG USAGE_TELEMETRY_AGENT_RELEASE_BASE_URL=https://github.com/PastureStack/usage-telemetry-agent/releases/download ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866 ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be ARG MACHINE_DRIVER_BUNDLE_RELEASE_BASE_URL=https://github.com/PastureStack/machine-driver-bundle/releases/download -ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.5 -ARG MACHINE_DRIVER_BUNDLE_COMMIT=f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21 -ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=d9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b -ARG MACHINE_DRIVER_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31 -ARG PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100 +ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.6 +ARG MACHINE_DRIVER_BUNDLE_COMMIT=d5bade2722a788f54fe7f3a25af6245336a1e841 +ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d +ARG MACHINE_DRIVER_BINARY_SHA256=8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c +ARG PACKET_DRIVER_BINARY_SHA256=a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79 RUN set -eux; \ for release_base_url in "${COMPOSE_EXECUTOR_RELEASE_BASE_URL}" "${VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL}"; do \ @@ -751,10 +751,10 @@ ARG HOST_PROVISIONER_VERSION=0.39.10 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661 ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff -ARG SECRET_DELIVERY_API_VERSION=0.3.3 -ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69 -ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699 -ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665 +ARG SECRET_DELIVERY_API_VERSION=0.3.4 +ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d +ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010 +ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866 @@ -767,11 +767,11 @@ ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4 ARG VSPHERE_CLI_BUNDLE_COMMIT=35ca999b775a41e7fb34e9a6b6ceb4fa51f3f242 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0 ARG GOVC_BINARY_SHA256=8f43086cc85de88a93e510efe9375a1ff6e265ca12e764c1fc8ae4c35be69ded -ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.5 -ARG MACHINE_DRIVER_BUNDLE_COMMIT=f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21 -ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=d9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b -ARG MACHINE_DRIVER_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31 -ARG PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100 +ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.6 +ARG MACHINE_DRIVER_BUNDLE_COMMIT=d5bade2722a788f54fe7f3a25af6245336a1e841 +ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d +ARG MACHINE_DRIVER_BINARY_SHA256=8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c +ARG PACKET_DRIVER_BINARY_SHA256=a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79 COPY --from=runtime_security_packages /out/ /tmp/pasturestack-runtime-security/ COPY scripts/install-ubuntu-security-updates.sh security/ubuntu-security-packages.lock artifacts/verify-pcre2-runtime.sh /tmp/pasturestack-security-input/ diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh index 96bc5b9ce2..9baacf20c8 100755 --- a/server/build-api-explorer-patch-image.sh +++ b/server/build-api-explorer-patch-image.sh @@ -99,11 +99,11 @@ compose_executor_archive_sha256=${COMPOSE_EXECUTOR_ARCHIVE_SHA256:-4ab4685af67a8 compose_executor_binary_sha256=${COMPOSE_EXECUTOR_BINARY_SHA256:-0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5} vsphere_cli_bundle_release_base_url=${VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/vsphere-cli-bundle/releases/download} machine_driver_bundle_release_base_url=${MACHINE_DRIVER_BUNDLE_RELEASE_BASE_URL:-https://github.com/PastureStack/machine-driver-bundle/releases/download} -machine_driver_bundle_version=${MACHINE_DRIVER_BUNDLE_VERSION:-0.16.5} -machine_driver_bundle_commit=${MACHINE_DRIVER_BUNDLE_COMMIT:-f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21} -machine_driver_bundle_archive_sha256=${MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256:-d9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b} -machine_driver_binary_sha256=${MACHINE_DRIVER_BINARY_SHA256:-9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31} -packet_driver_binary_sha256=${PACKET_DRIVER_BINARY_SHA256:-b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100} +machine_driver_bundle_version=${MACHINE_DRIVER_BUNDLE_VERSION:-0.16.6} +machine_driver_bundle_commit=${MACHINE_DRIVER_BUNDLE_COMMIT:-d5bade2722a788f54fe7f3a25af6245336a1e841} +machine_driver_bundle_archive_sha256=${MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256:-82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d} +machine_driver_binary_sha256=${MACHINE_DRIVER_BINARY_SHA256:-8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c} +packet_driver_binary_sha256=${PACKET_DRIVER_BINARY_SHA256:-a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79} [[ "$machine_driver_bundle_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ && "$machine_driver_bundle_commit" =~ ^[0-9a-f]{40}$ ]] for machine_hash in "$machine_driver_bundle_archive_sha256" "$machine_driver_binary_sha256" "$packet_driver_binary_sha256"; do [[ "$machine_hash" =~ ^[0-9a-f]{64}$ ]] @@ -119,10 +119,10 @@ host_provisioner_commit=${HOST_PROVISIONER_COMMIT:-d5f6d5c9f4f0599f4bf1bdc9d5d0c host_provisioner_archive_sha256=${HOST_PROVISIONER_ARCHIVE_SHA256:-fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661} host_provisioner_binary_sha256=${HOST_PROVISIONER_BINARY_SHA256:-92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff} secret_delivery_api_release_base_url=${SECRET_DELIVERY_API_RELEASE_BASE_URL:-https://github.com/PastureStack/secret-delivery-api/releases/download} -secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.3} -secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-da196acba539fe7a0c04539f6f7537cdfb2d8d69} -secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699} -secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665} +secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.4} +secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-705589989f542669b7e60e1fdab8ae2694ed5d5d} +secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010} +secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c} usage_telemetry_agent_release_base_url=${USAGE_TELEMETRY_AGENT_RELEASE_BASE_URL:-https://github.com/PastureStack/usage-telemetry-agent/releases/download} usage_telemetry_agent_version=${USAGE_TELEMETRY_AGENT_VERSION:-0.4.4} usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628} @@ -875,7 +875,7 @@ docker run --rm --env "ORCHESTRATION_ENGINE_VERSION=${orchestration_engine_versi e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192 /usr/bin/authentication-service.real 0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5 /usr/bin/compose-executor.real 92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff /usr/bin/host-provisioner.real -e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665 /usr/bin/secret-delivery-api +1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c /usr/bin/secret-delivery-api 90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be /usr/bin/usage-telemetry-agent b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c /usr/bin/webhook-automation-service EOF @@ -917,7 +917,7 @@ EOF test -s /usr/share/licenses/pasturestack/catalog-service/LICENSE.txt grep -Fx "Release source commit: ${PASTURESTACK_CATALOG_SERVICE_COMMIT}" \ /usr/share/licenses/pasturestack/catalog-service/SOURCES.txt >/dev/null - /usr/bin/secret-delivery-api --version | grep -F "v0.3.3" >/dev/null + /usr/bin/secret-delivery-api --version | grep -F "v0.3.4" >/dev/null /usr/bin/usage-telemetry-agent --version | grep -F "0.4.4" >/dev/null /usr/bin/webhook-automation-service --version | grep -F "0.10.5" >/dev/null test "$(readlink -f /usr/bin/webhook-service)" = /usr/bin/webhook-automation-service diff --git a/server/security/check_scan_coverage.py b/server/security/check_scan_coverage.py index d88310f25d..78869dc461 100644 --- a/server/security/check_scan_coverage.py +++ b/server/security/check_scan_coverage.py @@ -19,15 +19,15 @@ # dependency graphs; the image builder pins their producer and payload SHA256. OPENPGP_VEX_SCOPE = frozenset({ ('usr/bin/authentication-service.real', 'pkg:golang/golang.org/x/crypto@v0.57.0'), - ('usr/bin/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.57.0'), - ('usr/bin/docker-machine-driver-packet', 'pkg:golang/golang.org/x/crypto@v0.57.0'), + ('usr/bin/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.58.0'), + ('usr/bin/docker-machine-driver-packet', 'pkg:golang/golang.org/x/crypto@v0.58.0'), ('usr/bin/compose-executor.real', 'pkg:golang/golang.org/x/crypto@v0.56.0'), ('usr/bin/host-provisioner.real', 'pkg:golang/golang.org/x/crypto@v0.56.0'), }) OPENPGP_VEX_BINARY_SHA256 = { 'usr/bin/authentication-service.real': 'e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192', - 'usr/bin/docker-machine': '9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31', - 'usr/bin/docker-machine-driver-packet': 'b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100', + 'usr/bin/docker-machine': '8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c', + 'usr/bin/docker-machine-driver-packet': 'a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79', 'usr/bin/compose-executor.real': '0f0c0ada23564572b569e1c73951ca363c0dc262fe7bba9c2474106650c4eac5', 'usr/bin/host-provisioner.real': '92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff', } diff --git a/server/security/openvex.json b/server/security/openvex.json index 9ca77b9ff6..b203584272 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -2,7 +2,7 @@ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.554", "author": "PastureStack Security", - "timestamp": "2026-10-29T09:57:33.809116+00:00", + "timestamp": "2026-10-29T10:54:00Z", "version": 66, "statements": [ { @@ -343,11 +343,14 @@ }, { "@id": "pkg:golang/golang.org/x/crypto@v0.56.0" + }, + { + "@id": "pkg:golang/golang.org/x/crypto@v0.58.0" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", - "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The exact authentication-service 0.4.46 and machine-driver-bundle 0.16.5 release dependency graphs and govulncheck evidence contain no OpenPGP import or reachable symbol, including both docker-machine and docker-machine-driver-packet. The existing compose-executor and host-provisioner v0.56.0 paths remain unchanged. Before applying this VEX the publisher rejects any other executable path or module version using the reviewed occurrence allowlist; this does not authorize a new OpenPGP consumer." + "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The authentication-service 0.4.46 (v0.57.0) and machine-driver-bundle 0.16.6 (v0.58.0) release dependency graphs and source-mode/symbol govulncheck evidence contain no OpenPGP package import or reachable function, including both docker-machine and docker-machine-driver-packet. The compose-executor and host-provisioner v0.56.0 paths are unchanged. Before applying this VEX, the publisher requires exact reviewed executable paths, module versions and binary SHA256 values; it rejects any new consumer or changed bytes. This is a code-absence decision, not a claim that the full crypto module is fixed." }, { "vulnerability": { diff --git a/server/security/test_scan_coverage.py b/server/security/test_scan_coverage.py index 2db1742da6..942a63d6c4 100644 --- a/server/security/test_scan_coverage.py +++ b/server/security/test_scan_coverage.py @@ -69,7 +69,8 @@ def test_reviewed_openpgp_module_occurrences_are_allowed(self): def test_unreviewed_openpgp_target_or_version_blocks_before_vex(self): for target, purl in ( ('usr/bin/govc', 'pkg:golang/golang.org/x/crypto@v0.57.0'), - ('usr/bin/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.58.0'), + ('usr/bin/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.57.0'), + ('usr/bin/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.59.0'), ('tmp/docker-machine', 'pkg:golang/golang.org/x/crypto@v0.57.0'), ('usr/bin/docker-machine', None)): with self.subTest(target=target, purl=purl):