Fix final Server 1.6.554 Go component security findings

README.md

@@ -17,7 +17,8 @@ Server `v1.6.554` is a prepared source candidate, not a published image.
 It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional,
 scoped AI collaboration. New pages start with tools off. Upgrade execution
 requires an authenticated owner's separate confirmation; ordinary API Keys
-retain their existing permissions. See the [candidate note](docs/releases/server-1.6.554.md).
+retain their existing permissions. It also includes qualified security updates
+for secret delivery and host provisioning. See the [candidate note](docs/releases/server-1.6.554.md).
 
 The previous published release is
 [Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553),

docs/releases/server-1.6.554.md

@@ -10,12 +10,18 @@ revision only after its required checks pass.
   archive SHA256 `4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa`.
 - Engine `v0.183.355`: producer `9ea138d1db1718cf65157c9564c379e62bafe9a0`,
   `cattle.jar` SHA256 `a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f`.
+- Secret Delivery API `v0.3.4`: producer `705589989f542669b7e60e1fdab8ae2694ed5d5d`,
+  archive SHA256 `941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010`.
+- Machine Driver Bundle `v0.16.6`: producer `d5bade2722a788f54fe7f3a25af6245336a1e841`,
+  archive SHA256 `82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d`.
 
 This release integrates Web Console `1.6.196` and Engine `v0.183.355` for optional
 AI collaboration. Engine uses official Guava `33.7.2-jre` for
 `CVE-2026-102554`; assembly verifies the exact nested artifact and rejects older
-or additional Guava jars. Other component versions and the existing security backport
-baseline are retained. The build recipe pins component commits, archive hashes
+or additional Guava jars. The release also updates the secret-delivery and
+machine-driver transports to the qualified Go security dependencies. Remaining
+component versions and the existing security backport baseline are retained.
+The build recipe pins component commits, archive hashes
 and the Web Console runtime SBOM; the bridge has a separate source archive and
 SBOM because its Node.js process is not part of the browser bundle.
 
@@ -35,9 +41,10 @@ the stricter retired-instance path does not add a general delete grant.
 
 The isolated candidate completed two consecutive scoped-Key image upgrades and
 return to its original image, a weak-model upgrade through human confirmation,
-and an ordinary GENERAL/FULL Key upgrade as a control. Launch settings and
-mounted data were retained; retired instances and their live ports were gone.
-Server restart and browser refresh retained service state and data. Native
+and an ordinary GENERAL/FULL Key upgrade as a control. Launch settings were
+retained; retired instances and their live ports were gone. Mounted-data
+persistence is a separate deployment check using a random marker generated
+only when the mounted file is absent, verified across upgrade and restart. Native
 tool registration, explicit off/read-only/enabled modes, role/scope rejection,
 conditional-description conflicts and per-Key audit were checked separately.
 

scripts/check-server-api-explorer-patch.sh

@@ -742,10 +742,10 @@ for incremental_producer_marker in \
     'ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba' \
     'ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661' \
     'ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff' \
-    'ARG SECRET_DELIVERY_API_VERSION=0.3.3' \
-    'ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69' \
-    'ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699' \
-    'ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665' \
+    'ARG SECRET_DELIVERY_API_VERSION=0.3.4' \
+    'ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d' \
+    'ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010' \
+    'ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c' \
     'ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4' \
     'ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628' \
     'ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866' \
@@ -760,10 +760,10 @@ for incremental_producer_build_marker in \
     'host_provisioner_commit=${HOST_PROVISIONER_COMMIT:-d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba}' \
     'host_provisioner_archive_sha256=${HOST_PROVISIONER_ARCHIVE_SHA256:-fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661}' \
     'host_provisioner_binary_sha256=${HOST_PROVISIONER_BINARY_SHA256:-92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff}' \
-    'secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.3}' \
-    'secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-da196acba539fe7a0c04539f6f7537cdfb2d8d69}' \
-    'secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699}' \
-    'secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665}' \
+    'secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.4}' \
+    'secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-705589989f542669b7e60e1fdab8ae2694ed5d5d}' \
+    'secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010}' \
+    'secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c}' \
     'usage_telemetry_agent_version=${USAGE_TELEMETRY_AGENT_VERSION:-0.4.4}' \
     'usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}' \
     'usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}' \

scripts/test-current-server-packaging-contract.py

@@ -146,10 +146,10 @@
             "ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba",
             "ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661",
             "ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff",
-            "ARG SECRET_DELIVERY_API_VERSION=0.3.3",
-            "ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69",
-            "ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699",
-            "ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665",
+            "ARG SECRET_DELIVERY_API_VERSION=0.3.4",
+            "ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d",
+            "ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010",
+            "ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c",
             "ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4",
             "ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628",
             "ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866",
@@ -166,10 +166,10 @@
             "host_provisioner_commit=${HOST_PROVISIONER_COMMIT:-d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba}",
             "host_provisioner_archive_sha256=${HOST_PROVISIONER_ARCHIVE_SHA256:-fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661}",
             "host_provisioner_binary_sha256=${HOST_PROVISIONER_BINARY_SHA256:-92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff}",
-            "secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.3}",
-            "secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-da196acba539fe7a0c04539f6f7537cdfb2d8d69}",
-            "secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699}",
-            "secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665}",
+            "secret_delivery_api_version=${SECRET_DELIVERY_API_VERSION:-0.3.4}",
+            "secret_delivery_api_commit=${SECRET_DELIVERY_API_COMMIT:-705589989f542669b7e60e1fdab8ae2694ed5d5d}",
+            "secret_delivery_api_archive_sha256=${SECRET_DELIVERY_API_ARCHIVE_SHA256:-941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010}",
+            "secret_delivery_api_binary_sha256=${SECRET_DELIVERY_API_BINARY_SHA256:-1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c}",
             "usage_telemetry_agent_version=${USAGE_TELEMETRY_AGENT_VERSION:-0.4.4}",
             "usage_telemetry_agent_commit=${USAGE_TELEMETRY_AGENT_COMMIT:-4ee641bc1273cf582a77609af71d00b72f17b628}",
             "usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866}",
@@ -949,7 +949,7 @@ def test_new_producer_binary_alias_version_and_legal_commands_fail_closed(self):
                         verify_incremental_contract(dict(FILES, **{DOCKER: FILES[DOCKER].replace(marker, replacement)}))
         for upper, version, digest, binary in (
             ('HOST_PROVISIONER', '0.39.10', '92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff', '/usr/bin/host-provisioner.real'),
-            ('SECRET_DELIVERY_API', '0.3.3', 'e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665', '/usr/bin/secret-delivery-api'),
+            ('SECRET_DELIVERY_API', '0.3.4', '1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c', '/usr/bin/secret-delivery-api'),
             ('USAGE_TELEMETRY_AGENT', '0.4.4', '90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be', '/usr/bin/usage-telemetry-agent'),
         ):
             self.assertIn(digest + '  ' + binary, FILES[BUILD])
@@ -1606,11 +1606,11 @@ def test_current_readme_keeps_install_and_upgrade_contract(self):
 
     def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
         for name, value in (
-            ('MACHINE_DRIVER_BUNDLE_VERSION', '0.16.5'),
-            ('MACHINE_DRIVER_BUNDLE_COMMIT', 'f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21'),
-            ('MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256', 'd9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b'),
-            ('MACHINE_DRIVER_BINARY_SHA256', '9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31'),
-            ('PACKET_DRIVER_BINARY_SHA256', 'b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100'),
+            ('MACHINE_DRIVER_BUNDLE_VERSION', '0.16.6'),
+            ('MACHINE_DRIVER_BUNDLE_COMMIT', 'd5bade2722a788f54fe7f3a25af6245336a1e841'),
+            ('MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256', '82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d'),
+            ('MACHINE_DRIVER_BINARY_SHA256', '8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c'),
+            ('PACKET_DRIVER_BINARY_SHA256', 'a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79'),
         ):
             self.assertEqual(2, FILES[DOCKER].count('ARG ' + name + '=' + value))
             self.assertIn(name.lower() + '=${' + name + ':-' + value + '}', FILES[BUILD])

scripts/test-server-component-candidate.py

@@ -58,6 +58,7 @@ def fixture_environment():
                    "API_EXPLORER_ARTIFACT": "api-explorer-1.1.19.tar.gz",
                    "WEBSOCKET_PROXY_VERSION": "0.23.17", "HOST_API_VERSION": "0.38.7",
                    "NODE_AGENT_VERSION": "0.13.31", "HOST_PROVISIONER_VERSION": "0.39.9",
+                   "SECRET_DELIVERY_API_VERSION": "0.3.3",
                    "USAGE_TELEMETRY_AGENT_VERSION": "0.4.3", "CATALOG_SERVICE_VERSION": "0.20.14",
                    "AUTHENTICATION_SERVICE_VERSION": "0.4.44", "COMPOSE_EXECUTOR_VERSION": "0.14.38",
                    "MACHINE_DRIVER_BUNDLE_VERSION": "0.16.5"}

server/Dockerfile.web-compose-release

@@ -135,21 +135,21 @@ ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661
 ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff
 ARG SECRET_DELIVERY_API_RELEASE_BASE_URL=https://github.com/PastureStack/secret-delivery-api/releases/download
-ARG SECRET_DELIVERY_API_VERSION=0.3.3
-ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69
-ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699
-ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665
+ARG SECRET_DELIVERY_API_VERSION=0.3.4
+ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d
+ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010
+ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c
 ARG USAGE_TELEMETRY_AGENT_RELEASE_BASE_URL=https://github.com/PastureStack/usage-telemetry-agent/releases/download
 ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4
 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628
 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866
 ARG USAGE_TELEMETRY_AGENT_BINARY_SHA256=90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be
 ARG MACHINE_DRIVER_BUNDLE_RELEASE_BASE_URL=https://github.com/PastureStack/machine-driver-bundle/releases/download
-ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.5
-ARG MACHINE_DRIVER_BUNDLE_COMMIT=f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21
-ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=d9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b
-ARG MACHINE_DRIVER_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31
-ARG PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100
+ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.6
+ARG MACHINE_DRIVER_BUNDLE_COMMIT=d5bade2722a788f54fe7f3a25af6245336a1e841
+ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d
+ARG MACHINE_DRIVER_BINARY_SHA256=8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c
+ARG PACKET_DRIVER_BINARY_SHA256=a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79
 
 RUN set -eux; \
     for release_base_url in "${COMPOSE_EXECUTOR_RELEASE_BASE_URL}" "${VSPHERE_CLI_BUNDLE_RELEASE_BASE_URL}"; do \
@@ -751,10 +751,10 @@ ARG HOST_PROVISIONER_VERSION=0.39.10
 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661
 ARG HOST_PROVISIONER_BINARY_SHA256=92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff
-ARG SECRET_DELIVERY_API_VERSION=0.3.3
-ARG SECRET_DELIVERY_API_COMMIT=da196acba539fe7a0c04539f6f7537cdfb2d8d69
-ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=026ba87f4c8fb7bfbf991f63a496db9c4a0837913ab56dc505c187f9b9598699
-ARG SECRET_DELIVERY_API_BINARY_SHA256=e4928ca7359975ba4ad73456296baace8ef0b428c0901055a0317244a17e4665
+ARG SECRET_DELIVERY_API_VERSION=0.3.4
+ARG SECRET_DELIVERY_API_COMMIT=705589989f542669b7e60e1fdab8ae2694ed5d5d
+ARG SECRET_DELIVERY_API_ARCHIVE_SHA256=941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010
+ARG SECRET_DELIVERY_API_BINARY_SHA256=1d302e8005e35fe56108d704cd3b18e12a0fbbc1871e7b5cd61ac429db37566c
 ARG USAGE_TELEMETRY_AGENT_VERSION=0.4.4
 ARG USAGE_TELEMETRY_AGENT_COMMIT=4ee641bc1273cf582a77609af71d00b72f17b628
 ARG USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256=6d482fed63734d4912174747ad1b70bc57ee0ac52e0cc60e7d43a12ad17d3866
@@ -767,11 +767,11 @@ ARG VSPHERE_CLI_BUNDLE_VERSION=0.55.4
 ARG VSPHERE_CLI_BUNDLE_COMMIT=35ca999b775a41e7fb34e9a6b6ceb4fa51f3f242
 ARG VSPHERE_CLI_BUNDLE_ARCHIVE_SHA256=abec8c22504adde66e2ccd89b7b764c8a643c5e1e4425dafb2964abde75806a0
 ARG GOVC_BINARY_SHA256=8f43086cc85de88a93e510efe9375a1ff6e265ca12e764c1fc8ae4c35be69ded
-ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.5
-ARG MACHINE_DRIVER_BUNDLE_COMMIT=f8d9d86f896ca14a50f3788c2f6a200a1c3b6b21
-ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=d9f33bcb16f478ceab44da4b185fb1fbadcab4f0f441f259c96a9805a854a28b
-ARG MACHINE_DRIVER_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31
-ARG PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100
+ARG MACHINE_DRIVER_BUNDLE_VERSION=0.16.6
+ARG MACHINE_DRIVER_BUNDLE_COMMIT=d5bade2722a788f54fe7f3a25af6245336a1e841
+ARG MACHINE_DRIVER_BUNDLE_ARCHIVE_SHA256=82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d
+ARG MACHINE_DRIVER_BINARY_SHA256=8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c
+ARG PACKET_DRIVER_BINARY_SHA256=a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79
 
 COPY --from=runtime_security_packages /out/ /tmp/pasturestack-runtime-security/
 COPY scripts/install-ubuntu-security-updates.sh security/ubuntu-security-packages.lock artifacts/verify-pcre2-runtime.sh /tmp/pasturestack-security-input/