Repository navigation
fix: unbreak Unbound CI on Ubuntu 26 runners, pin libcurl 8.23.0-r0 - #786
Merged
Merged
Conversation
- setup.sh: read the split-DNS authority's IP from .NetworkSettings.Networks instead of the legacy top-level .NetworkSettings.IPAddress, which newer Docker Engine (ubuntu-latest now on Ubuntu 26) no longer returns - the template aborted with "map has no entry for key IPAddress", failing every caller since 2026-10-27. Also fail loudly if no IP comes back. - core/updater: pin libcurl 8.23.0-r0 for CVE-2026-92392 (HIGH) in the docker:29-cli base, the nightly scan's only finding (#784).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Was ändert dieser Pull Request?
Behebt die zwei Workflows, die auf
mainseit Tagen beim unveränderten Commit9a097a1rot sind:Unbound CI (rot seit 2026-10-27):
ubuntu-latestläuft inzwischen auf Ubuntu 26 mit neuerem Docker Engine. Dort fehlt das alte Top-Level-Feld.NetworkSettings.IPAddressindocker inspect, also brichtscripts/ci/dnssec-test-zone/setup.shab:Die IP wird jetzt aus
.NetworkSettings.Networksgelesen, wieinject.shes schon tut. Das funktioniert mit alten und neuen Docker-Versionen. Wenn keine gültige IP zurückkommt, bricht das Skript mit einer klaren Meldung ab. Betroffen waren alle Aufrufer aufubuntu-latest(ci-unbound,ci,clean-install,backup-restore,ci-adguard-compat,release-alpha). Die arm64-Jobs aufubuntu-24.04-armliefen weiter grün.Nightly security scan (rot seit 2026-10-26, #784): Trivy stuft CVE-2026-92392 (libcurl, HTTP/2 upload use-after-free) als HIGH ein, betroffen ist das
libcurl 8.22.0-r0aus der Basisdocker:29-cliin Core und Updater. Alpine 3.24mainliefert8.23.0-r0für x86_64 und aarch64. Der Pin folgt demselben Muster wie beibrotli-libs/libexpat, undcheck-alpine-pins.shpflegt ihn automatisch mit.Prüfung
git diff --checkHinweise
Keine. Nach dem Merge sollte der nächste Nightly-Scan #784 selbst schließen.
Verknüpftes Issue: #784