From bb11821b64bbd952528d127814325493b6aa6000 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Thu, 22 Oct 2026 04:05:02 +0800 Subject: [PATCH 1/2] build: rebuild host provisioner 0.39.9 with Go 1.27.3 --- .github/workflows/codeql-verification.yml | 6 +++--- .github/workflows/security-release-gate.yml | 17 +++++++++-------- .github/workflows/validate.yml | 20 ++++++++++---------- Dockerfile.dapper | 4 ++-- README.md | 4 ++-- scripts/validate | 7 +++++-- 6 files changed, 31 insertions(+), 27 deletions(-) diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index c8c0f46..ee9ba71 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -32,12 +32,12 @@ jobs: shell: bash run: | set -euo pipefail - archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz" + archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz" curl --fail --silent --show-error --location \ --output "$archive" \ - 'https://go.dev/dl/go1.27.2.linux-amd64.tar.gz' + 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz' printf '%s %s\n' \ - 'ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' \ + '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \ "$archive" | sha256sum --check tar -C "$RUNNER_TEMP" -xzf "$archive" "$RUNNER_TEMP/go/bin/go" version diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index d0314a4..e7f8ac6 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -23,7 +23,7 @@ jobs: env: DAPPER_IMAGE: pasturestack/host-provisioner-dapper:${{ github.sha }} TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 - VERSION_OVERRIDE: v0.39.8 + VERSION_OVERRIDE: v0.39.9 SOURCE_DATE_EPOCH: '0' steps: - name: Check out candidate @@ -47,23 +47,24 @@ jobs: run: | set -euo pipefail make DAPPER_IMAGE="$DAPPER_IMAGE" ci - test -s dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz - package_dir='host-provisioner-0.39.8-linux-amd64' - tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner" - tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE" - tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md" + test -s dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz + package_dir='host-provisioner-0.39.9-linux-amd64' + tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner" + tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE" + tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md" expected_legal=$(find vendor -type f \( \ -name 'LICENSE' -o -name 'LICENSE.*' -o \ -name 'NOTICE' -o -name 'NOTICE.*' -o \ -name 'COPYING' -o -name 'COPYING.*' -o \ -name 'AUTHORS' -o -name 'AUTHORS.*' \ \) | wc -l) - actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$") + actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$") test "$expected_legal" -gt 0 test "$actual_legal" -eq "$expected_legal" - sha256sum dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256 + sha256sum dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256 docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \ version -m /work/bin/host-provisioner > evidence/product-go-version.txt + grep -F 'go1.27.3' evidence/product-go-version.txt >/dev/null grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null - name: Scan source, product, and build image diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index a4162cd..9f6b51d 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -33,19 +33,19 @@ jobs: set -euo pipefail test -z "$(git status --porcelain)" git merge-base --is-ancestor 22d7baca609c18589f08225a97bf8c5e00109204 HEAD - grep -Fq 'VERSION_OVERRIDE: v0.39.8' .github/workflows/validate.yml + grep -Fq 'VERSION_OVERRIDE: v0.39.9' .github/workflows/validate.yml - name: Run complete tests, validation, and package env: - VERSION_OVERRIDE: v0.39.8 + VERSION_OVERRIDE: v0.39.9 SOURCE_DATE_EPOCH: '0' shell: bash run: | set -euo pipefail make ci - asset='dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz' + asset='dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz' test -s "$asset" - package_dir='host-provisioner-0.39.8-linux-amd64' + package_dir='host-provisioner-0.39.9-linux-amd64' tar -tJf "$asset" | grep -Fx "${package_dir}/host-provisioner" tar -tJf "$asset" | grep -Fx "${package_dir}/LICENSE" tar -tJf "$asset" | grep -Fx "${package_dir}/ORIGIN.md" @@ -61,28 +61,28 @@ jobs: mkdir -p evidence extracted tar -xJf "$asset" -C extracted test -x "extracted/${package_dir}/host-provisioner" - test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.8' + test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.9' sha256sum "$asset" "extracted/${package_dir}/host-provisioner" > evidence/product-artifacts.sha256 - name: Verify reproducible artifact env: - VERSION_OVERRIDE: v0.39.8 + VERSION_OVERRIDE: v0.39.9 SOURCE_DATE_EPOCH: '0' shell: bash run: | set -euo pipefail - cp dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz /tmp/first.tar.xz + cp dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz /tmp/first.tar.xz rm -rf bin dist make ci - cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz + cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz printf 'HOST_PROVISIONER_VALIDATION_OK source=%s version=%s\n' "$GITHUB_SHA" "$VERSION_OVERRIDE" - name: Retain reviewed release candidate uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: host-provisioner-0.39.8 + name: host-provisioner-0.39.9 path: | - dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz + dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz evidence/product-artifacts.sha256 if-no-files-found: error retention-days: 30 diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 95201a1..80e2cbe 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -2,8 +2,8 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b ENV DEBIAN_FRONTEND=noninteractive -ARG GO_VERSION=1.27.2 -ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 +ARG GO_VERSION=1.27.3 +ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 ARG UBUNTU_SNAPSHOT=20261010T200000Z ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \ diff --git a/README.md b/README.md index 1ad670a..28184b5 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status -This is the `v0.39.8` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.2 for Linux/amd64. Published tags and assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled. +This is the `v0.39.9` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.3 for Linux/amd64. Published `v0.39.8` and earlier tags/assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled. ## Configuration @@ -26,7 +26,7 @@ make package Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources. -The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.8` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.8-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its new SHA-256 digest before installation. Users do not need to host a package mirror. +The build container does not receive the host Docker socket. For the current candidate, build with `VERSION_OVERRIDE=v0.39.9` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic asset `host-provisioner-0.39.9-linux-amd64.tar.xz`. Publication and matching Server acceptance are separate required steps. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads published assets from their versioned GitHub Release and verifies the new SHA-256 digest before installation. Users do not need to host a package mirror. The build-only Ubuntu snapshot is fixed at `20261010T200000Z`, with kernel headers `7.0.0-38.38` and OpenSSL `3.5.5-1ubuntu3.7`. CI builds and scans that container separately from the static product executable; available upstream fixes must pass the existing security gate rather than be classified as pending vendor fixes. diff --git a/scripts/validate b/scripts/validate index 360cbab..c555187 100755 --- a/scripts/validate +++ b/scripts/validate @@ -5,8 +5,11 @@ cd $(dirname $0)/.. echo Running validation -grep -Fq 'ARG GO_VERSION=1.27.2' Dockerfile.dapper -grep -Fq 'ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' Dockerfile.dapper +grep -Fq 'ARG GO_VERSION=1.27.3' Dockerfile.dapper +grep -Fq 'ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' Dockerfile.dapper +grep -Fq 'archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"' .github/workflows/codeql-verification.yml +grep -Fq '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' .github/workflows/codeql-verification.yml +grep -Fq "grep -F 'go1.27.3' evidence/product-go-version.txt" .github/workflows/security-release-gate.yml grep -Fq 'ARG UBUNTU_SNAPSHOT=20261010T200000Z' Dockerfile.dapper grep -Fq 'linux-libc-dev=7.0.0-38.38' Dockerfile.dapper for package in libssl3t64 openssl openssl-provider-legacy; do From 6ab11424719d2b77228f054970b7fdef164983ff Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Thu, 22 Oct 2026 04:15:55 +0800 Subject: [PATCH 2/2] build: install verified official curl security updates --- Dockerfile.dapper | 13 +++++++++++++ scripts/validate | 8 ++++++++ 2 files changed, 21 insertions(+) diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 80e2cbe..ec98fd4 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -9,6 +9,9 @@ ARG UBUNTU_SNAPSHOT=20261010T200000Z ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \ https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \ /tmp/ca-certificates.deb +ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb /tmp/curl.deb +ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb +ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb ENV GOPATH=/go ENV GOROOT=/usr/local/go ENV PATH=/usr/local/go/bin:/go/bin:${PATH} @@ -39,6 +42,16 @@ RUN set -eux; \ git \ tar \ xz-utils && \ + for package in curl libcurl3t64-gnutls libcurl4t64; do \ + test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}" || exit 1; \ + test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 8.18.0-1ubuntu2.8 || exit 1; \ + test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64 || exit 1; \ + done && \ + dpkg -i /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb && \ + for package in curl libcurl3t64-gnutls libcurl4t64; do \ + test "$(dpkg-query -W -f='${Version}' "${package}")" = 8.18.0-1ubuntu2.8 || exit 1; \ + done && \ + rm -f /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb && \ rm -rf /var/lib/apt/lists/* && \ rm -f /usr/bin/pebble diff --git a/scripts/validate b/scripts/validate index c555187..abdf91a 100755 --- a/scripts/validate +++ b/scripts/validate @@ -15,6 +15,14 @@ grep -Fq 'linux-libc-dev=7.0.0-38.38' Dockerfile.dapper for package in libssl3t64 openssl openssl-provider-legacy; do grep -Fq "${package}=3.5.5-1ubuntu3.7" Dockerfile.dapper done +for checksum in \ + 2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc \ + 8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e \ + 7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266; do + grep -Fq "ADD --checksum=sha256:${checksum} https://security.ubuntu.com/ubuntu/pool/main/c/curl/" Dockerfile.dapper +done +grep -Fq 'dpkg -i /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb' Dockerfile.dapper +grep -Fq 'test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${package}")" = 8.18.0-1ubuntu2.8 || exit 1;' Dockerfile.dapper grep -Fq 'aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969' .github/workflows/security-release-gate.yml if grep -E 'ARG DOCKER_VERSION=|download\.docker\.com/linux/static|tar xzf /tmp/docker\.tgz' Dockerfile.dapper; then echo 'Unused Docker CLI must not be bundled in the build container.' >&2