build: rebuild Host Provisioner 0.39.9 with Go 1.27.3

.github/workflows/codeql-verification.yml

@@ -32,12 +32,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location \
             --output "$archive" \
-            'https://go.dev/dl/go1.27.2.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            'ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           "$RUNNER_TEMP/go/bin/go" version

.github/workflows/security-release-gate.yml

@@ -23,7 +23,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack/host-provisioner-dapper:${{ github.sha }}
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.39.8
+      VERSION_OVERRIDE: v0.39.9
       SOURCE_DATE_EPOCH: '0'
     steps:
       - name: Check out candidate
@@ -47,23 +47,24 @@ jobs:
         run: |
           set -euo pipefail
           make DAPPER_IMAGE="$DAPPER_IMAGE" ci
-          test -s dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
-          package_dir='host-provisioner-0.39.8-linux-amd64'
-          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
-          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
-          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
+          test -s dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz
+          package_dir='host-provisioner-0.39.9-linux-amd64'
+          tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
+          tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
+          tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
           expected_legal=$(find vendor -type f \( \
             -name 'LICENSE' -o -name 'LICENSE.*' -o \
             -name 'NOTICE' -o -name 'NOTICE.*' -o \
             -name 'COPYING' -o -name 'COPYING.*' -o \
             -name 'AUTHORS' -o -name 'AUTHORS.*' \
           \) | wc -l)
-          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
+          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
           test "$expected_legal" -gt 0
           test "$actual_legal" -eq "$expected_legal"
-          sha256sum dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
+          sha256sum dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
           docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \
             version -m /work/bin/host-provisioner > evidence/product-go-version.txt
+          grep -F 'go1.27.3' evidence/product-go-version.txt >/dev/null
           grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null
 
       - name: Scan source, product, and build image

.github/workflows/validate.yml

@@ -33,19 +33,19 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor 22d7baca609c18589f08225a97bf8c5e00109204 HEAD
-          grep -Fq 'VERSION_OVERRIDE: v0.39.8' .github/workflows/validate.yml
+          grep -Fq 'VERSION_OVERRIDE: v0.39.9' .github/workflows/validate.yml
 
       - name: Run complete tests, validation, and package
         env:
-          VERSION_OVERRIDE: v0.39.8
+          VERSION_OVERRIDE: v0.39.9
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
           make ci
-          asset='dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz'
+          asset='dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz'
           test -s "$asset"
-          package_dir='host-provisioner-0.39.8-linux-amd64'
+          package_dir='host-provisioner-0.39.9-linux-amd64'
           tar -tJf "$asset" | grep -Fx "${package_dir}/host-provisioner"
           tar -tJf "$asset" | grep -Fx "${package_dir}/LICENSE"
           tar -tJf "$asset" | grep -Fx "${package_dir}/ORIGIN.md"
@@ -61,28 +61,28 @@ jobs:
           mkdir -p evidence extracted
           tar -xJf "$asset" -C extracted
           test -x "extracted/${package_dir}/host-provisioner"
-          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.8'
+          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.9'
           sha256sum "$asset" "extracted/${package_dir}/host-provisioner" > evidence/product-artifacts.sha256
 
       - name: Verify reproducible artifact
         env:
-          VERSION_OVERRIDE: v0.39.8
+          VERSION_OVERRIDE: v0.39.9
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
-          cp dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz /tmp/first.tar.xz
+          cp dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz /tmp/first.tar.xz
           rm -rf bin dist
           make ci
-          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
+          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz
           printf 'HOST_PROVISIONER_VALIDATION_OK source=%s version=%s\n' "$GITHUB_SHA" "$VERSION_OVERRIDE"
 
       - name: Retain reviewed release candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: host-provisioner-0.39.8
+          name: host-provisioner-0.39.9
           path: |
-            dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
+            dist/artifacts/host-provisioner-0.39.9-linux-amd64.tar.xz
             evidence/product-artifacts.sha256
           if-no-files-found: error
           retention-days: 30

Dockerfile.dapper

@@ -2,13 +2,16 @@
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 ENV DEBIAN_FRONTEND=noninteractive
-ARG GO_VERSION=1.27.2
-ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
+ARG GO_VERSION=1.27.3
+ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
 ARG UBUNTU_SNAPSHOT=20261010T200000Z
 
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
     https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
     /tmp/ca-certificates.deb
+ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb /tmp/curl.deb
+ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb
+ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb
 ENV GOPATH=/go
 ENV GOROOT=/usr/local/go
 ENV PATH=/usr/local/go/bin:/go/bin:${PATH}
@@ -39,6 +42,16 @@ RUN set -eux; \
         git \
         tar \
         xz-utils && \
+    for package in curl libcurl3t64-gnutls libcurl4t64; do \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}" || exit 1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 8.18.0-1ubuntu2.8 || exit 1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64 || exit 1; \
+    done && \
+    dpkg -i /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb && \
+    for package in curl libcurl3t64-gnutls libcurl4t64; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = 8.18.0-1ubuntu2.8 || exit 1; \
+    done && \
+    rm -f /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb && \
     rm -rf /var/lib/apt/lists/* && \
     rm -f /usr/bin/pebble
 

README.md

@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-This is the `v0.39.8` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.2 for Linux/amd64. Published tags and assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
+This is the `v0.39.9` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.3 for Linux/amd64. Published `v0.39.8` and earlier tags/assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
 
 ## Configuration
 
@@ -26,7 +26,7 @@ make package
 
 Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.
 
-The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.8` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.8-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its new SHA-256 digest before installation. Users do not need to host a package mirror.
+The build container does not receive the host Docker socket. For the current candidate, build with `VERSION_OVERRIDE=v0.39.9` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic asset `host-provisioner-0.39.9-linux-amd64.tar.xz`. Publication and matching Server acceptance are separate required steps. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads published assets from their versioned GitHub Release and verifies the new SHA-256 digest before installation. Users do not need to host a package mirror.
 
 The build-only Ubuntu snapshot is fixed at `20261010T200000Z`, with kernel headers `7.0.0-38.38` and OpenSSL `3.5.5-1ubuntu3.7`. CI builds and scans that container separately from the static product executable; available upstream fixes must pass the existing security gate rather than be classified as pending vendor fixes.
 

scripts/validate

@@ -5,13 +5,24 @@ cd $(dirname $0)/..
 
 echo Running validation
 
-grep -Fq 'ARG GO_VERSION=1.27.2' Dockerfile.dapper
-grep -Fq 'ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' Dockerfile.dapper
+grep -Fq 'ARG GO_VERSION=1.27.3' Dockerfile.dapper
+grep -Fq 'ARG GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' Dockerfile.dapper
+grep -Fq 'archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"' .github/workflows/codeql-verification.yml
+grep -Fq '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' .github/workflows/codeql-verification.yml
+grep -Fq "grep -F 'go1.27.3' evidence/product-go-version.txt" .github/workflows/security-release-gate.yml
 grep -Fq 'ARG UBUNTU_SNAPSHOT=20261010T200000Z' Dockerfile.dapper
 grep -Fq 'linux-libc-dev=7.0.0-38.38' Dockerfile.dapper
 for package in libssl3t64 openssl openssl-provider-legacy; do
   grep -Fq "${package}=3.5.5-1ubuntu3.7" Dockerfile.dapper
 done
+for checksum in \
+  2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc \
+  8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e \
+  7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266; do
+  grep -Fq "ADD --checksum=sha256:${checksum} https://security.ubuntu.com/ubuntu/pool/main/c/curl/" Dockerfile.dapper
+done
+grep -Fq 'dpkg -i /tmp/curl.deb /tmp/libcurl3t64-gnutls.deb /tmp/libcurl4t64.deb' Dockerfile.dapper
+grep -Fq 'test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${package}")" = 8.18.0-1ubuntu2.8 || exit 1;' Dockerfile.dapper
 grep -Fq 'aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969' .github/workflows/security-release-gate.yml
 if grep -E 'ARG DOCKER_VERSION=|download\.docker\.com/linux/static|tar xzf /tmp/docker\.tgz' Dockerfile.dapper; then
   echo 'Unused Docker CLI must not be bundled in the build container.' >&2