Skip to content

Consume qualified Brotli decoder fix in v0.17.15 #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 25, 2026
Merged

Consume qualified Brotli decoder fix in v0.17.15 #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/runtime-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
set -euo pipefail
test "$GITHUB_REF" = refs/heads/main
[[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
test "$RELEASE_TAG" = 'v0.17.14'
test "$RELEASE_TAG" = 'v0.17.15'
test -z "$(git status --porcelain)"
test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main" --jq .object.sha)" = "$GITHUB_SHA"
Expand Down Expand Up @@ -104,7 +104,7 @@ jobs:
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
-v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
image --skip-db-update --format cyclonedx --output /evidence/image.cdx.json "$TESTED_IMAGE"
bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19'
mkdir -p evidence/bundle-tools
bundle_container=$(docker create "$bundle_image" unused)
trap 'docker rm "$bundle_container" >/dev/null' EXIT
Expand All @@ -118,7 +118,7 @@ jobs:
python3 evidence/bundle-tools/verify-consumer-evidence.py \
--evidence-dir evidence/ubuntu-backports --sbom evidence/image.cdx.json \
--bundle-checksums evidence/bundle-tools/SHA256SUMS \
--expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json
--expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > evidence/ubuntu-backports-validation.json
# Only native Trivy interprets the exact qualified OpenVEX statements.
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
-v "$cache:/root/.cache/trivy" -v "$PWD/evidence:/evidence" "$TRIVY_IMAGE" \
Expand Down
10 changes: 6 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Internal DNS

Linux runtime **`v0.17.14`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
Linux runtime **`v0.17.15`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.

The shared bundle includes the official Brotli decoder fix for CVE-2026-111497.

The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`.

Expand Down Expand Up @@ -29,10 +31,10 @@ make build
```

`scripts/build` also cross-compiles `windows/amd64`. The Linux image is
`ghcr.io/pasturestack/internal-dns:v0.17.14`; Catalog selection follows its release and integration gates.
`ghcr.io/pasturestack/internal-dns:v0.17.15`; Catalog selection follows its release and integration gates.
The separately versioned Windows Server 2022 image remains
`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. This Linux preparation
does not rebuild or revalidate that Windows image.
`ghcr.io/pasturestack/internal-dns-windows:v0.17.12`. The Windows image remains separately
versioned and is not rebuilt by this Linux release.

Linux integration tests require `bats`, `dig`, free local TCP/UDP port 15353, and controlled recursive DNS access:

Expand Down
4 changes: 2 additions & 2 deletions package/linux/amd64/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# syntax=docker/dockerfile:1.7
FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports
FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b

ARG UBUNTU_SNAPSHOT=20260825T000000Z
Expand Down Expand Up @@ -55,7 +55,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/
for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \
done; \
printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \
(cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
rm -f /var/cache/ldconfig/aux-cache
Expand Down
Loading