From d2cfc6c1ca69cc92054a86fcb9ebd568acf0b2cc Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:12:54 +0800 Subject: [PATCH 1/5] fix: refresh compiler and trust-store security inputs --- .github/workflows/codeql-verification.yml | 6 +- .github/workflows/release.yml | 42 ++++----- .github/workflows/security-release-gate.yml | 16 ++-- .gitignore | 1 + Dockerfile.dapper | 9 +- README.md | 2 + THIRD_PARTY_NOTICES.md | 2 +- go.mod | 6 +- go.sum | 4 + package/Dockerfile | 5 +- scripts/package | 4 +- tests/test_openssl_package_contract.py | 17 +++- ubuntu-apt.lock | 2 +- vendor/golang.org/x/sys/unix/ifreq_linux.go | 8 +- vendor/golang.org/x/sys/unix/ioctl_linux.go | 7 ++ vendor/golang.org/x/sys/unix/mkerrors.sh | 9 +- vendor/golang.org/x/sys/unix/syscall.go | 2 +- vendor/golang.org/x/sys/unix/syscall_bsd.go | 2 +- vendor/golang.org/x/sys/unix/syscall_linux.go | 2 +- vendor/golang.org/x/sys/unix/zerrors_linux.go | 2 + .../x/sys/unix/zerrors_linux_386.go | 1 - .../x/sys/unix/zerrors_linux_amd64.go | 1 - .../x/sys/unix/zerrors_linux_arm.go | 1 - .../x/sys/unix/zerrors_linux_arm64.go | 1 - .../x/sys/unix/zerrors_linux_loong64.go | 1 - .../x/sys/unix/zerrors_linux_mips.go | 1 - .../x/sys/unix/zerrors_linux_mips64.go | 1 - .../x/sys/unix/zerrors_linux_mips64le.go | 1 - .../x/sys/unix/zerrors_linux_mipsle.go | 1 - .../x/sys/unix/zerrors_linux_ppc.go | 1 - .../x/sys/unix/zerrors_linux_ppc64.go | 1 - .../x/sys/unix/zerrors_linux_ppc64le.go | 1 - .../x/sys/unix/zerrors_linux_riscv64.go | 1 - .../x/sys/unix/zerrors_linux_s390x.go | 1 - .../x/sys/unix/zerrors_linux_sparc64.go | 35 ++++---- vendor/golang.org/x/sys/unix/ztypes_linux.go | 86 +++++++++++++++++-- .../golang.org/x/sys/unix/ztypes_linux_386.go | 32 ++++++- .../x/sys/unix/ztypes_linux_amd64.go | 32 ++++++- .../golang.org/x/sys/unix/ztypes_linux_arm.go | 32 ++++++- .../x/sys/unix/ztypes_linux_arm64.go | 32 ++++++- .../x/sys/unix/ztypes_linux_loong64.go | 32 ++++++- .../x/sys/unix/ztypes_linux_mips.go | 32 ++++++- .../x/sys/unix/ztypes_linux_mips64.go | 32 ++++++- .../x/sys/unix/ztypes_linux_mips64le.go | 32 ++++++- .../x/sys/unix/ztypes_linux_mipsle.go | 32 ++++++- .../golang.org/x/sys/unix/ztypes_linux_ppc.go | 32 ++++++- .../x/sys/unix/ztypes_linux_ppc64.go | 32 ++++++- .../x/sys/unix/ztypes_linux_ppc64le.go | 32 ++++++- .../x/sys/unix/ztypes_linux_riscv64.go | 32 ++++++- .../x/sys/unix/ztypes_linux_s390x.go | 32 ++++++- .../x/sys/unix/ztypes_linux_sparc64.go | 32 ++++++- .../golang.org/x/sys/windows/types_windows.go | 1 + vendor/modules.txt | 8 +- 53 files changed, 659 insertions(+), 113 deletions(-) diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index 02822b6..63c891c 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -24,8 +24,8 @@ jobs: - name: Install verified Go toolchain shell: bash env: - GO_VERSION: 1.27.0 - GO_LINUX_AMD64_SHA256: 675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685 + GO_VERSION: 1.27.3 + GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 run: | set -euo pipefail archive="go${GO_VERSION}.linux-amd64.tar.gz" @@ -53,7 +53,7 @@ jobs: cd "$GITHUB_WORKSPACE" go test -run '^$' ./... go test -run '^$' -tags=integration ./store - VERSION_OVERRIDE=0.14.38 ./scripts/build + VERSION_OVERRIDE=0.14.39 ./scripts/build - name: Analyze without publishing temporary alerts uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b3cff96..9148903 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,6 @@ name: Release IPsec overlay -# A release is dispatched from main only after an annotated v0.14.38 tag and +# A release is dispatched from main only after an annotated v0.14.39 tag and # successful, same-commit Security release gate and CodeQL verification runs. # GHCR, registry attestations, and GitHub Releases are not an atomic transaction. # All source/product/runtime gates precede the image push. A later failure may @@ -9,11 +9,11 @@ on: workflow_dispatch: inputs: release_tag: - description: Existing annotated, numeric v0.14.38 tag at main HEAD + description: Existing annotated, numeric v0.14.39 tag at main HEAD required: true type: choice options: - - v0.14.38 + - v0.14.39 security_run_id: description: Successful same-SHA Security release gate run ID required: true @@ -35,7 +35,7 @@ permissions: attestations: write concurrency: - group: ipsec-vxlan-overlay-release-v0.14.38 + group: ipsec-vxlan-overlay-release-v0.14.39 cancel-in-progress: false jobs: @@ -48,8 +48,8 @@ jobs: CODEQL_RUN_ID: ${{ inputs.codeql_run_id }} RESUME_DIGEST: ${{ inputs.resume_digest }} GH_TOKEN: ${{ github.token }} - SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.38 - LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.38 + SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.39 + LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 GOFLAGS: -mod=vendor GOWORK: off @@ -67,7 +67,7 @@ jobs: run: | set -euo pipefail test "$GITHUB_REF" = refs/heads/main - test "$RELEASE_TAG" = v0.14.38 + test "$RELEASE_TAG" = v0.14.39 [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] [[ "$SECURITY_RUN_ID" =~ ^[0-9]+$ ]] [[ "$CODEQL_RUN_ID" =~ ^[0-9]+$ ]] @@ -134,15 +134,15 @@ jobs: select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' "$report")" -eq 0 done - - name: Install checksum-pinned Go 1.27.0 + - name: Install checksum-pinned Go 1.27.3 shell: bash run: | set -euo pipefail - archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz" + archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz" curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \ - --output "$archive" 'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz' + --output "$archive" 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz' printf '%s %s\n' \ - '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \ + '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \ "$archive" | sha256sum --check tar -C "$RUNNER_TEMP" -xzf "$archive" printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH" @@ -152,15 +152,15 @@ jobs: shell: bash run: | set -euo pipefail - VERSION_OVERRIDE=0.14.38 ./scripts/build + VERSION_OVERRIDE=0.14.39 ./scripts/build sha256sum --check evidence/product.sha256 if [ -z "$RESUME_DIGEST" ]; then - VERSION_OVERRIDE=0.14.38 TAG=0.14.38 REPO=local/pasturestack \ + VERSION_OVERRIDE=0.14.39 TAG=0.14.39 REPO=local/pasturestack \ IMAGE_REVISION="$SOURCE_SHA" ./scripts/package test "$(wc -l < dist/images)" -eq 1 grep -Fx "$LOCAL_IMAGE" dist/images test "$(docker image inspect "$LOCAL_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.38 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39 test "$(docker image inspect "$LOCAL_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" docker tag "$LOCAL_IMAGE" "$SERVICE_IMAGE" @@ -178,7 +178,7 @@ jobs: docker pull "$SERVICE_IMAGE@$RESUME_DIGEST" docker tag "$SERVICE_IMAGE@$RESUME_DIGEST" "$SERVICE_IMAGE" test "$(docker image inspect "$SERVICE_IMAGE" \ - --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.38 + --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39 test "$(docker image inspect "$SERVICE_IMAGE" \ --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA" verification_container="$(docker create "$SERVICE_IMAGE")" @@ -315,7 +315,7 @@ jobs: run: | set -euo pipefail release_dir="dist/release" - product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.38-linux-amd64" + product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64" mkdir -p "$product_dir" cp bin/ipsec-vxlan-overlay-network bin/ipsec-vxlan-overlay-topology bin/pasture-cni-resolver \ LICENSE ORIGIN.md SECURITY.md THIRD_PARTY_NOTICES.md "$product_dir/" @@ -327,11 +327,11 @@ jobs: find "$product_dir" -exec touch -h -d "@$source_epoch" {} + tar --sort=name --mtime="@$source_epoch" --owner=0 --group=0 \ --numeric-owner -C "$release_dir" \ - -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz" \ - ipsec-vxlan-overlay-network-0.14.38-linux-amd64 + -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz" \ + ipsec-vxlan-overlay-network-0.14.39-linux-amd64 ( cd "$release_dir" - sha256sum ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz \ + sha256sum ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \ source-sbom.cdx.json image-sbom.cdx.json product.sha256 \ runtime-security.json gate-security-summary.txt image-digest.txt \ release-identity.txt > SHA256SUMS @@ -355,9 +355,9 @@ jobs: run: | set -euo pipefail gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \ - --title 'IPsec Overlay v0.14.38' \ + --title 'IPsec Overlay v0.14.39' \ --notes "Source ${SOURCE_SHA}; Security gate run ${SECURITY_RUN_ID}; CodeQL run ${CODEQL_RUN_ID}. GHCR image ${SERVICE_IMAGE}@$(cat dist/release/image-digest.txt | sed 's/^.*@//')." \ - dist/release/ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz \ + dist/release/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \ dist/release/source-sbom.cdx.json \ dist/release/image-sbom.cdx.json \ dist/release/product.sha256 \ diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index cabe46f..3903fa5 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -1,6 +1,8 @@ name: Security release gate on: + pull_request: + branches: [main] push: branches: - 'verification/ipsec-vxlan-overlay-network-*' @@ -18,14 +20,14 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 120 env: - CANDIDATE_VERSION: 0.14.38 - VERSION_OVERRIDE: 0.14.38 - TAG: 0.14.38 + CANDIDATE_VERSION: 0.14.39 + VERSION_OVERRIDE: 0.14.39 + TAG: 0.14.39 IMAGE_REVISION: ${{ github.sha }} REPO: local/pasturestack - IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.38 - GO_VERSION: 1.27.0 - GO_LINUX_AMD64_SHA256: 675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685 + IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39 + GO_VERSION: 1.27.3 + GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 TRIVY_CACHE: /tmp/pasturestack-ipsec-vxlan-overlay-trivy-cache GOFLAGS: '-mod=vendor' @@ -281,7 +283,7 @@ jobs: impact_statement:$impact }] | { "@context":"https://openvex.dev/ns/v0.2.0", - "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.38", + "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.39", author:"PastureStack Security", timestamp:$timestamp, version:1, diff --git a/.gitignore b/.gitignore index 2e08bdc..9734a6a 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /package/per-host-subnet /package/mount-propagation /package/licenses +__pycache__/ diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 7bda0bc..6cf4310 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -1,15 +1,15 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock -ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb +ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb ADD --checksum=sha256:1b582b937a1f7a8f987da9e1bbfcc806faea714267631ce0fbbd352c924b7daf https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl-provider-legacy.deb ARG DAPPER_HOST_ARCH=amd64 -ARG GO_VERSION=1.27.0 +ARG GO_VERSION=1.27.3 ARG DOCKER_VERSION=29.8.0 -ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685 +ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 ARG DOCKER_LINUX_AMD64_SHA256=cc21815cf1e2efed867dc9c8b96b46ffed8ea176ffab32b0aacb54726ded8f25 ENV DEBIAN_FRONTEND=noninteractive @@ -34,7 +34,7 @@ RUN set -eux; \ /tmp/pasturestack-libssl3t64.deb \ /tmp/pasturestack-openssl.deb \ /tmp/pasturestack-openssl-provider-legacy.deb \ - ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \ + /tmp/ca-certificates.deb \ curl="${UBUNTU_APT_CURL_VERSION}" \ file="${UBUNTU_APT_FILE_VERSION}" \ gcc="${UBUNTU_APT_GCC_VERSION}" \ @@ -44,6 +44,7 @@ RUN set -eux; \ make="${UBUNTU_APT_MAKE_VERSION}" \ tar="${UBUNTU_APT_TAR_VERSION}" \ xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \ + test "$(dpkg-query -W -f='${Version}' ca-certificates)" = "${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ diff --git a/README.md b/README.md index a44bfc3..a55eca8 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # PastureStack IPsec/VXLAN Overlay Network +Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package without advancing the remaining package snapshot. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts. + This repository provides the privileged network data plane used by PastureStack. It contains IPsec and VXLAN overlay processes, connectivity checks, CNI runtime assets, and an audit-only topology planner. PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE. diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 412eb36..075a0c7 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -11,7 +11,7 @@ PastureStack does not relicense third-party work. Copyright, license, and attrib | Metadata CNI IPAM | 0.2.7 | [PastureStack/metadata-cni-ipam](https://github.com/PastureStack/metadata-cni-ipam) | Apache-2.0 | | Host-local CNI IPAM | 0.1.4 | [PastureStack/host-local-cni-ipam](https://github.com/PastureStack/host-local-cni-ipam) | Apache-2.0 | | Flat CNI IPAM | 0.1.4 | [PastureStack/flat-cni-ipam](https://github.com/PastureStack/flat-cni-ipam) | Apache-2.0 | -| Per-host subnet | 0.2.8 | [PastureStack/per-host-subnet](https://github.com/PastureStack/per-host-subnet) | Apache-2.0 | +| Per-host subnet | 0.2.5 | [PastureStack/per-host-subnet](https://github.com/PastureStack/per-host-subnet) | Apache-2.0 | | Mount propagation | 1.0.11 | [PastureStack/mount-propagation](https://github.com/PastureStack/mount-propagation) | Apache-2.0 | The reachable Go dependency graph is declared in [`go.mod`](go.mod), checksum-bound by [`go.sum`](go.sum), and materialized in the standard module-aware `vendor` tree. Unreachable historical test-server dependencies are not shipped. diff --git a/go.mod b/go.mod index ec234b1..835ed13 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/PastureStack/ipsec-vxlan-overlay-network go 1.26.0 -toolchain go1.27.0 +toolchain go1.27.3 require ( github.com/bronze1man/goStrongswanVici v0.0.0-20231128135937-211cef3b0b20 @@ -20,7 +20,7 @@ require ( github.com/josharian/native v1.1.0 // indirect github.com/mdlayher/packet v1.1.2 // indirect github.com/mdlayher/socket v0.6.1 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect + golang.org/x/sys v0.48.0 // indirect ) diff --git a/go.sum b/go.sum index f9eaf06..246d77b 100644 --- a/go.sum +++ b/go.sum @@ -42,6 +42,8 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= @@ -53,6 +55,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= diff --git a/package/Dockerfile b/package/Dockerfile index eba2842..2da3301 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,7 +1,7 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock -ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb +ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb ADD --checksum=sha256:1b582b937a1f7a8f987da9e1bbfcc806faea714267631ce0fbbd352c924b7daf https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl-provider-legacy.deb @@ -38,7 +38,7 @@ RUN set -eux; \ arptables="${UBUNTU_APT_ARPTABLES_VERSION}" \ bash="${UBUNTU_APT_BASH_VERSION}" \ bridge-utils="${UBUNTU_APT_BRIDGE_UTILS_VERSION}" \ - ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \ + /tmp/ca-certificates.deb \ conntrack="${UBUNTU_APT_CONNTRACK_VERSION}" \ curl="${UBUNTU_APT_CURL_VERSION}" \ ethtool="${UBUNTU_APT_ETHTOOL_VERSION}" \ @@ -58,6 +58,7 @@ RUN set -eux; \ strongswan-swanctl="${UBUNTU_APT_STRONGSWAN_VERSION}" \ tar="${UBUNTU_APT_TAR_VERSION}" \ util-linux="${UBUNTU_APT_UTIL_LINUX_VERSION}"; \ + test "$(dpkg-query -W -f='${Version}' ca-certificates)" = "${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ diff --git a/scripts/package b/scripts/package index 5e3ebc6..732affb 100755 --- a/scripts/package +++ b/scripts/package @@ -11,8 +11,8 @@ trap cleanup_package_staging EXIT METADATA_CNI_IPAM_URL=${METADATA_CNI_IPAM_URL:-https://github.com/PastureStack/metadata-cni-ipam/releases/download/v0.2.7/metadata-cni-ipam-0.2.7-linux-amd64} METADATA_CNI_IPAM_SHA256=${METADATA_CNI_IPAM_SHA256:-acde77de17d117f32dd2bbc80dae212c7209165f8101299eaea10561cf058d76} -PER_HOST_SUBNET_URL=${PER_HOST_SUBNET_URL:-https://github.com/PastureStack/per-host-subnet/releases/download/v0.2.8/per-host-subnet-v0.2.8-linux-amd64} -PER_HOST_SUBNET_SHA256=${PER_HOST_SUBNET_SHA256:-d12acca4526eee45d52b87541717ae81432225d9c5dabfd823d6b43631c20e84} +PER_HOST_SUBNET_URL=${PER_HOST_SUBNET_URL:-https://github.com/PastureStack/per-host-subnet/releases/download/v0.2.5/per-host-subnet-v0.2.5-linux-amd64} +PER_HOST_SUBNET_SHA256=${PER_HOST_SUBNET_SHA256:-cf58d91c9856ed76da7a50206c7e2adb2efb325b3419ab205117e75214123406} HOST_LOCAL_CNI_IPAM_URL=${HOST_LOCAL_CNI_IPAM_URL:-https://github.com/PastureStack/host-local-cni-ipam/releases/download/v0.1.4/host-local-cni-ipam-0.1.4-linux-amd64} HOST_LOCAL_CNI_IPAM_SHA256=${HOST_LOCAL_CNI_IPAM_SHA256:-9bb79b9f269663715f44aea898854df0e0e319a3ba35e4d52db5477cde026e3e} FLAT_CNI_IPAM_URL=${FLAT_CNI_IPAM_URL:-https://github.com/PastureStack/flat-cni-ipam/releases/download/v0.1.5/flat-cni-ipam-v0.1.5-linux-amd64} diff --git a/tests/test_openssl_package_contract.py b/tests/test_openssl_package_contract.py index 75e1eff..af2dd57 100644 --- a/tests/test_openssl_package_contract.py +++ b/tests/test_openssl_package_contract.py @@ -8,6 +8,8 @@ BASE = Path(__file__).resolve().parents[1] VERSION = "3.5.5-1ubuntu3.6" SNAPSHOT = "20260930T000000Z" +CA_VERSION = "20260816ubuntu0.26.04.1" +CA_SHA256 = "5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd" # Canonical snapshot resolute-security/main/binary-amd64/Packages.gz SHA256 fields. PACKAGES = { "libssl3t64": "44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340", @@ -35,8 +37,16 @@ def verify_dockerfile(source): if not transaction: raise ValueError("single pinned apt transaction required") local_debs = re.findall(r"/tmp/[^\s;]+\.deb", transaction.group(1)) - if sorted(local_debs) != sorted(item[2] for item in expected): - raise ValueError("all and only three local debs required in apt transaction") + if sorted(local_debs) != sorted([item[2] for item in expected] + ["/tmp/ca-certificates.deb"]): + raise ValueError("exact OpenSSL triplet and CA package required in apt transaction") + ca_add = ("ADD --checksum=sha256:" + CA_SHA256 + + " https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/" + + "ca-certificates_" + CA_VERSION + "_all.deb /tmp/ca-certificates.deb") + ca_check = "test \"$(dpkg-query -W -f='${Version}' ca-certificates)\" = \"${UBUNTU_APT_CA_CERTIFICATES_VERSION}\"" + if source.count(ca_add) != 1 or source.count(ca_check) != 1: + raise ValueError("official CA package and installed-version readback required") + if source.index(ca_check) < transaction.end(): + raise ValueError("CA version must be verified after apt install") check = (" for package in openssl libssl3t64 openssl-provider-legacy; do \\\n" " test \"$(dpkg-query -W -f='${Version}' \"$package\")\" " "= \"${UBUNTU_APT_OPENSSL_VERSION}\"; \\\n" @@ -58,6 +68,7 @@ def setUpClass(cls): def test_both_images_pin_install_and_verify_official_triplet(self): lock = (BASE / "ubuntu-apt.lock").read_text(encoding="utf-8") self.assertIn("UBUNTU_APT_OPENSSL_VERSION='" + VERSION + "'", lock) + self.assertIn("UBUNTU_APT_CA_CERTIFICATES_VERSION='" + CA_VERSION + "'", lock) self.assertIn("UBUNTU_APT_SNAPSHOT='20260808T000000Z'", lock) self.assertIn("UBUNTU_APT_GCC_VERSION='4:15.2.0-5ubuntu1'", lock) for name, source in self.sources.items(): @@ -70,6 +81,8 @@ def test_mutated_url_hash_version_and_incomplete_install_rejected(self): changes = ( source.replace("20260930T000000Z", "20261001T000000Z", 1), source.replace(PACKAGES["openssl"], "0" * 64, 1), + source.replace(CA_SHA256, "0" * 64, 1), + source.replace(" /tmp/ca-certificates.deb \\\n", "", 1), source.replace("openssl_" + VERSION, "openssl_3.5.5-1ubuntu3.3", 1), source.replace(" /tmp/pasturestack-openssl-provider-legacy.deb \\\n", "", 1), source.replace("= \"${UBUNTU_APT_OPENSSL_VERSION}\"", "= \"ignored\"", 1), diff --git a/ubuntu-apt.lock b/ubuntu-apt.lock index f9a3716..a32a891 100644 --- a/ubuntu-apt.lock +++ b/ubuntu-apt.lock @@ -7,7 +7,7 @@ UBUNTU_APT_SNAPSHOT='20260808T000000Z' UBUNTU_APT_ARPTABLES_VERSION='0.0.5-5build1' UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1' UBUNTU_APT_BRIDGE_UTILS_VERSION='1.7.1-4ubuntu3' -UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1' +UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1' UBUNTU_APT_CONNTRACK_VERSION='1:1.4.9-1' UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.3' UBUNTU_APT_ETHTOOL_VERSION='1:6.19-1' diff --git a/vendor/golang.org/x/sys/unix/ifreq_linux.go b/vendor/golang.org/x/sys/unix/ifreq_linux.go index 309f5a2..3f7fa76 100644 --- a/vendor/golang.org/x/sys/unix/ifreq_linux.go +++ b/vendor/golang.org/x/sys/unix/ifreq_linux.go @@ -22,7 +22,13 @@ import ( // fields can be get and set using the following methods: // - Uint16/SetUint16: flags // - Uint32/SetUint32: ifindex, metric, mtu -type Ifreq struct{ raw ifreq } +type Ifreq struct { + // Aligns the union for the accessors below, which cast it in place; + // the generated ifreq is all byte arrays, so its alignment is one. + _ [0]int64 + + raw ifreq +} // NewIfreq creates an Ifreq with the input network interface name after // validating the name does not exceed IFNAMSIZ-1 (trailing NULL required) diff --git a/vendor/golang.org/x/sys/unix/ioctl_linux.go b/vendor/golang.org/x/sys/unix/ioctl_linux.go index 7ca4fa1..5589d4f 100644 --- a/vendor/golang.org/x/sys/unix/ioctl_linux.go +++ b/vendor/golang.org/x/sys/unix/ioctl_linux.go @@ -332,3 +332,10 @@ func IoctlLoopSetStatus64(fd int, value *LoopInfo64) error { func IoctlLoopConfigure(fd int, value *LoopConfig) error { return ioctlPtr(fd, LOOP_CONFIGURE, unsafe.Pointer(value)) } + +// IoctlPidfdInfo fetches information about a pidfd. +// The Mask field of the info argument indicates which +// values to fetch. +func IoctlPidfdInfo(fd int, info *PidfdInfo) error { + return ioctlPtr(fd, PIDFD_GET_INFO, unsafe.Pointer(info)) +} diff --git a/vendor/golang.org/x/sys/unix/mkerrors.sh b/vendor/golang.org/x/sys/unix/mkerrors.sh index fa74cfe..9e907ac 100644 --- a/vendor/golang.org/x/sys/unix/mkerrors.sh +++ b/vendor/golang.org/x/sys/unix/mkerrors.sh @@ -290,14 +290,7 @@ struct ltchars { #include #include -#if defined(__sparc__) -// On sparc{,64}, the kernel defines struct termios2 itself which clashes with the -// definition in glibc. As only the error constants are needed here, include the -// generic termibits.h (which is included by termbits.h on sparc). -#include -#else #include -#endif #ifndef PTRACE_GETREGS #define PTRACE_GETREGS 0xc @@ -544,7 +537,7 @@ ccflags="$@" $2 ~ /^LO_(KEY|NAME)_SIZE$/ || $2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ || $2 == "LOOP_CONFIGURE" || - $2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ || + $2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|MLOCK|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ || $2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ || $2 ~ /^NFC_.*_(MAX)?SIZE$/ || $2 ~ /^PTP_/ || diff --git a/vendor/golang.org/x/sys/unix/syscall.go b/vendor/golang.org/x/sys/unix/syscall.go index 5ea74da..8f27e7e 100644 --- a/vendor/golang.org/x/sys/unix/syscall.go +++ b/vendor/golang.org/x/sys/unix/syscall.go @@ -76,7 +76,7 @@ func BytePtrToString(p *byte) string { // Find NUL terminator. n := 0 for ptr := unsafe.Pointer(p); *(*byte)(ptr) != 0; n++ { - ptr = unsafe.Pointer(uintptr(ptr) + 1) + ptr = unsafe.Add(ptr, 1) } return string(unsafe.Slice(p, n)) diff --git a/vendor/golang.org/x/sys/unix/syscall_bsd.go b/vendor/golang.org/x/sys/unix/syscall_bsd.go index a00c3e5..035c2cd 100644 --- a/vendor/golang.org/x/sys/unix/syscall_bsd.go +++ b/vendor/golang.org/x/sys/unix/syscall_bsd.go @@ -188,7 +188,7 @@ func (sa *SockaddrUnix) sockaddr() (unsafe.Pointer, _Socklen, error) { } sa.raw.Len = byte(3 + n) // 2 for Family, Len; 1 for NUL sa.raw.Family = AF_UNIX - for i := 0; i < n; i++ { + for i := range n { sa.raw.Path[i] = int8(name[i]) } return unsafe.Pointer(&sa.raw), _Socklen(sa.raw.Len), nil diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go index 21e2bfa..6926057 100644 --- a/vendor/golang.org/x/sys/unix/syscall_linux.go +++ b/vendor/golang.org/x/sys/unix/syscall_linux.go @@ -2363,7 +2363,7 @@ func (fh *FileHandle) Bytes() []byte { if n == 0 { return nil } - return unsafe.Slice((*byte)(unsafe.Pointer(uintptr(unsafe.Pointer(&fh.fileHandle.Type))+4)), n) + return unsafe.Slice((*byte)(unsafe.Add(unsafe.Pointer(&fh.fileHandle.Type), 4)), n) } // NameToHandleAt wraps the name_to_handle_at system call; it obtains diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux.go b/vendor/golang.org/x/sys/unix/zerrors_linux.go index 5bb51d7..45feb12 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go @@ -2048,6 +2048,7 @@ const ( MINIX3_SUPER_MAGIC = 0x4d5a MINIX_SUPER_MAGIC = 0x137f MINIX_SUPER_MAGIC2 = 0x138f + MLOCK_ONFAULT = 0x1 MNT_DETACH = 0x2 MNT_EXPIRE = 0x4 MNT_FORCE = 0x1 @@ -3862,6 +3863,7 @@ const ( TIOCPKT_NOSTOP = 0x10 TIOCPKT_START = 0x8 TIOCPKT_STOP = 0x4 + TIOCSER_TEMT = 0x1 TIPC_ADDR_ID = 0x3 TIPC_ADDR_MCAST = 0x1 TIPC_ADDR_NAME = 0x2 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go index c0a8ea1..6f74d4a 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go @@ -483,7 +483,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go index ff927c8..36c1f0b 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go @@ -484,7 +484,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go index 55294ed..c5512db 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go @@ -489,7 +489,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go index 5dac54c..4dabfae 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go @@ -483,7 +483,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go index 46ac1fc..ea97930 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go @@ -476,7 +476,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go index b55483e..0826a92 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go @@ -481,7 +481,6 @@ const ( TIOCSERGWILD = 0x5489 TIOCSERSETMULTI = 0x5490 TIOCSERSWILD = 0x548a - TIOCSER_TEMT = 0x1 TIOCSETD = 0x7401 TIOCSETN = 0x740a TIOCSETP = 0x7409 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go index 71890c9..139deed 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go @@ -481,7 +481,6 @@ const ( TIOCSERGWILD = 0x5489 TIOCSERSETMULTI = 0x5490 TIOCSERSWILD = 0x548a - TIOCSER_TEMT = 0x1 TIOCSETD = 0x7401 TIOCSETN = 0x740a TIOCSETP = 0x7409 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go index a78b6cc..b8018af 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go @@ -481,7 +481,6 @@ const ( TIOCSERGWILD = 0x5489 TIOCSERSETMULTI = 0x5490 TIOCSERSWILD = 0x548a - TIOCSER_TEMT = 0x1 TIOCSETD = 0x7401 TIOCSETN = 0x740a TIOCSETP = 0x7409 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go index d0e38ca..deb5c2e 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go @@ -481,7 +481,6 @@ const ( TIOCSERGWILD = 0x5489 TIOCSERSETMULTI = 0x5490 TIOCSERSWILD = 0x548a - TIOCSER_TEMT = 0x1 TIOCSETD = 0x7401 TIOCSETN = 0x740a TIOCSETP = 0x7409 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go index c883e14..0603bf3 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go @@ -535,7 +535,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETC = 0x80067411 TIOCSETD = 0x5423 TIOCSETN = 0x8006740a diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go index 1834273..5fa8a5d 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go @@ -539,7 +539,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETC = 0x80067411 TIOCSETD = 0x5423 TIOCSETN = 0x8006740a diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go index 39945dd..2733e99 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go @@ -539,7 +539,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETC = 0x80067411 TIOCSETD = 0x5423 TIOCSETN = 0x8006740a diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go index bc0f372..1470172 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go @@ -486,7 +486,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go index 6e87bd6..1871579 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go @@ -545,7 +545,6 @@ const ( TIOCSERGWILD = 0x5454 TIOCSERSETMULTI = 0x545b TIOCSERSWILD = 0x5455 - TIOCSER_TEMT = 0x1 TIOCSETD = 0x5423 TIOCSIG = 0x40045436 TIOCSISO7816 = 0xc0285443 diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go index 7e2b2e8..10881cf 100644 --- a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go +++ b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go @@ -14,21 +14,21 @@ const ( ASI_LEON_DFLUSH = 0x11 ASI_LEON_IFLUSH = 0x10 ASI_LEON_MMUFLUSH = 0x18 - B1000000 = 0x1008 + B1000000 = 0x100c B115200 = 0x1002 - B1152000 = 0x1009 - B1500000 = 0x100a - B2000000 = 0x100b + B1152000 = 0x100d + B1500000 = 0x100e + B153600 = 0x1006 + B2000000 = 0x100f B230400 = 0x1003 - B2500000 = 0x100c - B3000000 = 0x100d - B3500000 = 0x100e - B4000000 = 0x100f + B307200 = 0x1007 B460800 = 0x1004 - B500000 = 0x1005 + B500000 = 0x100a B57600 = 0x1001 - B576000 = 0x1006 - B921600 = 0x1007 + B576000 = 0x100b + B614400 = 0x1008 + B76800 = 0x1005 + B921600 = 0x1009 BLKALIGNOFF = 0x2000127a BLKBSZGET = 0x40081270 BLKBSZSET = 0x80081271 @@ -91,7 +91,7 @@ const ( FFDLY = 0x8000 FICLONE = 0x80049409 FICLONERANGE = 0x8020940d - FLUSHO = 0x1000 + FLUSHO = 0x2000 FS_IOC_ENABLE_VERITY = 0x80806685 FS_IOC_GETFLAGS = 0x40086601 FS_IOC_GET_ENCRYPTION_NONCE = 0x4010661b @@ -563,6 +563,9 @@ const ( TIOCM_CD = 0x40 TIOCM_CTS = 0x20 TIOCM_DSR = 0x100 + TIOCM_LOOP = 0x8000 + TIOCM_OUT1 = 0x2000 + TIOCM_OUT2 = 0x4000 TIOCM_RI = 0x80 TIOCM_RNG = 0x80 TIOCM_SR = 0x10 @@ -641,10 +644,11 @@ const ( UBI_IOCVOLRMBLK = 0x20004f08 UBI_IOCVOLUP = 0x80084f00 VDISCARD = 0xd + VDSUSP = 0xb VEOF = 0x4 - VEOL = 0xb - VEOL2 = 0x10 - VMIN = 0x6 + VEOL = 0x5 + VEOL2 = 0x6 + VMIN = 0x4 VREPRINT = 0xc VSTART = 0x8 VSTOP = 0x9 @@ -664,6 +668,7 @@ const ( WDIOC_KEEPALIVE = 0x40045705 WDIOC_SETOPTIONS = 0x40045704 WORDSIZE = 0x40 + WRAP = 0x20000 XCASE = 0x4 XTABS = 0x1800 _HIDIOCGRAWNAME = 0x40804804 diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux.go b/vendor/golang.org/x/sys/unix/ztypes_linux.go index 526a0d5..538a18f 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go @@ -4264,19 +4264,29 @@ type HwTstampConfig struct { } const ( - HWTSTAMP_FILTER_NONE = 0x0 - HWTSTAMP_FILTER_ALL = 0x1 - HWTSTAMP_FILTER_SOME = 0x2 - HWTSTAMP_FILTER_PTP_V1_L4_EVENT = 0x3 - HWTSTAMP_FILTER_PTP_V2_L4_EVENT = 0x6 - HWTSTAMP_FILTER_PTP_V2_L2_EVENT = 0x9 - HWTSTAMP_FILTER_PTP_V2_EVENT = 0xc + HWTSTAMP_FILTER_NONE = 0x0 + HWTSTAMP_FILTER_ALL = 0x1 + HWTSTAMP_FILTER_SOME = 0x2 + HWTSTAMP_FILTER_PTP_V1_L4_EVENT = 0x3 + HWTSTAMP_FILTER_PTP_V1_L4_SYNC = 0x4 + HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ = 0x5 + HWTSTAMP_FILTER_PTP_V2_L4_EVENT = 0x6 + HWTSTAMP_FILTER_PTP_V2_L4_SYNC = 0x7 + HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ = 0x8 + HWTSTAMP_FILTER_PTP_V2_L2_EVENT = 0x9 + HWTSTAMP_FILTER_PTP_V2_L2_SYNC = 0xa + HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ = 0xb + HWTSTAMP_FILTER_PTP_V2_EVENT = 0xc + HWTSTAMP_FILTER_PTP_V2_SYNC = 0xd + HWTSTAMP_FILTER_PTP_V2_DELAY_REQ = 0xe + HWTSTAMP_FILTER_NTP_ALL = 0xf ) const ( HWTSTAMP_TX_OFF = 0x0 HWTSTAMP_TX_ON = 0x1 HWTSTAMP_TX_ONESTEP_SYNC = 0x2 + HWTSTAMP_TX_ONESTEP_P2P = 0x3 ) type ( @@ -4541,6 +4551,48 @@ const ( LANDLOCK_RULE_PATH_BENEATH = 0x1 ) +const ( + PIDFD_SIGNAL_THREAD = 0x1 + PIDFD_SIGNAL_THREAD_GROUP = 0x2 + PIDFD_SIGNAL_PROCESS_GROUP = 0x4 + PIDFD_SELF_THREAD = -0x2710 + PIDFD_SELF_THREAD_GROUP = -0x2711 + PIDFD_SELF = -0x2710 + PIDFD_SELF_PROCESS = -0x2711 + PIDFD_INFO_PID = 0x1 + PIDFD_INFO_CREDS = 0x2 + PIDFD_INFO_CGROUPID = 0x4 + PIDFD_INFO_EXIT = 0x8 + PIDFD_INFO_COREDUMP = 0x10 + PIDFD_COREDUMPED = 0x1 + PIDFD_COREDUMP_SKIP = 0x2 + PIDFD_COREDUMP_USER = 0x4 + PIDFD_COREDUMP_ROOT = 0x8 + PIDFD_INFO_SIZE_VER0 = 0x40 + PIDFD_GET_INFO = 0xc048ff0b +) + +const SizeofPidfdInfo = 0x48 + +type PidfdInfo struct { + Mask uint64 + Cgroupid uint64 + Pid uint32 + Tgid uint32 + Ppid uint32 + Ruid uint32 + Rgid uint32 + Euid uint32 + Egid uint32 + Suid uint32 + Sgid uint32 + Fsuid uint32 + Fsgid uint32 + Exit_code int32 + Coredump_mask uint32 + _ uint32 +} + const ( IPC_CREAT = 0x200 IPC_EXCL = 0x400 @@ -6473,3 +6525,23 @@ type GPIOV2LineEvent struct { Line_seqno uint32 _ [6]uint32 } + +const ( + IPMI_MAX_ADDR_SIZE = 0x20 + IPMI_SYSTEM_INTERFACE_ADDR_TYPE = 0xc + IPMI_BMC_CHANNEL = 0xf + IPMI_RESPONSE_RECV_TYPE = 0x1 +) + +type IPMISystemInterfaceAddr struct { + Type int32 + Channel int16 + Lun uint8 + _ [1]byte +} +type IPMIMsg struct { + Netfn uint8 + Cmd uint8 + Len uint16 + Data *uint8 +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go index aede1de..38658a3 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go @@ -680,7 +680,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -715,3 +726,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8014690d + IPMICTL_RECEIVE_MSG = 0xc018690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int32 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int32 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go index bb3bc4d..267ffe0 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go @@ -697,7 +697,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -729,3 +740,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go index 1fdf4c5..ec459d5 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go @@ -674,7 +674,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -709,3 +720,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8014690d + IPMICTL_RECEIVE_MSG = 0xc018690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int32 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int32 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go index 063e6f0..fa45ab7 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go @@ -676,7 +676,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -708,3 +719,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go index 9cf836c..3da72cc 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go @@ -677,7 +677,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -709,3 +720,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go index 1d222fc..78f8c6d 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go @@ -680,7 +680,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x80 + PIDFD_NONBLOCK = 0x80 + PIDFD_THREAD = 0x400 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -714,3 +725,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4014690d + IPMICTL_RECEIVE_MSG = 0xc018690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int32 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int32 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go index 912cc4a..bbd4c6c 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go @@ -679,7 +679,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x80 + PIDFD_NONBLOCK = 0x80 + PIDFD_THREAD = 0x400 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -711,3 +722,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go index 1e358ef..644d31d 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go @@ -679,7 +679,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x80 + PIDFD_NONBLOCK = 0x80 + PIDFD_THREAD = 0x400 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -711,3 +722,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go index df59f32..a976f62 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go @@ -680,7 +680,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x80 + PIDFD_NONBLOCK = 0x80 + PIDFD_THREAD = 0x400 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -714,3 +725,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4014690d + IPMICTL_RECEIVE_MSG = 0xc018690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int32 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int32 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go index 29355aa..4632469 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go @@ -686,7 +686,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -722,3 +733,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4014690d + IPMICTL_RECEIVE_MSG = 0xc018690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int32 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int32 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go index c6083a1..cbc3039 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go @@ -686,7 +686,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -717,3 +728,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go index 6321cc7..b47f7b4 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go @@ -686,7 +686,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -717,3 +728,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go index b44f402..cb16add 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go @@ -704,7 +704,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -796,3 +807,22 @@ const ( const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go index b22c795..a57ab8f 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go @@ -700,7 +700,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x800 + PIDFD_NONBLOCK = 0x800 + PIDFD_THREAD = 0x80 + PIDFD_GET_CGROUP_NAMESPACE = 0xff01 + PIDFD_GET_IPC_NAMESPACE = 0xff02 + PIDFD_GET_MNT_NAMESPACE = 0xff03 + PIDFD_GET_NET_NAMESPACE = 0xff04 + PIDFD_GET_PID_NAMESPACE = 0xff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0xff06 + PIDFD_GET_TIME_NAMESPACE = 0xff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0xff08 + PIDFD_GET_USER_NAMESPACE = 0xff09 + PIDFD_GET_UTS_NAMESPACE = 0xff0a ) type SysvIpcPerm struct { @@ -731,3 +742,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x8044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x8028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go index 0b18075..bf99635 100644 --- a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go +++ b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go @@ -681,7 +681,18 @@ const ( ) const ( - PIDFD_NONBLOCK = 0x4000 + PIDFD_NONBLOCK = 0x4000 + PIDFD_THREAD = 0x800 + PIDFD_GET_CGROUP_NAMESPACE = 0x2000ff01 + PIDFD_GET_IPC_NAMESPACE = 0x2000ff02 + PIDFD_GET_MNT_NAMESPACE = 0x2000ff03 + PIDFD_GET_NET_NAMESPACE = 0x2000ff04 + PIDFD_GET_PID_NAMESPACE = 0x2000ff05 + PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE = 0x2000ff06 + PIDFD_GET_TIME_NAMESPACE = 0x2000ff07 + PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE = 0x2000ff08 + PIDFD_GET_USER_NAMESPACE = 0x2000ff09 + PIDFD_GET_UTS_NAMESPACE = 0x2000ff0a ) type SysvIpcPerm struct { @@ -712,3 +723,22 @@ type SysvShmDesc struct { const ( GPIO_GET_CHIPINFO_IOCTL = 0x4044b401 ) + +const ( + IPMICTL_SEND_COMMAND = 0x4028690d + IPMICTL_RECEIVE_MSG = 0xc030690c +) + +type IPMIReq struct { + Addr *uint8 + Len uint32 + Msgid int64 + Msg IPMIMsg +} +type IPMIRecv struct { + Recv_type int32 + Addr *uint8 + Addr_len uint32 + Msgid int64 + Msg IPMIMsg +} diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go index 75a50b3..643737d 100644 --- a/vendor/golang.org/x/sys/windows/types_windows.go +++ b/vendor/golang.org/x/sys/windows/types_windows.go @@ -1065,6 +1065,7 @@ const ( SO_BROADCAST = 32 SO_LINGER = 128 SO_RCVBUF = 0x1002 + SO_SNDTIMEO = 0x1005 SO_RCVTIMEO = 0x1006 SO_SNDBUF = 0x1001 SO_UPDATE_ACCEPT_CONTEXT = 0x700b diff --git a/vendor/modules.txt b/vendor/modules.txt index 3ed7ea1..ba5a6f5 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -32,14 +32,14 @@ github.com/vishvananda/netlink/nl # github.com/vishvananda/netns v0.0.5 ## explicit; go 1.17 github.com/vishvananda/netns -# golang.org/x/net v0.58.0 -## explicit; go 1.25.0 +# golang.org/x/net v0.60.0 +## explicit; go 1.26.0 golang.org/x/net/bpf # golang.org/x/sync v0.22.0 ## explicit; go 1.25.0 golang.org/x/sync/errgroup -# golang.org/x/sys v0.47.0 -## explicit; go 1.25.0 +# golang.org/x/sys v0.48.0 +## explicit; go 1.26.0 golang.org/x/sys/unix golang.org/x/sys/windows # gopkg.in/yaml.v3 v3.0.1 From 1c08bfeb95ddbbd01958b888a12323a2a57d4aab Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:32:44 +0800 Subject: [PATCH 2/5] fix: apply precise artifact security updates and gates --- .github/workflows/security-release-gate.yml | 4 +- Dockerfile.dapper | 9 +++- Makefile | 2 +- README.md | 4 +- package/Dockerfile | 5 ++ scripts/package | 4 +- security/install-ubuntu-security-updates.sh | 51 +++++++++++++++++++++ security/ubuntu-security-packages.lock | 36 +++++++++++++++ tests/test_release_history_contract.py | 4 ++ 9 files changed, 112 insertions(+), 7 deletions(-) create mode 100644 security/install-ubuntu-security-updates.sh create mode 100644 security/ubuntu-security-packages.lock diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 3903fa5..f206bc5 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -228,7 +228,7 @@ jobs: --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \ --format cyclonedx --output /evidence/dapper-sbom.cdx.json /scan - dapper_purl='pkg:deb/ubuntu/linux-libc-dev@7.0.0-29.29?arch=amd64&distro=ubuntu-26.04' + dapper_purl='pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04' jq -r ' .Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" or .Severity == "HIGH") @@ -256,7 +256,7 @@ jobs: echo 'Unreviewed non-header vulnerability in Dapper tooling' >&2 exit 1 fi - grep -Fx $'linux-libc-dev:amd64\t7.0.0-29.29' \ + grep -Fx $'linux-libc-dev:amd64\t7.0.0-38.38' \ evidence/dapper-ubuntu-apt-packages.tsv >/dev/null if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' \ evidence/dapper-ubuntu-apt-packages.tsv; then diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 6cf4310..85d627d 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -1,6 +1,9 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock +COPY security/install-ubuntu-security-updates.sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh +COPY security/ubuntu-security-packages.lock /usr/share/pasturestack/ubuntu-security-packages.lock + ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb @@ -8,9 +11,9 @@ ADD --checksum=sha256:1b582b937a1f7a8f987da9e1bbfcc806faea714267631ce0fbbd352c92 ARG DAPPER_HOST_ARCH=amd64 ARG GO_VERSION=1.27.3 -ARG DOCKER_VERSION=29.8.0 +ARG DOCKER_VERSION=29.9.2 ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 -ARG DOCKER_LINUX_AMD64_SHA256=cc21815cf1e2efed867dc9c8b96b46ffed8ea176ffab32b0aacb54726ded8f25 +ARG DOCKER_LINUX_AMD64_SHA256=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb ENV DEBIAN_FRONTEND=noninteractive ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} @@ -48,6 +51,8 @@ RUN set -eux; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ + sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ + dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ { printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; } \ > /licenses/IPSEC-VXLAN-OVERLAY-DAPPER-UBUNTU-APT-PACKAGES.tsv; \ rm -rf /var/lib/apt/lists/* && \ diff --git a/Makefile b/Makefile index 1fa9d82..02f95f5 100644 --- a/Makefile +++ b/Makefile @@ -3,7 +3,7 @@ TARGETS := $(shell ls scripts) DAPPER_IMAGE ?= pasturestack-overlay-network-dapper:ubuntu26 DAPPER_HOST_ARCH ?= amd64 -DOCKER_VERSION ?= 29.8.0 +DOCKER_VERSION ?= 29.9.2 DOCKER_BUILD_NETWORK ?= host DAPPER_SOURCE ?= /go/src/github.com/PastureStack/ipsec-vxlan-overlay-network diff --git a/README.md b/README.md index a55eca8..0969013 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # PastureStack IPsec/VXLAN Overlay Network -Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package without advancing the remaining package snapshot. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts. +Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package with only officially fixed, already-installed packages advanced by the reviewed security overlay. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts. This repository provides the privileged network data plane used by PastureStack. It contains IPsec and VXLAN overlay processes, connectivity checks, CNI runtime assets, and an audit-only topology planner. @@ -205,3 +205,5 @@ bridge firewall must accept mark `0x1068/0x1068`. See The official upstream history and original copyright notices are preserved. See [ORIGIN.md](ORIGIN.md), [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md), and [LICENSE](LICENSE) before redistributing this source or its image. The repository source is licensed under Apache License 2.0. The runtime image also contains separately licensed operating-system packages, including strongSwan under GPL-2.0-or-later with the OpenSSL exception. Those components are not relicensed by PastureStack. + +Security micro-updates are constrained by `security/ubuntu-security-packages.lock` to the signed Ubuntu 26.04 snapshot of 2026-10-23; the general package snapshot remains unchanged. Builds record the resulting package versions in `/usr/share/pasturestack/ubuntu-security-packages.tsv`. Existing runtime and firewall contracts are unchanged. diff --git a/package/Dockerfile b/package/Dockerfile index 2da3301..b93a93f 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,6 +1,9 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock +COPY security/install-ubuntu-security-updates.sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh +COPY security/ubuntu-security-packages.lock /usr/share/pasturestack/ubuntu-security-packages.lock + ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb @@ -62,6 +65,8 @@ RUN set -eux; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ + sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ + dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ mkdir -p /licenses/strongswan-source; \ cd /licenses/strongswan-source; \ apt-get source --download-only strongswan="${UBUNTU_APT_STRONGSWAN_VERSION}"; \ diff --git a/scripts/package b/scripts/package index 732affb..87e0578 100755 --- a/scripts/package +++ b/scripts/package @@ -5,7 +5,7 @@ source "$(dirname "$0")/version" cd "$(dirname "$0")/.." cleanup_package_staging() { - rm -f package/ubuntu-apt.lock + rm -f package/ubuntu-apt.lock package/security/install-ubuntu-security-updates.sh package/security/ubuntu-security-packages.lock } trap cleanup_package_staging EXIT @@ -80,6 +80,8 @@ stage_binary mount-propagation "${MOUNT_PROPAGATION_BINARY:-}" "$MOUNT_PROPAGATI rm -rf package/licenses mkdir -p package/licenses/source package/licenses/vendor install -m 0644 ubuntu-apt.lock package/ubuntu-apt.lock +mkdir -p package/security +install -m 0644 security/install-ubuntu-security-updates.sh security/ubuntu-security-packages.lock package/security/ install -m 0644 LICENSE package/licenses/source/LICENSE for license in LICENSES/*; do install -m 0644 "$license" "package/licenses/source/$(basename "$license")" diff --git a/security/install-ubuntu-security-updates.sh b/security/install-ubuntu-security-updates.sh new file mode 100644 index 0000000..054c893 --- /dev/null +++ b/security/install-ubuntu-security-updates.sh @@ -0,0 +1,51 @@ +#!/bin/sh +# Same-series official micro-updates. Never install a package just for a scan. +set -eu +test "$#" -eq 2 || { echo 'usage: security-updates LOCK TRUSTED_CA_BUNDLE' >&2; exit 2; } +lock=$1 +trusted_ca=$2 +. /etc/os-release +test "$ID:$VERSION_ID" = ubuntu:26.04 +test -s "$lock" +test -s "$trusted_ca" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT HUP INT TERM +dpkg-query -W -f='${binary:Package}\t${db:Status-Status}\n' | LC_ALL=C sort > "$tmp/before" +set -- +while IFS= read -r entry || test -n "$entry"; do + case "$entry" in ''|'#'*) continue;; esac + case "$entry" in *[!a-zA-Z0-9.:+~=_-]*) echo "Invalid lock entry" >&2; exit 1;; esac + package=${entry%%=*} + version=${entry#*=} + test "$package" != "$version" + status=$(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null || true) + test "$status" = installed || continue + installed=$(dpkg-query -W -f='${Version}' "$package") + # A newer base may already contain the fix; never downgrade it. + dpkg --compare-versions "$installed" ge "$version" && continue + set -- "$@" "$entry" +done < "$lock" +if test "$#" -gt 0; then + printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/20261023T000000Z\nSuites: resolute-updates resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' > "$tmp/security.sources" + apt_security() { + apt-get -o Dir::Etc::sourcelist="$tmp/security.sources" \ + -o Dir::Etc::sourceparts=- -o Acquire::https::CaInfo="$trusted_ca" \ + -o Acquire::https::Verify-Peer=true -o Acquire::https::Verify-Host=true \ + -o Acquire::AllowInsecureRepositories=false -o APT::Get::AllowUnauthenticated=false \ + -o Acquire::Retries=5 "$@" + } + apt_security update + DEBIAN_FRONTEND=noninteractive apt_security install -y --only-upgrade --no-install-recommends --no-remove "$@" +fi +while IFS= read -r entry || test -n "$entry"; do + case "$entry" in ''|'#'*) continue;; esac + package=${entry%%=*} + version=${entry#*=} + status=$(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null || true) + test "$status" = installed || continue + dpkg --compare-versions "$(dpkg-query -W -f='${Version}' "$package")" ge "$version" +done < "$lock" +dpkg-query -W -f='${binary:Package}\t${db:Status-Status}\n' | LC_ALL=C sort > "$tmp/after" +# A security micro-update must not add/remove packages or change installed status. +cmp "$tmp/before" "$tmp/after" +printf 'UBUNTU_SECURITY_MICRO_UPDATES_OK\n' diff --git a/security/ubuntu-security-packages.lock b/security/ubuntu-security-packages.lock new file mode 100644 index 0000000..1dfca4b --- /dev/null +++ b/security/ubuntu-security-packages.lock @@ -0,0 +1,36 @@ +# Official Ubuntu 26.04 security/updates snapshot: 20261023T000000Z +# Existing packages only; ABI series and unrelated packages are preserved. +bsdutils=1:2.41.3-3ubuntu2.2 +curl=8.18.0-1ubuntu2.8 +diffutils=1:3.12-1ubuntu0.1 +gnu-coreutils=9.7-3ubuntu2.1 +gpgv=2.4.8-4ubuntu3.1 +libattr1=1:2.5.2-4ubuntu0.1 +libblkid1=2.41.3-3ubuntu2.2 +libbz2-1.0=1.0.8-6ubuntu0.1 +libc-bin=2.43-2ubuntu2.4 +libc-gconv-modules-extra=2.43-2ubuntu2.4 +libc6=2.43-2ubuntu2.4 +libc6-dev=2.43-2ubuntu2.4 +libcurl4t64=8.18.0-1ubuntu2.8 +libgcrypt20=1.12.0-2ubuntu1.1 +libmount1=2.41.3-3ubuntu2.2 +libperl5.40=5.40.1-7ubuntu0.3 +libsmartcols1=2.41.3-3ubuntu2.2 +libssh2-1t64=1.11.1-1ubuntu0.26.04.4 +libssl3t64=3.5.5-1ubuntu3.7 +libuuid1=2.41.3-3ubuntu2.2 +linux-libc-dev=7.0.0-38.38 +login=1:4.16.0-2+really2.41.3-3ubuntu2.2 +mount=2.41.3-3ubuntu2.2 +openssl=3.5.5-1ubuntu3.7 +openssl-provider-legacy=3.5.5-1ubuntu3.7 +perl=5.40.1-7ubuntu0.3 +perl-base=5.40.1-7ubuntu0.3 +perl-modules-5.40=5.40.1-7ubuntu0.3 +util-linux=2.41.3-3ubuntu2.2 +zlib1g=1:1.3.dfsg+really1.3.1-1ubuntu3.2 +curl=8.18.0-1ubuntu2.8 +libcurl4t64=8.18.0-1ubuntu2.8 +libssh2-1t64=1.11.1-1ubuntu0.26.04.4 +libcurl3t64-gnutls=8.18.0-1ubuntu2.8 diff --git a/tests/test_release_history_contract.py b/tests/test_release_history_contract.py index 71bd053..c73a4ee 100644 --- a/tests/test_release_history_contract.py +++ b/tests/test_release_history_contract.py @@ -48,6 +48,10 @@ def setUp(self): self.addCleanup(self.temporary.cleanup) self.directory = Path(self.temporary.name) self.env = os.environ.copy() + # The fixture owns a separate repository, even when the caller uses a + # linked worktree or exports Git location overrides (for example WSL). + for name in ("GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR"): + self.env.pop(name, None) self.env.update({ "GIT_CONFIG_NOSYSTEM": "1", "GIT_CONFIG_GLOBAL": os.devnull, From 3d801b04f128a4e11822e21494e6b6859adb3067 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:37:12 +0800 Subject: [PATCH 3/5] fix: archive source before applying security indexes --- package/Dockerfile | 4 ++-- tests/test_openssl_package_contract.py | 7 +++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/package/Dockerfile b/package/Dockerfile index b93a93f..2c3683a 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -65,8 +65,6 @@ RUN set -eux; \ for package in openssl libssl3t64 openssl-provider-legacy; do \ test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \ done; \ - sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ - dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ mkdir -p /licenses/strongswan-source; \ cd /licenses/strongswan-source; \ apt-get source --download-only strongswan="${UBUNTU_APT_STRONGSWAN_VERSION}"; \ @@ -77,6 +75,8 @@ RUN set -eux; \ for package in strongswan-charon strongswan-swanctl libstrongswan-standard-plugins libstrongswan-extra-plugins; do \ cp "/usr/share/doc/${package}/copyright" "/licenses/ubuntu-packages/${package}-copyright"; \ done; \ + sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ + dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ { printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; } \ > /licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv; \ rm -rf /var/lib/apt/lists/* /tmp/ca-certificates.deb /tmp/ca-bootstrap \ diff --git a/tests/test_openssl_package_contract.py b/tests/test_openssl_package_contract.py index af2dd57..537be35 100644 --- a/tests/test_openssl_package_contract.py +++ b/tests/test_openssl_package_contract.py @@ -100,6 +100,13 @@ def test_formal_security_gate_executes_contract(self): self.assertLess(workflow.index("python3 tests/test_openssl_package_contract.py"), workflow.index("name: Package the candidate runtime image")) + def test_source_archives_precede_security_index_overlay(self): + source = self.sources["package/Dockerfile"] + overlay = source.index(" sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh") + self.assertLess(source.index("apt-get source --download-only strongswan="), overlay) + self.assertLess(source.index('echo "${STRONGSWAN_DSC_SHA256}'), overlay) + self.assertLess(overlay, source.index("/licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv")) + if __name__ == "__main__": unittest.main() From f467587c1980b7be5ea498c9797dc160631bd70f Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:42:20 +0800 Subject: [PATCH 4/5] fix: align Docker CLI readback with security-patched version --- .github/workflows/security-release-gate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index f206bc5..7ec2711 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -138,7 +138,7 @@ jobs: /licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv \ > evidence/runtime-ubuntu-apt-packages.tsv docker run --rm --entrypoint docker "$dapper_image" --version \ - | grep -F 'Docker version 29.8.0' \ + | grep -F 'Docker version 29.9.2' \ > evidence/docker-cli-version.txt printf 'DAPPER_IMAGE=%s\n' "$dapper_image" >> "$GITHUB_ENV" From 635c072b1ece8935a2a851d4a88a513e8853896a Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 21:22:04 +0800 Subject: [PATCH 5/5] fix: pin verified companion releases and isolate security indexes --- README.md | 13 +++++++++++++ THIRD_PARTY_NOTICES.md | 8 ++++---- package/Dockerfile | 1 + scripts/package | 16 ++++++++-------- security/install-ubuntu-security-updates.sh | 6 +++++- security/ubuntu-security-packages.lock | 2 ++ tests/test_openssl_package_contract.py | 9 +++++++++ 7 files changed, 42 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 0969013..ed20c77 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,19 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Release status +Candidate `v0.14.39` refreshes the compiler, effective Go dependencies, +official Ubuntu security packages, and checksum-pinned companion binaries. +The companions are metadata CNI IPAM `v0.2.8`, host-local CNI IPAM `v0.1.6`, +flat CNI IPAM `v0.1.6`, mount propagation `v1.0.12`, and per-host subnet +`v0.2.5`. The last is an official Go 1.27.3 rebuild whose Go implementation +and tests are byte-identical to the historical `v0.2.8` prerelease companion; +the numeric tag difference does not remove a runtime feature. The security +APT overlay uses private index/cache paths and verifies that the original +strongSwan source index remains readable. Networking, CLI/API, CNI, and +firewall ownership contracts are unchanged. Candidate inputs are not proof +of publication; require the final release's same-source checks, scan results, +and immutable image digest before deployment. + The prior `v0.14.27` source and image were published with manifest digest `sha256:917c4369ee22808c100dd890d17296fe341e0dda4b2ad2923050f4fca5c22386` and release SBOM/provenance attestations. On an isolated Ubuntu 26.04.1 / Docker 29.8 VM, that diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 075a0c7..65af89d 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -8,11 +8,11 @@ PastureStack does not relicense third-party work. Copyright, license, and attrib | CNI reference plugins | 0.3.0 | [containernetworking/plugins](https://github.com/containernetworking/plugins) | Apache-2.0 | | CNI bridge compatibility binary | 0.7.2 | [rancher/rancher-cni-bridge](https://github.com/rancher/rancher-cni-bridge) | Apache-2.0 | | Weave router helper | r-v0.0.4 | [rancher-archives/weave](https://github.com/rancher-archives/weave) | Apache-2.0 | -| Metadata CNI IPAM | 0.2.7 | [PastureStack/metadata-cni-ipam](https://github.com/PastureStack/metadata-cni-ipam) | Apache-2.0 | -| Host-local CNI IPAM | 0.1.4 | [PastureStack/host-local-cni-ipam](https://github.com/PastureStack/host-local-cni-ipam) | Apache-2.0 | -| Flat CNI IPAM | 0.1.4 | [PastureStack/flat-cni-ipam](https://github.com/PastureStack/flat-cni-ipam) | Apache-2.0 | +| Metadata CNI IPAM | 0.2.8 | [PastureStack/metadata-cni-ipam](https://github.com/PastureStack/metadata-cni-ipam) | Apache-2.0 | +| Host-local CNI IPAM | 0.1.6 | [PastureStack/host-local-cni-ipam](https://github.com/PastureStack/host-local-cni-ipam) | Apache-2.0 | +| Flat CNI IPAM | 0.1.6 | [PastureStack/flat-cni-ipam](https://github.com/PastureStack/flat-cni-ipam) | Apache-2.0 | | Per-host subnet | 0.2.5 | [PastureStack/per-host-subnet](https://github.com/PastureStack/per-host-subnet) | Apache-2.0 | -| Mount propagation | 1.0.11 | [PastureStack/mount-propagation](https://github.com/PastureStack/mount-propagation) | Apache-2.0 | +| Mount propagation | 1.0.12 | [PastureStack/mount-propagation](https://github.com/PastureStack/mount-propagation) | Apache-2.0 | The reachable Go dependency graph is declared in [`go.mod`](go.mod), checksum-bound by [`go.sum`](go.sum), and materialized in the standard module-aware `vendor` tree. Unreachable historical test-server dependencies are not shipped. diff --git a/package/Dockerfile b/package/Dockerfile index 2c3683a..20f9693 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -76,6 +76,7 @@ RUN set -eux; \ cp "/usr/share/doc/${package}/copyright" "/licenses/ubuntu-packages/${package}-copyright"; \ done; \ sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \ + apt-cache showsrc strongswan | grep -Fx "Version: ${UBUNTU_APT_STRONGSWAN_VERSION}"; \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ { printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; } \ > /licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv; \ diff --git a/scripts/package b/scripts/package index 87e0578..e9759a0 100755 --- a/scripts/package +++ b/scripts/package @@ -9,16 +9,16 @@ cleanup_package_staging() { } trap cleanup_package_staging EXIT -METADATA_CNI_IPAM_URL=${METADATA_CNI_IPAM_URL:-https://github.com/PastureStack/metadata-cni-ipam/releases/download/v0.2.7/metadata-cni-ipam-0.2.7-linux-amd64} -METADATA_CNI_IPAM_SHA256=${METADATA_CNI_IPAM_SHA256:-acde77de17d117f32dd2bbc80dae212c7209165f8101299eaea10561cf058d76} +METADATA_CNI_IPAM_URL=${METADATA_CNI_IPAM_URL:-https://github.com/PastureStack/metadata-cni-ipam/releases/download/v0.2.8/metadata-cni-ipam-0.2.8-linux-amd64} +METADATA_CNI_IPAM_SHA256=${METADATA_CNI_IPAM_SHA256:-9e9d0cd9bd5abe316d6580d6d01e022fa6b13c2dabfcb43a90501b45d4147869} PER_HOST_SUBNET_URL=${PER_HOST_SUBNET_URL:-https://github.com/PastureStack/per-host-subnet/releases/download/v0.2.5/per-host-subnet-v0.2.5-linux-amd64} PER_HOST_SUBNET_SHA256=${PER_HOST_SUBNET_SHA256:-cf58d91c9856ed76da7a50206c7e2adb2efb325b3419ab205117e75214123406} -HOST_LOCAL_CNI_IPAM_URL=${HOST_LOCAL_CNI_IPAM_URL:-https://github.com/PastureStack/host-local-cni-ipam/releases/download/v0.1.4/host-local-cni-ipam-0.1.4-linux-amd64} -HOST_LOCAL_CNI_IPAM_SHA256=${HOST_LOCAL_CNI_IPAM_SHA256:-9bb79b9f269663715f44aea898854df0e0e319a3ba35e4d52db5477cde026e3e} -FLAT_CNI_IPAM_URL=${FLAT_CNI_IPAM_URL:-https://github.com/PastureStack/flat-cni-ipam/releases/download/v0.1.5/flat-cni-ipam-v0.1.5-linux-amd64} -FLAT_CNI_IPAM_SHA256=${FLAT_CNI_IPAM_SHA256:-c0044889348313d84d631e36121068fc5072fb423e25fcd795e6b34424f38de7} -MOUNT_PROPAGATION_URL=${MOUNT_PROPAGATION_URL:-https://github.com/PastureStack/mount-propagation/releases/download/v1.0.11/mount-propagation-v1.0.11-linux-amd64} -MOUNT_PROPAGATION_SHA256=${MOUNT_PROPAGATION_SHA256:-800bbc2d74c318ccc62d2c3c76846ee1fe307c21daf558c7edcf5de25e393a4b} +HOST_LOCAL_CNI_IPAM_URL=${HOST_LOCAL_CNI_IPAM_URL:-https://github.com/PastureStack/host-local-cni-ipam/releases/download/v0.1.6/host-local-cni-ipam-0.1.6-linux-amd64} +HOST_LOCAL_CNI_IPAM_SHA256=${HOST_LOCAL_CNI_IPAM_SHA256:-7648f7b6c7bfb643785b025e33ab0a03507d76f201ff7a0d9d95b4f89309f684} +FLAT_CNI_IPAM_URL=${FLAT_CNI_IPAM_URL:-https://github.com/PastureStack/flat-cni-ipam/releases/download/v0.1.6/flat-cni-ipam-v0.1.6-linux-amd64} +FLAT_CNI_IPAM_SHA256=${FLAT_CNI_IPAM_SHA256:-88f3eacdacd5be185de51f473fa26e72732926bb8739cd045e8c04c5d6dea98e} +MOUNT_PROPAGATION_URL=${MOUNT_PROPAGATION_URL:-https://github.com/PastureStack/mount-propagation/releases/download/v1.0.12/mount-propagation-v1.0.12-linux-amd64} +MOUNT_PROPAGATION_SHA256=${MOUNT_PROPAGATION_SHA256:-aede2dc837985c8d86e4334aaa794b88700eb60974e9425c5f97233bd95094b9} TAG=${TAG:-${VERSION}} REPO=${REPO:-ghcr.io/${IMAGE_NAMESPACE:-pasturestack}} diff --git a/security/install-ubuntu-security-updates.sh b/security/install-ubuntu-security-updates.sh index 054c893..7fd1afe 100644 --- a/security/install-ubuntu-security-updates.sh +++ b/security/install-ubuntu-security-updates.sh @@ -26,9 +26,13 @@ while IFS= read -r entry || test -n "$entry"; do set -- "$@" "$entry" done < "$lock" if test "$#" -gt 0; then + mkdir -p "$tmp/lists/partial" printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/20261023T000000Z\nSuites: resolute-updates resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' > "$tmp/security.sources" apt_security() { - apt-get -o Dir::Etc::sourcelist="$tmp/security.sources" \ + apt-get -o Dir::State::lists="$tmp/lists" \ + -o Dir::Cache::pkgcache="$tmp/pkgcache.bin" \ + -o Dir::Cache::srcpkgcache="$tmp/srcpkgcache.bin" \ + -o Dir::Etc::sourcelist="$tmp/security.sources" \ -o Dir::Etc::sourceparts=- -o Acquire::https::CaInfo="$trusted_ca" \ -o Acquire::https::Verify-Peer=true -o Acquire::https::Verify-Host=true \ -o Acquire::AllowInsecureRepositories=false -o APT::Get::AllowUnauthenticated=false \ diff --git a/security/ubuntu-security-packages.lock b/security/ubuntu-security-packages.lock index 1dfca4b..848640b 100644 --- a/security/ubuntu-security-packages.lock +++ b/security/ubuntu-security-packages.lock @@ -34,3 +34,5 @@ curl=8.18.0-1ubuntu2.8 libcurl4t64=8.18.0-1ubuntu2.8 libssh2-1t64=1.11.1-1ubuntu0.26.04.4 libcurl3t64-gnutls=8.18.0-1ubuntu2.8 +libc-dev-bin=2.43-2ubuntu2.4 +libexpat1=2.7.4-1ubuntu0.2 diff --git a/tests/test_openssl_package_contract.py b/tests/test_openssl_package_contract.py index 537be35..d374980 100644 --- a/tests/test_openssl_package_contract.py +++ b/tests/test_openssl_package_contract.py @@ -107,6 +107,15 @@ def test_source_archives_precede_security_index_overlay(self): self.assertLess(source.index('echo "${STRONGSWAN_DSC_SHA256}'), overlay) self.assertLess(overlay, source.index("/licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv")) + def test_security_indexes_are_isolated_and_original_source_remains_readable(self): + helper = (BASE / "security/install-ubuntu-security-updates.sh").read_text(encoding="utf-8") + for option in ('Dir::State::lists="$tmp/lists"', + 'Dir::Cache::pkgcache="$tmp/pkgcache.bin"', + 'Dir::Cache::srcpkgcache="$tmp/srcpkgcache.bin"'): + self.assertIn(option, helper) + self.assertIn('apt-cache showsrc strongswan | grep -Fx "Version: ${UBUNTU_APT_STRONGSWAN_VERSION}"', + self.sources["package/Dockerfile"]) + if __name__ == "__main__": unittest.main()