From bb25f6ef7dfaa91b419b715a6e77dff6e3d4c4bd Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:16:25 +0800 Subject: [PATCH] Consume qualified Brotli security backport for v0.8.22 --- .github/workflows/release.yml | 4 ++-- .github/workflows/supply-chain.yml | 6 +++--- README.md | 8 +++++--- package/Dockerfile | 4 ++-- scripts/check-migration-policy | 2 +- 5 files changed, 13 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9cbca66..ef9f702 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -102,7 +102,7 @@ jobs: exit 1 fi (cd "$release_dir"/ubuntu-backports && sha256sum --check SHA256SUMS) - bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' + bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' mkdir -p "$release_dir"/bundle-tools bundle_container=$(docker create "$bundle_image" unused) if docker cp "$bundle_container:/out/verify-consumer-evidence.py" "$release_dir"/bundle-tools/verify-consumer-evidence.py && \ @@ -118,7 +118,7 @@ jobs: python3 "$release_dir"/bundle-tools/verify-consumer-evidence.py \ --evidence-dir "$release_dir"/ubuntu-backports --sbom "$release_dir/resource-scheduler-${RELEASE_TAG#v}-image.cdx.json" \ --bundle-checksums "$release_dir"/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "$release_dir"/ubuntu-backports-validation.json + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "$release_dir"/ubuntu-backports-validation.json docker run --rm --network none -v /var/run/docker.sock:/var/run/docker.sock \ -v "$PWD/$release_dir:/release" -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" \ image --skip-db-update --offline-scan --scanners vuln,secret \ diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 535f53d..d19a62b 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 90 env: - CANDIDATE_VERSION: v0.8.21 + CANDIDATE_VERSION: v0.8.22 DAPPER_IMAGE: local/resource-scheduler-dapper:${{ github.sha }} TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 @@ -285,7 +285,7 @@ jobs: exit 1 fi (cd evidence/ubuntu-backports && sha256sum --check SHA256SUMS) - bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' + bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' mkdir -p evidence/bundle-tools bundle_container=$(docker create "$bundle_image" unused) if docker cp "$bundle_container:/out/verify-consumer-evidence.py" evidence/bundle-tools/verify-consumer-evidence.py && \ @@ -301,7 +301,7 @@ jobs: python3 evidence/bundle-tools/verify-consumer-evidence.py \ --evidence-dir evidence/ubuntu-backports --sbom evidence/runtime.cdx.json \ --bundle-checksums evidence/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > evidence/ubuntu-backports-validation.json trivy_cache="$RUNNER_TEMP/resource-scheduler-trivy-cache" docker run --rm --network none --volume /var/run/docker.sock:/var/run/docker.sock \ --volume "$PWD/evidence:/evidence" --volume "$trivy_cache:/root/.cache/trivy" \ diff --git a/README.md b/README.md index d08ccfc..76bb108 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # PastureStack Resource Scheduler -Linux runtime **`v0.8.21`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. +Linux runtime **`v0.8.22`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. + +The shared bundle includes the official Brotli decoder fix for CVE-2026-111497. The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. @@ -27,7 +29,7 @@ original severity and `under_investigation` status. The Linux image coordinate is: ```text -ghcr.io/pasturestack/resource-scheduler:v0.8.21 +ghcr.io/pasturestack/resource-scheduler:v0.8.22 ``` This image is a system component, not a standalone application. The PastureStack infrastructure catalog supplies the control-plane URL, scoped access credentials, metadata endpoint, health-check configuration, and an explicit numeric version tag. The container runs as UID/GID `10001:10001`; only the scheduler binary receives `cap_net_bind_service` so the established port `80` health contract can remain available without a root process. @@ -48,7 +50,7 @@ make validate bash scripts/check-build-downloads go list -mod=vendor ./... bash scripts/check-migration-policy -VERSION_OVERRIDE=v0.8.21 IMAGE_NAMESPACE=pasturestack make package +VERSION_OVERRIDE=v0.8.22 IMAGE_NAMESPACE=pasturestack make package ``` CI validates source and dependency locks, tests and reproducible builds, and generates short-lived security evidence. Releases are published only from an annotated, pure numeric SemVer tag that resolves to the reviewed commit. diff --git a/package/Dockerfile b/package/Dockerfile index 8ef889a..efe0b68 100644 --- a/package/Dockerfile +++ b/package/Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1.7 ARG SOURCE_DATE_EPOCH ARG UBUNTU_IMAGE=ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b -FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports +FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports FROM ${UBUNTU_IMAGE} AS snapshot-ca-bootstrap ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd \ https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb \ @@ -92,7 +92,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \ cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \ done; \ - printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \ + printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \ (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ { \ diff --git a/scripts/check-migration-policy b/scripts/check-migration-policy index 7b13ea8..3deccc1 100755 --- a/scripts/check-migration-policy +++ b/scripts/check-migration-policy @@ -43,7 +43,7 @@ done grep -Fq "PastureStack is an independent community effort to preserve, audit, and modernize the ${legacy_title} 1.6 ecosystem. It is not affiliated with or endorsed by ${legacy_title} Labs or SUSE." README.md || fail "independence_notice_missing" grep -Fq 'ad28c1d94b7f1b1814fa6404886398b4f4094d64' ORIGIN.md || fail "upstream_boundary_missing" grep -Fq 'ghcr.io/pasturestack/resource-scheduler' README.md || fail "public_image_missing" -grep -Fq 'v0.8.21' README.md || fail "current_numeric_release_missing" +grep -Fq 'v0.8.22' README.md || fail "current_numeric_release_missing" grep -Fq "[[ \"\$RELEASE_TAG\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+\$ ]]" .github/workflows/release.yml || fail "numeric_release_gate_missing" if git grep -I -n -E "${legacy_brand}-1\\.6-|${retired_short}" -- ':!vendor/**' ':!LICENSES/**' >/tmp/resource-scheduler-policy-matches 2>/dev/null; then