Repository navigation
Release Server v1.6.552 with qualified runtime security backports - #369
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Server v1.6.552 consumes the qualified Ubuntu security backports for its six already-installed runtime packages. It preserves the GNU coreutils provider and configuration, keeps the original Canonical download versions distinct from the patched runtime, and derives PCRE compatibility receipts from the released package bytes instead of compiling them again. No jq, Rust coreutils or development packages are added to Server.
The release defaults to the published Python Node Agent v1.2.33 and Catalog v0.3.17 at commit 72b0d9767306baf7091fca021d0a2b6bdbca5d51. Explicit operator overrides, data volumes, authentication, authorization and networking behavior are retained.
The publisher preserves its complete original raw scans, generates the actual runtime SBOM, validates retained package metadata against the immutable producer checksums, and then applies native exact-package VEX. The vendor-pending policy is unchanged; only the three obsolete libc scopes for CVE-2026-89092 are removed in favor of the qualified custom-package code-absence evidence. Fixed and not-affected decisions remain distinct.
Validation: five focused backport contracts pass; all 47 packaging source contracts pass after correcting the expected additional data stage (46 unaffected PASS results carried forward, only the failed stage-count case rerun). Independent bounded source review found no required changes. The already-passed native package/provider qualification is reused. Required PR checks and the normal immutable image publisher still gate publication; QA deployment is limited to the authorized 8080 test installation.