Repository navigation
Qualify Brotli decoder fix in Ubuntu backports 0.1.1 - #373
Merged
Merged
Conversation
chen21019
changed the title
This was referenced Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ubuntu 26.04 libbrotli1 1.2.0-3build1 lacks Google's accepted CVE-2026-111497 decoder fix. Apply only official commit b418fa81c48262a86a95332b0bc6d62c30aa78b6 to the original Ubuntu source, preserve its packaging and dependencies, and export libbrotli1 only.
Extend the existing build-only bundle to 0.1.1 with seven exact families/thirteen runtime packages. The original six families retain their source/deb/native receipt pins and bytes; only their CI closure annotations record the additive Brotli selector. No original native family is rebuilt. The same installer preserves existing-only selection, providers, dependencies, ELF ABI, full payload/dpkg integrity and exact producer metadata/SBOM closure. Historical 0.1.0 remains immutable with its original frozen verifier.
Validation: Brotli-only native run 40174455200/job121112022951 is completed/SUCCESS on signed source 7f90a14. Original packaging/build and 12 CMake + 135 Python cases pass; all three SONAME/NEEDED/export sets match Ubuntu; 15 ordinary compression/API and 45 streaming controls pass. Exact libbrotli1 deb SHA256 a2dca2c08cbc5ffe9a57432e80b989c458f7ed38c39bad33f3a3fa006fea507b. No exploit or crafted CVE stream is executed.
Local checks: six module controls, 31 qualifier tests, 14 metadata guard tests, seven historical 0.1.0 completion tests, source-ready closure, syntax and Linux amd64 CGO=0 static compilation pass. Full installer tests require Linux loader/ownership/symlink fixtures and remain mandatory in the existing Linux CodeQL job. Both real GNU/uutils consumer installs and the added installed-Brotli RTLD_NOW/valid-roundtrip probe remain mandatory prepublication publisher gates.
Retained history: run40173371135 rejected incorrect Windows CRLF post-patch hashes before compilation; exact official LF hashes corrected the lock without weakening the check. Run40173631568 produced the same PASS deb/tests but GitHub retained an inconsistent in-progress job despite its successful completed run and steps. Its original evidence is preserved; one authorized Brotli-only recovery run obtained consistent official metadata. No API receipt was rewritten and verify_api is unchanged.
This PR does not deploy any service or publish a consumer. Separate normal protected publication of the immutable bundle must pass its owning gates before products use its new digest.