Release Server v1.6.553 with qualified Brotli decoder fix

.github/workflows/publish-current-server.yml

@@ -216,6 +216,21 @@ jobs:
             printf 'SERVER_JAVA_SECURITY_RUNTIME_OK version=25.0.5+8 official_archive_sha256=68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb actual_candidate=1\n'
           } |& tee "$RUNNER_TEMP/server-evidence/java-security-runtime.txt"
 
+      - name: Verify ordinary Brotli operations against the actual final image
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          evidence="$RUNNER_TEMP/server-evidence"
+          cc -O2 -Wall -Wextra -Werror \
+            source/server/security/ubuntu-backports/bundle/installer/testdata/consumer-brotli-probe.c \
+            -ldl -o "$evidence/brotli-runtime-probe"
+          docker run --rm --network none \
+            --mount "type=bind,source=$evidence/brotli-runtime-probe,target=/tmp/brotli-runtime-probe,readonly" \
+            --entrypoint /tmp/brotli-runtime-probe "$CANDIDATE_IMAGE" |
+            tee "$evidence/brotli-runtime.txt"
+          grep -Fx 'PASS: three installed Brotli SONAMEs RTLD_NOW, ordinary compression/decompression' \
+            "$evidence/brotli-runtime.txt"
+
       - name: Start, restart, and export the candidate
         shell: bash
         run: |
@@ -575,8 +590,8 @@ jobs:
           # before passing its exact-package VEX to native Trivy.
           cp -a "$RUNNER_TEMP/server-rootfs/usr/share/pasturestack/security/ubuntu-backports" "$evidence/ubuntu-backports"
           (cd "$evidence/ubuntu-backports" && sha256sum --check SHA256SUMS)
-          bundle_image="$(sed -n 's/^FROM \(ghcr.io\/pasturestack\/ubuntu-security-backports:v0\.1\.0@sha256:[0-9a-f]\{64\}\) AS ubuntu_security_backports$/\1/p' source/server/Dockerfile.web-compose-release)"
-          [[ "$bundle_image" =~ ^ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.0@sha256:[0-9a-f]{64}$ ]]
+          bundle_image="$(sed -n 's/^FROM \(ghcr.io\/pasturestack\/ubuntu-security-backports:v0\.1\.1@sha256:[0-9a-f]\{64\}\) AS ubuntu_security_backports$/\1/p' source/server/Dockerfile.web-compose-release)"
+          [[ "$bundle_image" =~ ^ghcr.io/pasturestack/ubuntu-security-backports:v0\.1\.1@sha256:[0-9a-f]{64}$ ]]
           docker pull --platform linux/amd64 "$bundle_image"
           mkdir -p "$evidence/bundle-tools"
           bundle_container="$(docker create --entrypoint /unused "$bundle_image")"
@@ -771,6 +786,7 @@ jobs:
             cd "$evidence"
             sha256sum \
               build.log \
+              brotli-runtime.txt \
               candidate.log \
               candidate-smoke.txt \
               "host-api-${HOST_API_VERSION}.tar.gz" \
@@ -812,6 +828,7 @@ jobs:
             --notes-file "$evidence/release-notes.md" \
             "$evidence/SHA256SUMS" \
             "$evidence/build.log" \
+            "$evidence/brotli-runtime.txt" \
             "$evidence/candidate.log" \
             "$evidence/candidate-smoke.txt" \
             "$evidence/host-api-${HOST_API_VERSION}.tar.gz" \

COMPATIBILITY.md

@@ -1,5 +1,30 @@
 # Compatibility Contract
 
+<a id="server-v16553-brotli"></a>
+
+## Server v1.6.553 prepared, not published
+
+This candidate adds the exact accepted Google Brotli fix for CVE-2026-111497 to
+the Ubuntu runtime package. Ubuntu's distribution advisory remains under
+evaluation; the downstream package is a PastureStack rebuild, not a Canonical
+release. Original package ownership, ABI and ordinary compression/streaming
+tests must pass before consumers install it.
+
+Publication requires the qualified immutable bundle, final-rootfs package and
+linkage readback, SBOM and the existing full-severity scan policy. Existing
+unfixed findings and the original raw reports remain separate. No publication,
+deployment or multi-Host acceptance is claimed by this source preparation.
+
+The candidate pins published Catalog `v0.3.18` source
+`00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and Node Agent `v1.2.34`, based on
+compatibility base `v0.3.8`. Their immutable publication identities remain
+separate from this Server candidate and its later deployment acceptance.
+
+Keep the existing environment, authentication, firewall backend, mounts,
+volumes and restart policy. Infrastructure Stacks and Host Agents adopt new
+images only through their normal upgrade lifecycle; changing Server defaults
+does not override an operator's existing database settings.
+
 <a id="server-v16552-runtime-backports"></a>
 
 ## Server v1.6.552 published

README.md

@@ -11,23 +11,25 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current release
+## Current source candidate
 
-Server `v1.6.552` is the current published release.
-It includes Ubuntu security backports from verified upstream releases and accepted
-fixes. Each image updates only packages already installed, preserving its package
-set, coreutils provider, configuration and library interfaces. The compiler stages
-remain separate from the final runtime.
+Server `v1.6.553` is a prepared source candidate, not a published image.
+It adds the accepted Google Brotli fix for CVE-2026-111497 through the qualified
+Ubuntu backport bundle. Only already-installed packages are updated; package sets,
+providers, library interfaces and configuration are preserved.
 
 Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`,
 Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
-Node Agent `v1.2.33` uses compatibility base `v0.3.7`; Catalog `v0.3.17`
-references the corresponding verified component images.
+Node Agent `v1.2.34` uses compatibility base `v0.3.8`. Published Catalog
+`v0.3.18` is pinned to `00eec89e5fdeb9728c1c41babccad8b7dfc8b297` and records
+the qualified component images and their publication evidence.
 
-See [Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
-its [release note](docs/releases/server-1.6.552.md) and the
-[compatibility contract](COMPATIBILITY.md#server-v16552-runtime-backports)
+See its [release note](docs/releases/server-1.6.553.md) and the
+[compatibility contract](COMPATIBILITY.md#server-v16553-brotli)
 for producer identities, immutable image digests, SBOMs and remaining findings.
+The current published release remains
+[Server v1.6.552](https://github.com/PastureStack/server/releases/tag/v1.6.552),
+with its [release note](docs/releases/server-1.6.552.md).
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -54,22 +56,23 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the published numeric `v1.6.552` tag.
+This candidate is not yet available. The examples below use its numeric tag;
+run them only after its official release.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.552
+  ghcr.io/pasturestack/server:v1.6.553
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.552
+    image: ghcr.io/pasturestack/server:v1.6.553
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -8,8 +8,10 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published numeric Server v1.6.552 tag.
-See the [release note](../releases/server-1.6.552.md) and the
+The example uses the prepared numeric Server v1.6.553 tag. It
+is not yet available from GHCR;
+run it only after its official release and image have been published and read back.
+See the [release note](../releases/server-1.6.553.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -20,7 +22,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.552
+    image: ghcr.io/pasturestack/server:v1.6.553
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.553.md

@@ -0,0 +1,42 @@
+# Server v1.6.553 candidate
+
+Prepared source only; no Server image or release has been published.
+Deployment acceptance is not claimed until the normal protected release workflow
+and the affected runtime checks complete.
+
+## Scope
+
+CVE-2026-111497 affects the Brotli decoder. The accepted Google fix is applied
+to the pinned Ubuntu source without replacing Ubuntu packaging or adding
+packages to the runtime. The qualified shared bundle binds the official patch,
+native owning tests, ordinary compression/streaming tests, three-library ABI,
+package bytes, consumer installation receipts and exact-package OpenVEX.
+
+Web Console `1.6.195`, Engine `v0.183.354`, Host API `0.38.8`, Temurin
+`25.0.5+8` and their application behavior are retained. Node Agent `v1.2.34`
+uses published compatibility base `v0.3.8`. Catalog `v0.3.18`, source
+`00eec89e5fdeb9728c1c41babccad8b7dfc8b297`, references the separately published
+qualified component images. Node.js
+build SDK checks are separate from the static web runtime artifacts.
+
+## Upgrade and rollback
+
+Back up the database and all three named volumes. Preserve the existing Compose
+environment, HTTPS origin, ports, AppArmor, mounts and restart policy. After
+publication use the numeric `ghcr.io/pasturestack/server:v1.6.553` tag, then
+upgrade existing infrastructure Stacks and Host Agents normally. A new Server
+default does not override an explicit database setting.
+
+Keep the preceding immutable images and matching data checkpoint. Do not run
+`docker compose down -v` or retain an old runtime web-bundle override. A rollback
+may require restoring the matching database and volumes; never restore over
+the only copy of current data.
+
+## Acceptance boundary
+
+Only affected package installation, linkage, startup/restart and system-service
+functions require new evidence. Unchanged UI, language, RBAC and session tests
+retain their earlier results. Runtime adoption must identify the actual
+container digest on each eligible Host; registry publication alone is not
+deployment acceptance. Production, HAProxy and host firewall configuration are
+outside this QA deployment.

scripts/check-server-api-explorer-patch.sh

@@ -570,7 +570,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.552' \
+    'ARG SERVER_RELEASE_TAG=v1.6.553' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -1138,10 +1138,10 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.552}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.553}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.552}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.553}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -1597,13 +1597,13 @@ require_marker "$build_script" \
     'grep -F "pasturestack-catalog-pinned-commit"' \
     SERVER_CATALOG_PINNED_COMMIT_IMAGE_GATE_MISSING
 require_marker "$release_dockerfile" \
-    'ENV PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51' \
+    'ENV PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297' \
     SERVER_CATALOG_VERSION_LABEL_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    '"pinnedCommit":"72b0d9767306baf7091fca021d0a2b6bdbca5d51"' \
+    '"pinnedCommit":"00eec89e5fdeb9728c1c41babccad8b7dfc8b297"' \
     SERVER_CATALOG_VERSION_LABEL_URL_MISSING
 require_marker "$build_script" \
-    'PASTURESTACK_CATALOG_COMMIT=72b0d9767306baf7091fca021d0a2b6bdbca5d51' \
+    'PASTURESTACK_CATALOG_COMMIT=00eec89e5fdeb9728c1c41babccad8b7dfc8b297' \
     SERVER_CATALOG_VERSION_LABEL_IMAGE_GATE_MISSING
 for previous_release_marker in \
     '# Server v1.6.462' \
@@ -1691,10 +1691,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.552` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.553` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.552'; do
+        'ghcr.io/pasturestack/server:v1.6.553'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2300,7 +2300,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.552"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.553"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2338,7 +2338,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.552 >/dev/null
+    "$vendor_pending_fixture" v1.6.553 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2427,4 +2427,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.552 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.553 base=v1.6.460 engine=0.183.354 web_console=1.6.195 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'

scripts/check-server-runtime-image-references.sh

@@ -6,7 +6,7 @@ cd "$repo_root"
 
 approved_registry=ghcr.io/pasturestack
 approved_agent="${approved_registry}/node-agent:v1.2.31"
-current_agent="${approved_registry}/node-agent:v1.2.33"
+current_agent="${approved_registry}/node-agent:v1.2.34"
 approved_balancer="${approved_registry}/load-balancer-service:v0.9.33"
 # Historical recipes and opt-in migration tools keep their reviewed coordinates.
 historical_balancer="${approved_registry}/load-balancer-service:v0.9.27"