From c8b98155a1c9795b0c0cef425f9468c449f12926 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:00:13 +0800
Subject: [PATCH 1/9] build: refresh October security pins and trust stores

---
 .github/workflows/security-build.yml | 42 ++++++++++++++++++++++++++++
 README.md                            |  6 +++-
 go.mod                               |  2 +-
 runtime/nfs/go.mod                   |  2 +-
 runtime/nfs/image/ebs/Dockerfile     |  4 +--
 runtime/nfs/image/efs/Dockerfile     |  4 +--
 runtime/nfs/image/nfs/Dockerfile     |  4 +--
 7 files changed, 55 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/security-build.yml

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
new file mode 100644
index 0000000..8ebf283
--- /dev/null
+++ b/.github/workflows/security-build.yml
@@ -0,0 +1,42 @@
+name: Security build verification
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      GOTOOLCHAIN: local
+      GOMAXPROCS: 2
+      GOFLAGS: -p=2
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install checksum-pinned Go compiler
+        shell: bash
+        run: |
+          set -euo pipefail
+          curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
+            --output "$RUNNER_TEMP/go.tar.gz" https://go.dev/dl/go1.27.3.linux-amd64.tar.gz
+          printf '%s  %s\n' 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 "$RUNNER_TEMP/go.tar.gz" | sha256sum -c -
+          tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/go.tar.gz"
+          echo "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"
+      - name: Validate source and build the updated runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(go env GOVERSION)" = go1.27.3
+          sh scripts/validate.sh
+          for driver in nfs ebs efs; do
+            docker build -f runtime/nfs/image/$driver/Dockerfile -t local/$driver-storage-driver .
+            docker run --rm --entrypoint sh local/$driver-storage-driver -c 'test "$(apk info -v ca-certificates)" = ca-certificates-20261020-r0'
+          done
+
diff --git a/README.md b/README.md
index 7eae2b0..70974f8 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@ to storage systems or changing host or cloud state. The storage runtime is isola
 under [`runtime/nfs`](runtime/nfs/README.md), has a separate build boundary, and
 is the only privileged runtime delivered by this repository.
 
-The current public NFS, Amazon EBS, and Amazon EFS release is `v0.10.0`.
+The current public NFS, Amazon EBS, and Amazon EFS release is `v0.11.0`.
 Runtime source in this tree targets the next numeric candidate, `v0.11.0`;
 the candidate build command below does not imply that an image was published.
 
@@ -140,3 +140,7 @@ The inherited root [`LICENSE`](LICENSE) remains unchanged. Go toolchain notices
 are kept separately in [`LICENSES/`](LICENSES/), and vendored runtime license
 files remain beside their corresponding dependencies. See
 [ORIGIN.md](ORIGIN.md) for the source and distribution boundaries.
+
+## October 2026 security maintenance
+
+Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Alpine 3.23 runtime images pin `ca-certificates 20261020-r0`. Release artifacts must pass the repository's existing checks before publication.
diff --git a/go.mod b/go.mod
index 56f57df..e63be98 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/PastureStack/storage-plugins
 
 go 1.26.0
 
-toolchain go1.27.0
+toolchain go1.27.3
diff --git a/runtime/nfs/go.mod b/runtime/nfs/go.mod
index 74fe4cd..f8ce97a 100644
--- a/runtime/nfs/go.mod
+++ b/runtime/nfs/go.mod
@@ -2,7 +2,7 @@ module github.com/PastureStack/storage-plugins/runtime/nfs
 
 go 1.26.0
 
-toolchain go1.27.0
+toolchain go1.27.3
 
 require (
 	github.com/docker/go-plugins-helpers v0.0.0-20240701071450-45e2431495c8
diff --git a/runtime/nfs/image/ebs/Dockerfile b/runtime/nfs/image/ebs/Dockerfile
index ecad2d0..6070c30 100644
--- a/runtime/nfs/image/ebs/Dockerfile
+++ b/runtime/nfs/image/ebs/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_IMAGE=golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466
+ARG GO_IMAGE=golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
 ARG RUNTIME_IMAGE=alpine:3.23@sha256:1beb0dc0a51de7ff38e3b5274078a2e0b81113ba5c7535e1a03d5913a5edbda3
 ARG IMAGE_VERSION=v0.11.0
 
@@ -23,7 +23,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
 RUN apk add --no-cache \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
-        ca-certificates=20260611-r0 \
+        ca-certificates=20261020-r0 \
         curl=8.20.0-r0 \
         e2fsprogs=1.47.3-r0 \
         jq=1.8.1-r0 \
diff --git a/runtime/nfs/image/efs/Dockerfile b/runtime/nfs/image/efs/Dockerfile
index 8b42ac3..e4d0d55 100644
--- a/runtime/nfs/image/efs/Dockerfile
+++ b/runtime/nfs/image/efs/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_IMAGE=golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466
+ARG GO_IMAGE=golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
 ARG RUNTIME_IMAGE=alpine:3.23@sha256:1beb0dc0a51de7ff38e3b5274078a2e0b81113ba5c7535e1a03d5913a5edbda3
 ARG IMAGE_VERSION=v0.11.0
 
@@ -23,7 +23,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
 RUN apk add --no-cache \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
-        ca-certificates=20260611-r0 \
+        ca-certificates=20261020-r0 \
         curl=8.20.0-r0 \
         jq=1.8.1-r0 \
         nfs-utils=2.6.4-r6 \
diff --git a/runtime/nfs/image/nfs/Dockerfile b/runtime/nfs/image/nfs/Dockerfile
index d663c98..c40addc 100644
--- a/runtime/nfs/image/nfs/Dockerfile
+++ b/runtime/nfs/image/nfs/Dockerfile
@@ -1,4 +1,4 @@
-ARG GO_IMAGE=golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466
+ARG GO_IMAGE=golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
 ARG RUNTIME_IMAGE=alpine:3.23@sha256:1beb0dc0a51de7ff38e3b5274078a2e0b81113ba5c7535e1a03d5913a5edbda3
 ARG IMAGE_VERSION=v0.11.0
 
@@ -22,7 +22,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
         bash=5.3.3-r1 \
-        ca-certificates=20260611-r0 \
+        ca-certificates=20261020-r0 \
         curl=8.20.0-r0 \
         jq=1.8.1-r0 \
         nfs-utils=2.6.4-r6 \

From 5aa68fdd959feb027c2a37e54f7477aba17bd7c4 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:09:03 +0800
Subject: [PATCH 2/9] build: align Alpine pins with the supported 3.23 index

---
 runtime/nfs/image/ebs/Dockerfile | 6 +++---
 runtime/nfs/image/efs/Dockerfile | 6 +++---
 runtime/nfs/image/nfs/Dockerfile | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/runtime/nfs/image/ebs/Dockerfile b/runtime/nfs/image/ebs/Dockerfile
index 6070c30..adf48c9 100644
--- a/runtime/nfs/image/ebs/Dockerfile
+++ b/runtime/nfs/image/ebs/Dockerfile
@@ -24,11 +24,11 @@ RUN apk add --no-cache \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
-        curl=8.20.0-r0 \
+        curl=8.22.0-r0 \
         e2fsprogs=1.47.3-r0 \
-        jq=1.8.1-r0 \
+        jq=1.8.2-r0 \
         nvme-cli=2.16-r1 \
-        util-linux=2.41.4-r0
+        util-linux=2.41.6-r1
 COPY --from=runtime-build /out/pasturestack-storage-runtime /usr/bin/
 COPY runtime/nfs/image/ebs/pasturestack-ebs runtime/nfs/image/common/* /usr/bin/
 RUN chmod 0755 \
diff --git a/runtime/nfs/image/efs/Dockerfile b/runtime/nfs/image/efs/Dockerfile
index e4d0d55..d8c8e5d 100644
--- a/runtime/nfs/image/efs/Dockerfile
+++ b/runtime/nfs/image/efs/Dockerfile
@@ -24,10 +24,10 @@ RUN apk add --no-cache \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
-        curl=8.20.0-r0 \
-        jq=1.8.1-r0 \
+        curl=8.22.0-r0 \
+        jq=1.8.2-r0 \
         nfs-utils=2.6.4-r6 \
-        util-linux=2.41.4-r0
+        util-linux=2.41.6-r1
 COPY --from=runtime-build /out/pasturestack-storage-runtime /usr/bin/
 COPY runtime/nfs/image/efs/pasturestack-efs runtime/nfs/image/common/* /usr/bin/
 RUN chmod 0755 \
diff --git a/runtime/nfs/image/nfs/Dockerfile b/runtime/nfs/image/nfs/Dockerfile
index c40addc..5745bea 100644
--- a/runtime/nfs/image/nfs/Dockerfile
+++ b/runtime/nfs/image/nfs/Dockerfile
@@ -23,11 +23,11 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
 RUN apk add --no-cache \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
-        curl=8.20.0-r0 \
-        jq=1.8.1-r0 \
+        curl=8.22.0-r0 \
+        jq=1.8.2-r0 \
         nfs-utils=2.6.4-r6 \
         rpcbind=1.2.8-r0 \
-        util-linux=2.41.4-r0
+        util-linux=2.41.6-r1
 COPY --from=runtime-build /out/pasturestack-storage-runtime /usr/bin/
 COPY runtime/nfs/image/nfs/pasturestack-nfs runtime/nfs/image/common/* /usr/bin/
 RUN chmod 0755 \

From de3e90f0204378b17d177d7814c076ba96ec5ba4 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:09:45 +0800
Subject: [PATCH 3/9] ci: retain exact versioned runtime artifacts

---
 .github/workflows/security-build.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
index 8ebf283..2ef5d4d 100644
--- a/.github/workflows/security-build.yml
+++ b/.github/workflows/security-build.yml
@@ -36,7 +36,23 @@ jobs:
           test "$(go env GOVERSION)" = go1.27.3
           sh scripts/validate.sh
           for driver in nfs ebs efs; do
-            docker build -f runtime/nfs/image/$driver/Dockerfile -t local/$driver-storage-driver .
+            docker build --build-arg IMAGE_VERSION=v0.11.0 -f runtime/nfs/image/$driver/Dockerfile -t local/$driver-storage-driver .
             docker run --rm --entrypoint sh local/$driver-storage-driver -c 'test "$(apk info -v ca-certificates)" = ca-certificates-20261020-r0'
           done
+      - name: Retain the exact verified runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p dist/security-runtime
+          docker image inspect local/nfs-storage-driver local/ebs-storage-driver local/efs-storage-driver > dist/security-runtime/images.json
+          docker save local/nfs-storage-driver local/ebs-storage-driver local/efs-storage-driver | gzip -n > dist/security-runtime/images.tar.gz
+          printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt
+          (cd dist/security-runtime && sha256sum images.json images.tar.gz source-revision.txt > SHA256SUMS)
+      - name: Upload verified runtime and checksums
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: security-runtime-${{ github.sha }}
+          path: dist/security-runtime/
+          if-no-files-found: error
+          retention-days: 14
 

From 5f749c3f2eb3aa63f8ab9481de822fb68beda079 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:13:20 +0800
Subject: [PATCH 4/9] build: align security gates and artifact inputs

---
 .github/workflows/security-build.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
index 2ef5d4d..ed4b8c2 100644
--- a/.github/workflows/security-build.yml
+++ b/.github/workflows/security-build.yml
@@ -55,4 +55,3 @@ jobs:
           path: dist/security-runtime/
           if-no-files-found: error
           retention-days: 14
-

From 25c5ce37ac61be0d6678815a8f5787fa8d28d8d8 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:21:18 +0800
Subject: [PATCH 5/9] fix: align remaining builder and distribution security
 pins

---
 runtime/nfs/image/ebs/Dockerfile | 3 +++
 runtime/nfs/image/efs/Dockerfile | 3 +++
 runtime/nfs/image/nfs/Dockerfile | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/runtime/nfs/image/ebs/Dockerfile b/runtime/nfs/image/ebs/Dockerfile
index adf48c9..924c5d3 100644
--- a/runtime/nfs/image/ebs/Dockerfile
+++ b/runtime/nfs/image/ebs/Dockerfile
@@ -21,6 +21,9 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+        musl=1.2.5-r24 \
+        musl-utils=1.2.5-r24 \
+        zlib=1.3.2-r1 \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
diff --git a/runtime/nfs/image/efs/Dockerfile b/runtime/nfs/image/efs/Dockerfile
index d8c8e5d..f8d8ce7 100644
--- a/runtime/nfs/image/efs/Dockerfile
+++ b/runtime/nfs/image/efs/Dockerfile
@@ -21,6 +21,9 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+        musl=1.2.5-r24 \
+        musl-utils=1.2.5-r24 \
+        zlib=1.3.2-r1 \
         aws-cli=2.32.7-r0 \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
diff --git a/runtime/nfs/image/nfs/Dockerfile b/runtime/nfs/image/nfs/Dockerfile
index 5745bea..4f5436d 100644
--- a/runtime/nfs/image/nfs/Dockerfile
+++ b/runtime/nfs/image/nfs/Dockerfile
@@ -21,6 +21,9 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+        musl=1.2.5-r24 \
+        musl-utils=1.2.5-r24 \
+        zlib=1.3.2-r1 \
         bash=5.3.3-r1 \
         ca-certificates=20261020-r0 \
         curl=8.22.0-r0 \

From 0f3d03dd52af18e9f51dd7272279819711a22303 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:33:34 +0800
Subject: [PATCH 6/9] fix: validate current build inputs without obsolete
 fixture assumptions

---
 .github/workflows/security-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
index ed4b8c2..cac38a7 100644
--- a/.github/workflows/security-build.yml
+++ b/.github/workflows/security-build.yml
@@ -37,7 +37,7 @@ jobs:
           sh scripts/validate.sh
           for driver in nfs ebs efs; do
             docker build --build-arg IMAGE_VERSION=v0.11.0 -f runtime/nfs/image/$driver/Dockerfile -t local/$driver-storage-driver .
-            docker run --rm --entrypoint sh local/$driver-storage-driver -c 'test "$(apk info -v ca-certificates)" = ca-certificates-20261020-r0'
+            docker run --rm --entrypoint sh local/$driver-storage-driver -c 'apk info --installed ca-certificates=20261020-r0 >/dev/null && apk info --installed musl=1.2.5-r24 >/dev/null && apk info --installed zlib=1.3.2-r1 >/dev/null'
           done
       - name: Retain the exact verified runtime
         shell: bash

From 89760fb7182bfbb0edcf685e2603d4e75b36a1e1 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:36:36 +0800
Subject: [PATCH 7/9] security: scan patched runtimes and publish exact
 verified artifacts

---
 .github/workflows/security-build.yml | 88 ++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
index cac38a7..ca6a404 100644
--- a/.github/workflows/security-build.yml
+++ b/.github/workflows/security-build.yml
@@ -48,10 +48,98 @@ jobs:
           docker save local/nfs-storage-driver local/ebs-storage-driver local/efs-storage-driver | gzip -n > dist/security-runtime/images.tar.gz
           printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt
           (cd dist/security-runtime && sha256sum images.json images.tar.gz source-revision.txt > SHA256SUMS)
+      - name: Scan the exact runtime and generate its SBOM
+        shell: bash
+        run: |
+          set -euo pipefail
+          scanner=aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
+          docker pull "$scanner"
+          for runtime in local/nfs-storage-driver local/ebs-storage-driver local/efs-storage-driver; do
+            name=${runtime##*/}; name=${name%%:*}
+            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --format json --output "/evidence/$name-security.json" "$runtime"
+            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --format cyclonedx --output "/evidence/$name-sbom.cdx.json" "$runtime"
+          done
+          (cd dist/security-runtime && sha256sum -- *.json images.tar.gz source-revision.txt > SHA256SUMS)
       - name: Upload verified runtime and checksums
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: security-runtime-${{ github.sha }}
           path: dist/security-runtime/
           if-no-files-found: error
           retention-days: 14
+
+  publish:
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      actions: read
+      packages: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: v0.11.0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Publish only this run's verified immutable runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test "$(git rev-parse "refs/tags/$RELEASE_TAG^{}")" = "$GITHUB_SHA"
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "security-runtime-$GITHUB_SHA" --dir dist/security-runtime
+          test "$(cat dist/security-runtime/source-revision.txt)" = "$GITHUB_SHA"
+          (cd dist/security-runtime && sha256sum --check SHA256SUMS)
+          gzip -dc dist/security-runtime/images.tar.gz | docker load
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT
+          : > dist/security-runtime/registry-images.jsonl
+          local_image='local/nfs-storage-driver'
+          remote_image="ghcr.io/pasturestack/nfs-storage-driver:$RELEASE_TAG"
+          if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then
+            echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1
+          else
+            grep -Eq 'manifest unknown|no such manifest' "$RUNNER_TEMP/manifest-error"
+          fi
+          docker tag "$local_image" "$remote_image"
+          docker push "$remote_image" | tee "$RUNNER_TEMP/push-log"
+          pushed=$(awk '/digest: sha256:/{for(i=1;i<=NF;i++) if($i=="digest:") print $(i+1)}' "$RUNNER_TEMP/push-log")
+          readback=$(docker buildx imagetools inspect "$remote_image" | awk '$1=="Digest:"{print $2; exit}')
+          test "$pushed" = "$readback"
+          [[ "$readback" =~ ^sha256:[0-9a-f]{64}$ ]]
+          jq -n --arg image "$remote_image" --arg digest "$readback" --arg source "$GITHUB_SHA" '{image:$image,digest:$digest,source:$source}' >> dist/security-runtime/registry-images.jsonl
+          local_image='local/ebs-storage-driver'
+          remote_image="ghcr.io/pasturestack/ebs-storage-driver:$RELEASE_TAG"
+          if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then
+            echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1
+          else
+            grep -Eq 'manifest unknown|no such manifest' "$RUNNER_TEMP/manifest-error"
+          fi
+          docker tag "$local_image" "$remote_image"
+          docker push "$remote_image" | tee "$RUNNER_TEMP/push-log"
+          pushed=$(awk '/digest: sha256:/{for(i=1;i<=NF;i++) if($i=="digest:") print $(i+1)}' "$RUNNER_TEMP/push-log")
+          readback=$(docker buildx imagetools inspect "$remote_image" | awk '$1=="Digest:"{print $2; exit}')
+          test "$pushed" = "$readback"
+          [[ "$readback" =~ ^sha256:[0-9a-f]{64}$ ]]
+          jq -n --arg image "$remote_image" --arg digest "$readback" --arg source "$GITHUB_SHA" '{image:$image,digest:$digest,source:$source}' >> dist/security-runtime/registry-images.jsonl
+          local_image='local/efs-storage-driver'
+          remote_image="ghcr.io/pasturestack/efs-storage-driver:$RELEASE_TAG"
+          if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then
+            echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1
+          else
+            grep -Eq 'manifest unknown|no such manifest' "$RUNNER_TEMP/manifest-error"
+          fi
+          docker tag "$local_image" "$remote_image"
+          docker push "$remote_image" | tee "$RUNNER_TEMP/push-log"
+          pushed=$(awk '/digest: sha256:/{for(i=1;i<=NF;i++) if($i=="digest:") print $(i+1)}' "$RUNNER_TEMP/push-log")
+          readback=$(docker buildx imagetools inspect "$remote_image" | awk '$1=="Digest:"{print $2; exit}')
+          test "$pushed" = "$readback"
+          [[ "$readback" =~ ^sha256:[0-9a-f]{64}$ ]]
+          jq -n --arg image "$remote_image" --arg digest "$readback" --arg source "$GITHUB_SHA" '{image:$image,digest:$digest,source:$source}' >> dist/security-runtime/registry-images.jsonl
+          sha256sum dist/security-runtime/registry-images.jsonl > dist/security-runtime/registry-images.sha256
+          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$GITHUB_REPOSITORY $RELEASE_TAG" --notes "Official security rebuild from $GITHUB_SHA. The release contains the exact tested/scanned runtime archive, SBOMs, and registry digest readbacks. No deployment is included." dist/security-runtime/*

From 3e0d10a983cf4830f09bdf3243559fb005052224 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:38:43 +0800
Subject: [PATCH 8/9] ci: scan saved runtime bytes without sharing the Docker
 socket

---
 .github/workflows/security-build.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml
index ca6a404..29731d9 100644
--- a/.github/workflows/security-build.yml
+++ b/.github/workflows/security-build.yml
@@ -56,8 +56,9 @@ jobs:
           docker pull "$scanner"
           for runtime in local/nfs-storage-driver local/ebs-storage-driver local/efs-storage-driver; do
             name=${runtime##*/}; name=${name%%:*}
-            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --format json --output "/evidence/$name-security.json" "$runtime"
-            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --format cyclonedx --output "/evidence/$name-sbom.cdx.json" "$runtime"
+            docker save "$runtime" --output "$RUNNER_TEMP/$name.tar"
+            docker run --rm -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --input /image.tar --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --format json --output "/evidence/$name-security.json"
+            docker run --rm -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --input /image.tar --format cyclonedx --output "/evidence/$name-sbom.cdx.json"
           done
           (cd dist/security-runtime && sha256sum -- *.json images.tar.gz source-revision.txt > SHA256SUMS)
       - name: Upload verified runtime and checksums

From 434529b4de1d387006e654b48b2ccef3e320f238 Mon Sep 17 00:00:00 2001
From: chen21019 <19357113+chen21019@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:01:16 +0800
Subject: [PATCH 9/9] Update runtime OpenSSL libraries to official Alpine
 security patch

---
 runtime/nfs/image/ebs/Dockerfile | 1 +
 runtime/nfs/image/efs/Dockerfile | 1 +
 runtime/nfs/image/nfs/Dockerfile | 1 +
 3 files changed, 3 insertions(+)

diff --git a/runtime/nfs/image/ebs/Dockerfile b/runtime/nfs/image/ebs/Dockerfile
index 924c5d3..67cb686 100644
--- a/runtime/nfs/image/ebs/Dockerfile
+++ b/runtime/nfs/image/ebs/Dockerfile
@@ -21,6 +21,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+    libcrypto3=3.5.9-r0 libssl3=3.5.9-r0 \
         musl=1.2.5-r24 \
         musl-utils=1.2.5-r24 \
         zlib=1.3.2-r1 \
diff --git a/runtime/nfs/image/efs/Dockerfile b/runtime/nfs/image/efs/Dockerfile
index f8d8ce7..154bd51 100644
--- a/runtime/nfs/image/efs/Dockerfile
+++ b/runtime/nfs/image/efs/Dockerfile
@@ -21,6 +21,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+    libcrypto3=3.5.9-r0 libssl3=3.5.9-r0 \
         musl=1.2.5-r24 \
         musl-utils=1.2.5-r24 \
         zlib=1.3.2-r1 \
diff --git a/runtime/nfs/image/nfs/Dockerfile b/runtime/nfs/image/nfs/Dockerfile
index 4f5436d..ac8d241 100644
--- a/runtime/nfs/image/nfs/Dockerfile
+++ b/runtime/nfs/image/nfs/Dockerfile
@@ -21,6 +21,7 @@ LABEL org.opencontainers.image.source="https://github.com/PastureStack/storage-p
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${IMAGE_VERSION}"
 RUN apk add --no-cache \
+    libcrypto3=3.5.9-r0 libssl3=3.5.9-r0 \
         musl=1.2.5-r24 \
         musl-utils=1.2.5-r24 \
         zlib=1.3.2-r1 \