From a6be73e3b8ae6e89079c09728b37f684c6da2c1c Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:16:18 +0800 Subject: [PATCH] Consume qualified Brotli security backport for v0.3.4 --- .github/workflows/security-build.yml | 18 +++++++++--------- Dockerfile | 4 ++-- Makefile | 2 +- README.md | 6 ++++-- scripts/integration-smoke | 2 +- 5 files changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/workflows/security-build.yml b/.github/workflows/security-build.yml index d045c27..b9ad811 100644 --- a/.github/workflows/security-build.yml +++ b/.github/workflows/security-build.yml @@ -43,20 +43,20 @@ jobs: run: | set -euo pipefail mkdir -p dist/security-runtime - docker image inspect local/system-image-preloader:v0.3.3 > dist/security-runtime/images.json - container=$(docker create --entrypoint /bin/true local/system-image-preloader:v0.3.3) + docker image inspect local/system-image-preloader:v0.3.4 > dist/security-runtime/images.json + container=$(docker create --entrypoint /bin/true local/system-image-preloader:v0.3.4) trap 'docker rm -f "$container" >/dev/null 2>&1 || true' EXIT docker cp "$container:/licenses/third-party/security/." dist/security-runtime/ docker cp "$container:/usr/local/bin/docker" dist/security-runtime/docker-cli docker run --rm --network none --entrypoint sha256sum \ - local/system-image-preloader:v0.3.3 /usr/local/bin/docker \ + local/system-image-preloader:v0.3.4 /usr/local/bin/docker \ > dist/security-runtime/docker-sha256.txt python3 -B tests/docker_manifest_digest_proof.py \ > dist/security-runtime/docker-manifest-digest-proof.json rm dist/security-runtime/docker-cli docker rm "$container" >/dev/null trap - EXIT - docker save local/system-image-preloader:v0.3.3 | gzip -n > dist/security-runtime/images.tar.gz + docker save local/system-image-preloader:v0.3.4 | gzip -n > dist/security-runtime/images.tar.gz printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt (cd dist/security-runtime && sha256sum images.json images.tar.gz source-revision.txt > SHA256SUMS) - name: Scan the exact runtime and generate its SBOM @@ -68,7 +68,7 @@ jobs: cache="$RUNNER_TEMP/ubuntu-backports-trivy-cache" mkdir -p "$cache" docker run --rm -v "$cache:/root/.cache/trivy" "$scanner" image --download-db-only - for runtime in local/system-image-preloader:v0.3.3; do + for runtime in local/system-image-preloader:v0.3.4; do name=${runtime##*/}; name=${name%%:*} docker save "$runtime" --output "$RUNNER_TEMP/$name.tar" docker run --rm -v "$cache:/root/.cache/trivy" -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --skip-db-update --input /image.tar --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --list-all-pkgs --format json --output "/evidence/$name-security.json" @@ -82,7 +82,7 @@ jobs: exit 1 fi (cd dist/security-runtime/ubuntu-backports && sha256sum --check SHA256SUMS) - bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' + bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' mkdir -p dist/security-runtime/bundle-tools bundle_container=$(docker create "$bundle_image" unused) if docker cp "$bundle_container:/out/verify-consumer-evidence.py" dist/security-runtime/bundle-tools/verify-consumer-evidence.py && \ @@ -98,7 +98,7 @@ jobs: python3 dist/security-runtime/bundle-tools/verify-consumer-evidence.py \ --evidence-dir dist/security-runtime/ubuntu-backports --sbom "dist/security-runtime/$name-sbom.cdx.json" \ --bundle-checksums dist/security-runtime/bundle-tools/SHA256SUMS \ - --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > dist/security-runtime/ubuntu-backports-validation.json + --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > dist/security-runtime/ubuntu-backports-validation.json docker run --rm -v "$cache:/root/.cache/trivy" -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --skip-db-update --input /image.tar --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --list-all-pkgs --vex /evidence/ubuntu-backports/openvex.json --format json --output "/evidence/$name-security-backports.json" tar -cf dist/security-runtime/ubuntu-backports-evidence.tar -C dist/security-runtime ubuntu-backports ubuntu-backports-validation.json done @@ -125,7 +125,7 @@ jobs: packages: write env: GH_TOKEN: ${{ github.token }} - RELEASE_TAG: v0.3.3 + RELEASE_TAG: v0.3.4 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -144,7 +144,7 @@ jobs: printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT : > dist/security-runtime/registry-images.jsonl - local_image='local/system-image-preloader:v0.3.3' + local_image='local/system-image-preloader:v0.3.4' remote_image="ghcr.io/pasturestack/system-image-preloader:$RELEASE_TAG" if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1 diff --git a/Dockerfile b/Dockerfile index 622d73e..03dc134 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ # Modified by PastureStack contributors for independent maintenance and rebranding. ARG UBUNTU_IMAGE=ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b -FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports +FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports FROM ${UBUNTU_IMAGE} AS tool-builder ARG GO_VERSION=1.27.3 @@ -194,7 +194,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/ for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \ cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \ done; \ - printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \ + printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \ (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \ dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \ rm -f /var/cache/ldconfig/aux-cache diff --git a/Makefile b/Makefile index 74e32c7..65842cb 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ # Created by PastureStack contributors for repeatable validation. -VERSION ?= v0.3.3 +VERSION ?= v0.3.4 REVISION ?= $(shell git rev-parse HEAD) IMAGE_REPOSITORY ?= local/system-image-preloader IMAGE ?= $(IMAGE_REPOSITORY):$(VERSION) diff --git a/README.md b/README.md index 90d7ae4..2c4c92c 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ # PastureStack System Image Preloader -Linux runtime **`v0.3.3`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. +Linux runtime **`v0.3.4`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider. + +The shared bundle includes the official Brotli decoder fix for CVE-2026-111497. The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`. @@ -77,7 +79,7 @@ restores the image-presence state. It never performs a broad image prune. Use the immutable semantic tag: ```text -ghcr.io/pasturestack/system-image-preloader:v0.3.3 +ghcr.io/pasturestack/system-image-preloader:v0.3.4 ``` The deployment definition must mount `/var/run/docker.sock`, run one instance diff --git a/scripts/integration-smoke b/scripts/integration-smoke index c9854d5..f51ed08 100755 --- a/scripts/integration-smoke +++ b/scripts/integration-smoke @@ -4,7 +4,7 @@ set -Eeuo pipefail PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -IMAGE="${IMAGE:-local/system-image-preloader:v0.3.3}" +IMAGE="${IMAGE:-local/system-image-preloader:v0.3.4}" TEST_PULL_IMAGE="${TEST_PULL_IMAGE:-ghcr.io/pasturestack/container-cron:v0.6.0}" PLATFORM_VERSION="${PLATFORM_VERSION:-v1.6.281}" ACCESS_KEY="integration-access"