Consume qualified Brotli decoder fix in v0.3.4

.github/workflows/security-build.yml

@@ -43,20 +43,20 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p dist/security-runtime
-          docker image inspect local/system-image-preloader:v0.3.3 > dist/security-runtime/images.json
-          container=$(docker create --entrypoint /bin/true local/system-image-preloader:v0.3.3)
+          docker image inspect local/system-image-preloader:v0.3.4 > dist/security-runtime/images.json
+          container=$(docker create --entrypoint /bin/true local/system-image-preloader:v0.3.4)
           trap 'docker rm -f "$container" >/dev/null 2>&1 || true' EXIT
           docker cp "$container:/licenses/third-party/security/." dist/security-runtime/
           docker cp "$container:/usr/local/bin/docker" dist/security-runtime/docker-cli
           docker run --rm --network none --entrypoint sha256sum \
-            local/system-image-preloader:v0.3.3 /usr/local/bin/docker \
+            local/system-image-preloader:v0.3.4 /usr/local/bin/docker \
             > dist/security-runtime/docker-sha256.txt
           python3 -B tests/docker_manifest_digest_proof.py \
             > dist/security-runtime/docker-manifest-digest-proof.json
           rm dist/security-runtime/docker-cli
           docker rm "$container" >/dev/null
           trap - EXIT
-          docker save local/system-image-preloader:v0.3.3 | gzip -n > dist/security-runtime/images.tar.gz
+          docker save local/system-image-preloader:v0.3.4 | gzip -n > dist/security-runtime/images.tar.gz
           printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt
           (cd dist/security-runtime && sha256sum images.json images.tar.gz source-revision.txt > SHA256SUMS)
       - name: Scan the exact runtime and generate its SBOM
@@ -68,7 +68,7 @@ jobs:
           cache="$RUNNER_TEMP/ubuntu-backports-trivy-cache"
           mkdir -p "$cache"
           docker run --rm -v "$cache:/root/.cache/trivy" "$scanner" image --download-db-only
-          for runtime in local/system-image-preloader:v0.3.3; do
+          for runtime in local/system-image-preloader:v0.3.4; do
             name=${runtime##*/}; name=${name%%:*}
             docker save "$runtime" --output "$RUNNER_TEMP/$name.tar"
             docker run --rm -v "$cache:/root/.cache/trivy" -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --skip-db-update --input /image.tar --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --list-all-pkgs --format json --output "/evidence/$name-security.json"
@@ -82,7 +82,7 @@ jobs:
                 exit 1
             fi
             (cd dist/security-runtime/ubuntu-backports && sha256sum --check SHA256SUMS)
-            bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
+            bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19'
             mkdir -p dist/security-runtime/bundle-tools
             bundle_container=$(docker create "$bundle_image" unused)
             if docker cp "$bundle_container:/out/verify-consumer-evidence.py" dist/security-runtime/bundle-tools/verify-consumer-evidence.py && \
@@ -98,7 +98,7 @@ jobs:
             python3 dist/security-runtime/bundle-tools/verify-consumer-evidence.py \
                 --evidence-dir dist/security-runtime/ubuntu-backports --sbom "dist/security-runtime/$name-sbom.cdx.json" \
                 --bundle-checksums dist/security-runtime/bundle-tools/SHA256SUMS \
-                --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > dist/security-runtime/ubuntu-backports-validation.json
+                --expected-bundle-digest 'sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > dist/security-runtime/ubuntu-backports-validation.json
             docker run --rm -v "$cache:/root/.cache/trivy" -v "$RUNNER_TEMP/$name.tar:/image.tar:ro" -v "$PWD/dist/security-runtime:/evidence" "$scanner" image --skip-db-update --input /image.tar --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --list-all-pkgs --vex /evidence/ubuntu-backports/openvex.json --format json --output "/evidence/$name-security-backports.json"
             tar -cf dist/security-runtime/ubuntu-backports-evidence.tar -C dist/security-runtime ubuntu-backports ubuntu-backports-validation.json
           done
@@ -125,7 +125,7 @@ jobs:
       packages: write
     env:
       GH_TOKEN: ${{ github.token }}
-      RELEASE_TAG: v0.3.3
+      RELEASE_TAG: v0.3.4
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -144,7 +144,7 @@ jobs:
           printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
           trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT
           : > dist/security-runtime/registry-images.jsonl
-          local_image='local/system-image-preloader:v0.3.3'
+          local_image='local/system-image-preloader:v0.3.4'
           remote_image="ghcr.io/pasturestack/system-image-preloader:$RELEASE_TAG"
           if docker manifest inspect "$remote_image" >/dev/null 2>"$RUNNER_TEMP/manifest-error"; then
             echo "Refusing to replace an existing immutable image tag: $remote_image" >&2; exit 1

Dockerfile

@@ -2,7 +2,7 @@
 # Modified by PastureStack contributors for independent maintenance and rebranding.
 
 ARG UBUNTU_IMAGE=ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
-FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a AS ubuntu_security_backports
+FROM ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19 AS ubuntu_security_backports
 FROM ${UBUNTU_IMAGE} AS tool-builder
 
 ARG GO_VERSION=1.27.3
@@ -194,7 +194,7 @@ RUN --mount=from=ubuntu_security_backports,source=/out,target=/opt/pasturestack/
     for document in manifest.json qualification.json openvex.json source-inputs.lock.json; do \
         cp "/opt/pasturestack/ubuntu-security-backports/${document}" "${evidence}/${document}"; \
     done; \
-    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > "${evidence}/bundle-image.txt"; \
+    printf '%s\n' 'ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19' > "${evidence}/bundle-image.txt"; \
     (cd "${evidence}" && sha256sum manifest.json qualification.json openvex.json source-inputs.lock.json install.json verify.json bundle-image.txt > SHA256SUMS); \
     dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
     rm -f /var/cache/ldconfig/aux-cache

Makefile

@@ -1,6 +1,6 @@
 # Created by PastureStack contributors for repeatable validation.
 
-VERSION ?= v0.3.3
+VERSION ?= v0.3.4
 REVISION ?= $(shell git rev-parse HEAD)
 IMAGE_REPOSITORY ?= local/system-image-preloader
 IMAGE ?= $(IMAGE_REPOSITORY):$(VERSION)

README.md

@@ -1,6 +1,8 @@
 # PastureStack System Image Preloader
 
-Linux runtime **`v0.3.3`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+Linux runtime **`v0.3.4`** integrates shared Ubuntu 26.04 security backports for already-installed packages while preserving the selected coreutils provider.
+
+The shared bundle includes the official Brotli decoder fix for CVE-2026-111497.
 
 The image retains bundle manifests, source inputs and installation receipts under `/usr/share/pasturestack/security/ubuntu-backports/`.
 
@@ -77,7 +79,7 @@ restores the image-presence state. It never performs a broad image prune.
 Use the immutable semantic tag:
 
 ```text
-ghcr.io/pasturestack/system-image-preloader:v0.3.3
+ghcr.io/pasturestack/system-image-preloader:v0.3.4
 ```
 
 The deployment definition must mount `/var/run/docker.sock`, run one instance

scripts/integration-smoke

@@ -4,7 +4,7 @@
 set -Eeuo pipefail
 
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-IMAGE="${IMAGE:-local/system-image-preloader:v0.3.3}"
+IMAGE="${IMAGE:-local/system-image-preloader:v0.3.4}"
 TEST_PULL_IMAGE="${TEST_PULL_IMAGE:-ghcr.io/pasturestack/container-cron:v0.6.0}"
 PLATFORM_VERSION="${PLATFORM_VERSION:-v1.6.281}"
 ACCESS_KEY="integration-access"