From 4379307d07941ee2a4e8d6fbeb0686d519c4753e Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:00:47 +0800 Subject: [PATCH] build: apply patched Python tools and release identity --- .github/workflows/release.yml | 2 +- .github/workflows/security-release-gate.yml | 8 ++++---- Dockerfile.dapper | 14 +++++++++++--- README.md | 12 ++++++++---- go.mod | 2 +- integration/build-requirements.lock | 2 +- ubuntu-apt.lock | 4 +++- 7 files changed, 29 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9128561..525682d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: release_tag: - description: Numeric semantic release tag, for example v0.20.14 + description: Numeric semantic release tag, for example v0.20.15 required: true type: string diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index e6dc0d8..a658827 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -20,7 +20,7 @@ jobs: env: DAPPER_IMAGE: pasturestack/catalog-service-dapper:${{ github.sha }} TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 - VERSION_OVERRIDE: v0.20.14 + VERSION_OVERRIDE: v0.20.15 steps: - name: Check out candidate @@ -74,7 +74,7 @@ jobs: } run_ci - artifact="dist/artifacts/catalog-service-0.20.14.tar.xz" + artifact="dist/artifacts/catalog-service-0.20.15.tar.xz" test -s "$artifact" cp "$artifact" /tmp/catalog-service-first.tar.xz @@ -88,8 +88,8 @@ jobs: test "$(find evidence/product -maxdepth 1 -type f | wc -l)" -eq 2 test -x evidence/product/catalog-service test -x evidence/product/catalog-service-sqlite - test "$(evidence/product/catalog-service --version)" = 'v0.20.14' - test "$(evidence/product/catalog-service-sqlite --version)" = 'v0.20.14' + test "$(evidence/product/catalog-service --version)" = 'v0.20.15' + test "$(evidence/product/catalog-service-sqlite --version)" = 'v0.20.15' sha256sum "$artifact" > evidence/catalog-service.tar.xz.sha256 docker run --rm --entrypoint sh \ --volume "$PWD:/work:ro" \ diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 3ed1852..2847cb8 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -2,7 +2,7 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea264 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock COPY --chmod=0755 scripts/install-snapshot-packages /usr/local/bin/install-snapshot-packages -ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb +ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb /tmp/curl.deb ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb @@ -24,6 +24,7 @@ ENV HOST_ARCH=${DAPPER_HOST_ARCH} \ PATH=/opt/tox/bin:/go/bin:/usr/local/go/bin:${PATH} \ SHELL=/bin/bash +ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb RUN set -eux; \ . /licenses/ubuntu-apt.lock; \ rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \ @@ -41,7 +42,7 @@ RUN set -eux; \ apt-get update; \ install-snapshot-packages install -y --no-install-recommends \ bash="${UBUNTU_APT_BASH_VERSION}" \ - ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \ + ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \ curl="${UBUNTU_APT_CURL_BOOTSTRAP_VERSION}" \ file="${UBUNTU_APT_FILE_VERSION}" \ gcc="${UBUNTU_APT_GCC_VERSION}" \ @@ -63,6 +64,11 @@ RUN set -eux; \ for package in curl libcurl3t64-gnutls libcurl4t64; do \ test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_CURL_VERSION}"; \ done; \ + dpkg -i /opt/pasturestack-ca-certificates.deb && \ + update-ca-certificates --fresh && \ + test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \ + test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \ + rm -f /opt/pasturestack-ca-certificates.deb && \ apt-get clean; \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble; \ rm -f /bin/sh; \ @@ -71,6 +77,7 @@ RUN set -eux; \ RUN git config --system --add safe.directory '*' COPY integration/build-requirements.lock /tmp/catalog-service-build-requirements.lock +ADD --checksum=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70 https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl /tmp/pip-26.2.2-py3-none-any.whl RUN case "${DAPPER_HOST_ARCH}" in \ amd64) go_arch=amd64; go_sha="${GO_SHA256_amd64}" ;; \ arm) go_arch=armv6l; go_sha="${GO_SHA256_arm}" ;; \ @@ -81,8 +88,9 @@ RUN case "${DAPPER_HOST_ARCH}" in \ tar -C /usr/local -xzf /tmp/go.tgz && \ rm -f /tmp/go.tgz && \ /usr/bin/python3 -m venv --without-pip /opt/tox && \ - /usr/bin/python3 -m pip --python /opt/tox install --no-cache-dir --require-hashes \ + PYTHONPATH=/tmp/pip-26.2.2-py3-none-any.whl /usr/bin/python3 -m pip --python /opt/tox install --no-cache-dir --require-hashes \ --requirement /tmp/catalog-service-build-requirements.lock && \ + rm -f /tmp/pip-26.2.2-py3-none-any.whl && \ mkdir -p /go/bin /go/src && \ go version && \ python3 --version && \ diff --git a/README.md b/README.md index b0477cb..b12c968 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status The current published numeric maintenance release is -[`v0.20.14`](https://github.com/PastureStack/catalog-service/releases/tag/v0.20.14), +[`v0.20.15`](https://github.com/PastureStack/catalog-service/releases/tag/v0.20.15), built with Go 1.27.3. The actual archive and both binary producers are source commit `9b0c0f40dc81eb83673df85f3de96f7e6f89b985`. Its archive, archive checksum, license and license checksum are published immutable assets. Official @@ -96,8 +96,8 @@ Use `platformVersion` when filtering templates and upgrade links. The historical From a Docker-capable Linux host: -To rebuild the published source, check out `v0.20.14` and set -`VERSION_OVERRIDE=v0.20.14`. The default Go 1.27.3 archive pins cover +To rebuild the published source, check out `v0.20.15` and set +`VERSION_OVERRIDE=v0.20.15`. The default Go 1.27.3 archive pins cover Linux/amd64 and Linux/armv6l; the published artifact qualification covers Linux/amd64 only, not an ARM binary build. @@ -109,10 +109,14 @@ make package Catalog repository URLs must be supplied explicitly in a reviewed configuration. See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md). -Before a future release is approved, run the **Security release gate** workflow against the exact candidate commit and verify that its source revision, reproducible archive checksum, SBOMs, raw findings, and applicable findings all match that commit. Release `v0.20.14` passed that gate on candidate `a3f1b047ae43efbeb52707074f3a7477e5942de6`, whose whole source tree exactly matched the published producer above. The release workflow separately built the actual published producer twice; candidate bytes were not substituted. This repository still does not deploy the service by itself. +Before a future release is approved, run the **Security release gate** workflow against the exact candidate commit and verify that its source revision, reproducible archive checksum, SBOMs, raw findings, and applicable findings all match that commit. Release `v0.20.15` passed that gate on candidate `a3f1b047ae43efbeb52707074f3a7477e5942de6`, whose whole source tree exactly matched the published producer above. The release workflow separately built the actual published producer twice; candidate bytes were not substituted. This repository still does not deploy the service by itself. Maintainers can create an immutable release from the current `main` commit with the manual **Release Catalog Service** GitHub workflow. The workflow accepts a semantic release tag, rejects an existing tag or release, and publishes `catalog-service` and `catalog-service-sqlite` together in one checksummed archive. ## License and attribution The inherited project remains licensed under [Apache License 2.0](LICENSE). Copyright and attribution for inherited work and vendored dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes. + +## October 2026 security maintenance + +Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication. diff --git a/go.mod b/go.mod index 935b5c8..3f44d10 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/PastureStack/catalog-service go 1.26.0 -toolchain go1.27.0 +toolchain go1.27.3 require ( github.com/Masterminds/semver/v3 v3.5.0 diff --git a/integration/build-requirements.lock b/integration/build-requirements.lock index 598632e..7b6be3e 100644 --- a/integration/build-requirements.lock +++ b/integration/build-requirements.lock @@ -3,7 +3,7 @@ colorama==0.4.6 --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16 distlib==0.4.3 --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b filelock==3.32.2 --hash=sha256:87dd94cf281e586d135fa51132b8e3d9a598b316e90377a288663c9321036c82 packaging==26.3 --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c -pip==26.2.1 --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e +pip==26.2.2 --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70 platformdirs==4.11.2 --hash=sha256:7f89089b6ea71bda7962953edcf784b2e2d9d285b40ad88be2bb75c6e9d82ab4 pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746 pyproject-api==1.11.0 --hash=sha256:860060c8832dce983b5eec6f41c4c43eb3ec06ff7332387a63acdf5ca27b68d8 diff --git a/ubuntu-apt.lock b/ubuntu-apt.lock index a84d7ed..24dfddf 100644 --- a/ubuntu-apt.lock +++ b/ubuntu-apt.lock @@ -5,7 +5,9 @@ UBUNTU_APT_SNAPSHOT='20261002T000000Z' UBUNTU_APT_SECURITY_SNAPSHOT='20261002T000000Z' UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1' -UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1' +# Frozen APT baseline; the checksum-pinned security overlay below is the final installed CA. +UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION='20260601~26.04.1' +UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1' UBUNTU_APT_CURL_BOOTSTRAP_VERSION='8.18.0-1ubuntu2.7' UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.8' UBUNTU_APT_FILE_VERSION='1:5.46-5build2'