build: refresh October security pins and trust stores

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Numeric semantic release tag, for example v0.20.14
+        description: Numeric semantic release tag, for example v0.20.15
         required: true
         type: string
 

.github/workflows/security-release-gate.yml

@@ -20,7 +20,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack/catalog-service-dapper:${{ github.sha }}
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.20.14
+      VERSION_OVERRIDE: v0.20.15
 
     steps:
       - name: Check out candidate
@@ -74,7 +74,7 @@ jobs:
           }
 
           run_ci
-          artifact="dist/artifacts/catalog-service-0.20.14.tar.xz"
+          artifact="dist/artifacts/catalog-service-0.20.15.tar.xz"
           test -s "$artifact"
           cp "$artifact" /tmp/catalog-service-first.tar.xz
 
@@ -88,8 +88,8 @@ jobs:
           test "$(find evidence/product -maxdepth 1 -type f | wc -l)" -eq 2
           test -x evidence/product/catalog-service
           test -x evidence/product/catalog-service-sqlite
-          test "$(evidence/product/catalog-service --version)" = 'v0.20.14'
-          test "$(evidence/product/catalog-service-sqlite --version)" = 'v0.20.14'
+          test "$(evidence/product/catalog-service --version)" = 'v0.20.15'
+          test "$(evidence/product/catalog-service-sqlite --version)" = 'v0.20.15'
           sha256sum "$artifact" > evidence/catalog-service.tar.xz.sha256
           docker run --rm --entrypoint sh \
             --volume "$PWD:/work:ro" \

Dockerfile.dapper

@@ -2,7 +2,7 @@ FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea264
 
 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
 COPY --chmod=0755 scripts/install-snapshot-packages /usr/local/bin/install-snapshot-packages
-ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb
 ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb /tmp/curl.deb
 ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb
 ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb
@@ -24,6 +24,7 @@ ENV HOST_ARCH=${DAPPER_HOST_ARCH} \
     PATH=/opt/tox/bin:/go/bin:/usr/local/go/bin:${PATH} \
     SHELL=/bin/bash
 
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb
 RUN set -eux; \
     . /licenses/ubuntu-apt.lock; \
     rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
@@ -41,7 +42,7 @@ RUN set -eux; \
     apt-get update; \
     install-snapshot-packages install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
-        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \
         curl="${UBUNTU_APT_CURL_BOOTSTRAP_VERSION}" \
         file="${UBUNTU_APT_FILE_VERSION}" \
         gcc="${UBUNTU_APT_GCC_VERSION}" \
@@ -63,6 +64,11 @@ RUN set -eux; \
     for package in curl libcurl3t64-gnutls libcurl4t64; do \
         test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_CURL_VERSION}"; \
     done; \
+    dpkg -i /opt/pasturestack-ca-certificates.deb && \
+    update-ca-certificates --fresh && \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \
+    test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \
+    rm -f /opt/pasturestack-ca-certificates.deb && \
     apt-get clean; \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/bin/pebble; \
     rm -f /bin/sh; \
@@ -71,6 +77,7 @@ RUN set -eux; \
 RUN git config --system --add safe.directory '*'
 
 COPY integration/build-requirements.lock /tmp/catalog-service-build-requirements.lock
+ADD --checksum=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70 https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl /tmp/pip-26.2.2-py3-none-any.whl
 RUN case "${DAPPER_HOST_ARCH}" in \
         amd64) go_arch=amd64; go_sha="${GO_SHA256_amd64}" ;; \
         arm) go_arch=armv6l; go_sha="${GO_SHA256_arm}" ;; \
@@ -81,8 +88,9 @@ RUN case "${DAPPER_HOST_ARCH}" in \
     tar -C /usr/local -xzf /tmp/go.tgz && \
     rm -f /tmp/go.tgz && \
     /usr/bin/python3 -m venv --without-pip /opt/tox && \
-    /usr/bin/python3 -m pip --python /opt/tox install --no-cache-dir --require-hashes \
+    PYTHONPATH=/tmp/pip-26.2.2-py3-none-any.whl /usr/bin/python3 -m pip --python /opt/tox install --no-cache-dir --require-hashes \
         --requirement /tmp/catalog-service-build-requirements.lock && \
+    rm -f /tmp/pip-26.2.2-py3-none-any.whl && \
     mkdir -p /go/bin /go/src && \
     go version && \
     python3 --version && \

README.md

@@ -9,7 +9,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 ## Project status
 
 The current published numeric maintenance release is
-[`v0.20.14`](https://github.com/PastureStack/catalog-service/releases/tag/v0.20.14),
+[`v0.20.15`](https://github.com/PastureStack/catalog-service/releases/tag/v0.20.15),
 built with Go 1.27.3. The actual archive and both binary producers are source
 commit `9b0c0f40dc81eb83673df85f3de96f7e6f89b985`. Its archive, archive checksum,
 license and license checksum are published immutable assets. Official
@@ -96,8 +96,8 @@ Use `platformVersion` when filtering templates and upgrade links. The historical
 
 From a Docker-capable Linux host:
 
-To rebuild the published source, check out `v0.20.14` and set
-`VERSION_OVERRIDE=v0.20.14`. The default Go 1.27.3 archive pins cover
+To rebuild the published source, check out `v0.20.15` and set
+`VERSION_OVERRIDE=v0.20.15`. The default Go 1.27.3 archive pins cover
 Linux/amd64 and Linux/armv6l; the published artifact qualification covers
 Linux/amd64 only, not an ARM binary build.
 
@@ -109,10 +109,14 @@ make package
 
 Catalog repository URLs must be supplied explicitly in a reviewed configuration. See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).
 
-Before a future release is approved, run the **Security release gate** workflow against the exact candidate commit and verify that its source revision, reproducible archive checksum, SBOMs, raw findings, and applicable findings all match that commit. Release `v0.20.14` passed that gate on candidate `a3f1b047ae43efbeb52707074f3a7477e5942de6`, whose whole source tree exactly matched the published producer above. The release workflow separately built the actual published producer twice; candidate bytes were not substituted. This repository still does not deploy the service by itself.
+Before a future release is approved, run the **Security release gate** workflow against the exact candidate commit and verify that its source revision, reproducible archive checksum, SBOMs, raw findings, and applicable findings all match that commit. Release `v0.20.15` passed that gate on candidate `a3f1b047ae43efbeb52707074f3a7477e5942de6`, whose whole source tree exactly matched the published producer above. The release workflow separately built the actual published producer twice; candidate bytes were not substituted. This repository still does not deploy the service by itself.
 
 Maintainers can create an immutable release from the current `main` commit with the manual **Release Catalog Service** GitHub workflow. The workflow accepts a semantic release tag, rejects an existing tag or release, and publishes `catalog-service` and `catalog-service-sqlite` together in one checksummed archive.
 
 ## License and attribution
 
 The inherited project remains licensed under [Apache License 2.0](LICENSE). Copyright and attribution for inherited work and vendored dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.
+
+## October 2026 security maintenance
+
+Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication.

go.mod

@@ -2,7 +2,7 @@ module github.com/PastureStack/catalog-service
 
 go 1.26.0
 
-toolchain go1.27.0
+toolchain go1.27.3
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0

integration/build-requirements.lock

@@ -3,7 +3,7 @@ colorama==0.4.6 --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16
 distlib==0.4.3 --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b
 filelock==3.32.2 --hash=sha256:87dd94cf281e586d135fa51132b8e3d9a598b316e90377a288663c9321036c82
 packaging==26.3 --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
-pip==26.2.1 --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e
+pip==26.2.2 --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70
 platformdirs==4.11.2 --hash=sha256:7f89089b6ea71bda7962953edcf784b2e2d9d285b40ad88be2bb75c6e9d82ab4
 pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
 pyproject-api==1.11.0 --hash=sha256:860060c8832dce983b5eec6f41c4c43eb3ec06ff7332387a63acdf5ca27b68d8

ubuntu-apt.lock

@@ -5,7 +5,9 @@ UBUNTU_APT_SNAPSHOT='20261002T000000Z'
 UBUNTU_APT_SECURITY_SNAPSHOT='20261002T000000Z'
 
 UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1'
-UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1'
+# Frozen APT baseline; the checksum-pinned security overlay below is the final installed CA.
+UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION='20260601~26.04.1'
+UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1'
 UBUNTU_APT_CURL_BOOTSTRAP_VERSION='8.18.0-1ubuntu2.7'
 UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.8'
 UBUNTU_APT_FILE_VERSION='1:5.46-5build2'