build: refresh October security pins and trust stores

.github/workflows/security-release-gate.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
-      VERSION_OVERRIDE: v0.23.17
+      VERSION_OVERRIDE: v0.23.18
       SOURCE_DATE_EPOCH: "0"
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
       BUILDER_IMAGE: pasturestack-websocket-proxy-dapper:ubuntu26
@@ -34,7 +34,7 @@ jobs:
           set -o pipefail
           make ci 2>&1 | tee evidence/build-test.log
           cp bin/websocket-proxy evidence/websocket-proxy-linux-amd64
-          cp dist/artifacts/websocket-proxy-0.23.17-linux-amd64.tar.xz evidence/first-build.tar.xz
+          cp dist/artifacts/websocket-proxy-0.23.18-linux-amd64.tar.xz evidence/first-build.tar.xz
           docker run --rm --entrypoint /bin/bash \
             -v "$PWD/evidence:/evidence:ro" "$BUILDER_IMAGE" \
             -lc 'go version -m /evidence/websocket-proxy-linux-amd64' >evidence/product.buildinfo
@@ -46,7 +46,7 @@ jobs:
           set -o pipefail
           rm -rf bin dist
           make package 2>&1 | tee evidence/reproducible-build.log
-          cp dist/artifacts/websocket-proxy-0.23.17-linux-amd64.tar.xz evidence/second-build.tar.xz
+          cp dist/artifacts/websocket-proxy-0.23.18-linux-amd64.tar.xz evidence/second-build.tar.xz
           cmp evidence/first-build.tar.xz evidence/second-build.tar.xz
           sha256sum evidence/first-build.tar.xz evidence/second-build.tar.xz \
             | tee evidence/package-sha256.txt

Dockerfile.dapper

@@ -1,14 +1,14 @@
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
-ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb
 
 ARG DAPPER_HOST_ARCH=amd64
 ARG GO_VERSION=1.27.3
 ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
 ARG GO_SHA256_arm=d6f4e11dd7157030d7ac11c51c8f73201a2db932d593c3106b1da11cc32bfdf8
-ARG DOCKER_VERSION=29.7.2
-ARG DOCKER_SHA256_amd64=803d433f226db4776e1768fd319fc6c6e4935a456acf84fcc0080818b854bc8f
+ARG DOCKER_VERSION=29.9.2
+ARG DOCKER_SHA256_amd64=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb
 ARG DOCKER_SHA256_arm=e9d0ba1b419d0c7a83ecec33c4c1ca8ac1e4f36b41c7254d5a816f766f106a59
 
 ENV HOST_ARCH=${DAPPER_HOST_ARCH} \
@@ -25,6 +25,7 @@ ENV HOST_ARCH=${DAPPER_HOST_ARCH} \
     PATH=/go/bin:/usr/local/go/bin:${PATH} \
     SHELL=/bin/bash
 
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /opt/pasturestack-ca-certificates.deb
 RUN set -eux; \
     . /licenses/ubuntu-apt.lock; \
     rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
@@ -42,14 +43,19 @@ RUN set -eux; \
     apt-get update; \
     apt-get install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
-        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION}" \
         curl="${UBUNTU_APT_CURL_VERSION}" \
         gcc="${UBUNTU_APT_GCC_VERSION}" \
         git="${UBUNTU_APT_GIT_VERSION}" \
         gzip="${UBUNTU_APT_GZIP_VERSION}" \
         libc6-dev="${UBUNTU_APT_LIBC6_DEV_VERSION}" \
         tar="${UBUNTU_APT_TAR_VERSION}" \
         xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \
+    dpkg -i /opt/pasturestack-ca-certificates.deb && \
+    update-ca-certificates --fresh && \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = '20260816ubuntu0.26.04.1' && \
+    test ! -e /usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt && \
+    rm -f /opt/pasturestack-ca-certificates.deb && \
     { \
         printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; \
         dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; \

Makefile

@@ -1,7 +1,7 @@
 TARGETS := $(shell ls scripts)
 DAPPER_IMAGE ?= pasturestack-websocket-proxy-dapper:ubuntu26
 DAPPER_SOURCE ?= /go/src/github.com/PastureStack/websocket-proxy
-DOCKER_VERSION ?= 29.7.2
+DOCKER_VERSION ?= 29.9.2
 
 .dapper-image: Dockerfile.dapper
 	docker build \

README.md

@@ -6,7 +6,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Capabilities
 
-The source package version is `0.23.17`, built with Go 1.27.3 and supporting protocol-compatible Host API patch releases. Target-bound API Key tickets require exact target, operation, revision, expiry, and ticket digest matches from the trusted Engine. Handshake and periodic live checks fail closed. Persistent console secrets cannot extend an expired or revoked ticket; revocation also clears replay data. Legacy and full-without-expiry token authentication remains unchanged.
+The source package version is `0.23.18`, built with Go 1.27.3 and supporting protocol-compatible Host API patch releases. Target-bound API Key tickets require exact target, operation, revision, expiry, and ticket digest matches from the trusted Engine. Handshake and periodic live checks fail closed. Persistent console secrets cannot extend an expired or revoked ticket; revocation also clears replay data. Legacy and full-without-expiry token authentication remains unchanged.
 
 Every verified API Key stream requires an authenticated Host API connection declaring exactly `key-audit-v1,key-delegation-v1`, with a canonical numeric `0.38.x` version whose patch is at least `5`. Unknown major/minor families, duplicate or malformed declarations, prereleases, and leading-zero versions fail closed. Missing capabilities prevent forwarding any execution payload. The Proxy submits only the signed stream ticket and that connection's signed backend ticket to the Engine's fixed audit-only failure endpoint; it returns `BackendAuditCapabilityUnavailable` (503) only after durable acceptance, or `AuditUnavailable` (503) when evidence cannot be accepted. Ordinary non-Key streams do not gain this capability requirement.
 
@@ -42,12 +42,16 @@ make build
 make package
 ```
 
-The default producer version is `0.23.17`; `VERSION_OVERRIDE` accepts only numeric semantic versions. Packaging
+The default producer version is `0.23.18`; `VERSION_OVERRIDE` accepts only numeric semantic versions. Packaging
 rejects brand or maintenance suffixes and produces the deterministic,
-versioned `websocket-proxy-0.23.17-linux-amd64.tar.xz` asset. Install only a published artifact with the matching official Engine and host-api package; scoped stream protection cannot be provided by replacing the proxy alone. Package publication and deployment are explicit operations.
+versioned `websocket-proxy-0.23.18-linux-amd64.tar.xz` asset. Install only a published artifact with the matching official Engine and host-api package; scoped stream protection cannot be provided by replacing the proxy alone. Package publication and deployment are explicit operations.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).
 
 ## License and attribution
 
 The inherited project remains licensed under [Apache License 2.0](LICENSE). Copyright and attribution for inherited work and vendored dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.
+
+## October 2026 security maintenance
+
+Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned `ca-certificates 20260816ubuntu0.26.04.1` security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication.

go.mod

@@ -2,7 +2,7 @@ module github.com/PastureStack/websocket-proxy
 
 go 1.26.0
 
-toolchain go1.27.0
+toolchain go1.27.3
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1

scripts/validate

@@ -30,7 +30,7 @@ if [ "${#maintained_go_files[@]}" -gt 0 ]; then
 fi
 
 echo Running: version and dependency policy
-test "$(VERSION_OVERRIDE=v0.23.17 bash -c 'source scripts/version; printf %s "$VERSION"')" = "0.23.17"
+test "$(VERSION_OVERRIDE=v0.23.18 bash -c 'source scripts/version; printf %s "$VERSION"')" = "0.23.18"
 if VERSION_OVERRIDE=v0.23.12-maintenance.1 bash -c 'source scripts/version' >/dev/null 2>&1; then
     echo "non-numeric version suffix was accepted" >&2
     exit 1
@@ -92,7 +92,7 @@ grep -Fx 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb
 grep -Fx 'ARG GO_VERSION=1.27.3' Dockerfile.dapper >/dev/null
 test "$(go env GOVERSION)" = go1.27.3
 test "$(go version bin/websocket-proxy | awk '{print $2}')" = go1.27.3
-grep -Fx 'ARG DOCKER_VERSION=29.7.2' Dockerfile.dapper >/dev/null
+grep -Fx 'ARG DOCKER_VERSION=29.9.2' Dockerfile.dapper >/dev/null
 grep -Fx "UBUNTU_APT_SNAPSHOT='20260808T000000Z'" ubuntu-apt.lock >/dev/null
 
 gate='.github/workflows/security-release-gate.yml'

scripts/version

@@ -12,5 +12,5 @@ if [ -n "${VERSION_OVERRIDE:-}" ]; then
 	fi
 	VERSION=${VERSION_OVERRIDE#v}
 else
-	VERSION="0.23.17"
+	VERSION="0.23.18"
 fi

ubuntu-apt.lock

@@ -4,7 +4,9 @@
 UBUNTU_APT_SNAPSHOT='20260808T000000Z'
 
 UBUNTU_APT_BASH_VERSION='5.3-2ubuntu1'
-UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1'
+# Frozen APT baseline; the checksum-pinned security overlay below is the final installed CA.
+UBUNTU_APT_CA_CERTIFICATES_BOOTSTRAP_VERSION='20260601~26.04.1'
+UBUNTU_APT_CA_CERTIFICATES_VERSION='20260816ubuntu0.26.04.1'
 UBUNTU_APT_CURL_VERSION='8.18.0-1ubuntu2.3'
 UBUNTU_APT_GCC_VERSION='4:15.2.0-5ubuntu1'
 UBUNTU_APT_GIT_VERSION='1:2.53.0-1ubuntu1'