mixandClaude Opus 5.5
68493dc097
Security audit 2026-10-17, findings I4 and I5 (low), stage 5. I4: every action is pinned by commit with its version in a comment - the latest release of the major each used, so nothing changes in behaviour (checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0, build-push-action v6.19.2, login-action v3.7.0; commits read with git ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the source in test.yml, and in release.yml on the image's panel and selfpost-backup binaries before the push (-mode=binary: the base image's Go, which may lag the runner's - a fixed stdlib advisory then fails the release until golang:1.26-trixie moves, which is the point). certbot is pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17). provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the plan says. I5: published tags are never rebuilt, so a Debian security fix reaches operators with the next release. The guide (§ Upgrading) and SECURITY.md say so; base-packages.yml runs .github/scripts/base-packages.sh every Monday: what debian:trixie-slim would install for postfix, libsasl2-2, libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against the table in development.md (the 2.14.3 image's versions), red when one moved. Tried on the test server: green as it stands, red with a version changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.7 KiB
Bash
Executable File
33 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# base-packages.sh: compare the Debian packages the mail path runs on with
|
|
# what debian:trixie-slim would install today (security audit 2026-10-17,
|
|
# I5). The image installs without pinning, and published tags are never
|
|
# rebuilt, so a security update of postfix, Cyrus SASL, OpenSSL or Berkeley
|
|
# DB reaches operators only with the next release. This fails when one of
|
|
# them has moved past the version the last release was built with - the
|
|
# table between the base-package-versions markers in docs/development.md -
|
|
# as the nudge to cut a patch release (and then to update the table).
|
|
#
|
|
# Run by .github/workflows/base-packages.yml every week; needs docker.
|
|
set -eu
|
|
doc=docs/development.md
|
|
table=$(sed -n '/<!-- base-package-versions -->/,/<!-- \/base-package-versions -->/p' "$doc" |
|
|
sed -n 's/^| `\([^`]*\)` | `\([^`]*\)` |$/\1 \2/p')
|
|
[ -n "$table" ] || { echo "no base-package-versions table in $doc" >&2; exit 2; }
|
|
names=$(echo "$table" | cut -d' ' -f1 | tr '\n' ' ')
|
|
# apt-cache policy's "Candidate:" is what an install would take now.
|
|
now=$(docker run --rm debian:trixie-slim sh -c "apt-get update -qq >/dev/null && for p in $names; do printf '%s %s\n' \"\$p\" \"\$(apt-cache policy \"\$p\" | sed -n 's/^ *Candidate: //p')\"; done")
|
|
moved=0
|
|
echo "$table" | while read -r name built; do
|
|
cand=$(echo "$now" | awk -v n="$name" '$1 == n { print $2 }')
|
|
if [ "$cand" != "$built" ]; then
|
|
echo "::warning::$name: the last release was built with $built, trixie now installs ${cand:-nothing}" >&2
|
|
echo moved
|
|
fi
|
|
done | grep -q moved && moved=1
|
|
if [ "$moved" = 1 ]; then
|
|
echo "A package the mail path runs on has moved: cut a patch release, then update the table in $doc." >&2
|
|
exit 1
|
|
fi
|
|
echo "Every watched package is as the last release was built."
|