From e072083f19c656671478e8db519c0a82c96ecf43 Mon Sep 17 00:00:00 2001 From: DevomB Date: Tue, 6 Oct 2026 20:56:39 -0700 Subject: [PATCH 1/5] expat 2.9.0: the release of 2026-10-05 that checks XML_ParseBuffer's len against the buffer it was given (CVE-2026-77214) and fixes an integer overflow in expat_realloc on 32-bit targets (CVE-2026-102633), signed by the same subkey of the pinned key as 2.8.5 The image's python3 reads XML through the system expat (--with-system-expat), so pyexpat carries the fix. x86_64 does not reach the 32-bit overflow. 2.9.0 also drops the attribute-info and minimum-size features, both off by default and never enabled by the recipe, and moves the library to libexpat.so.1.13.0, still libexpat.so.1. The release signature verifies against subkey CB8DE70A90CFBF6C3BF5CC5696262ACFFBD3AEC6 of the pinned 3176EF7DB2367F1FCA4F306B1F9B0E909AF37285. --- build/config/versions.env | 2 +- sources.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/config/versions.env b/build/config/versions.env index 950bae32..233d6625 100644 --- a/build/config/versions.env +++ b/build/config/versions.env @@ -55,7 +55,7 @@ V_SHADOW=4.16.0 # --- compression / core libs --- V_BZIP2=1.0.8 V_ZSTD=1.5.6 -V_EXPAT=2.8.5 +V_EXPAT=2.9.0 V_LIBFFI=3.5.2 V_LIBXCRYPT=4.5.2 diff --git a/sources.lock b/sources.lock index 0fb416c3..e171b6ea 100644 --- a/sources.lock +++ b/sources.lock @@ -23,7 +23,7 @@ ccc8bbb3fb66a7e6f0392693533ac9c8bd4e6283dd1f66992e68ec4d4a9cdee7 dwl-v0.8.tar.g df76db71366d1d708365fc7a6c60ca48398f14367eb2b8954efc8897147ad871 elfutils-0.191.tar.bz2 eb69809fc0d1187f2463ab2149c53aa9f42a78e59f14ebea68eae6cb6b4fc1c3 eudev-3.2.15.tar.gz 908ed4db3a6b3a23a205d8fd4cf2a71089156f2aeae0f54656045aafad2dee32 execline-2.9.9.2.tar.gz -1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182 expat-2.8.5.tar.xz +1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051 expat-2.9.0.tar.xz fc97f51029bb0e2c9f4e3bffefdaf678f0e039ee872b9de5c002a6d09c784d82 file-5.45.tar.gz bfd19cb06cc71f3352d567e90284d8cdac02ac89774bbeadf0b533b0c11432fd findutils-4.11.0.tar.xz e87aae032bf07c26f85ac0ed3250998c37621d95f8bd748b31f15b33c45ee995 flex-2.6.4.tar.gz From 157c872db59cb1b05bb4fbc586d7a928e847d546 Mon Sep 17 00:00:00 2001 From: DevomB Date: Tue, 6 Oct 2026 20:56:41 -0700 Subject: [PATCH 2/5] iana-etc 20260930: /etc/services and /etc/protocols from IANA's registries of 2026-09-30; data files only, nothing is built --- build/config/versions.env | 2 +- sources.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/config/versions.env b/build/config/versions.env index 233d6625..dbe59cbd 100644 --- a/build/config/versions.env +++ b/build/config/versions.env @@ -73,7 +73,7 @@ V_GPERF=3.1 # --- system utilities --- V_ATTR=2.6.0 V_ACL=2.4.0 -V_IANA_ETC=20240806 +V_IANA_ETC=20260930 V_LESS=710 V_GROFF=1.23.0 V_PROCPS=4.0.7 diff --git a/sources.lock b/sources.lock index e171b6ea..ae42de8c 100644 --- a/sources.lock +++ b/sources.lock @@ -40,7 +40,7 @@ a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898 gmp-6.3.0.tar. 9aa0cc780dec156b8282844833b342ab7cb08c25d2cd9a1869cdd0df31deff48 gzip-1.15.tar.xz b4f819bfc3b0f8ea967018948dbf3a71f174a02886d00ee16121739fcd140d6f havoc-0.7.0.tar.gz f0c64cd7e31d70a5fb3a52e53ab50a61e74c0421a6381eaa45114eec3bde5fe7 hwdata-0.412.tar.gz -672dbe1ba52b889a46dc07ee3876664ed601983239f82d729d02a002475a5b66 iana-etc-20240806.tar.gz +ead94c150ba26a30a33c36722b97624fd9ff24c80abcd6303a21af52b24f9e55 iana-etc-20260930.tar.gz 57b3cf4f77555992881e5ba2a09a63b05aa2c56342a60ed4305b5f45938390b5 inetutils-2.8.tar.gz 4c2fa124c2cf0afd7ca34d1eeacba6ba048a56f6374e2aab93dafbdbd4eea9c0 iproute2-7.2.0.tar.xz 6f213700dbf96b5cc4499ca70cb15ecd69c09f405b06785bb4a1a10b572b6276 iputils-20250605.tar.xz From 2f37e3b521db191143069e6ed375fd63abd62882 Mon Sep 17 00:00:00 2001 From: DevomB Date: Tue, 6 Oct 2026 20:56:42 -0700 Subject: [PATCH 3/5] cmake 4.4.4: the patch release of 2026-10-02, which changes no documented feature or interface; the binary the chroot runs and the source fallback move together, and the sum list that names both is signed by the pinned key Upstream's note for 4.4.4 says only that implementation updates were made for ecosystem changes and regressions. cmake builds json-c and nothing else here and is not in the image. cmake-4.4.4-SHA-256.txt.asc verifies against subkey C6C265324BBEBDC350B513D02D2CEF1034921684 of the pinned CBA23971357C2E6590D9EFD3EC8FEF3A7BFB4EDA. --- build/config/versions.env | 2 +- sources.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/build/config/versions.env b/build/config/versions.env index dbe59cbd..fcc721b7 100644 --- a/build/config/versions.env +++ b/build/config/versions.env @@ -106,7 +106,7 @@ V_PERL=5.40.5 # cmake only builds json-c and is not in the image. The chroot runs Kitware's # binary (cmake-bin in sources.lock) to save a long source build; the source # tarball is the fallback where that binary cannot run. -V_CMAKE=4.4.3 +V_CMAKE=4.4.4 V_JSON_C=0.19-20260627 V_POPT=1.19 V_LIBAIO=0.3.113 diff --git a/sources.lock b/sources.lock index ae42de8c..e946e095 100644 --- a/sources.lock +++ b/sources.lock @@ -10,8 +10,8 @@ ae470fec429775653e042015edc928d07c8c3b2fc59765172a330d3d87785f86 bc-1.08.2.tar. 9bba0214ccf7f1079c5d59210045227bcf619519840ebfa80cd3849cff5a5bf2 bison-3.8.2.tar.xz ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269 bzip2-1.0.8.tar.gz f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9 cacert-2026-08-13.pem -d6c83076c575bc00b823522ac974bda66d0af05d6ddc30e739c12385cf32c6cc cmake-4.4.3-linux-x86_64.tar.gz -c46400618b4f1f2b43507f24fb22f3ae830c3416cf23b776e16e1d413aa892f0 cmake-4.4.3.tar.gz +e5bb807f7728cb60cd8b27ebc97a2edb469b68655f21e844a600c3575b76f5bb cmake-4.4.4-linux-x86_64.tar.gz +bd24c30d80a7744ae84b845ff080cc8453b06c622ef01066564108e9cefc44cf cmake-4.4.4.tar.gz a480198559733e9b3da999e90543ac6f888a2caa544d8d664c5a1f17e528e210 coreutils-9.12.tar.xz 3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35 cryptsetup-2.8.8.tar.xz fa9ca4d13871dd122f61258a80d01751d603b4d3ee14095d65453b4e846e17d7 dejavu-fonts-ttf-2.37.tar.bz2 From 22ad93e474c1d0b34bee66ff88c619f704c27709 Mon Sep 17 00:00:00 2001 From: DevomB Date: Tue, 6 Oct 2026 22:03:46 -0700 Subject: [PATCH 4/5] iana-etc's review row goes: the pin is current, and the gate refuses a row for a current pin --- tools/pin-reviews.tsv | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/pin-reviews.tsv b/tools/pin-reviews.tsv index 29d023b8..da6412ef 100644 --- a/tools/pin-reviews.tsv +++ b/tools/pin-reviews.tsv @@ -33,7 +33,6 @@ texinfo 7.1 7.3 fine 2026-09-19 NEWS 7.1.1 to 7.3: no security libtool 2.4.7 2.6.2 fine 2026-09-19 NEWS 2.5.x and 2.6.x: no security fix. gperf 3.1 3.3 fine 2026-09-19 NEWS 3.2 and 3.3: no security fix. pkgconf 2.3.0 3.0.7 fine 2026-09-19 NEWS to 3.0.7: no security fix. 3.0 breaks the libpkgconf ABI, moves to meson and changed quoting and sysroot handling twice. -iana-etc 20240806 20260911 fine 2026-09-19 Data only: /etc/services and /etc/protocols. intel-microcode 20260812 20260925 fine 2026-09-27 Release notes 20260925: one functional update, Meteor Lake C0 (06-aa-04, 0x28 to 0x2b), and no security advisory. ca-bundle 2026-08-13 2026-09-25 fine 2026-09-27 The 2026-09-25 bundle holds the same 121 certificates, byte for byte; only its header's date and certdata.txt digest differ. groff 1.23.0 1.24.2 fine 2026-09-29 NEWS 1.24.0 to 1.24.2: 1.24.2 fixes command injection (CWE-78) in mmroff, pdfmom and pre-grohtml, which the image does not install (build/recipes/groff.sh); man renders for a terminal, never HTML. 1.24.0 has incompatible request-syntax changes; never that one. From 53f407890c8b76837f63b23512702708729b5a63 Mon Sep 17 00:00:00 2001 From: DevomB Date: Tue, 6 Oct 2026 22:03:49 -0700 Subject: [PATCH 5/5] openssh 10.6p1: the release of 2026-10-06, whose one fix in ssh-keygen (dates converted with the wrong daylight-saving offset, so a certificate could carry an expiry an hour off) is the only one the image can reach, since ssh-keygen is all it builds; signed by the pinned key Everything else in the release is sshd, ssh and sftp: the LZ77 compression side channel, GSSAPI credential handling, sftp path validation, the "restrict" keyword and tunnel forwarding, usernames with $ and \ on the command line. None of those programs is built (build/recipes/openssh.sh makes ssh-keygen alone, for -Y verification). Upstream says it will now release more often; the pin follows. The tarball's signature verifies against the pinned 7168B983815A5EEF59A4ADFD2A3F414E736060BA. --- build/config/versions.env | 2 +- sources.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/config/versions.env b/build/config/versions.env index fcc721b7..4729f88c 100644 --- a/build/config/versions.env +++ b/build/config/versions.env @@ -114,7 +114,7 @@ V_LIBAIO=0.3.113 V_LVM2=2.03.42 # --- release signatures: only ssh-keygen is built from OpenSSH --- -V_OPENSSH=10.5p1 +V_OPENSSH=10.6p1 # --- the net zone: NAT, a resolver and DHCP (docs/design/net-zone.md) --- V_LIBMNL=1.0.5 diff --git a/sources.lock b/sources.lock index e946e095..9042b72c 100644 --- a/sources.lock +++ b/sources.lock @@ -79,7 +79,7 @@ a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e mtdev-1.1.7.ta 355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11 ncurses-6.6.tar.gz a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f nftables-1.1.7.tar.xz 974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17 ninja-1.13.2.tar.gz -d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11 openssh-10.5p1.tar.gz +a9dc9565dffe8640f64d863cd29a32bc4a3dbdec0566a7fc44c5d6ee767d5f39 openssh-10.6p1.tar.gz 603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a openssl-3.5.9.tar.gz f87cee69eec2b4fcbf60a396b030ad6aa3415f192aa5f7ee84cad5e11f7f5ae3 patch-2.8.tar.xz 1fe6f825b487d26c35aa51a35f52fe494d4cfc77b8051f8b1ee3391bf0289bc6 perl-5.40.5.tar.xz