Repository navigation
fix(release): overlay the fixed zlib1g on runtime images - #2612
Merged
Merged
Conversation
The pinned Distroless cc-debian13 base carries zlib1g 1:1.3.dfsg+really1.3.1-1+b1. DSA-6613-1 fixes it in 1:1.3.dfsg+really1.3.1-1+deb13u1 (CVE-2026-76844, CVE-2026-85091 and CVE-2026-27171), so release images fail the advisory policy on fixable zlib findings until the base index ships that release. Add zlib1g to the pinned runtime package overlay beside libc6 and libssl3t64. It is the first overlaid package with an epoch: the Version field keeps the epoch while the archive file name drops it, so the installer and the image checker derive the file name without it. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Every advisory baseline accepted CVE-2026-85091 against zlib1g 1:1.3.dfsg+really1.3.1-1+b1. The overlay removes that version from the images, and the release candidate check refuses an exception whose finding is fixed or absent. Remove it, and test that every exception on an overlaid package names the overlay version. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every release image fails the advisory policy on fixable zlib findings. The pinned Distroless cc-debian13 base carries zlib1g
1:1.3.dfsg+really1.3.1-1+b1, and DSA-6613-1 fixes it in1:1.3.dfsg+really1.3.1-1+deb13u1(CVE-2026-76844, CVE-2026-85091 and CVE-2026-27171). This blocks the next release.What
1:1.3.dfsg+really1.3.1-1+deb13u1to the pinned runtime package overlay, beside libc6 and libssl3t64. Both architectures are pinned by SHA-256 to the debian-security snapshot20261107T075304Z; the hashes match that snapshot'sPackages.xz.+b1out of the images, and the release candidate check refuses an exception whose finding is fixed or absent.Checks run
python3 -m unittestontest_check_debian13_images,test_check_advisory_baselines(54 ran, 1 skipped),test_advisory_renewal,test_check_release_image_oci_labels(23 ran),test_nightly_release: OK.test_registry_releasewith PyYAML 6.0.2: 160 ran, OK, 1 skipped (platform-bound smoke).release/scripts/check-debian13-images.py: passed.dpkg,dpkg-debandsha256sum; it was red on the epoch file name before the fix.debian:trixie-sliminto the pinned Distroless runtime) forlinux/amd64andlinux/arm64with the real packages. Both final images recordzlib1g 1:1.3.dfsg+really1.3.1-1+deb13u1understatus.dand shiplibz.so.1.3.1.shellcheckandshfmt -don the installer: clean.Not verified here