[chen21019]

Result

Restore release build prerequisites without weakening package, CI, or scanner gates. The signed v0.9.28 tag remains immutable; its failed release run is not rerun or retagged. This source candidate targets a new v0.9.29 release.

Root cause and minimal change

The v0.9.28 Release run passed source tests and validation, then failed apk add in the HAProxy builder and runtime. Alpine's live stable repository no longer served eight locked direct-package versions.

Compared the direct packages against the official Alpine 3.24 main x86_64 APKINDEX and community APKINDEX:

Direct package	Previous pin	Available pin
ca-certificates	20260611-r0	20261020-r0
curl	8.21.0-r0	8.22.0-r0
libcrypto3, libssl3, openssl-dev	3.5.8-r0	3.5.9-r0
pcre2, pcre2-dev	10.47-r1	10.49-r0
zlib-dev	1.3.2-r0	1.3.2-r1

The other ten direct-package pins remain unchanged. Synchronize the two exact OpenSSL safety assertions with the upgraded pins; no assertion is removed. README records the failed immutable tag and the new source candidate truthfully.

Validation

• On local rootless disposable containers from the unchanged digest-pinned Alpine base, installed every exact builder direct-package pin: PASS, 69 packages.
• Installed every exact runtime direct-package pin: PASS, 51 packages.
• scripts/supply-chain-check: PASS, including module/vendor and existing TLS/action/image pin checks.
• git diff --check: PASS.
• Existing LB source/race validation is unchanged and was not needlessly rerun for this package-lock correction.

No controller source, workflow, scanner version, severity gate, ignore list, or base-image pin changed. Source/image scanning and normal protected PR checks remain required by the existing workflows. Native PastureStack load-balancer QA remains pending; no native PASS is claimed. No QA or production runtime was touched.