fix(security): package the official Ubuntu curl security update

docs/releases/server-1.6.533.md

@@ -23,6 +23,15 @@ Server正式發行、成品讀回、8080部署、13語系×桌面／窄版×亮
 以及普通HTTP複製仍各自待完成，不將來源測試當成瀏覽器通過。
 歷史矩陣與KVM待驗維持原狀。
 
+正式成品安全 gate 發現 curl `8.18.0-1ubuntu2.7` 的 `CVE-2026-92392` HIGH。
+本候選版改用 Ubuntu 2026-10-14 [USN-8927-1](https://ubuntu.com/security/notices/USN-8927-1)
+正式修補的 `curl`、`libcurl3t64-gnutls`、`libcurl4t64` `8.18.0-1ubuntu2.8`。
+三包直接取自官方安全套件庫，以簽章索引與實際 deb bytes 核對 SHA-256 後鎖定；
+保留其他套件的既有 snapshot、原套件 metadata、授權與安裝路徑。
+既有 `PASTURESTACK_CURL_SECURITY_SNAPSHOT=20261002T000000Z` 僅保留為 apt 來源標記；
+本次 curl 三包由上述獨立官方 ADD 與 checksum 提供，不來自該舊 snapshot。
+不新增 HIGH 豁免或 vendor-pending；仍須由正式成品安全 gate 確認修補結果。
+
 ## 邊界與升級
 
 不改註冊API、帳號權限、OIDC、MFA、HAProxy、DB、網路後端或效能設定。

scripts/check-server-api-explorer-patch.sh

@@ -1731,7 +1731,7 @@ fi
 for release_curl_security_marker in \
     'FROM ${UBUNTU_SECURITY_IMAGE} AS runtime_security_packages' \
     'ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z' \
-    'ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7' \
+    'ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8' \
     'ARG OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7' \
     'Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg' \
     'Acquire::AllowInsecureRepositories "false"' \
@@ -1753,6 +1753,17 @@ for release_curl_security_marker in \
     require_marker "$release_dockerfile" "$release_curl_security_marker" \
         SERVER_INCREMENTAL_CURL_SECURITY_REFRESH_MISSING
 done
+for release_curl_official_deb_marker in \
+    'ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc' \
+    'https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb' \
+    'ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e' \
+    'https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb' \
+    'ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266' \
+    'https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb' \
+    'cp "/tmp/${package}.deb" "/out/packages/${package}_${CURL_PACKAGE_VERSION}_amd64.deb"'; do
+    require_marker "$release_dockerfile" "$release_curl_official_deb_marker" \
+        SERVER_CURL_OFFICIAL_FIXED_DEB_PIN_MISSING
+done
 for release_libdbi_security_marker in \
     'ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4' \
     'ADD --checksum=sha256:3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e' \
@@ -1831,7 +1842,7 @@ require_marker "$build_script" \
     'PASTURESTACK_CURL_SECURITY_SNAPSHOT=20261002T000000Z' \
     SERVER_CURL_IMAGE_SNAPSHOT_GATE_MISSING
 require_marker "$build_script" \
-    'PASTURESTACK_CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7' \
+    'PASTURESTACK_CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8' \
     SERVER_CURL_IMAGE_VERSION_GATE_MISSING
 require_marker "$build_script" \
     'PASTURESTACK_GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4' \
@@ -2261,4 +2272,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.533 base=v1.6.460 engine=0.183.348 web_console=1.6.188 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'

scripts/test-current-server-packaging-contract.py

@@ -508,6 +508,58 @@ def previous_gate(gate=GATE):
 
 
 class Tests(unittest.TestCase):
+    def test_official_curl_fixed_debs_are_pinned_outside_the_unchanged_snapshot(self):
+        recipe, builder = FILES[DOCKER], FILES[BUILD]
+        version = '8.18.0-1ubuntu2.8'
+        expected = {
+            'curl': '2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc',
+            'libcurl3t64-gnutls': '8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e',
+            'libcurl4t64': '7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266',
+        }
+        declared = engine_gate_markers(GATE, 'release_curl_official_deb_marker')
+        normalized = recipe.replace('\\\n', ' ')
+        for package, digest in expected.items():
+            url = 'https://security.ubuntu.com/ubuntu/pool/main/c/curl/' + package + '_' + version + '_amd64.deb'
+            pattern = (r'^ADD --checksum=sha256:' + digest + r'\s+' + re.escape(url)
+                       + r'\s+/tmp/' + re.escape(package) + r'[.]deb\s*$')
+            self.assertRegex(normalized, re.compile(pattern, re.M))
+            self.assertIn('ADD --checksum=sha256:' + digest, declared)
+            self.assertIn(url, declared)
+        self.assertEqual(recipe.count('ARG CURL_PACKAGE_VERSION=' + version), 2)
+        self.assertEqual(recipe.count('ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z'), 2)
+        self.assertNotRegex(recipe, r'apt-get download\s+\\\s*\n\s*"curl=')
+        copy = 'cp "/tmp/${package}.deb" "/out/packages/${package}_${CURL_PACKAGE_VERSION}_amd64.deb"'
+        self.assertIn(copy, declared)
+        self.assertIn(copy + ';', recipe)
+        self.assertIn('PASTURESTACK_CURL_PACKAGE_VERSION=' + version, builder)
+        self.assertIn('"' + version + '"', builder)
+        self.assertNotIn('8.18.0-1ubuntu2.7', recipe + builder + FILES[VEX] + GATE)
+        for field in ('Package', 'Version', 'Architecture'):
+            self.assertIn('dpkg-deb -f "${package_file}" ' + field, recipe)
+        fixed = next(item for item in json.loads(FILES[VEX])['statements']
+                     if item['vulnerability']['name'] == 'CVE-2026-8932')
+        self.assertEqual(fixed['status'], 'fixed')
+        self.assertEqual({item['@id'] for item in fixed['products']},
+                         {'pkg:deb/ubuntu/' + package + '@' + version + '?arch=amd64&distro=ubuntu-26.04'
+                          for package in expected})
+
+    def test_official_curl_gate_rejects_replaced_deb_inputs(self):
+        declared = engine_gate_markers(GATE, 'release_curl_official_deb_marker')
+        recipe = FILES[DOCKER]
+        self.assertEqual(len(declared), 7)
+        self.assertTrue(all(marker in recipe for marker in declared))
+        for marker in declared:
+            replacements = ['REMOVED_CURL_PIN']
+            if '8.18.0-1ubuntu2.8' in marker:
+                replacements.append(marker.replace('8.18.0-1ubuntu2.8', '8.18.0-1ubuntu2.7'))
+            if 'ADD --checksum=sha256:' in marker:
+                replacements.append('ADD --checksum=sha256:' + '0' * 64)
+            for replacement in replacements:
+                with self.subTest(marker=marker, replacement=replacement):
+                    mutated = recipe.replace(marker, replacement)
+                    self.assertFalse(all(required in mutated for required in declared),
+                                     'the actual require_marker set rejects a removed, stale or wrong-hash input')
+
     def test_official_dbi_security_update_is_isolated_and_hash_pinned(self):
         recipe, builder = FILES[DOCKER], FILES[BUILD]
         digest = '3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e'

scripts/test-server-component-candidate.py

@@ -264,7 +264,7 @@ def test_agent_archive_verbose_failure_cannot_bypass_link_rejection(self):
     def test_security_pins_and_overlay_path_are_retained(self):
         text = (ROOT / "server/Dockerfile.web-compose-release").read_text()
         for marker in ("ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403",
-                       "OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7", "CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7",
+                       "OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7", "CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8",
                        "FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2", "UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z",
                        "PatchV1GlobalSubscribe verify-hardware", "schema/service/service-auth.json", "db/core-124.xml"):
             self.assertIn(marker, text)

server/Dockerfile.web-compose-release

@@ -460,7 +460,7 @@ RUN set -eux; \
 FROM ${UBUNTU_SECURITY_IMAGE} AS runtime_security_packages
 
 ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z
-ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7
+ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8
 ARG OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7
 ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4
 ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2
@@ -479,6 +479,15 @@ ADD --checksum=sha256:f24a7f7c0428d74e33ea934696987b7336ec0962f212535185f0493792
 ADD --checksum=sha256:3040f61cc06ebf363e5895db4cc2c7a2db8951296d39d4ef5fa0fc3fd364654e \
     https://security.ubuntu.com/ubuntu/pool/main/libd/libdbi-perl/libdbi-perl_1.647-1ubuntu0.26.04.4_amd64.deb \
     /tmp/libdbi-perl.deb
+ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba0945dc \
+    https://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_8.18.0-1ubuntu2.8_amd64.deb \
+    /tmp/curl.deb
+ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e \
+    https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb \
+    /tmp/libcurl3t64-gnutls.deb
+ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 \
+    https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb \
+    /tmp/libcurl4t64.deb
 RUN set -eux; \
     mkdir -p /tmp/ca-bootstrap /etc/ssl/certs; \
     dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap; \
@@ -511,11 +520,8 @@ RUN set -eux; \
     sha256sum usr/lib/x86_64-linux-gnu/libpng16.so.16 > /out/libpng-runtime.sha256; \
     test "$(wc -l < /out/libpng-runtime.sha256)" -eq 1; \
     cd /out/packages; \
-    apt-get download \
-      "curl=${CURL_PACKAGE_VERSION}" \
-      "libcurl3t64-gnutls=${CURL_PACKAGE_VERSION}" \
-      "libcurl4t64=${CURL_PACKAGE_VERSION}"; \
     for package in curl libcurl3t64-gnutls libcurl4t64; do \
+      cp "/tmp/${package}.deb" "/out/packages/${package}_${CURL_PACKAGE_VERSION}_amd64.deb"; \
       package_file="$(find . -maxdepth 1 -type f -name "${package}_*.deb" -print)"; \
       test -n "${package_file}"; \
       test "$(printf '%s\n' "${package_file}" | wc -l)" -eq 1; \
@@ -581,7 +587,7 @@ ARG NODE_AGENT_VERSION=0.13.28
 ARG NODE_AGENT_COMMIT=bb4e057c089e5384bc9836b42db206326c690387
 ARG NODE_AGENT_ARCHIVE_SHA256=a16ae6be5fb72fa2ba38bd1076fd3b9e0536c48e70995ffa49d17b8063e2f8d0
 ARG UBUNTU_RUNTIME_SECURITY_SNAPSHOT=20261002T000000Z
-ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7
+ARG CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8
 ARG OPENSSL_PACKAGE_VERSION=3.5.5-1ubuntu3.7
 ARG LIBDBI_PERL_PACKAGE_VERSION=1.647-1ubuntu0.26.04.4
 ARG FREETYPE_PACKAGE_VERSION=2.14.2+dfsg-1ubuntu0.2

server/build-api-explorer-patch-image.sh

@@ -356,7 +356,7 @@ for marker in \
     PASTURESTACK_RUNTIME_GO_VERSION=1.27.2 \
     PASTURESTACK_UBUNTU_SECURITY_REFRESH=2026-09-10 \
     PASTURESTACK_CURL_SECURITY_SNAPSHOT=20261002T000000Z \
-    PASTURESTACK_CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.7 \
+    PASTURESTACK_CURL_PACKAGE_VERSION=8.18.0-1ubuntu2.8 \
     PASTURESTACK_GLIBC_CVE_2026_18374_FIX=not-in-execute-path \
     PASTURESTACK_GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4 \
     PASTURESTACK_PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3 \
@@ -847,7 +847,7 @@ EOF
     }
     for curl_package in curl libcurl3t64-gnutls libcurl4t64; do
         test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${curl_package}")" = \
-            "8.18.0-1ubuntu2.7"
+            "8.18.0-1ubuntu2.8"
     done
     for glibc_package in libc6 libc-bin libc-gconv-modules-extra; do
         test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${glibc_package}")" = \
@@ -966,7 +966,7 @@ EOF
 docker run --rm -i --network none --entrypoint bash "$image" -s \
     < scripts/test-server-openssl-tls.sh
 
-printf 'SERVER_API_EXPLORER_PATCH_IMAGE_OK image=%s revision=%s base=%s orchestration=%s orchestration_commit=%s orchestration_sha256=%s api_explorer=%s api_explorer_commit=%s artifact_sha256=%s web_console=%s web_console_commit=%s web_console_sha256=%s catalog_service=%s catalog_service_commit=%s catalog_service_archive_sha256=%s catalog_service_binary_sha256=%s catalog_service_sqlite_binary_sha256=%s authentication_service=%s authentication_service_commit=%s authentication_service_archive_sha256=%s authentication_service_binary_sha256=%s websocket_proxy=%s websocket_proxy_commit=%s websocket_proxy_archive_sha256=%s websocket_proxy_binary_sha256=%s compose_executor=%s compose_executor_commit=%s compose_executor_archive_sha256=%s compose_executor_binary_sha256=%s vsphere_cli=%s vsphere_cli_commit=%s vsphere_cli_archive_sha256=%s govc_binary_sha256=%s runtime_go=1.27.2 orchestration_updated=1 wrappers_pinned=1 audit_log_filters=1 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 vendor_pending=exact-set artifact_scan=required\n' \
+printf 'SERVER_API_EXPLORER_PATCH_IMAGE_OK image=%s revision=%s base=%s orchestration=%s orchestration_commit=%s orchestration_sha256=%s api_explorer=%s api_explorer_commit=%s artifact_sha256=%s web_console=%s web_console_commit=%s web_console_sha256=%s catalog_service=%s catalog_service_commit=%s catalog_service_archive_sha256=%s catalog_service_binary_sha256=%s catalog_service_sqlite_binary_sha256=%s authentication_service=%s authentication_service_commit=%s authentication_service_archive_sha256=%s authentication_service_binary_sha256=%s websocket_proxy=%s websocket_proxy_commit=%s websocket_proxy_archive_sha256=%s websocket_proxy_binary_sha256=%s compose_executor=%s compose_executor_commit=%s compose_executor_archive_sha256=%s compose_executor_binary_sha256=%s vsphere_cli=%s vsphere_cli_commit=%s vsphere_cli_archive_sha256=%s govc_binary_sha256=%s runtime_go=1.27.2 orchestration_updated=1 wrappers_pinned=1 audit_log_filters=1 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 vendor_pending=exact-set artifact_scan=required\n' \
     "$image" "$revision" "$base_image" "${orchestration_engine_release_tag#v}" \
     "$orchestration_engine_commit" "$orchestration_engine_artifact_sha256" \
     "${api_explorer_release_tag#v}" "$api_explorer_commit" "$api_explorer_artifact_sha256" \

server/security/openvex.json

@@ -55,17 +55,17 @@
       },
       "products": [
         {
-          "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04"
+          "@id": "pkg:deb/ubuntu/curl@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04"
         },
         {
-          "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04"
+          "@id": "pkg:deb/ubuntu/libcurl3t64-gnutls@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04"
         },
         {
-          "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.7?arch=amd64&distro=ubuntu-26.04"
+          "@id": "pkg:deb/ubuntu/libcurl4t64@8.18.0-1ubuntu2.8?arch=amd64&distro=ubuntu-26.04"
         }
       ],
       "status": "fixed",
-      "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.7, including the 2026-09-24 security update, and enforces the exact installed versions during image assembly and post-build validation."
+      "impact_statement": "The final runtime installs Ubuntu 26.04 curl and both shipped libcurl variants at 8.18.0-1ubuntu2.8 from the official USN-8927-1 security update, retaining the CVE-2026-8932 fix, and enforces the exact installed versions during image assembly and post-build validation."
     },
     {
       "vulnerability": {