Merge forward/ubuntu jammy to noble - #724
Merged
Merged
Conversation
- Set MaxStartups 10:30:100 in sshd_config (CIS 5.1.18) - Enable use_pty and logfile=/var/log/sudo.log in sudoers (CIS 5.2.2, 5.2.3) - Configure TMOUT=900 shell timeout in /etc/profile.d/01-tmout.sh (CIS 5.4.3.2) - Add corresponding rspec tests in os_image_shared_examples
- Change MaxStartups from default 10:30:100 to 10:30:60 in sshd_config - Update corresponding rspec test assertion
- Assert root ownership and group for /etc/profile.d/01-tmout.sh in rspec tests - Ensure MaxStartups scan validates single directive in sshd_config - Normalize MaxStartups sed pattern to match tab/space indentations and quote chroot paths - Quote chroot path expansions in TMOUT profile script creation
Commit 4dfe37a refactored the iptables rules in restrict-monit-api-access to be idempotent, but accidentally reversed the insertion order. By using `-I` (Insert at position 1) for both rules, the DROP rule was inserted first, and then the ACCEPT rule was inserted above it. This meant the DROP rule was evaluated before the ACCEPT rule. As a result, TCP RESET packets sent by the kernel (which do not belong to the monit-api-access cgroup) to clean up orphaned connections were dropped. This left sockets lingering in the LAST-ACK state for ~106 seconds, causing subsequent monit commands to fail with "Cannot connect to the monit daemon" if they were assigned the same ephemeral port. This commit fixes the idempotency logic to ensure the rules are always inserted in the correct order, using `-A` to append so that the order is the same as the reading order (ACCEPT evaluated before DROP).
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.7...v4.37.8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [advanced-security/spdx-dependency-submission-action](https://github.com/advanced-security/spdx-dependency-submission-action) from 0.2.0 to 0.3.2. - [Release notes](https://github.com/advanced-security/spdx-dependency-submission-action/releases) - [Commits](advanced-security/spdx-dependency-submission-action@v0.2.0...v0.3.2) --- updated-dependencies: - dependency-name: advanced-security/spdx-dependency-submission-action dependency-version: 0.3.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
The git resource does a full clone of canonical/ubuntu-security-notices on every get, regardless of sparse_paths/depth config - vex/ and osv/ dominate the repo (34GB at HEAD) even though usn/, the only directory any consumer reads, is 570MB. Benchmarked on a real worker: plain clone 8909s/58.5GB vs. partial+shallow+sparse clone 43s/664MB cold, 2s warm. ai-assisted=yes [TNZ-88995]
CI: replace usn git resource with partial-clone task
It depends on a get of bosh-stemcells-ci in the in_parallel block, so it can't be parallelized with it. ai-assisted=yes [TNZ-88995]
CI: Move fetch-usn-gh-json task outside of in_parallel
We recently ran into a problem where publishing a stemcell failed because our USN resource was broken for a month, and thus we accumulated many many fixed CVES. So many that we exceeded the allowed length of a github release body. This commit drops the USN description text in that case. ai-assisted=yes [TNZ-135846]
…ny-cves CI: Drop USN descriptions from release when too big
Canonical publishes OVAL data keyed by codename only (com.ubuntu.<codename>.usn.oval.xml.bz2) -- a `ubuntu-<version>-lts` form has never existed upstream. usn-resource carried a hardcoded alias map to translate that form, and it had no 26.04 entry, so both resolute USN resources failed every check with `Unknown os: ubuntu-26.04-lts` and no job in the automatic-triggers group had ever run. Derive `os` from os_short_name, which is already the codename and already the single source of truth for resource names, input mappings and image_os_tag. That removes the second, independently-derived spelling of the release which caused the divergence, and needs no resource-side table for future stemcell lines. ai-assisted=yes [TNZ-88995]
…e-jammy CI: Address USN OVAL feed by release codename
Two conflicts, both resolved toward the branch that had moved on: ci/pipeline-template.yml (check-usn-packages-are-available) -- took jammy. PRs #717/#718 replaced the <os>-usn-gh-json git resource with the fetch-usn-gh-json partial-clone task and activated the high-critical-cves-processed trigger. The other two USN jobs had already auto-merged to the task, and the usn-gh-json resource definition was gone, so noble's side left a `get:` of an undefined resource. The resolved job is byte-identical to jammy's. stemcell_builder/.../assets/restrict-monit-api-access -- took noble's deletion. noble moved monit's firewall from iptables to nftables/systemd in e1245f4, which also deleted monit-access-helper.sh; the script sources that file, so jammy's version cannot run on noble. noble's bosh_monit/apply.sh copies only monitrc and monit.service, and nothing in the tree references the script. jammy's 382ac0b LAST-ACK fix touched only this file, so nothing else needed carrying.
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
aramprice
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supercedes #723