Skip to content

Pin reviews for ten releases since 2026-10-19: seven fine, three held #644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevomB merged 1 commit into from
Oct 29, 2026
Merged

Pin reviews for ten releases since 2026-10-19: seven fine, three held #644

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions tools/pin-reviews.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,14 @@ gcc 14.4.0 16.2.0 fine 2026-09-19 14.4.0 is the newest 14.x. 15
glibc 2.40 2.44 fine 2026-09-19 The tarball is 2.40 and build/patches/glibc-2.40 carries upstream's maintained release/2.40/master branch to cdaa5d6d (2026-09-10), which is where 2.40's security fixes live. Re-read that branch's head when this row is next reviewed. GLIBC-SA-2026-0022 (CVE-2026-86805, the loader's $ORIGIN check racing for setuid programs; fixed only for 2.45) needs a setuid program whose RPATH climbs out of $ORIGIN, and fs.protected_hardlinks off: su and passwd carry no RPATH (the artifact audit lists every one in the image) and build/config/sysctl.d sets protected_hardlinks to 1.
glibc-branch cdaa5d6db08e 9bc3c99bffba fine 2026-10-15 build/patches/glibc-2.40's 0001 carries release/2.40/master to cdaa5d6d. The branch's one commit since, 9bc3c99b (2026-10-13), fixes an off-by-one in the AT_HWCAP4 loop of sysdeps/powerpc/dl-procinfo.h, reached only on PowerPC: nothing in it builds for x86-64. Move the patch to the branch head when the branch next fixes generic or x86-64 code.
rustc 1.98.1 1.99.1 fine 2026-10-16 Release notes 1.99.0: language, lint, library and Cargo changes; no security fix. 1.99.1 fixes a miscompilation that 1.99.0 brought in on x86-64, a bool returned to C with its upper bits left set (rust-lang/rust#163911: rustc stopped marking the return zeroext), and wcslen on UEFI and rust-lld's rpath on macOS; 1.98.1 still masks the bool. Never 1.99.0. The browser's layer and kryptikd (build/config/rust.lock) move together.
llvm 23.1.3 23.1.4 fine 2026-10-23 The 34 commits from llvmorg-23.1.3 to 23.1.4: code generation fixes (X86, ARM, AArch64, PowerPC, Mips, SPARC, NVPTX, SelectionDAG, InstCombine, GlobalISel), Clang's counted_by through unions, lld's ELF layout, llvm-objcopy, llvm-ar and release tooling; no security fix. Only the browser's build uses this release build (build/images/clang.sh): bindgen's libclang reads Firefox's headers and llvm-objdump answers configure. GCC compiles the browser and rustc brings its own LLVM, so none of its code generation reaches the image.
mpc 1.3.1 1.4.1 fine 2026-09-19 NEWS 1.4.0 and 1.4.1: no security or wrong-result fix. 1.4.0 is to be skipped if this ever moves.

# --- held: a fix exists upstream and the pin stays, for the reason given -----------
ca-bundle 2026-08-13 2026-10-20 held 2026-10-23 The 2026-09-25 bundle holds the same 121 certificates as the pin, byte for byte; only its header's date and certdata.txt digest differ. 2026-10-20's is made from that same certdata.txt and leaves out three eMudhra roots, emSign Root CA - C1, emSign ECC Root CA - C3 and emSign ECC Root CA - G3: curl.se strips them (mk-ca-bundle.pl -x in its ca/update.sh) after Mozilla reported on 2026-10-20 that the private keys of eight eMudhra intermediate certificates were compromised, and NSS 3.131.1 removes the same three. OpenSSL and Python have nothing like Firefox's OneCRL, so with the pin the net zone's check of a release server, and lynx or python in a zone, accept a certificate those intermediates issue under the emSign roots; a release itself is still checked by its signature. The report also names Sectigo-issued cross-certificates sharing those keys, whose root was not identified here, so the new bundle closes the emSign path and is not known to close every path. The bump is queued. Not today: the owner tests on a laptop this weekend, and ca-bundle is built before wlroots, the base every image is built on, so its bump rebuilds every image, the 2.5-hour browser image among them.
firefox 153.5.0 153.5.1 held 2026-10-23 MFSA 2026-112 (2026-10-20) names one fix in 153.5.1: CVE-2026-113470 (high) builds in the OneCRL entries that block the compromised eMudhra intermediates, which Mozilla sent to running browsers through Remote Settings on 2026-10-17. 153.5.0 has them only once Remote Settings syncs, and a profile made afresh at each start, as untrusted's is, begins every session without them. The bump is queued. Not today: the owner tests on a laptop this weekend, and a browser bump rebuilds the 2.5-hour browser image.
node 24.22.0 24.22.1 held 2026-10-23 A security release (2026-10-21): CVE-2026-105481 (http agent data guard), -105482 (null bytes in dns resolve), -105483 and -106069 (TLS IP address checks), -106073 (realpathSync under the permission model), -106074 (random caches across snapshots) and -111497 (brotli decoder), with OpenSSL 3.5.9, NSS 3.131.1's roots (the three emSign roots gone), c-ares 1.34.9 and undici 7.30.1. None reaches a running Kryptik: node is a layer only the browser's build uses (build/images/node.sh), which runs it offline on Mozilla's verified source to build the devtools debugger's modules, and no zone gets it. Held as a security release all the same; the bump is queued with the browser's. Not today: the owner tests on a laptop this weekend, and a node bump rebuilds the 2.5-hour browser image.

# --- fine: nothing in the gap is a security fix that reaches Kryptik ---------------
gawk 5.3.0 5.4.1 fine 2026-09-26 build/patches/gawk-5.3.0 carries upstream's fixes for CVE-2026-40467 (do_getline_redir use-after-free, a2d18c74), -40468 (do_sub and parse_escape overflows, 062f2f25) and -40553 (readdir extension, cca03661 and bfa2e4b8), made against 5.3.0's text; make check passes. -40469 (aa7272a6) guards 32-bit builds only and is not carried. 5.4 makes MinRX the default regex engine under every build script that calls awk, glibc's and the kernel's included: move in a build of its own, not in a batch.
shadow 4.16.0 4.20.3 fine 2026-09-27 build/patches/shadow-4.16.0 carries 4.17.0's sgetgrent use-after-free fix (8424d7c49462). No CVE is fixed in the gap; 4.20.3 only fixes the build with --with-nscd=no. CVE-2024-56433 is unfixed upstream and does not reach Kryptik: it needs accounts defined on the network with UIDs in the default /etc/subuid range and a setuid newuidmap; nsswitch.conf reads passwd and group from files only, and stage 06's audit-setuid.sh refuses any setuid file but su, so no user can map the subordinate range that zones (uid_base 100000) also use. 4.19 needs --disable-logind, 4.20 changes the login.defs line the recipe edits, removes PASS_MIN_DAYS and makes su - fail unless TIOCSTI is off. Target 4.19.4, with the recipe.
Expand All @@ -35,20 +41,23 @@ pkgconf 2.3.0 3.0.10 fine 2026-10-19 NEWS to 3.0.10: no security fi
skalibs 2.15.1.0 2.16.0.0 fine 2026-10-19 NEWS and the eight commits to v2.16.0.0: waitpids and waitpids_nohang replace waitn*, openslurpclose_at becomes a macro over openslurpnclose_at, tain_addmsec_g's definition is fixed, header order and Solaris qsort_r detection; no security fix. An API change: execline, s6 and s6-rc move with it.
execline 2.9.9.2 2.10.0.0 fine 2026-10-19 NEWS and the six commits to v2.10.0.0: cd and umask renamed, --enable-pedantic-posix, posix-cd and loopwhilex -n removed, wait rewritten to reap only the pids it lists; no security fix. Kryptik's services and scripts call none of these (no execline script in build/services).
s6 2.15.1.0 2.15.1.1 fine 2026-10-19 The eight commits to v2.15.1.1: READY=1 accepted without a newline, s6-softlimit -h lowering the soft limit, s6-sudod's error reporting, doc typos; no security fix. Kryptik calls neither s6-softlimit nor s6-sudod.
s6-rc 0.7.0.0 0.8.0.1 fine 2026-10-19 NEWS and the 25 commits to v0.8.0.1: compiled databases record their major version, s6-rc-compile -L, snapshots in s6-rc-set-install for upgrades across major versions, s6-rc-update's rollback deleting the right directory, and in 0.8.0.1 alone s6-rc-set-new's naming of a set's .real directory; no security fix. Kryptik compiles its database at build time and runs neither s6-rc-update nor the s6-rc-set commands.
s6-rc 0.7.0.0 0.8.0.2 fine 2026-10-23 NEWS and the 25 commits to v0.8.0.1: compiled databases record their major version, s6-rc-compile -L, snapshots in s6-rc-set-install for upgrades across major versions, s6-rc-update's rollback deleting the right directory, and in 0.8.0.1 alone s6-rc-set-new's naming of a set's .real directory; no security fix. 0.8.0.2's one fix (e3e2e110) gives s6-rc-set-new's rx buffer the byte that 0.8.0.1's longer .real name needs, which it wrote past on the stack: a bug 0.8.0.1 brought in, as 0.7.0.0 sizes that buffer to what it writes (checked). Kryptik compiles its database at build time and runs neither s6-rc-update nor the s6-rc-set commands.
iana-etc 20261009 20261015 fine 2026-10-19 One commit: IANA's protocol-numbers.xml and service-names-port-numbers.xml refreshed. Data, no code.
intel-microcode 20260812 20260925 fine 2026-09-27 Release notes 20260925: one functional update, Meteor Lake C0 (06-aa-04, 0x28 to 0x2b), and no security advisory.
ca-bundle 2026-08-13 2026-09-25 fine 2026-09-27 The 2026-09-25 bundle holds the same 121 certificates, byte for byte; only its header's date and certdata.txt digest differ.
linux-firmware 20260916 20261019 fine 2026-10-23 The 206 commits between the tags, read against firmware.list and the AMD microcode stage 05 builds into the kernel. What changes in the image: AMD's family 1Ah microcode (new patches for models 02h and 11h, EPYC 9005: 0x0b00217b and 0x0b101068; models 08h and 24h unchanged); iwlwifi's core24.80-41 builds for cc, Qu and QuZ (-77), ty, So and Ma (-89, with their PNVM files), Bz with Hr or Gf and Sc with Gf (-100); amdgpu's DMCUB, GC, PSP TA and ASD, VCN and VPE updates; and new board entries in the ath11k WCN6855 hw2.0 and ath12k WCN7850 hw2.0 board-2.bin. No commit states a security fix, and no AMD or Intel advisory, Debian tracker entry or NVD record names one in these files; Intel's August Wi-Fi advisories (INTEL-SA-01422, -01468) came before the pin, which carries core24.70-49. Vendors disclose firmware fixes on their own dates: re-read this row when Intel or AMD next publish.
groff 1.23.0 1.24.2 fine 2026-09-29 NEWS 1.24.0 to 1.24.2: 1.24.2 fixes command injection (CWE-78) in mmroff, pdfmom and pre-grohtml, which the image does not install (build/recipes/groff.sh); man renders for a terminal, never HTML. 1.24.0 has incompatible request-syntax changes; never that one.
lvm2 2.03.42 2.03.43 fine 2026-09-30 WHATS_NEW 2.03.43 and WHATS_NEW_DM 1.02.217: no security fix. Kryptik builds device-mapper alone (libdevmapper, dmsetup); its changes are raid reload suppression, vdostats and a nesting limit in the config parser, which reads nothing a zone supplies.
e2fsprogs 1.47.1 1.47.4 fine 2026-09-19 Release notes 1.47.2 to 1.47.4: no security fix.
libpipeline 1.5.7 1.5.8 fine 2026-09-19 NEWS 1.5.8: no security fix.
man-db 2.12.1 2.13.1 fine 2026-09-19 NEWS 2.13.0 and 2.13.1: no security fix.
perl 5.40.5 5.44.0 fine 2026-09-19 5.40.5 is the newest 5.40.x and has every fix through CVE-2026-13221. 5.40 is in perlpolicy's security-fix window (tools/support-policy.tsv). 5.42 and 5.44 are new series, not security releases.
elfutils 0.191 0.196 fine 2026-09-27 Only libelf is built: objtool links it when stage 05 builds the kernel, and iproute2's ip and tc use it to load BPF objects (lib/bpf_legacy.c). 43 commits touch libelf in 0.192 to 0.196. The fixes for crafted files include elf_strptr on a section without data (CVE-2025-1376, b16f441), the elf_scnshndx rewrite (c65c467), checks on compressed-section and archive-member sizes, and 2026's out-of-bounds reads in elf_getarsym and the archive index (b35e1ec, 8b19216, 3a122a0, 681b793). None reaches Kryptik: objtool reads only the build's own objects, and ip and tc parse an object only when root loads it as BPF, which already needs CAP_NET_ADMIN; nothing in Kryptik does. CVE-2025-1352, -1365, -1371, -1372 and -1377 are in libdw, readelf and strip, which are not built.
elfutils 0.191 0.197 fine 2026-10-23 Only libelf is installed: objtool links it when stage 05 builds the kernel, and iproute2's ip and tc use it to load BPF objects (lib/bpf_legacy.c). 43 commits touch libelf in 0.192 to 0.196, and five in 0.197. The fixes for crafted files include elf_strptr on a section without data (CVE-2025-1376, b16f441), the elf_scnshndx rewrite (c65c467), checks on compressed-section and archive-member sizes, 2026's out-of-bounds reads in elf_getarsym and the archive index (b35e1ec, 8b19216, 3a122a0, 681b793), and in 0.197 a bound on the buffer a zstd-compressed section's header makes libelf allocate (0a8e362). 0.197's other libelf commits fix locking in the --enable-thread-safety build, which is not configured, add a reference-count helper libdwfl_stacktrace uses, and sync elf.h. None reaches Kryptik: objtool reads only the build's own objects, and ip and tc parse an object only when root loads it as BPF, which already needs CAP_NET_ADMIN; nothing in Kryptik does. CVE-2025-1352, -1365, -1371, -1372 and -1377, and 0.197's fixes to readelf, libdw and unstrip, are in code the image does not install.
iproute2 7.2.0 7.3.0 fine 2026-10-23 The 35 commits from v7.2.0 to v7.3.0: OVPN device mode, DPLL pin details, nexthop fdb ports, bond lacp_strict and the LACP partner port state read as 16 bits, SRv6 encap lookup, ipmaddr through RTM_GETMULTICAST, ss's vsock port filter and wider sockstat ports, tc u32's IPv6 port printing, two leaks in lib (getcmdline, a failed realloc), devlink and rdma changes, kernel headers and compiler warnings; no security fix. The recipe builds neither devlink nor rdma.
meson 1.12.0 1.12.1 fine 2026-09-27 The 53 commits of 1.12.1: fixes to compiler sanity checks, dist, cargo, the Java and PyPy probes and the Visual Studio backend; no security fix.
libxkbcommon 1.13.2 1.14.0 fine 2026-09-19 NEWS for 1.14.0: no security fix. Upstream's own tags show 1.14.0 only as betas on the day this was read, so the survey may be early.
libdrm 2.4.129 2.4.134 fine 2026-09-19 The 27 commits between them: none is a security fix.
libinput 1.30.4 1.32.0 fine 2026-09-19 CVE-2026-35093, -35094 and -50292 are all fixed in the pinned 1.30.4, the newest 1.30.x. 1.31.3 and 1.32.0 add hardening against malicious uinput devices that was not backported; wlroots 0.19.3 has not been built against 1.32.
dwl 0.8 0.9 fine 2026-09-27 v0.8..v0.9, 55 commits. The decoration use-after-free fix (f4dfdab, 04279f2) is carried as build/patches/dwl-0.8, and the idle-inhibitor one (4847f97) needs a protocol the proxy never offers a zone (see that README); 433c325, d16036e and 7ba3350 fix IME and pointer code new in 0.9. The Xwayland fixes do not apply (built with XWAYLAND=). 0.8 holds a monitor's frames while a tiled window's resize is pending only when its client is dwl's own child, and a zone window's client is the proxy, which kryptikd starts. f6800e9 stops a key binding's release from reaching the client focused after it, which learns only which binding key was let go. 0.9 needs wlroots 0.20; its new data-control, image-capture and foreign-toplevel globals are off the proxy's allowlist.
libevdev 1.13.7 1.14.0 fine 2026-10-07 Four commits since 1.13.7 (tagged 2026-10-07): two new force-feedback functions, libevdev_upload_ff_effect and libevdev_remove_ff_effect, and two documentation fixes; no security fix, and libinput calls neither.
nano 9.2 9.3 fine 2026-10-23 NEWS 9.3 and the 51 commits in its ChangeLog: the mini bar clips an overlong file name properly and converts it once, the keypad's operator keys type their characters, a multibyte character typed with Alt held is kept, and the rest is linter, help, syntax, build and code tidying; no security fix. 9.2 draws the file name only after display_string() has put its control codes in ^ notation, and the mini bar is off unless --minibar or a nanorc asks for it; the image installs no nanorc.
harfbuzz 14.6.0 15.0.0 fine 2026-10-23 NEWS 15.0.0 and its 142 commits. GHSA-r62p-jr5f-3mjm (medium: out-of-bounds reads on a crafted font's substitute feature parameters, fixed by e0f6fbfa) is in libharfbuzz-subset, which the toolkit image does not build (-Dsubset=disabled), nor does it build the raster, vector, GPU or WebAssembly parts 15.0.0 also fixes. The use-after-free in hb_font_set_face() (ef64f7ea) and the heap overflow in hb_font_set_variation() after it (47b18b6e) need a caller that moves a font to another face; Pango 1.58.2 and GTK 3.24.52 call neither (checked in the pinned tarballs). The shaper's other crafted-font fixes bound the work on composite glyphs (0bfc7a9b) and clamp a variable advance (3fff9052), against a timeout and a wrong advance. GTK shapes with the fonts a zone's own fontconfig finds, and Firefox shapes web fonts with its own copy.
Loading