diff --git a/CHANGELOG.md b/CHANGELOG.md index e625f0f..834e832 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,20 @@ useful than saying where the real one is. ## [Unreleased] +### Security + +- **The default engine is 29.9.2, built with Go 1.26.10, with containerd 2.3.7.** + Go 1.26.10 is the whole of moby 29.9.2: it rejects TLS chains through eight eMudhra + intermediates whose keys were compromised (CVE-2026-111943), so a pull from a registry + that still chains through one now fails verification instead of succeeding. containerd + moves from 2.3.6 to 2.3.7, the patch on the same line, for CVE-2026-95839 and + GHSA-8647-2jxj-p2rc (a crafted image manifest, or a registry's `Content-Length`, could + crash containerd) and GHSA-5p7c-hggf-c748 (a CRI-plugin mount leak). moby 29.9.1 took + containerd 2.4.2 for the first two; staying on 2.3 gets them without a minor-version + move. runc and BuildKit are unchanged. Existing installs + move with `skrog engine upgrade`; 29.9.0 stays in the manifest, so `skrog engine + rollback` returns to it. + ### Fixed - **`skrog compact` works on WSL 3.0** ([#560](https://github.com/wslkit/skrog/issues/560)). @@ -99,10 +113,10 @@ useful than saying where the real one is. `skrog install` and `skrog target create`. Behaviour is unchanged. - The verified rootfs download is cached in the base state directory when installing a named engine, so a second engine does not download it again. -- **The bundled docker CLI is 29.9.1**, from 29.8.2. amd64 is Docker's own zip, checksum +- **The bundled docker CLI is 29.9.2**, from 29.8.2. amd64 is Docker's own zip, checksum computed from the official download as before; the arm64 `docker.exe` is built from - docker/cli at commit `dfc520d`, pinned, with Go 1.26.9 to match the engine. Compose, - buildx and the credential helper are unchanged. The engine is still 29.9.0. + docker/cli at commit `a82e528`, pinned, with Go 1.26.10 to match the engine. Compose, + buildx and the credential helper are unchanged. ## [0.10.0] — 2026-10-12 diff --git a/guest/rootfs/versions.env b/guest/rootfs/versions.env index fbabd0e..1058be8 100644 --- a/guest/rootfs/versions.env +++ b/guest/rootfs/versions.env @@ -7,9 +7,9 @@ ALPINE_ROOTFS_SHA256=auto # verified against Alpine's published .sha256 at bui # Engine components, built from source (git tags in their upstream repos). # ENGINE_VERSION is the user-facing number; MOBY_TAG is moby's own tag spelling. -ENGINE_VERSION=29.9.0 -MOBY_TAG=docker-v29.9.0 -CONTAINERD_VERSION=v2.3.6 +ENGINE_VERSION=29.9.2 +MOBY_TAG=docker-v29.9.2 +CONTAINERD_VERSION=v2.3.7 RUNC_VERSION=v1.5.2 BUILDKIT_VERSION=v0.33.1 @@ -18,8 +18,8 @@ BUILDKIT_VERSION=v0.33.1 # engine VM. build-engine.sh fails the build on mismatch. Bump a *_SHA in the # same commit as its *_VERSION; discover a new value by running the build with # the SHA blank, which logs the resolved commit instead of failing. -MOBY_SHA=a5b58c94d334674eae3a3207d4f05417643a90d0 -CONTAINERD_SHA=ee2735368117d2eb259779949d5e75cdafec9761 +MOBY_SHA=0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c +CONTAINERD_SHA=6f589cf13dc01a5b493911355427e05b2ff005d7 RUNC_SHA=29dd3dc2b13b4123162e5fe132504bb4b15569f1 BUILDKIT_SHA=8c91502cf280bd70a0c50912ce251c46a8881d9f @@ -42,12 +42,13 @@ ALPINE_DIGEST=sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec4349 # "engine upgrade refuses combinations outside the tested matrix" (PLAN §04). # Toolchain used to build them; bumping this changes output, so it is pinned too. -# Floor is set by moby's go.mod (docker-v29.9.0 requires >= 1.26.8, as do -# containerd v2.3.6 and buildkit v0.33.1). The floor is not the target: moby -# builds docker-v29.9.0 with Go 1.26.9, whose runtime fixes five stdlib CVEs -# in dockerd (HTTP/2 DoS x4, a Windows junction escape) -- see moby's 29.9.0 -# notes. rootfs 29.9.0-1 was built with 1.26.8 and lacks them. -GO_VERSION=1.26.9 +# Floor is set by moby's go.mod (docker-v29.9.2 requires >= 1.26.8, as do +# containerd v2.3.7 and buildkit v0.33.1). The floor is not the target: moby +# builds docker-v29.9.2 with Go 1.26.10, which is the whole of that release -- +# its crypto/x509 rejects chains through eight compromised eMudhra +# intermediates (CVE-2026-111943). rootfs 29.9.0-1 was built with the floor +# and lacked 29.9.0's fixes; match moby's Dockerfile, not its go.mod. +GO_VERSION=1.26.10 # Packaging revision of the rootfs itself. The tarball carries more than the # engine (the skrog-agent, config, Alpine userland), so it can change while @@ -55,7 +56,7 @@ GO_VERSION=1.26.9 # Debian-style. Bump this when rootfs contents change without an engine bump; # reset to 1 on an engine bump. (The first 29.7.2 release predates the scheme # and is tagged bare, as rootfs-v29.7.2.) -ROOTFS_REVISION=2 +ROOTFS_REVISION=1 # Bump to force CI to recompile the engine even when nothing above changed — # the escape hatch for a poisoned cache or a change to build.sh's docker diff --git a/internal/dockercli/manifest.json b/internal/dockercli/manifest.json index 51118ad..37f477b 100644 --- a/internal/dockercli/manifest.json +++ b/internal/dockercli/manifest.json @@ -39,20 +39,20 @@ "components": [ { "name": "docker", - "version": "29.9.1", + "version": "29.9.2", "role": "cli", "target": "docker.exe", "license": "Apache-2.0", "licenseURL": "https://raw.githubusercontent.com/docker/cli/master/LICENSE", "arch": { "amd64": { - "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.9.1.zip", - "sha256": "5d9b66509390553fd97d590ec2ff0ce10b04c2ac653fa52f2abf2f05c4c197ca", + "url": "https://download.docker.com/win/static/stable/x86_64/docker-29.9.2.zip", + "sha256": "b2be959bfed1281ddaf665c0972cba9a62ce30c542b6bcce82f055bf8886bc7d", "zipEntry": "docker/docker.exe" }, "arm64": { - "url": "https://github.com/wslkit/skrog/releases/download/dockercli-v29.9.1/docker-29.9.1-windows-arm64.exe", - "sha256": "02eb3c7a2e266cecd91e77fb7e4de714eb3e39700764abca567196c4a94d9668" + "url": "https://github.com/wslkit/skrog/releases/download/dockercli-v29.9.2/docker-29.9.2-windows-arm64.exe", + "sha256": "9954955562a61a18ec2cc1f102a12e95987e71883617fb28af15cd565c461b01" } } }, diff --git a/internal/release/manifest.json b/internal/release/manifest.json index 81028d0..7b53640 100644 --- a/internal/release/manifest.json +++ b/internal/release/manifest.json @@ -38,8 +38,30 @@ ], "engines": [ { - "version": "29.9.0", + "version": "29.9.2", "default": true, + "rootfs": { + "amd64": { + "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.2-1/skrog-rootfs-29.9.2-1-amd64.tar.gz", + "sha256": "8be21d15f1debce03f2e707c0eb6258a85a70bdd92c7f83275864f3c4a427b31" + }, + "arm64": { + "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.2-1/skrog-rootfs-29.9.2-1-arm64.tar.gz", + "sha256": "bf9d7d3c5f3dbee42dd6c9a9fcde1f90db600ed0fee6a97cf6400151e46690aa" + } + }, + "components": { + "dockerd": "29.9.2", + "containerd": "2.3.7", + "runc": "1.5.2", + "buildkit": "0.33.1", + "alpine": "3.24.1", + "nvidia-cdi-hook": "1.20.0" + } + }, + { + "version": "29.9.0", + "default": false, "rootfs": { "amd64": { "url": "https://github.com/wslkit/skrog/releases/download/rootfs-v29.9.0-2/skrog-rootfs-29.9.0-2-amd64.tar.gz", diff --git a/third_party/docker-cli/versions.env b/third_party/docker-cli/versions.env index 17a8ed4..727fbef 100644 --- a/third_party/docker-cli/versions.env +++ b/third_party/docker-cli/versions.env @@ -14,8 +14,8 @@ # internal/dockercli/manifest.json -- the same binary is installed on both # architectures and reporting two different versions would be a support # nightmare. A test pins the two together. -DOCKER_CLI_VERSION=29.9.1 -DOCKER_CLI_TAG=v29.9.1 +DOCKER_CLI_VERSION=29.9.2 +DOCKER_CLI_TAG=v29.9.2 # The commit the tag must resolve to (#88). A git tag can be moved and a # source repository compromised, and the result is the binary every docker @@ -23,9 +23,9 @@ DOCKER_CLI_TAG=v29.9.1 # # This is the tag's dereferenced commit (refs/tags/^{}), not the tag # object's own hash. -DOCKER_CLI_SHA=dfc520dcc28994c4c699b9b219fd2f5a6bcec0ff +DOCKER_CLI_SHA=a82e528901260c8df6073311379eac65f92db204 # Toolchain. Bumping this changes the output, so it is pinned like everything # else. Kept in step with guest/rootfs/versions.env so the engine and the CLI # are built by the same compiler. -GO_VERSION=1.26.9 +GO_VERSION=1.26.10