From 83acd5ddb0f8e3249cf7b478cf9d0c706972e33b Mon Sep 17 00:00:00 2001
From: Leechael Yim <yanleech@gmail.com>
Date: Thu, 22 Oct 2026 08:08:48 +0800
Subject: [PATCH] fix(images): move gateway, KMS and verifier images to the
 fixed ca-certificates

The gateway, KMS and verifier runtime images pinned
ca-certificates=20230311+deb12u1 from the 20260317T000000Z snapshot. That
trust store still holds emSign ECC Root CA - G3 and Comodo AAA Services
root, and curl in an image built from those pins accepts a certificate
issued by one of the compromised eMudhra/emSign intermediates.

Advance the default Debian snapshot in pin-packages.sh to
20261021T000000Z, the first midnight snapshot whose debian-security
archive carries ca-certificates 20250419~deb12u2 (bookworm) and
20250419+deb13u1 (trixie), and pin ca-certificates=20250419~deb12u2 in the three runtime
lists and in the verifier builder list.

The other pins are regenerated the way build-image.sh records them
(dpkg -l of each stage after its apt step). Only packages whose pinned
version is gone from the new snapshot move, all to Debian security
updates: openssl/libssl3, curl/libcurl, krb5, nghttp2, jq, libcap2,
protobuf, musl. A second pass with the regenerated lists produces the
same lists.

The gateway and KMS builder stages keep ca-certificates=20250419: they
do not install ca-certificates, so the pin cannot move the copy that
ships in the rust base image.

The new images have new digests, so the compose hashes of the CVMs that
run them must be registered again in the on-chain and auth-config
allowlists.

Signed-off-by: Leechael Yim <yanleech@gmail.com>
---
 dstack/build/shared/pin-packages.sh           |  2 +-
 .../shared/builder-pinned-packages.txt        | 24 ++++++++---------
 .../builder/shared/pinned-packages.txt        | 26 +++++++++----------
 .../shared/builder-pinned-packages.txt        | 24 ++++++++---------
 .../builder/shared/pinned-packages.txt        |  6 ++---
 .../shared/builder-pinned-packages.txt        | 18 ++++++-------
 .../builder/shared/pinned-packages.txt        | 20 +++++++-------
 7 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/dstack/build/shared/pin-packages.sh b/dstack/build/shared/pin-packages.sh
index dbc036ad0..840c7b1af 100755
--- a/dstack/build/shared/pin-packages.sh
+++ b/dstack/build/shared/pin-packages.sh
@@ -15,7 +15,7 @@
 set -e
 
 PKG_LIST=$1
-SNAPSHOT_DATE=${SNAPSHOT_DATE:-20260317T000000Z}
+SNAPSHOT_DATE=${SNAPSHOT_DATE:-20261021T000000Z}
 
 if [ -z "$PKG_LIST" ]; then
     echo "Usage: $0 <pkg-list-file>" >&2
diff --git a/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt b/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
index e390e80bc..568d740a4 100644
--- a/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
+++ b/dstack/gateway/dstack-app/builder/shared/builder-pinned-packages.txt
@@ -309,10 +309,10 @@ libpng16-16t64:amd64=1.6.48-1
 libpq-dev=17.6-0+deb13u1
 libpq5:amd64=17.6-0+deb13u1
 libproc2-0:amd64=2:4.0.4-9
-libprotobuf-dev:amd64=3.21.12-11
-libprotobuf-lite32t64:amd64=3.21.12-11
-libprotobuf32t64:amd64=3.21.12-11
-libprotoc32t64:amd64=3.21.12-11
+libprotobuf-dev:amd64=3.21.12-11+deb13u1
+libprotobuf-lite32t64:amd64=3.21.12-11+deb13u1
+libprotobuf32t64:amd64=3.21.12-11+deb13u1
+libprotoc32t64:amd64=3.21.12-11+deb13u1
 libpsl-dev:amd64=0.21.2-1.1+b1
 libpsl5t64:amd64=0.21.2-1.1+b1
 libpython3-stdlib:amd64=3.13.5-1
@@ -347,8 +347,8 @@ libsqlite3-0:amd64=3.46.1-7
 libsqlite3-dev:amd64=3.46.1-7
 libssh2-1-dev:amd64=1.11.1-1
 libssh2-1t64:amd64=1.11.1-1
-libssl-dev:amd64=3.5.5-1~deb13u1
-libssl3t64:amd64=3.5.5-1~deb13u1
+libssl-dev:amd64=3.5.7-1~deb13u3
+libssl3t64:amd64=3.5.7-1~deb13u3
 libstdc++-14-dev:amd64=14.2.0-19
 libstdc++6:amd64=14.2.0-19
 libsvn1:amd64=1.14.5-3
@@ -424,9 +424,9 @@ media-types=13.0.0
 mercurial-common=7.0.1-2
 mercurial=7.0.1-2
 mount=2.41-5
-musl-dev:amd64=1.2.5-3
-musl-tools=1.2.5-3
-musl:amd64=1.2.5-3
+musl-dev:amd64=1.2.5-3.1~deb13u1
+musl-tools=1.2.5-3.1~deb13u1
+musl:amd64=1.2.5-3.1~deb13u1
 mysql-common=5.8+1.1.1
 native-architecture=0.2.6
 ncurses-base=6.5+20250216-2
@@ -434,8 +434,8 @@ ncurses-bin=6.5+20250216-2
 netbase=6.5
 nettle-dev:amd64=3.10.1-1
 openssh-client=1:10.0p1-7
-openssl-provider-legacy=3.5.5-1~deb13u1
-openssl=3.5.5-1~deb13u1
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
 pango1.0-tools=1.56.3-1
 passwd=1:4.17.4-2
 patch=2.8-2
@@ -446,7 +446,7 @@ pinentry-curses=1.3.1-2
 pkgconf-bin=1.8.1-4
 pkgconf:amd64=1.8.1-4
 procps=2:4.0.4-9
-protobuf-compiler=3.21.12-11
+protobuf-compiler=3.21.12-11+deb13u1
 python3-minimal=3.13.5-1
 python3-packaging=25.0-1
 python3.13-minimal=3.13.5-2
diff --git a/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt b/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
index f45296ccd..4efad8116 100644
--- a/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
+++ b/dstack/gateway/dstack-app/builder/shared/pinned-packages.txt
@@ -4,7 +4,7 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
 dash=0.5.12-2
 debconf=1.5.82
@@ -23,7 +23,7 @@ gzip=1.12-1
 hostname=3.23+nmu1
 init-system-helpers=1.65.2
 iproute2=6.1.0-3
-jq=1.6-2.1+deb12u1
+jq=1.6-2.1+deb12u3
 libacl1:amd64=2.3.1-3
 libapt-pkg6.0:amd64=2.6.1
 libattr1:amd64=1:2.5.1-4
@@ -37,11 +37,11 @@ libbz2-1.0:amd64=1.0.8-5+b1
 libc-bin=2.36-9+deb12u10
 libc6:amd64=2.36-9+deb12u10
 libcap-ng0:amd64=0.8.3-1+b3
-libcap2-bin=1:2.66-4+deb12u2+b2
-libcap2:amd64=1:2.66-4+deb12u2+b2
+libcap2-bin=1:2.66-4+deb12u3+b1
+libcap2:amd64=1:2.66-4+deb12u3+b1
 libcom-err2:amd64=1.47.0-2
 libcrypt1:amd64=1:4.4.33-2
-libcurl3-gnutls:amd64=7.88.1-10+deb12u14
+libcurl3-gnutls:amd64=7.88.1-10+deb12u15
 libdb5.3:amd64=5.3.28+dfsg2-1
 libdebconfclient0:amd64=0.270
 libelf1:amd64=0.188-2.1
@@ -56,14 +56,14 @@ libgdbm6:amd64=1.23-3
 libgmp10:amd64=2:6.2.1+dfsg1-1.1
 libgnutls30:amd64=3.7.9-2+deb12u4
 libgpg-error0:amd64=1.46-1
-libgssapi-krb5-2:amd64=1.20.1-2+deb12u4
+libgssapi-krb5-2:amd64=1.20.1-2+deb12u5
 libhogweed6:amd64=3.8.1-2
 libidn2-0:amd64=2.3.3-1+b1
-libjq1:amd64=1.6-2.1+deb12u1
-libk5crypto3:amd64=1.20.1-2+deb12u4
+libjq1:amd64=1.6-2.1+deb12u3
+libk5crypto3:amd64=1.20.1-2+deb12u5
 libkeyutils1:amd64=1.6.3-2
-libkrb5-3:amd64=1.20.1-2+deb12u4
-libkrb5support0:amd64=1.20.1-2+deb12u4
+libkrb5-3:amd64=1.20.1-2+deb12u5
+libkrb5support0:amd64=1.20.1-2+deb12u5
 libldap-2.5-0:amd64=2.5.13+dfsg-5
 liblz4-1:amd64=1.9.4-1
 liblzma5:amd64=5.4.1-1
@@ -71,7 +71,7 @@ libmd0:amd64=1.0.4-2
 libmnl0:amd64=1.0.4-3
 libmount1:amd64=2.38.1-5+deb12u3
 libnettle8:amd64=3.8.1-2
-libnghttp2-14:amd64=1.52.0-1+deb12u2
+libnghttp2-14:amd64=1.52.0-1+deb12u3
 libonig5:amd64=6.9.8-1
 libp11-kit0:amd64=0.24.1-2
 libpam-modules-bin=1.5.2-6+deb12u1
@@ -92,7 +92,7 @@ libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
 libssh2-1:amd64=1.10.0-3+b1
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -111,7 +111,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u3
 perl-modules-5.36=5.36.0-7+deb12u3
diff --git a/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt b/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
index e390e80bc..568d740a4 100644
--- a/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
+++ b/dstack/kms/dstack-app/builder/shared/builder-pinned-packages.txt
@@ -309,10 +309,10 @@ libpng16-16t64:amd64=1.6.48-1
 libpq-dev=17.6-0+deb13u1
 libpq5:amd64=17.6-0+deb13u1
 libproc2-0:amd64=2:4.0.4-9
-libprotobuf-dev:amd64=3.21.12-11
-libprotobuf-lite32t64:amd64=3.21.12-11
-libprotobuf32t64:amd64=3.21.12-11
-libprotoc32t64:amd64=3.21.12-11
+libprotobuf-dev:amd64=3.21.12-11+deb13u1
+libprotobuf-lite32t64:amd64=3.21.12-11+deb13u1
+libprotobuf32t64:amd64=3.21.12-11+deb13u1
+libprotoc32t64:amd64=3.21.12-11+deb13u1
 libpsl-dev:amd64=0.21.2-1.1+b1
 libpsl5t64:amd64=0.21.2-1.1+b1
 libpython3-stdlib:amd64=3.13.5-1
@@ -347,8 +347,8 @@ libsqlite3-0:amd64=3.46.1-7
 libsqlite3-dev:amd64=3.46.1-7
 libssh2-1-dev:amd64=1.11.1-1
 libssh2-1t64:amd64=1.11.1-1
-libssl-dev:amd64=3.5.5-1~deb13u1
-libssl3t64:amd64=3.5.5-1~deb13u1
+libssl-dev:amd64=3.5.7-1~deb13u3
+libssl3t64:amd64=3.5.7-1~deb13u3
 libstdc++-14-dev:amd64=14.2.0-19
 libstdc++6:amd64=14.2.0-19
 libsvn1:amd64=1.14.5-3
@@ -424,9 +424,9 @@ media-types=13.0.0
 mercurial-common=7.0.1-2
 mercurial=7.0.1-2
 mount=2.41-5
-musl-dev:amd64=1.2.5-3
-musl-tools=1.2.5-3
-musl:amd64=1.2.5-3
+musl-dev:amd64=1.2.5-3.1~deb13u1
+musl-tools=1.2.5-3.1~deb13u1
+musl:amd64=1.2.5-3.1~deb13u1
 mysql-common=5.8+1.1.1
 native-architecture=0.2.6
 ncurses-base=6.5+20250216-2
@@ -434,8 +434,8 @@ ncurses-bin=6.5+20250216-2
 netbase=6.5
 nettle-dev:amd64=3.10.1-1
 openssh-client=1:10.0p1-7
-openssl-provider-legacy=3.5.5-1~deb13u1
-openssl=3.5.5-1~deb13u1
+openssl-provider-legacy=3.5.7-1~deb13u3
+openssl=3.5.7-1~deb13u3
 pango1.0-tools=1.56.3-1
 passwd=1:4.17.4-2
 patch=2.8-2
@@ -446,7 +446,7 @@ pinentry-curses=1.3.1-2
 pkgconf-bin=1.8.1-4
 pkgconf:amd64=1.8.1-4
 procps=2:4.0.4-9
-protobuf-compiler=3.21.12-11
+protobuf-compiler=3.21.12-11+deb13u1
 python3-minimal=3.13.5-1
 python3-packaging=25.0-1
 python3.13-minimal=3.13.5-2
diff --git a/dstack/kms/dstack-app/builder/shared/pinned-packages.txt b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
index e966045f9..34659193c 100644
--- a/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
+++ b/dstack/kms/dstack-app/builder/shared/pinned-packages.txt
@@ -4,7 +4,7 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
 dash=0.5.12-2
 debconf=1.5.82
@@ -62,7 +62,7 @@ libsemanage2:amd64=3.4-1+b5
 libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -78,7 +78,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u2
 sed=4.9-1
diff --git a/dstack/verifier/builder/shared/builder-pinned-packages.txt b/dstack/verifier/builder/shared/builder-pinned-packages.txt
index 75a2bc37d..8717df157 100644
--- a/dstack/verifier/builder/shared/builder-pinned-packages.txt
+++ b/dstack/verifier/builder/shared/builder-pinned-packages.txt
@@ -12,7 +12,7 @@ binutils=2.40-2
 bsdutils=1:2.38.1-5+deb12u3
 build-essential=12.9
 bzip2=1.0.8-5+b1
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 clang-14=1:14.0.6-12
 clang=1:14.0-55.7~deb12u1
 comerr-dev:amd64=2.1-1.47.0-2+b2
@@ -277,10 +277,10 @@ libpng16-16:amd64=1.6.39-2+deb12u1
 libpq-dev=15.15-0+deb12u1
 libpq5:amd64=15.15-0+deb12u1
 libproc2-0:amd64=2:4.0.2-3
-libprotobuf-dev:amd64=3.21.12-3
-libprotobuf-lite32:amd64=3.21.12-3
-libprotobuf32:amd64=3.21.12-3
-libprotoc32:amd64=3.21.12-3
+libprotobuf-dev:amd64=3.21.12-3+deb12u1
+libprotobuf-lite32:amd64=3.21.12-3+deb12u1
+libprotobuf32:amd64=3.21.12-3+deb12u1
+libprotoc32:amd64=3.21.12-3+deb12u1
 libpsl5:amd64=0.21.2-1
 libpthread-stubs0-dev:amd64=0.4-1
 libpython3-stdlib:amd64=3.11.2-1+b1
@@ -310,8 +310,8 @@ libsqlite3-0:amd64=3.40.1-2+deb12u2
 libsqlite3-dev:amd64=3.40.1-2+deb12u2
 libss2:amd64=1.47.0-2+b2
 libssh2-1:amd64=1.10.0-3+b1
-libssl-dev:amd64=3.0.18-1~deb12u2
-libssl3:amd64=3.0.18-1~deb12u2
+libssl-dev:amd64=3.0.22-1~deb12u1
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++-12-dev:amd64=12.2.0-14+deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsvn1:amd64=1.14.2-4+deb12u1
@@ -390,7 +390,7 @@ ncurses-base=6.4-4
 ncurses-bin=6.4-4
 netbase=6.4
 openssh-client=1:9.2p1-2+deb12u7
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u2
 patch=2.7.6-7
 perl-base=5.36.0-7+deb12u3
@@ -401,7 +401,7 @@ pkg-config:amd64=1.8.1-1
 pkgconf-bin=1.8.1-1
 pkgconf:amd64=1.8.1-1
 procps=2:4.0.2-3
-protobuf-compiler=3.21.12-3
+protobuf-compiler=3.21.12-3+deb12u1
 python3-distutils=3.11.2-3
 python3-lib2to3=3.11.2-3
 python3-minimal=3.11.2-1+b1
diff --git a/dstack/verifier/builder/shared/pinned-packages.txt b/dstack/verifier/builder/shared/pinned-packages.txt
index a99c0061b..efd5dfac5 100644
--- a/dstack/verifier/builder/shared/pinned-packages.txt
+++ b/dstack/verifier/builder/shared/pinned-packages.txt
@@ -4,9 +4,9 @@ base-files=12.4+deb12u11
 base-passwd=3.6.1
 bash=5.2.15-2+b8
 bsdutils=1:2.38.1-5+deb12u3
-ca-certificates=20230311+deb12u1
+ca-certificates=20250419~deb12u2
 coreutils=9.1-1
-curl=7.88.1-10+deb12u14
+curl=7.88.1-10+deb12u15
 dash=0.5.12-2
 debconf=1.5.82
 debian-archive-keyring=2023.3+deb12u2
@@ -35,7 +35,7 @@ libcap-ng0:amd64=0.8.3-1+b3
 libcap2:amd64=1:2.66-4+deb12u1
 libcom-err2:amd64=1.47.0-2
 libcrypt1:amd64=1:4.4.33-2
-libcurl4:amd64=7.88.1-10+deb12u14
+libcurl4:amd64=7.88.1-10+deb12u15
 libdb5.3:amd64=5.3.28+dfsg2-1
 libdebconfclient0:amd64=0.270
 libext2fs2:amd64=1.47.0-2
@@ -45,20 +45,20 @@ libgcrypt20:amd64=1.10.1-3
 libgmp10:amd64=2:6.2.1+dfsg1-1.1
 libgnutls30:amd64=3.7.9-2+deb12u4
 libgpg-error0:amd64=1.46-1
-libgssapi-krb5-2:amd64=1.20.1-2+deb12u4
+libgssapi-krb5-2:amd64=1.20.1-2+deb12u5
 libhogweed6:amd64=3.8.1-2
 libidn2-0:amd64=2.3.3-1+b1
-libk5crypto3:amd64=1.20.1-2+deb12u4
+libk5crypto3:amd64=1.20.1-2+deb12u5
 libkeyutils1:amd64=1.6.3-2
-libkrb5-3:amd64=1.20.1-2+deb12u4
-libkrb5support0:amd64=1.20.1-2+deb12u4
+libkrb5-3:amd64=1.20.1-2+deb12u5
+libkrb5support0:amd64=1.20.1-2+deb12u5
 libldap-2.5-0:amd64=2.5.13+dfsg-5
 liblz4-1:amd64=1.9.4-1
 liblzma5:amd64=5.4.1-1
 libmd0:amd64=1.0.4-2
 libmount1:amd64=2.38.1-5+deb12u3
 libnettle8:amd64=3.8.1-2
-libnghttp2-14:amd64=1.52.0-1+deb12u2
+libnghttp2-14:amd64=1.52.0-1+deb12u3
 libp11-kit0:amd64=0.24.1-2
 libpam-modules-bin=1.5.2-6+deb12u1
 libpam-modules:amd64=1.5.2-6+deb12u1
@@ -77,7 +77,7 @@ libsepol2:amd64=3.4-2.1
 libsmartcols1:amd64=2.38.1-5+deb12u3
 libss2:amd64=1.47.0-2
 libssh2-1:amd64=1.10.0-3+b1
-libssl3:amd64=3.0.18-1~deb12u2
+libssl3:amd64=3.0.22-1~deb12u1
 libstdc++6:amd64=12.2.0-14+deb12u1
 libsystemd0:amd64=252.38-1~deb12u1
 libtasn1-6:amd64=4.19.0-2+deb12u1
@@ -93,7 +93,7 @@ mawk=1.3.4.20200120-3.1
 mount=2.38.1-5+deb12u3
 ncurses-base=6.4-4
 ncurses-bin=6.4-4
-openssl=3.0.18-1~deb12u2
+openssl=3.0.22-1~deb12u1
 passwd=1:4.13+dfsg1-1+deb12u1
 perl-base=5.36.0-7+deb12u2
 sed=4.9-1