From aa063309f4a7838d950f7b1149f01477460d9a15 Mon Sep 17 00:00:00 2001 From: Leechael Yim Date: Thu, 22 Oct 2026 08:11:27 +0800 Subject: [PATCH] fix(os): move the mkosi guest OS to a post-emSign snapshot and Go 1.26.10 The mkosi guest OS used the Debian 20260721T000000Z snapshot. Its trixie ca-certificates (20250419) still trusts emSign ECC Root CA - G3 and Comodo AAA Services root, so docker, containerd, curl and every other client in the guest that reads the system trust store accepts a certificate from one of the compromised eMudhra/emSign intermediates. Advance Snapshot in mkosi.conf and mkosi.tools.conf, and DEBIAN_SNAPSHOT in versions.env, to 20261021T000000Z. mkosi also adds the debian-security archive at the same timestamp, and that snapshot carries ca-certificates 20250419+deb13u1. The rest of the trixie package set moves forward to that date as well. Move the toolchain used for the Go components (sysbox and others) from 1.26.2 to 1.26.10, which carries the CVE-2026-111943 fix: crypto/x509 rejects chains with the compromised intermediate CA keys. Update the acceptance assertions for both values. This puts the mkosi Go ahead of the Go that oe-core pins for the Yocto backend. The upstream nerdctl 2.3.5 and stargz 0.18.2 binaries stay as they are: their newest releases (nerdctl 2.4.1, stargz 0.19.0) predate the Go fix. The rootfs changes, so the OS image hash and the measurements change, and the OS image allowlists in the auth configs and on chain must be updated. Signed-off-by: Leechael Yim --- os/mkosi/mkosi.conf | 2 +- os/mkosi/mkosi.tools.conf | 2 +- os/mkosi/tests/acceptance.sh | 11 ++++++----- os/mkosi/versions.env | 6 +++--- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/os/mkosi/mkosi.conf b/os/mkosi/mkosi.conf index 185087377..54835a0e9 100644 --- a/os/mkosi/mkosi.conf +++ b/os/mkosi/mkosi.conf @@ -6,7 +6,7 @@ MinimumVersion=26 Distribution=debian Release=trixie Architecture=x86-64 -Snapshot=20260721T000000Z +Snapshot=20261021T000000Z Repositories=main,contrib,non-free-firmware [Output] diff --git a/os/mkosi/mkosi.tools.conf b/os/mkosi/mkosi.tools.conf index c83a700e3..be614b18f 100644 --- a/os/mkosi/mkosi.tools.conf +++ b/os/mkosi/mkosi.tools.conf @@ -1,4 +1,4 @@ # SPDX-License-Identifier: Apache-2.0 [Distribution] -Snapshot=20260721T000000Z +Snapshot=20261021T000000Z Repositories=main diff --git a/os/mkosi/tests/acceptance.sh b/os/mkosi/tests/acceptance.sh index 0f34d11ce..aeee04a4f 100755 --- a/os/mkosi/tests/acceptance.sh +++ b/os/mkosi/tests/acceptance.sh @@ -268,16 +268,17 @@ grep -q 'scripts/build-components.sh' "$D/mkosi.build" grep -q '^BuildPackages=' "$D/mkosi.conf" grep -q '^ToolsTree=yes$' "$D/mkosi.conf" grep -q '^ToolsTreeProfiles=misc$' "$D/mkosi.conf" -grep -q '^Snapshot=20260721T000000Z$' "$D/mkosi.tools.conf" +grep -q '^Snapshot=20261021T000000Z$' "$D/mkosi.tools.conf" grep -q 'clean -f' "$D/build.sh" grep -q 'install-toolchains.sh' "$D/mkosi.build" grep -q '^RUST_TOOLCHAIN_VERSION=1.92.0$' "$D/versions.env" -# Tracks the Go that oe-core pins for the production Yocto backend, so both -# backends compile the same Go components with the same toolchain. It must also -# stay >= the highest 'go' directive among them (nvidia-container-toolkit +# Go 1.26.10 carries the CVE-2026-111943 fix (crypto/x509 rejects chains with +# the compromised eMudhra/emSign intermediate CA keys), so this is ahead of the +# Go that oe-core pins for the production Yocto backend. It must also stay >= +# the highest 'go' directive among the Go components (nvidia-container-toolkit # currently declares go 1.25.0); GOTOOLCHAIN=local turns a violation into a # build failure rather than a silent download. -grep -q '^GO_TOOLCHAIN_VERSION=1.26.2$' "$D/versions.env" +grep -q '^GO_TOOLCHAIN_VERSION=1.26.10$' "$D/versions.env" for component in dstack-rust image-tools container-stack sysbox nvattest kernel nvidia zfs ovmf; do definition="$D/components/$component/$component.sh" grep -q "^COMPONENT_NAME=$component$" "$definition" diff --git a/os/mkosi/versions.env b/os/mkosi/versions.env index fcebc7b15..ff7f0a3e4 100644 --- a/os/mkosi/versions.env +++ b/os/mkosi/versions.env @@ -3,7 +3,7 @@ KERNEL_VERSION=6.18.40 KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 DEBIAN_RELEASE=trixie -DEBIAN_SNAPSHOT=20260721T000000Z +DEBIAN_SNAPSHOT=20261021T000000Z # Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT: # apt pinned to the snapshot cannot downgrade packages the base already ships. DEBIAN_BASE_IMAGE=debian:trixie-20260713-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd @@ -17,8 +17,8 @@ RUST_TOOLCHAIN_VERSION=1.92.0 RUSTC_TOOLCHAIN_SHA256=78b2dd9c6b1fcd2621fa81c611cf5e2d6950690775038b585c64f364422886e0 CARGO_TOOLCHAIN_SHA256=e5e12be2c7126a7036c8adf573078a28b92611f5767cc9bd0a6f7c83081df103 RUST_STD_TOOLCHAIN_SHA256=5f106805ed86ebf8df287039e53a45cf974391ef4d088c2760776b05b8e48b5d -GO_TOOLCHAIN_VERSION=1.26.2 -GO_TOOLCHAIN_SHA256=990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282 +GO_TOOLCHAIN_VERSION=1.26.10 +GO_TOOLCHAIN_SHA256=ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5 NITRO_TPM_TOOLS_REVISION=d76d6eeebd4169b00a3c3af9858852d48f40e748 DSTACK_VERSION=0.6.1 DSTACK_CODENAME=trixie