Repository navigation
Confine the remaining CI, conformance and perf downloads to checked CA stores (GHSA-6q48-6c7w-9gw2) #677
Description
Server #673 confines pip, Composer and the StorageAdmission Cargo stage to CA stores checked against the roots withdrawn under GHSA-6q48-6c7w-9gw2. This issue owns every remaining client that makes package or binary requests in Server CI, conformance and perf qualification.
Non-completion boundary
#673 does not claim these requests are confined. Until this issue closes:
- Server's GHSA-6q48 remediation is incomplete for these clients.
- No release or qualification record may cite Start every Server pip install from the patched, bundle-only pip (GHSA-6q48-6c7w-9gw2) #673 as covering them.
Inventory (at #673 round 4)
-
PECL:
scripts/perf/Dockerfile.octane-swoole-experimentand…-openswoole-experimentrunpecl installon Server base images whose stores are not checked first. -
install-php-extensions:
scripts/perf/Dockerfile.octane-frankenphp-experiment. The extensions' own downloads count; apt packages are signature-checked. -
curl / wget:
- CLI installer downloads in the activities, namespaces, principal-attribution, python, replay, sagas, skew and workflow-updates runners;
- the schedules and heartbeats
.mjsrunners, and the binaries those installers fetch; dw.pharinserver-parity.yml(3 jobs) and the server-parity README;kindandkubectlinkubernetes-validation.yml;- the docs release audit in
scripts/ci/check-docs-release-audit.sh; run-vultr-soak.sh.
-
Language HTTP clients: Python
urlliband Node HTTPS downloads of installers or artifacts in conformance runners. These include child-workflows (the probe and its resolver), signals-queries, python, replay, sagas, namespaces, principal-attribution, agent-operability, single-region-failover and worker-versioning. -
Cargo outside StorageAdmission:
- server-parity adapter and codec builds;
- the signals-queries and workflow-lifecycle Rust probes;
- replay;
- the capacity Rust binding.
Builds that use a committed
Cargo.lockwith--lockedare already integrity-checked by the lock's checksums. Any unlocked resolution needs a checked store.
Done when
- Every active request meets one of two conditions before its first network operation:
- (a) It uses an exact checked CA store: a file
blocked_roots.pyaccepts, plus an empty directory wherever the client also reads a CA directory. A real-client counterfactual proves it, as Start every Server pip install from the patched, bundle-only pip (GHSA-6q48-6c7w-9gw2) #673's pip, Composer and Cargo controls do: the unconfined client trusts a synthetic withdrawn root, and the confined one refuses it. - (b) It verifies its artifact against a digest committed in this repository. A checksum fetched over the same unverified channel does not count.
- (a) It uses an exact checked CA store: a file
- A fail-closed inventory test covers curl/wget,
pecl,install-php-extensions, Python and Node HTTP downloads, and Cargo. It works liketests/Unit/Support/pip-sinks.jsonandcomposer-sinks.json, with machine-checked guards and ordering, and with counterfactuals for a new sink and for a deleted guard. - Security accepts the exact head (coordination on private cloud#438).
Owner: Rust Server (Server #325 maintainer).
Activity
rmcdaniel commentedon Oct 22, 2026
Adding a related residual: Brotli decoders affected by CVE-2026-111497 in CI images.
Since
e9dee7602, #673 corrects the Server image itself:libbrotli1 1.1.0-2+b7+dw1carrying upstream's 1.1-line fix;brotli-libs >= 1.2.1-r0in thephpredis-sourcestage;server-verify-brotli.CI jobs outside that image still decode package and artifact downloads through unfixed decoders:
composer:2.10.3: Alpine 3.24,brotli-libs1.2.0. The image's curl acceptsbr.libbrotli1 1.1.0-2+b7and Node v20.19.2.These requests are build-time only, over TLS to packagist and GitHub, and their results are lock- or digest-checked. They still decode attacker-reachable bytes with an affected decoder.
Done when, for these jobs: every Composer or curl request either runs after the same floor (
apk add --upgrade "brotli-libs>=1.2.1-r0"withapk info -e), or runs in an image that passesserver-verify-brotli. The inventory test covers the floor the same way it covers the CA guards.rmcdaniel commentedon Oct 23, 2026
Security publication-path disposition after the canceled 2.11.2 publisher:
5f186d4f; no exact image or chart was delivered.Two exact release-path subsets are now confirmed:
.github/workflows/release.ymlperforms its immutable dependency audit incomposer:2.10.3, whose Alpine 3.24brotli-libsis 1.2.0. Before any Composer/curl request, that job must establish and verifybrotli-libs >= 1.2.1-r0(or use an image passing the equivalent full verifier). The ordering must be machine-checked; upgrading after a request is not closure.f1e264a4has threeserver-parity.ymlqualification installs expressed as split-linedocker run --entrypoint composer ... install. They are invisible tocomposer-sinks.json, use published 2.11.x Server images, and pass no checkedCOMPOSER_CAFILE/emptyCOMPOSER_CAPATH. The Start every Server pip install from the patched, bundle-only pip (GHSA-6q48-6c7w-9gw2) #673 review records the exact lines and required counterfactual.This is PHP/release-tooling work and may proceed independently of native parity implementation. Required evidence is a fail-closed split-form inventory, checked CA pairing, decoder floor before the first network request, focused adversarial tests, and normal exact-head qualification. The unrelated residual sinks remain open here and must not be described as covered by the resulting release.