Release0.3.1 with patched official Debian13 runtime

jlxq0 commented

2026-10-28 18:23:13 +00:00

Owner

The 0.3.0 tag image was rejected by its mandatory final scan for CVE-2026-84782 in libssl3. Even the current official Debian12 distroless image still has the vulnerable package. This pins the official Debian13 nonroot runtime, whose verified package metadata contains fixed libssl3t64 3.5.7-1~deb13u3, and prepares immutable patch release0.3.1.

The Rust1.93/bookworm builder, application code, dependency versions, nonroot runtime and security gates are unchanged. Corrects release docs to the active Forge registry: the push-mirror API currently returns an empty list, so GHCR publication/signing is not claimed.

Validation: all274 Rust tests, pinned fmt/clippy pass. An isolated fixture combining the released0.3.0 binary with the exact candidate base passes actual ELF loader resolution and /health as UID65532 on a read-only filesystem; its final-image Trivy HIGH/CRITICAL scan reports0 findings. No mailbox or production changes. This compatibility fixture is not the0.3.1 release artifact; exact tag artifact scan/health/provenance and live checks remain mandatory after merge/tag. Fresh independent Claude review APPROVE at d74828e3ff; exact-head Forge cargo/ancestry/docker all green. GitHub publishing is unavailable because no mirror is configured; no GHCR claim or promotion.

The 0.3.0 tag image was rejected by its mandatory final scan for CVE-2026-84782 in libssl3. Even the current official Debian12 distroless image still has the vulnerable package. This pins the official Debian13 nonroot runtime, whose verified package metadata contains fixed libssl3t64 3.5.7-1~deb13u3, and prepares immutable patch release0.3.1. The Rust1.93/bookworm builder, application code, dependency versions, nonroot runtime and security gates are unchanged. Corrects release docs to the active Forge registry: the push-mirror API currently returns an empty list, so GHCR publication/signing is not claimed. Validation: all274 Rust tests, pinned fmt/clippy pass. An isolated fixture combining the released0.3.0 binary with the exact candidate base passes actual ELF loader resolution and /health as UID65532 on a read-only filesystem; its final-image Trivy HIGH/CRITICAL scan reports0 findings. No mailbox or production changes. This compatibility fixture is not the0.3.1 release artifact; exact tag artifact scan/health/provenance and live checks remain mandatory after merge/tag. Fresh independent Claude review APPROVE at d74828e3ff2f467b44ad95dee0f72cacb13dd679; exact-head Forge cargo/ancestry/docker all green. GitHub publishing is unavailable because no mirror is configured; no GHCR claim or promotion.

jlxq0 added 1 commit

2026-10-28 18:23:13 +00:00

Release 0.3.1 with patched Debian 13 runtime

CI / tag-ancestry (pull_request) Successful in 2s

Details

CI / cargo (pull_request) Successful in 1m33s

Details

CI / docker (pull_request) Successful in 1m23s

Details

70f6ddfdec

jlxq0 added 1 commit

2026-10-28 18:31:48 +00:00