8000 microvm-rootfs: bump 5 stale Alpine pins (5 CVEs across expat, nghttp2, pcre2; openssl 3.5.9) by bryan-minimal · Pull Request #933 · gominimal/pkgs · GitHub
[go: up one dir, main page]
Skip to content

microvm-rootfs: bump 5 stale Alpine pins (5 CVEs across expat, nghttp2, pcre2; openssl 3.5.9) - #933

Merged
bryan-minimal merged 1 commit into
mainfrom
microvm-rootfs-alpine-pins-2026-10-19
Oct 20, 2026
Merged

microvm-rootfs: bump 5 stale Alpine pins (5 CVEs across expat, nghttp2, pcre2; openssl 3.5.9)#933
bryan-minimal merged 1 commit into
mainfrom
microvm-rootfs-alpine-pins-2026-10-19

Conversation

@bryan-minimal
@bryan-minimal bryan-minimal commented Oct 19, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

Five .apk pins in microvm-rootfs sit below fixes that Alpine v3.24/main already ships. Found by pkgmgr's alpine-pins audit in the 2026-10-19 nightly.

package pinned now fixes (Alpine secdb)
libexpat 2.8.4-r0 2.9.0-r0 CVE-2026-93990 (2.8.5-r0), CVE-2026-102633, CVE-2026-77214 (2.9.0-r0)
nghttp2-libs 1.69.0-r0 1.70.0-r0 CVE-2026-58055
pcre2 10.48-r0 10.49-r0 CVE-2026-103111
libcrypto3 + libssl3 3.5.8-r0 3.5.9-r0 none recorded. Bumped so the override stays at the branch's current build

5 CVEs.

Supersedes #868

#868 (opened 2026-10-13, still waiting on review) makes the same nghttp2, pcre2 and openssl bumps, and its hashes are byte-identical to the ones here. It takes expat only to 2.8.5-r0, though. Since then Alpine has shipped 2.9.0-r0, which fixes two more CVEs. If this merges, #868 can be closed. The two conflict, so only one of them should merge.

The openssl override

libcrypto3/libssl3 are the SECURITY OVERRIDES OF THE BASE LAYER block (#709). The comment there says to keep them while alpine_release is a minirootfs older than the fix, and never to leave them pinned below the base layer. alpine_release is still 3.24.1, which ships 3.5.7-r0, so 3.5.9-r0 is still above the base layer and satisfies the comment. bui 8000 ld.sh's apk-db reconcile picks the new version up from .PKGINFO.

Verified

  • Dependencies: checked against the v3.24 APKINDEX for both arches. The only deps are musl, plus libssl3 → libcrypto3=3.5.9-r0, and that one moves with it. No new shared library enters the closure.
  • Integrity: each of the 10 .apk files (5 packages × 2 arches) was downloaded from dl-cdn and checked against that arch's APKINDEX entry three ways:
    • the size S: matches
    • the C: checksum (SHA1 of the control segment) matches
    • the .PKGINFO datahash matches the sha256 of the data segment
  • Mirror: the files were mirrored to gs://minimal-staging-archives/alpine/v3.24/main/<arch>/. 8 of the 10 were already there from microvm-rootfs: bump 5 Alpine pins with upstream security fixes (expat, nghttp2, pcre2, openssl) #868. All 10 were re-downloaded from GCS and re-hashed, and every one is byte-identical to the verified dl-cdn copy.
  • Build: not built locally. This relies on this PR's minimal build / minimal-check CI.

Needs a human reviewer per repo policy.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated bundled system libraries, including OpenSSL components, to newer Alpine releases. The updated versions are included across supported architectures. This keeps the components shipped with the microVM root filesystem aligned with the latest pinned package versions.

@bryan-minimal @claude
microvm-rootfs: bump 5 stale Alpine pins (expat, nghttp2, pcre2, open…
0d85787 
…ssl)

Alpine v3.24/main ships fixed builds; per Alpine secdb:

- libexpat     2.8.4-r0  -> 2.9.0-r0   CVE-2026-93990 (2.8.5-r0),
                                       CVE-2026-102633, CVE-2026-77214 (2.9.0-r0)
- nghttp2-libs 1.69.0-r0 -> 1.70.0-r0  CVE-2026-58055
- pcre2        10.48-r0  -> 10.49-r0   CVE-2026-103111
- libcrypto3 + libssl3 3.5.8-r0 -> 3.5.9-r0 (no secdb entry; keeps the
  base-layer override at the branch's current build, still above the
  3.24.1 minirootfs's 3.5.7-r0)

Dependencies unchanged (musl only; libssl3 -> libcrypto3=3.5.9-r0 moves
with it). Every .apk verified against the v3.24 APKINDEX for both arches
(size, C: control-segment SHA1, and .PKGINFO datahash), mirrored to
gs://minimal-staging-archives, and round-tripped byte-identical.

Found by pkgmgr's alpine-pins audit in the 2026-10-19 nightly.
Supersedes #868 (same openssl/nghttp2/pcre2 hashes; expat goes further).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bryan-minimal
bryan-minimal requested a review from a team as a code owner October 19, 2026 16:23
@coderabbitai
coderabbitai Bot commented Oct 19, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 16035f0b-634f-4354-aa74-82089fc89543
📥 Commits

Reviewing files that changed from the base of the PR and between e151ec2 and 0d85787.

📒 Files selected for processing: 1
  • packages/microvm-rootfs/build.ncl

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The microVM root filesystem build configuration updates Alpine package pins for libexpat, nghttp2-libs, and pcre2, and updates the OpenSSL overlay packages libcrypto3 and libssl3. The corresponding per-architecture SHA-256 digests also change.

Changes: Alpine package pins

Layer / File(s) Summary
Refresh package versions and hashes
packages/microvm-rootfs/build.ncl		 Updates the pinned versions of libexpat, nghttp2-libs, pcre2, libcrypto3, and libssl3, along with their per-architecture SHA-256 digests.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

  • gominimal/pkgs#868: Updates the same Alpine package pins; this PR advances libexpat to 2.9.0-r0.

Suggested reviewers: norrietaylor

Merge Risk: ⚪ Minimal · up to 0d857

The updated package pins and hashes match the published Alpine artifacts and staging copies. No actionable merge-blocking risk remains; the build was not run locally, so rely on the normal CI checks.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly summarizes the main change: updating five stale Alpine package pins, including the OpenSSL version and affected packages.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

norrietaylor
norrietaylor approved these changes Oct 19, 2026
View reviewed changes
@norrietaylor norrietaylor left a comment
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

  • All 10 sha256s match, in arm64-then-amd64 order.
  • Each .apk verifies against Alpine's signing keys from the pinned minirootfs, and every .PKGINFO datahash checks out.
  • libexpat 2.9.0 still provides libexpat.so.1.

This supersedes #868, which I'm closing.

Nits:

  • The openssl override comment (build.ncl:247-264) still describes 3.5.7 → 3.5.8. Please add a line on why it now sits at 3.5.9.
  • minimal build took 24s, so the image probably wasn't really rebuilt in CI. #868's local --rebuild covers the same path, which lowers the risk.
  • I couldn't verify the CVE IDs from here (secdb is blocked).

Generated by Claude Code

8000

@norrietaylor norrietaylor mentioned this pull request Oct 19, 2026
Closed
@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 20, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Oct 20, 2026
@bryan-minimal
bryan-minimal added this pull request to the merge queue Oct 20, 2026
Merged via the queue into main with commit f722837 Oct 20, 2026
11 checks passed
@bryan-minimal
bryan-minimal deleted the microvm-rootfs-alpine-pins-2026-10-19 branch October 20, 2026 01:49
This was referenced Oct 26, 2026
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@norrietaylor norrietaylor norrietaylor approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bryan-minimal @norrietaylor
0