From 6e00fcc2ce3a19794ff98beed5ed8031011ff8e9 Mon Sep 17 00:00:00 2001 From: EHotwagner Date: Wed, 14 Oct 2026 12:08:45 +0200 Subject: [PATCH 1/2] build: keep apt within admitted rootless identity mapping --- containers/barc-stock-headless/Containerfile | 4 ++-- containers/barc-stock-headless/README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/containers/barc-stock-headless/Containerfile b/containers/barc-stock-headless/Containerfile index fb470f4..e98b649 100644 --- a/containers/barc-stock-headless/Containerfile +++ b/containers/barc-stock-headless/Containerfile @@ -5,8 +5,8 @@ ENV DEBIAN_FRONTEND=noninteractive CC=gcc-13 CXX=g++-13 COPY containers/barc-stock-headless/ /recipe/ # Preserve Ubuntu archive signature validation; never use trusted=yes. RUN sed -i '/^Suites:/a Snapshot: 20261001T000000Z' /etc/apt/sources.list.d/ubuntu.sources && \ - timeout --kill-after=5s 1200s apt-get update --snapshot 20261001T000000Z && \ - timeout --kill-after=5s 1200s apt-get install --snapshot 20261001T000000Z -y --no-install-recommends \ + timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root update --snapshot 20261001T000000Z && \ + timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root install --snapshot 20261001T000000Z -y --no-install-recommends \ ca-certificates git curl python3 cmake=3.28.3-1build7 g++-13 ninja-build \ pkg-config binutils p7zip-full zip unzip tar autoconf automake libtool \ libgl1-mesa-dev libglu1-mesa-dev libsdl2-dev libdevil-dev libopenal-dev \ diff --git a/containers/barc-stock-headless/README.md b/containers/barc-stock-headless/README.md index 8a8972e..69253e5 100644 --- a/containers/barc-stock-headless/README.md +++ b/containers/barc-stock-headless/README.md @@ -23,7 +23,7 @@ The existing HighBar build script generates the plugin with HIGHBAR_STOCK_RECOIL ## Repository-owned toolchain bootstrap -The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. The existing Ubuntu archive keyring and Signed-By checks remain active; no moving snapshot, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes. +The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. Apt uses the mapped container root as its sandbox user: this host’s rootless UID/GID mapping stops at64510, while Ubuntu’s `_apt`/nobody group65534 is unavailable. This remains root inside the existing user namespace and changes no host mappings or privileges. The existing Ubuntu archive keyring and Signed-By checks remain active; no moving snapshot, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes. The builder fetches the existing HighBar vcpkg baseline256acc640… and verifies its exact commit/treee382dac5…. Its own bootstrap metadata pins the2026-04-08 glibc executable SHA512c5a43929…; the resulting downloaded executable must match before installation. The manifest retains HighBar's grpc/protobuf/abseil dependencies and adds GTest for the existing compiled stock controls. Baseline-selected gRPC1.76.0#1, Protobuf6.33.4#1, Abseil20260107.1#2 and GTest1.17.0#2 use the source archive hashes/patches owned by that immutable vcpkg tree. Protoc33.4 and gRPC1.76.0 are checked before generation. Vcpkg may acquire its own baseline-pinned supporting tools and dependency ports; their installed status is retained. This is a fresh source build, not reuse of historical GCC16/protobuf36 qualification. From 9af6c22cbfa5c3ffb6b67dd1d3c4e87c7bf409c7 Mon Sep 17 00:00:00 2001 From: EHotwagner Date: Wed, 14 Oct 2026 12:14:14 +0200 Subject: [PATCH 2/2] build: bootstrap authenticated CA trust before fixed snapshot apt --- containers/barc-stock-headless/Containerfile | 16 ++++++++++++---- containers/barc-stock-headless/README.md | 2 +- containers/barc-stock-headless/resources.json | 9 +++++++++ 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/containers/barc-stock-headless/Containerfile b/containers/barc-stock-headless/Containerfile index e98b649..6eff7a6 100644 --- a/containers/barc-stock-headless/Containerfile +++ b/containers/barc-stock-headless/Containerfile @@ -3,10 +3,18 @@ FROM docker.io/library/ubuntu@sha256:f610ab94648195aa356059f5b41d6085c9d4d903c07 USER 0:0 ENV DEBIAN_FRONTEND=noninteractive CC=gcc-13 CXX=g++-13 COPY containers/barc-stock-headless/ /recipe/ -# Preserve Ubuntu archive signature validation; never use trusted=yes. -RUN sed -i '/^Suites:/a Snapshot: 20261001T000000Z' /etc/apt/sources.list.d/ubuntu.sources && \ - timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root update --snapshot 20261001T000000Z && \ - timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root install --snapshot 20261001T000000Z -y --no-install-recommends \ +# Bootstrap only the hash-pinned Ubuntu CA package; the minimal base has no CA +# bundle. HTTP transport is content-authenticated by the signed snapshot pin. +RUN timeout --kill-after=5s 120s /usr/lib/apt/apt-helper -o APT::Sandbox::User=root download-file \ + http://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb \ + /tmp/ca-certificates.deb SHA256:641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a && \ + dpkg-deb --extract /tmp/ca-certificates.deb /tmp/ca-bootstrap && \ + mkdir -p /etc/ssl/certs && cat /tmp/ca-bootstrap/usr/share/ca-certificates/mozilla/*.crt > /etc/ssl/certs/ca-certificates.crt && \ + printf '%s\n' 'Types: deb' 'URIs: https://snapshot.ubuntu.com/ubuntu/20261001T000000Z/' \ + 'Suites: noble noble-updates noble-backports noble-security' 'Components: main restricted universe multiverse' \ + 'Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg' 'Check-Valid-Until: no' > /etc/apt/sources.list.d/ubuntu.sources && \ + timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root -o APT::Update::Error-Mode=any update && \ + timeout --kill-after=5s 1200s apt-get -o APT::Sandbox::User=root install -y --no-install-recommends \ ca-certificates git curl python3 cmake=3.28.3-1build7 g++-13 ninja-build \ pkg-config binutils p7zip-full zip unzip tar autoconf automake libtool \ libgl1-mesa-dev libglu1-mesa-dev libsdl2-dev libdevil-dev libopenal-dev \ diff --git a/containers/barc-stock-headless/README.md b/containers/barc-stock-headless/README.md index 69253e5..0adcd8a 100644 --- a/containers/barc-stock-headless/README.md +++ b/containers/barc-stock-headless/README.md @@ -23,7 +23,7 @@ The existing HighBar build script generates the plugin with HIGHBAR_STOCK_RECOIL ## Repository-owned toolchain bootstrap -The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. Apt uses the mapped container root as its sandbox user: this host’s rootless UID/GID mapping stops at64510, while Ubuntu’s `_apt`/nobody group65534 is unavailable. This remains root inside the existing user namespace and changes no host mappings or privileges. The existing Ubuntu archive keyring and Signed-By checks remain active; no moving snapshot, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes. +The `toolchain` stage starts from the official Ubuntu24.04 amd64 manifest f610ab94… and installs through Ubuntu's signed `20261001T000000Z` snapshot. Apt uses the mapped container root as its sandbox user: this host’s rootless UID/GID mapping stops at64510, while Ubuntu’s `_apt`/nobody group65534 is unavailable. This remains root inside the existing user namespace and changes no host mappings or privileges. The minimal base lacks a TLS CA bundle. Before package resolution, apt-helper acquires only Ubuntu ca-certificates20240203 by its SHA256641de77d… pin and extracts the public trust bundle. The package pin was authenticated from the fixed snapshot’s Packages.xz SHA2562a6a199e… and a verified Ubuntu Archive2018 InRelease signature. This bootstrap uses HTTP with mandatory content hash verification; subsequent package indexes and downloads use an explicit fixed HTTPS snapshot URI. The existing Ubuntu archive keyring and Signed-By checks remain active; strict apt update refuses any index failure. The historical signed snapshot deliberately disables expiry freshness, while keeping archive signatures and hashes. No moving mirror, TLS-verification bypass, trusted=yes or pre-existing toolchain image is accepted. CMake is pinned3.28.3-1build7; the produced CMake3.28.3 and GCC13.3.0 are verified before plugin compilation. The signed snapshot fixes the remaining apt package resolution; its actual complete package versions are recorded as build output, rather than invented from unobserved indexes. The builder fetches the existing HighBar vcpkg baseline256acc640… and verifies its exact commit/treee382dac5…. Its own bootstrap metadata pins the2026-04-08 glibc executable SHA512c5a43929…; the resulting downloaded executable must match before installation. The manifest retains HighBar's grpc/protobuf/abseil dependencies and adds GTest for the existing compiled stock controls. Baseline-selected gRPC1.76.0#1, Protobuf6.33.4#1, Abseil20260107.1#2 and GTest1.17.0#2 use the source archive hashes/patches owned by that immutable vcpkg tree. Protoc33.4 and gRPC1.76.0 are checked before generation. Vcpkg may acquire its own baseline-pinned supporting tools and dependency ports; their installed status is retained. This is a fresh source build, not reuse of historical GCC16/protobuf36 qualification. diff --git a/containers/barc-stock-headless/resources.json b/containers/barc-stock-headless/resources.json index 6ade430..739fb97 100644 --- a/containers/barc-stock-headless/resources.json +++ b/containers/barc-stock-headless/resources.json @@ -59,6 +59,15 @@ "gtest": "1.17.0#2", "c-ares": "1.34.6#1", "re2": "2025-11-05#0" + }, + "caCertificateBootstrap": { + "package": "ca-certificates", + "version": "20240203", + "url": "http://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb", + "bytes": 159378, + "sha256": "641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a", + "authenticatedIndexSha256": "2a6a199e1031a5c279cb346646d594993f35b1c03dd4a82aaa0323980dd92451", + "authentication": "fixedsnapshot noble/main/amd64 Packages.xz bound by UbuntuArchive2018 good InRelease signature; pin supplies bootstrapCA only" } } },