build: pin Go 1.27.2 for Host Provisioner 0.39.8

.github/workflows/codeql-verification.yml

@@ -32,12 +32,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location \
             --output "$archive" \
-            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.2.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            'ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           "$RUNNER_TEMP/go/bin/go" version

.github/workflows/security-release-gate.yml

@@ -23,7 +23,7 @@ jobs:
     env:
       DAPPER_IMAGE: pasturestack/host-provisioner-dapper:${{ github.sha }}
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
-      VERSION_OVERRIDE: v0.39.7
+      VERSION_OVERRIDE: v0.39.8
       SOURCE_DATE_EPOCH: '0'
     steps:
       - name: Check out candidate
@@ -47,21 +47,21 @@ jobs:
         run: |
           set -euo pipefail
           make DAPPER_IMAGE="$DAPPER_IMAGE" ci
-          test -s dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
-          package_dir='host-provisioner-0.39.7-linux-amd64'
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
-          tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
+          test -s dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
+          package_dir='host-provisioner-0.39.8-linux-amd64'
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/host-provisioner"
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/LICENSE"
+          tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Fx "${package_dir}/ORIGIN.md"
           expected_legal=$(find vendor -type f \( \
             -name 'LICENSE' -o -name 'LICENSE.*' -o \
             -name 'NOTICE' -o -name 'NOTICE.*' -o \
             -name 'COPYING' -o -name 'COPYING.*' -o \
             -name 'AUTHORS' -o -name 'AUTHORS.*' \
           \) | wc -l)
-          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
+          actual_legal=$(tar -tJf dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz | grep -Ec "^${package_dir}/licenses/.+/(LICENSE|LICENSE\..*|NOTICE|NOTICE\..*|COPYING|COPYING\..*|AUTHORS|AUTHORS\..*)$")
           test "$expected_legal" -gt 0
           test "$actual_legal" -eq "$expected_legal"
-          sha256sum dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
+          sha256sum dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz bin/host-provisioner > evidence/product-artifacts.sha256
           docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \
             version -m /work/bin/host-provisioner > evidence/product-go-version.txt
           grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null

.github/workflows/validate.yml

@@ -33,19 +33,19 @@ jobs:
           set -euo pipefail
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor 22d7baca609c18589f08225a97bf8c5e00109204 HEAD
-          grep -Fq 'VERSION_OVERRIDE: v0.39.7' .github/workflows/validate.yml
+          grep -Fq 'VERSION_OVERRIDE: v0.39.8' .github/workflows/validate.yml
 
       - name: Run complete tests, validation, and package
         env:
-          VERSION_OVERRIDE: v0.39.7
+          VERSION_OVERRIDE: v0.39.8
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
           make ci
-          asset='dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz'
+          asset='dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz'
           test -s "$asset"
-          package_dir='host-provisioner-0.39.7-linux-amd64'
+          package_dir='host-provisioner-0.39.8-linux-amd64'
           tar -tJf "$asset" | grep -Fx "${package_dir}/host-provisioner"
           tar -tJf "$asset" | grep -Fx "${package_dir}/LICENSE"
           tar -tJf "$asset" | grep -Fx "${package_dir}/ORIGIN.md"
@@ -61,28 +61,28 @@ jobs:
           mkdir -p evidence extracted
           tar -xJf "$asset" -C extracted
           test -x "extracted/${package_dir}/host-provisioner"
-          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.7'
+          test "$("extracted/${package_dir}/host-provisioner" -v)" = $'host-provisioner\t gitcommit=v0.39.8'
           sha256sum "$asset" "extracted/${package_dir}/host-provisioner" > evidence/product-artifacts.sha256
 
       - name: Verify reproducible artifact
         env:
-          VERSION_OVERRIDE: v0.39.7
+          VERSION_OVERRIDE: v0.39.8
           SOURCE_DATE_EPOCH: '0'
         shell: bash
         run: |
           set -euo pipefail
-          cp dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz /tmp/first.tar.xz
+          cp dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz /tmp/first.tar.xz
           rm -rf bin dist
           make ci
-          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
+          cmp /tmp/first.tar.xz dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
           printf 'HOST_PROVISIONER_VALIDATION_OK source=%s version=%s\n' "$GITHUB_SHA" "$VERSION_OVERRIDE"
 
       - name: Retain reviewed release candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: host-provisioner-0.39.7
+          name: host-provisioner-0.39.8
           path: |
-            dist/artifacts/host-provisioner-0.39.7-linux-amd64.tar.xz
+            dist/artifacts/host-provisioner-0.39.8-linux-amd64.tar.xz
             evidence/product-artifacts.sha256
           if-no-files-found: error
           retention-days: 30

Dockerfile.dapper

@@ -2,9 +2,9 @@
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 ENV DEBIAN_FRONTEND=noninteractive
-ARG GO_VERSION=1.27.0
-ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG UBUNTU_SNAPSHOT=20260909T000000Z
+ARG GO_VERSION=1.27.2
+ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
+ARG UBUNTU_SNAPSHOT=20261010T200000Z
 
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
     https://snapshot.ubuntu.com/ubuntu/20260909T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
@@ -31,7 +31,10 @@ RUN set -eux; \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         build-essential \
-        linux-libc-dev=7.0.0-31.31 \
+        linux-libc-dev=7.0.0-38.38 \
+        libssl3t64=3.5.5-1ubuntu3.7 \
+        openssl=3.5.5-1ubuntu3.7 \
+        openssl-provider-legacy=3.5.5-1ubuntu3.7 \
         curl \
         git \
         tar \

README.md

@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-The current reviewed compatibility release is `v0.39.7`, based on the preserved upstream `v0.39.4` boundary and consumed by PastureStack Server `v1.6.410`. Existing Ubuntu 26.04, Go 1.27.0, dependency, driver checksum, jailer, and test maintenance is retained. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files.
+This is the `v0.39.8` release candidate based on the preserved upstream `v0.39.4` boundary. Existing Ubuntu 26.04, dependency, driver checksum, jailer, and test maintenance is retained, with the compiler updated to checksum-pinned Go 1.27.2 for Linux/amd64. Published tags and assets remain immutable. The build container contains only the tools used by compilation and tests; Docker remains on the outer build runner and is not duplicated inside the container. Product-owned imports, executable names, state defaults, router identities, and operator messages use PastureStack naming. Machine storage is constrained to its configured root and restored configuration archives reject traversal, links, and special files. Driver publication and production deployment remain disabled while the complete Server release is assembled.
 
 ## Configuration
 
@@ -26,7 +26,9 @@ make package
 
 Dependencies are locked by `go.mod` and `go.sum`, and builds use the checked-in `vendor/` tree without network access. The machine RPC layer follows the maintained GitLab Docker Machine fork at `v0.16.2-gitlab.52`; only the packages used by Host Provisioner are shipped. The Rancher 1.6 event and API clients are retained as explicit compatibility modules under `third_party/`, so their frozen protocol surface is reviewable without treating abandoned upstream repositories as live package sources.
 
-The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.7` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.7-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its SHA-256 digest before installation. Users do not need to host a package mirror.
+The build container does not receive the host Docker socket. For the reviewed Server release, build with `VERSION_OVERRIDE=v0.39.8` and `SOURCE_DATE_EPOCH=0`; packaging produces the deterministic Release asset `host-provisioner-0.39.8-linux-amd64.tar.xz`. The archive contains the executable, root license, origin record, and preserved bundled-dependency legal files. PastureStack Server downloads that asset from its versioned GitHub Release and verifies its new SHA-256 digest before installation. Users do not need to host a package mirror.
+
+The build-only Ubuntu snapshot is fixed at `20261010T200000Z`, with kernel headers `7.0.0-38.38` and OpenSSL `3.5.5-1ubuntu3.7`. CI builds and scans that container separately from the static product executable; available upstream fixes must pass the existing security gate rather than be classified as pending vendor fixes.
 
 See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), and [ORIGIN.md](ORIGIN.md).
 

scripts/validate

@@ -5,8 +5,13 @@ cd $(dirname $0)/..
 
 echo Running validation
 
-grep -Fq 'ARG GO_VERSION=1.27.0' Dockerfile.dapper
-grep -Fq 'ARG GO_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' Dockerfile.dapper
+grep -Fq 'ARG GO_VERSION=1.27.2' Dockerfile.dapper
+grep -Fq 'ARG GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5' Dockerfile.dapper
+grep -Fq 'ARG UBUNTU_SNAPSHOT=20261010T200000Z' Dockerfile.dapper
+grep -Fq 'linux-libc-dev=7.0.0-38.38' Dockerfile.dapper
+for package in libssl3t64 openssl openssl-provider-legacy; do
+  grep -Fq "${package}=3.5.5-1ubuntu3.7" Dockerfile.dapper
+done
 grep -Fq 'aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969' .github/workflows/security-release-gate.yml
 if grep -E 'ARG DOCKER_VERSION=|download\.docker\.com/linux/static|tar xzf /tmp/docker\.tgz' Dockerfile.dapper; then
   echo 'Unused Docker CLI must not be bundled in the build container.' >&2