Repin verification bubblewrap to 0.13.0 (CVE-2026-87766) (#80) #82

Merged

kilo merged 3 commits from issue-80-bwrap-cve-repin into develop

2026-10-08 22:11:44 +00:00

kilo commented

2026-10-08 20:10:45 +00:00

Member

Refs #80. Security repin under owner-authorized /loop invocation kernel-loop-20261008T204521Z. Required canonical ordering #80 BEFORE #79 is recorded in #80 comment15816/#79 comment15812; #79 additional setup-time malicious-symlink/proc-magiclink acceptance remains separate.

Current Review Subject

Base/mergebase: 3bcc650802de1f1beead9f8e5f579bb387c52573; HEAD: 6c4bce578d2197f87655bd915c4c70f33b11f964. Original repin da893c1 preserved; normal develop merge a6ce4b8; minimal documentation reconciliation 6c4bce5. Seven-file full delta +101/-47; no history rewrite or dependency/lockfile change.

Scope

Repin optional ADR0008 verification/test-child bubblewrap from historical0.11.0 to maintained0.13.0, commit 719a4fd474d44b26906bcf2b1b0fb6eddd8d56d0, tag 52d23329a689f64a8b601f8b999affb69b9339ac, archive SHA256 e55bdb06f051664ecd3297d449a8b679b7cd1c73adb292b73a81d9b03c5fc462. Carries GHSA-pxhw-h44j-8pfx/CVE-2026-87766 fix: setup path resolution openat2 RESOLVE_IN_ROOT/NO_MAGICLINKS with fallback. LGPL-2.1-or-later; setuid refused. Source-specific reaper evidence re-derived: do_init585, pdeath611 before filter613; bootstrap3533/3539. Exact license links audited. No namespace/seccomp/resource/authorization/expiry/settlement guarantee weakened; all tests preserved.

Current whole-worker document reconciled to patched pin while retaining historical0.11 finding. #50 verification-only role unchanged; #53 AC4 remains unproved; #79 setup-time no-canary-effect tests not claimed.

Review History

Ordinal1 APPROVE on da893c1/19775b9 retained, now stale. Ordinal2 fresh independent GLM-5.3 whole-PR APPROVE findings[] on exact6c4bce5/3bcc650; complete source/security/currentness review, independent public archive/tag/license/advisory/readiness verification, full sanitized gates and native receipt. Counter2/10, no reset. Equivalent isolated read-only native path used after diagnosed pr-reviewer shell infrastructure denial; no self-review/config weakening.

Validation

Closed env make check PASS:1405tests+81subtests,71 honest native skips; make package-check/audit/diff-check PASS. Full native verification suite55PASS0SKIP on exact tested binary7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237; independently hash-verified and rerun by reviewer2. Historical second0.13 rebuild77a50609... retained, no reproducible-binary claim. Canonical exact-head CI2396 SUCCESS. Required supported merge/currentness/ancestry/acceptance/issue closure gates remain with sole-primary loop context; no auto-merge/main/release/deploy/live inference/product GO.

Refs #80. Security repin under owner-authorized `/loop` invocation kernel-loop-20261008T204521Z. Required canonical ordering #80 BEFORE #79 is recorded in #80 comment15816/#79 comment15812; #79 additional setup-time malicious-symlink/proc-magiclink acceptance remains separate. ## Current Review Subject Base/mergebase: `3bcc650802de1f1beead9f8e5f579bb387c52573`; HEAD: `6c4bce578d2197f87655bd915c4c70f33b11f964`. Original repin `da893c1` preserved; normal develop merge `a6ce4b8`; minimal documentation reconciliation `6c4bce5`. Seven-file full delta +101/-47; no history rewrite or dependency/lockfile change. ## Scope Repin optional ADR0008 verification/test-child bubblewrap from historical0.11.0 to maintained0.13.0, commit `719a4fd474d44b26906bcf2b1b0fb6eddd8d56d0`, tag `52d23329a689f64a8b601f8b999affb69b9339ac`, archive SHA256 `e55bdb06f051664ecd3297d449a8b679b7cd1c73adb292b73a81d9b03c5fc462`. Carries GHSA-pxhw-h44j-8pfx/CVE-2026-87766 fix: setup path resolution openat2 RESOLVE_IN_ROOT/NO_MAGICLINKS with fallback. LGPL-2.1-or-later; setuid refused. Source-specific reaper evidence re-derived: do_init585, pdeath611 before filter613; bootstrap3533/3539. Exact license links audited. No namespace/seccomp/resource/authorization/expiry/settlement guarantee weakened; all tests preserved. Current whole-worker document reconciled to patched pin while retaining historical0.11 finding. #50 verification-only role unchanged; #53 AC4 remains unproved; #79 setup-time no-canary-effect tests not claimed. ## Review History Ordinal1 APPROVE on da893c1/19775b9 retained, now stale. Ordinal2 fresh independent GLM-5.3 whole-PR APPROVE findings[] on exact6c4bce5/3bcc650; complete source/security/currentness review, independent public archive/tag/license/advisory/readiness verification, full sanitized gates and native receipt. Counter2/10, no reset. Equivalent isolated read-only native path used after diagnosed pr-reviewer shell infrastructure denial; no self-review/config weakening. ## Validation Closed env make check PASS:1405tests+81subtests,71 honest native skips; make package-check/audit/diff-check PASS. Full native verification suite55PASS0SKIP on exact tested binary7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237; independently hash-verified and rerun by reviewer2. Historical second0.13 rebuild77a50609... retained, no reproducible-binary claim. Canonical exact-head CI2396 SUCCESS. Required supported merge/currentness/ancestry/acceptance/issue closure gates remain with sole-primary loop context; no auto-merge/main/release/deploy/live inference/product GO.

kilo added 1 commit

2026-10-08 20:10:46 +00:00

fix: repin verification bubblewrap to 0.13.0 for CVE-2026-87766 (#80 )

ci / check (pull_request) Successful in 1m59s

Details

da893c1d1d

GHSA-pxhw-h44j-8pfx affects all bubblewrap before 0.12.0, including the
ADR 0008 pin 0.11.0: sandbox setup could resolve paths through parent
symlinks into the host-side /oldroot staging tree (setup-time,
same-privilege writes; not a runtime escape and no privilege escalation
for this unprivileged profile). Repin to the maintained v0.13.0 release,
which carries the openat2 RESOLVE_IN_ROOT fix and refuses setuid
execution outright; licence moved upstream to LGPL-2.1-or-later.

- tools/setup_bubblewrap.py: pin commit 719a4fd474d44b26906bcf2b1b0fb6ed
  dd8d56d0 (archive sha e55bdb06...), expect bubblewrap 0.13.0, allow the
  additional upstream COPYING.LIB -> COPYING licence link.
- adapters/bubblewrap_verification.py: version/source pins; readiness
  indicator re-derived from the new source (do_init at bubblewrap.c:585,
  pdeath setup at 611 before filter install at 613; bootstrap branch
  3533/3539). No policy, resource, lifecycle or settlement change.
- tests: version fixture and pre-arming comment updated to the new pin.
- ADR 0008: remediation section with advisory-bounded exposure analysis,
  both-pin evidence table, re-derived indicator lines; CONTRIBUTING and
  reuse records updated.

Native receipt: complete suite re-executed on two freshly built binaries
with zero skips (55 items each); old receipts retained as history only.
make check 1397 + 81 subtests, 53 honest skips; package-check, audit and
diff gates pass.

Refs #80

kilo referenced this pull request

2026-10-08 20:11:08 +00:00

Repin ADR 0008 verification bubblewrap to 0.12.0+ (GHSA-pxhw-h44j-8pfx / CVE-2026-87766) #80

kilo referenced this pull request

2026-10-08 21:50:49 +00:00

Security follow-up to #50: receive patched bubblewrap 0.12.0 and setup-time escape evidence #79

kilo referenced this pull request

2026-10-08 21:55:30 +00:00

Repin ADR 0008 verification bubblewrap to 0.12.0+ (GHSA-pxhw-h44j-8pfx / CVE-2026-87766) #80

adrian.tkacz added 2 commits

2026-10-08 22:01:05 +00:00

Merge develop into issue-80-bwrap-cve-repin a6ce4b8292