Repository navigation
fix(trivy): accept rclone go1.26.8 CVEs in the 11.0.1 image - #725
Merged
Merged
Conversation
Docker CI has been red on master since the 2026-10-11 schedule run. The 11.0.1 Trivy scan fails on three HIGH Go advisories published 2026-10-08, all reported from apps/migrate_to_ocis/bin/rclone_linux_amd64: rclone v1.75.1, built with go1.26.8 and golang.org/x/net v0.57.0, bundled by migrate_to_ocis v3.0.2. Matrix fail-fast then cancels the 10.16.6 leg, so neither line publishes. The 10.16.6 bundle ships no apps/*/bin/* file and is not affected. CVE-2026-78667 stdlib Range header parsing in FileServer/ServeContent CVE-2026-97031 stdlib ECH outer extensions in a crypto/tls server CVE-2026-78669 stdlib, x/net HTTP/2 SETTINGS flood, client or server The first two are server-side only. The app runs rclone purely as a client (`rclone sync`, `rclone obscure`), so neither is reachable. CVE-2026-78669 does affect clients, but only a malicious HTTP/2 peer can trigger it, here the oCIS instance an admin configured as the migration target, and the cost is CPU in a short-lived sync process. rclone v1.75.2 (2026-10-09) is built with go1.26.9 and pins x/net v0.60.0 and grpc v1.85.0-dev, which fixes all three and CVE-2026-84445. This repo builds from the immutable v11.0.1 tarball, so the fix can only arrive with a migrate_to_ocis release that bundles v1.75.2. The existing CVE-2026-84445 note is updated to the same drop-out condition. Verified by scanning the binary extracted from the pinned tarball with trivy 0.70.0 rootfs and the CI flags: without an ignore file it reports these three plus CVE-2026-84445. Master's ignore file exits 1, this one exits 0, and the result still contains the target. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
…8669 Review of the previous commit found the CVE-2026-78669 rationale understated who can trigger it and for how long. With -k the migration passes --no-check-certificate, so anyone on the network path can impersonate the oCIS target, and a large migration keeps rclone sync running for hours. The drop-out notes are reworded too. This file is tied to the immutable v11.0.1 tarball, so its entries can never drop out. What matters is not carrying them into the next 11.0.x file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
The second review pass found the note still inexact. -k is the short form of occ migrate:to-ocis:init --insecure, which is stored and then applies to every later files run. rclone's --no-check-certificate covers the ownCloud source remote as well as the oCIS target. The files migration runs one rclone sync per user rather than a single long process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
LukasHirt
approved these changes
Oct 15, 2026
oc-tmueller
added a commit
that referenced
this pull request
Oct 15, 2026
The build matrix runs one leg per release line and set no fail-fast, so GitHub's default of true applied. A Trivy failure in one leg cancelled the other before it could publish. That has blocked an unaffected line three times: #689 (guzzle/jmespath), #693, and the 2026-10-11 rclone go1.26.8 CVEs that #725 accepts for 11.0.1. Each time the 10.16 line did not publish although nothing in it had changed. A cancelled leg also hides its own findings: in #689, 11.0.0 turned out to be affected only once 10.16.4 stopped shadowing it. update-docker-hub-description keeps needs: build, so it still runs only when every leg succeeds. That is the right gate for a description both lines share. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
oc-tmueller
added a commit
that referenced
this pull request
Oct 15, 2026
The build matrix runs one leg per release line and set no fail-fast, so GitHub's default of true applied. A Trivy failure in one leg cancelled the other before it could publish. That has blocked an unaffected line three times: #689 (guzzle/jmespath), #693, and the 2026-10-11 rclone go1.26.8 CVEs that #725 accepts for 11.0.1. Each time the 10.16 line did not publish although nothing in it had changed. A cancelled leg also hides its own findings: in #689, 11.0.0 turned out to be affected only once 10.16.4 stopped shadowing it. update-docker-hub-description keeps needs: build, so it still runs only when every leg succeeds. That is the right gate for a description both lines share. Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
oc-tmueller
added a commit
to owncloud/migrate_to_ocis
that referenced
this pull request
Oct 15, 2026
Ship #76 (closes #74). It replaces the bundled rclone v1.75.1 (go1.26.8, golang.org/x/net v0.57.0) with upstream v1.75.2 (go1.26.9, x/net v0.60.0, the fixed grpc pseudo-version). That clears CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031, published 2026-10-08, plus the previously accepted CVE-2026-84445. The Server 11 distribution assembles its apps from tagged GitHub releases, so until this is tagged the 11.0.1 image keeps bundling v1.75.1, with the four findings accepted in owncloud-docker/server#725. Roll changelog/unreleased/rclone-1.75.2 into changelog/3.0.3_2026-10-15/, regenerate CHANGELOG.md with calens and bump appinfo/info.xml to 3.0.3. The release workflow refuses to build when the tag and the info.xml version disagree. Patch level is correct: there is no API, configuration or dependency-range change, and the oc11 range stays min-version="11" max-version="11". Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docker CI has failed on master since the 2026-10-11 schedule run (also the #723 and #724 pushes, e.g. run 38143841944). Nothing in this repo changed. Three Go advisories published 2026-10-08 began matching the rclone binary that the pinned v11.0.1 bundle ships in
apps/migrate_to_ocis/bin/rclone_linux_amd64: rclone v1.75.1, go1.26.8, x/net v0.57.0, from migrate_to_ocis v3.0.2.init --insecurewas used. Impact is CPU onlyMatrix fail-fast cancels the 10.16.6 leg, so neither line publishes until this is resolved. The 10.16.6 bundle ships no
apps/*/bin/*file and is not affected.Change
v24.04/11.0.1/.trivyignoreonly:This file is tied to the immutable v11.0.1 tarball, so the entries say not to carry them into the next 11.0.x file.
The actual fix
rclone v1.75.2 (2026-10-09) is built with go1.26.9 and pins x/net v0.60.0 and the fixed grpc, which clears all four findings. That bump goes into migrate_to_ocis (closing owncloud/migrate_to_ocis#74) and reaches this image with the next 11.0.x bundle.
Verification
I extracted the rclone binary from the pinned tarball and scanned it with
aquasec/trivy:0.70.0 rootfsusing the CI flags (HIGH,CRITICAL,--ignore-unfixed,--exit-code 1):A full local image scan was not possible because the local Docker VM is out of disk; this PR's CI run is the full-image check.
🤖 Generated with Claude Code