From 7832f0f0965f05328954463ceec9634ed6823ba7 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 19:06:59 +0000 Subject: [PATCH 1/3] spec: images ship packages current with updates and security pockets debootstrap installs only from the release pocket, so a fresh image can still trust root CAs the archive has since withdrawn, such as emSign ECC Root CA - G3 (Mozilla bug 2083449). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VJ4tUMKn4zAZM9n1pa86Rv --- docs/spec/disk-images.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/spec/disk-images.md b/docs/spec/disk-images.md index cb8dcc0..94f7bdd 100644 --- a/docs/spec/disk-images.md +++ b/docs/spec/disk-images.md @@ -90,6 +90,13 @@ r[image.base.debootstrap] The base system must be debootstrapped into the `@` subvolume. The debootstrap must create the minimal viable bootable system. +r[image.base.current-packages] +Every package installed in the image must be at the newest version its +configured archives offer at build time, including the suite's updates and +security pockets, not only the version the suite was released with. In +particular, the image must not trust a root certificate authority that those +archives have already withdrawn. + r[image.base.machine-id+2] `/etc/machine-id` must be truncated to zero bytes so that systemd generates a unique machine ID on each first boot. The image's initramfs must also carry an From 8bf510500c57ed1bf312b68b968a0113de9f3e04 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 19:06:59 +0000 Subject: [PATCH 2/3] image: upgrade debootstrapped packages from updates and security Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VJ4tUMKn4zAZM9n1pa86Rv --- image/configure.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/image/configure.sh b/image/configure.sh index d9a0e2e..5924a05 100755 --- a/image/configure.sh +++ b/image/configure.sh @@ -54,6 +54,11 @@ rm -f /etc/apt/sources.list apt-get update -q +# r[impl image.base.current-packages] +# debootstrap installs from the release pocket alone, so what it put down stays +# at release versions unless upgraded from the updates and security pockets. +apt-get dist-upgrade -y -q --no-install-recommends + # ============================================================ # Bootstrap essential packages # ============================================================ From ef4fb015dcfc71f5aabe6ba4cf39cbf4fc8a2e67 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 19:06:59 +0000 Subject: [PATCH 3/3] test: image does not ship the withdrawn emSign ECC Root CA - G3 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VJ4tUMKn4zAZM9n1pa86Rv --- tests/test-image-structure.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/test-image-structure.sh b/tests/test-image-structure.sh index 5bb3fa4..505eef8 100755 --- a/tests/test-image-structure.sh +++ b/tests/test-image-structure.sh @@ -330,6 +330,13 @@ echo "Detected suite: ${SUITE:-}" # r[verify image.base.debootstrap] check "/etc/fstab exists" test -f "$MNT/etc/fstab" +# r[verify image.base.current-packages] +# emSign ECC Root CA - G3 ships in the release-pocket ca-certificates of the +# suites we build and was withdrawn by later updates (Mozilla bug 2083449). +check "withdrawn root emSign ECC Root CA - G3 not installed" \ + test ! -e "$MNT/usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt" \ + -a ! -e "$MNT/etc/ssl/certs/emSign_ECC_Root_CA_-_G3.pem" + # r[verify image.variant.types+4] check "/etc/bes/image-variant exists" test -f "$MNT/etc/bes/image-variant"