Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Bug fix
What does this PR do? Why is it needed?
Address RHSB-2026-012 by requiring Alpine CA bundles >=20261020-r0 and using patched Node 24.22.1 LTS for both API build and runtime. Pin the tested base images, retain Alpine 3.23, and install the existing API lockfile with
--frozen-lockfile; run the original tests during the image build.Use APK’s signed, architecture-specific index to select WireGuard tools, preserving the explicit
WIREGUARD_RELEASEbuild argument. Add the security changelog entry. The patch changes four files; application code, dependencies, lockfile, Compose and CI stay unchanged.To build on native AMD64:
docker build --pull --no-cache -t wireguard-ca-test . docker build --pull --no-cache -t wireguard-api-ca-test ./apiOn ARM64, build WireGuard with
-f Dockerfile.aarch64and build the API with the same command above. Both architectures passed, including the three original API tests. System bundles and Node’s bundled roots were inspected: the affected AAA Certificate Services and emSign ECC Root CA - G3 roots are absent.Native AMD64 upgrade validation used the deployed 0.1.4 images in disposable containers with fresh volumes and an isolated network. Connect a test client, replace the test server with the new image while retaining its config volume, then restart server and API. Passed: unchanged keys/configs; handshake and encrypted traffic; DNS; forwarding/NAT; API remote/local/QR/CORS behavior; all CLI modes; restart recovery; package UID/GID, AllowedIPs and PeerDNS defaults.
Other notes for review
CoreDNS/WireGuard/wg-quick binaries and compiled API code match the deployed images byte-for-byte; runtime dependency versions also match. Installed Dappnode services were not replaced or restarted. An external user device/public endpoint was not exercised. This focused patch does not resolve unrelated dependency advisories.