58 lines
2.0 KiB
Bash
58 lines
2.0 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Exact Debian security versions from the staging image scan. Keep these pins
|
|
# explicit: a release build must fail rather than silently consume newer OS
|
|
# packages that were not scanned.
|
|
gzip_version='1.13-1+deb13u1'
|
|
pcre2_version='10.46-1~deb13u3'
|
|
sqlite3_version='3.46.1-7+deb13u2'
|
|
openssl_version='3.5.7-1~deb13u3'
|
|
perl_base_version='5.40.1-6+deb13u1'
|
|
util_linux_version='2.41.5-0+deb13u1'
|
|
bsdutils_version='1:2.41.5-0+deb13u1'
|
|
login_version='1:4.16.0-2+really2.41.5-0+deb13u1'
|
|
|
|
apt-get update
|
|
DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
|
|
"bsdutils=${bsdutils_version}" \
|
|
"gzip=${gzip_version}" \
|
|
"libblkid1=${util_linux_version}" \
|
|
"liblastlog2-2=${util_linux_version}" \
|
|
"libmount1=${util_linux_version}" \
|
|
"libpcre2-8-0=${pcre2_version}" \
|
|
"libsqlite3-0=${sqlite3_version}" \
|
|
"libssl3t64=${openssl_version}" \
|
|
"libsmartcols1=${util_linux_version}" \
|
|
"libuuid1=${util_linux_version}" \
|
|
"login=${login_version}" \
|
|
"mount=${util_linux_version}" \
|
|
"openssl=${openssl_version}" \
|
|
"openssl-provider-legacy=${openssl_version}" \
|
|
"perl-base=${perl_base_version}" \
|
|
"util-linux=${util_linux_version}"
|
|
|
|
assert_package_version() {
|
|
actual="$(dpkg-query -W -f='${Version}' "$1")"
|
|
if [ "${actual}" != "$2" ]; then
|
|
printf 'Expected %s=%s but found %s\n' "$1" "$2" "${actual}" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
assert_package_version "bsdutils" "${bsdutils_version}"
|
|
assert_package_version "login" "${login_version}"
|
|
for package in libblkid1 liblastlog2-2 libmount1 libsmartcols1 libuuid1 mount util-linux; do
|
|
assert_package_version "${package}" "${util_linux_version}"
|
|
done
|
|
assert_package_version "gzip" "${gzip_version}"
|
|
assert_package_version "libpcre2-8-0" "${pcre2_version}"
|
|
assert_package_version "libsqlite3-0" "${sqlite3_version}"
|
|
assert_package_version "libssl3t64" "${openssl_version}"
|
|
assert_package_version "openssl" "${openssl_version}"
|
|
assert_package_version "openssl-provider-legacy" "${openssl_version}"
|
|
assert_package_version "perl-base" "${perl_base_version}"
|
|
|
|
rm -rf /var/lib/apt/lists/*
|
|
|