Skip to content

WolfStack v25.9.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 08:01
· 388 commits to master since this release
v25.9.6
9b8a42e

v25.9.6: OSV scanner identifies the running kernel correctly — no more false all-clear on Proxmox, no more already-patched CVEs on live-patched hosts

Two defects in how src/predictive/osv.rs identifies the running kernel,
both measured on live hosts 2026-08-04.

DEFECT 1 — live-patched kernels report already-fixed CVEs. TuxCare/
KernelCare patches the kernel IN MEMORY, changing neither uname -r nor the
dpkg version, so osv.rs sent OSV the on-disk version (wolfstack-1:
6.12.90-2) while the host actually ran 6.12.96-1 per kcarectl --uname.
Every CVE fixed in between read as outstanding, and since live patching
means never rebooting, the gap only widens. Fix: prefer the agent's
effective version (kcarectl --uname) when the binary exists and exits 0;
unchanged behaviour with no agent (the common case). Applied to both the
Apt and RHEL arms.

DEFECT 2 (more dangerous) — Proxmox kernels never identified, silently.
kernel package name was hardcoded as linux-image-, which finds
nothing on Proxmox (it ships proxmox-kernel--signed). The lookup
returned None, fell back to the raw uname string, and queried OSV for a
package that does not exist — a silent false all-clear for kernel CVEs on
all three Proxmox+Ceph nodes running the railway work. Nobody investigates
a clean report. Fix: resolve the real owning package via
dpkg -S /boot/vmlinuz- (works on Debian AND Proxmox), reusing
boot_partition::parse_dpkg_search_owners; keep linux-image- as a fallback.

Silence fixed too: if the kernel package cannot be identified at all, the
scanner NO LONGER queries OSV with a bogus name — it emits a Warn-tier
finding (FINDING_KERNEL_UNIDENTIFIED) so the operator sees kernel CVEs
were NOT covered, mirroring the existing unrecognized-derivative
breadcrumb pattern. Auto-resolves once the kernel becomes identifiable.

Match the existing run_capped(3s) timeout discipline. Both match arms
correct, no half-wired agent branches (Ksplice/Livepatch left out openly
rather than stubbed). 5 new tests: agent present, agent absent, Proxmox
package name, Debian guess, and unidentifiable kernel.

Testing: the parsing/decision logic is unit-tested against the REAL
host-measured strings (kcarectl "6.12.96-1", the wolf1 dpkg -S line).
End-to-end collect_running_kernel on a live agent is NOT exercised this
session, and the RHEL live-patch path is untested (no RHEL host in the
fleet) — both flagged in-code. 1714 tests pass, clippy at baseline.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading