aicybercentral-releases/export_build_files
Watch
1
0
Fork
You've already forked export_build_files
 0
Code Issues Pull requests Projects Releases 41 Activity
41 releases 98 tags
  • cyber-suite-single-tenant-v2.6.75 bd515d9278

    Cyber Suite single-tenant v2.6.75 — WITHDRAWN (use v2.6.76) Stable

    michael released this 2026-09-08 13:03:59 +00:00 | 0 commits to main since this release

    WITHDRAWN — do not deploy. Use v2.6.76.

    The cyber-suite-single-tenant.zip asset has been removed from this release on
    2026-09-08. If you already downloaded it, replace it with v2.6.76.

    Why. This build fails a HIGH/CRITICAL container scan on nine findings:
    CVE-2026-56854 golang.org/x/crypto v0.53.0 — CRITICAL
    CVE-2026-84304 google.golang.org/grpc v1.82.1 — HIGH
    7 x stdlib Go 1.25.12 — HIGH

    The first two are real dependency issues, fixed in v2.6.76 (x/crypto v0.55.0,
    grpc v1.83.1). The seven stdlib findings were an artefact of how this export was
    built: it was assembled by hand against a stale golang:1.25-alpine base
    (go1.25.12) while the production image of the same version was built on
    go1.25.14, so this zip was more vulnerable than the service it mirrors.

    What changed after this. The customer export is now built by CI from the
    same cosign-signed image as production and is never rebuilt, both image scans
    gate on HIGH/CRITICAL, and the build bases are pinned by digest. v2.6.76 is the
    first release through that pipeline and scans clean.

    The release entry is kept rather than deleted so anyone holding this zip can
    find out why it was withdrawn.

    Downloads