Repository navigation
feat(server): update 11.0.1 to 11.1.0 image from GitHub release tarball - #753
Merged
Merged
Conversation
Build the 11.x image from the owncloud-complete-20261103 bundle on the v11.1.0 release and publish it as 11.1.0, 11.1 and 11. The 11.0 tag stays on 11.0.1. Move the line's .trivyignore and acceptance expected-failure lists to the new version. migrate_to_ocis v3.0.3 bundles rclone v1.75.2, which fixes CVE-2026-84445, CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031, so those entries are not carried over. CVE-2026-111943 stays (rclone is still built with go1.26.9). A local trivy 0.70.0 scan of the built image without the file reports exactly CVE-2024-4367 and CVE-2026-111943; with it, nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Match the expiry of the same acceptance in owncloud/server-release and owncloud/migrate_to_ocis#80, so the image gate does not keep suppressing it after those lapse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
jvillafanez
approved these changes
Nov 3, 2026
11.1.0 registers UpdateCertificateStore as a 17th repair step, but its own cliMain/maintenance.feature:9 still asserts 16. owncloud/core#41965 fixes the test; the 11.1.0 QA tarball keeps the stale one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
The CLI suite runs in full on PRs and pushes as well, against the smoke list, which is where #753's failing job looked it up. Also say the core fix is proposed, not merged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Resolve the expected conflicts with the 10.16.7 bump (#752): keep both bumps in README.md and agents.md, and fold the two 2026-11-03 CHANGELOG sections into one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds the 11.x image from
owncloud/core@v11.1.0's complete bundle,owncloud-complete-20261103.tar.bz2, and publishes it as11.1.0,11.1and11.Note: 11.1.0 and 10.16.7 were published on the same day, so both bundles are called
owncloud-complete-20261103.tar.bz2. Only the tag in the URL tells them apart.main.yml:version,tarballandqa-sha256(3c063d72…) in the acceptance matrix;version,tarball,trivy-ignoreandextra-tags(11.0→11.1) in the build matrixv24.04/11.0.1/.trivyignore→v24.04/11.1.0/, rewritten. See below.expected-failures-11.0.1-{full,smoke}.md→-11.1.0-. Every listed feature line points at the same scenario atv11.1.0as atv11.0.1.README.md,agents.md,CHANGELOG.md11.0is no longer rebuilt.owncloud/server:11.0and:11.0.1stay on the last 11.0.1 image and stop receiving base-image updates, as earlier lines did..trivyignoremigrate_to_ocis v3.0.3 bundles rclone v1.75.2, which fixes CVE-2026-84445, CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031, so those four are not carried over. Two entries remain:
exp:2026-11-30, the same date as the acceptance in owncloud/server-release (Integrate clair vuln checks #80 there) and ci: accept CVE-2026-111943 for the bundled rclone binary owncloud/migrate_to_ocis#80. Once the date passes, this image's Trivy gate fails again. That probably also stops the weekly rebuild from republishing11.1/11until migrate_to_ocis rebundles a fixed rclone. A plain.trivyignorecannot be path-scoped, so this entry covers the whole image.Verified locally
11.1.0on/status.php.exp:was tested against the bundle's rclone binary: exit 0 with 2026-11-30, exit 1 with a past date.workflow_dispatch, which pushes no image) is in progress: 41616790782.Conflicts with #752 (10.16.7)
That PR edits the same lines in
README.md,agents.mdandCHANGELOG.md. Whichever merges second needs a rebase that keeps both bumps and folds the two## 2026-11-03sections into one.🤖 Generated with Claude Code