diff --git a/.github/acceptance/expected-failures-11.0.1-full.md b/.github/acceptance/expected-failures-11.1.0-full.md similarity index 84% rename from .github/acceptance/expected-failures-11.0.1-full.md rename to .github/acceptance/expected-failures-11.1.0-full.md index cf3b403..421af2f 100644 --- a/.github/acceptance/expected-failures-11.0.1-full.md +++ b/.github/acceptance/expected-failures-11.1.0-full.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this # image (full run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` @@ -13,6 +13,10 @@ - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19) - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8) +# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0 +# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965. +- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9) + ## API # From local full runs: these failed in the suite and fail again on their own against diff --git a/.github/acceptance/expected-failures-11.0.1-smoke.md b/.github/acceptance/expected-failures-11.1.0-smoke.md similarity index 78% rename from .github/acceptance/expected-failures-11.0.1-smoke.md rename to .github/acceptance/expected-failures-11.1.0-smoke.md index 20bd661..e997808 100644 --- a/.github/acceptance/expected-failures-11.0.1-smoke.md +++ b/.github/acceptance/expected-failures-11.1.0-smoke.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this # image (smoke run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` @@ -12,3 +12,7 @@ - [cliManageApps/appsPath.feature:47](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L47) - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19) - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8) + +# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0 +# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965. +- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9cff461..392712b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -36,9 +36,9 @@ jobs: qa-sha256: 97371a5b1e1f3fd334aea42e3c67419f002b26260539a15e14e2672471bafb05 base: v22.04 php: "7.4" - - version: 11.0.1 - tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2 - qa-sha256: 932006415aa75d7cc6161594997dab88cb1cef1960c62eef79d45436700942dc + - version: 11.1.0 + tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2 + qa-sha256: 3c063d72422938c71f2ce53900b0d719ab418f49a9b5dda65fafc76630b2e45b base: v24.04 php: "8.3" @@ -83,12 +83,12 @@ jobs: 10 latest smoke-version-jq: ".versionstring" - - version: 11.0.1 - tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2 + - version: 11.1.0 + tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2 base: v24.04 - trivy-ignore: v24.04/11.0.1/.trivyignore + trivy-ignore: v24.04/11.1.0/.trivyignore extra-tags: | - 11.0 + 11.1 11 smoke-version-jq: ".versionstring" diff --git a/CHANGELOG.md b/CHANGELOG.md index 74cba2b..22c5f38 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,8 +2,11 @@ ## 2026-11-03 +* Added + * Publish the floating `11.1` tag for the 11.x image; `11.0` stays on 11.0.1 * Changed * Update 10.16.6 to 10.16.7 built from the GitHub release tarball + * Update 11.0.1 to 11.1.0 built from the GitHub release tarball ## 2026-10-06 diff --git a/README.md b/README.md index 9ffde95..94f97fd 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links - [`10.16.7`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.7` -- [`11.0.1`, `11.0`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.1` +- [`11.1.0`, `11.1`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.1.0` ## Default volumes diff --git a/agents.md b/agents.md index f455a95..3389d72 100644 --- a/agents.md +++ b/agents.md @@ -20,7 +20,7 @@ GitHub Actions. - `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`) - `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty - `v22.04//.trivyignore` — accepted-CVE exclusions for the Trivy scan -- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.1) +- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.1.0) - `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04//.trivyignore` — as above - `docs/` — design/spec notes - `images/` — README screenshots @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.0.1` +- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.1.0` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v24.04/11.0.1/.trivyignore b/v24.04/11.0.1/.trivyignore deleted file mode 100644 index 669cba6..0000000 --- a/v24.04/11.0.1/.trivyignore +++ /dev/null @@ -1,53 +0,0 @@ -# already fixed in the vendored copy: pdfjs-dist 2.10.0 reported from -# apps/files_pdfviewer/js/vendor/pdfjs/package.json (files_pdfviewer v1.1.2). The -# /FontMatrix fix was backported into build/pdf.js and build/pdf.worker.js in -# owncloud/files_pdfviewer#351 (v1.1.1) and is guarded there by a regression test -# against a PoC PDF. The vendored package.json deliberately keeps reporting the -# upstream version so scanners can inventory the library, which is why the row -# appears at all -- v1.1.1 shipped no package.json and so was never scanned. -# Drops out when the vendored copy is regenerated from pdf.js >= 4.2.67 -# (owncloud/files_pdfviewer#363). -CVE-2024-4367 - -# not fixed in this bundle: google.golang.org/grpc v1.84.0-dev, reported from -# apps/migrate_to_ocis/bin/rclone_linux_amd64 (migrate_to_ocis v3.0.2, which -# bundles upstream rclone v1.75.1). rclone v1.75.2 carries the fixed -# v1.85.0-dev, but no released migrate_to_ocis bundles it yet. Not reachable: -# the panic is in the xDS routing interceptor, installed only by servers built -# with xds.NewGRPCServer(), and needs an inbound RPC carrying neither :authority -# nor Host -- the app shells out to `rclone sync` and `rclone obscure` and never -# serves gRPC. Do not carry this into the next 11.0.x file once its bundle ships -# a migrate_to_ocis with rclone >= v1.75.2 (owncloud/migrate_to_ocis#74). -CVE-2026-84445 - -# not fixed in this bundle: Go standard library go1.26.8 and golang.org/x/net -# v0.57.0, reported from the same apps/migrate_to_ocis/bin/rclone_linux_amd64 -# (rclone v1.75.1). rclone v1.75.2 is built with the fixed go1.26.9 and x/net -# v0.60.0, but no released migrate_to_ocis bundles it yet. -# CVE-2026-78667 (Range header parsing in FileServer/ServeContent/ServeFile) and -# CVE-2026-97031 (ECH extension handling in a crypto/tls server) are server-side -# only and not reachable: the app runs rclone purely as a client. -# CVE-2026-78669 (HTTP/2 SETTINGS flood) does affect clients. It needs a -# malicious HTTP/2 peer: the oCIS target or the ownCloud source URL rclone is -# pointed at. If `occ migrate:to-ocis:init` ran with --insecure (-k), the app -# stores that and passes rclone --no-check-certificate for both remotes on -# every later files run, so anyone on the network path to either can be that -# peer. The impact is CPU load on the app server across the files migration, -# which runs one `rclone sync` per user and can take hours. No data is exposed. -# Do not carry these into the next 11.0.x file under the same condition as -# CVE-2026-84445 above. -CVE-2026-78667 -CVE-2026-78669 -CVE-2026-97031 - -# not fixed in this bundle: Go standard library go1.26.8, reported from the same -# apps/migrate_to_ocis/bin/rclone_linux_amd64 (rclone v1.75.1). Fixed in -# go1.26.10, which no rclone release is built with yet (v1.75.2 uses go1.26.9). -# GO-2026-6809 adds a crypto/x509 denylist of compromised intermediate CAs. rclone -# is only a client here, so the exposure is a man-in-the-middle presenting a chain -# through such an intermediate while an admin runs the files migration -# (`occ migrate:to-ocis:migrate:files`, the only step where rclone connects). With -# --insecure (-k) certificates are not verified at all, so the denylist would not -# help there either. Do not carry this into the next 11.0.x file once its bundle -# ships a migrate_to_ocis whose rclone is built with go >= 1.26.10. -CVE-2026-111943 diff --git a/v24.04/11.1.0/.trivyignore b/v24.04/11.1.0/.trivyignore new file mode 100644 index 0000000..0106008 --- /dev/null +++ b/v24.04/11.1.0/.trivyignore @@ -0,0 +1,26 @@ +# already fixed in the vendored copy: pdfjs-dist 2.10.0 reported from +# apps/files_pdfviewer/js/vendor/pdfjs/package.json (files_pdfviewer v1.1.2). The +# /FontMatrix fix was backported into build/pdf.js and build/pdf.worker.js in +# owncloud/files_pdfviewer#351 (v1.1.1) and is guarded there by a regression test +# against a PoC PDF. The vendored package.json deliberately keeps reporting the +# upstream version so scanners can inventory the library, which is why the row +# appears at all -- v1.1.1 shipped no package.json and so was never scanned. +# Drops out when the vendored copy is regenerated from pdf.js >= 4.2.67 +# (owncloud/files_pdfviewer#363). +CVE-2024-4367 + +# not fixed in this bundle: Go standard library go1.26.9, reported from +# apps/migrate_to_ocis/bin/rclone_linux_amd64 (migrate_to_ocis v3.0.3, which +# bundles upstream rclone v1.75.2). Fixed in go1.26.10 / 1.27.3, which no rclone +# release is built with yet. GO-2026-6809 adds a crypto/x509 denylist of +# compromised intermediate CAs. rclone is only a client here, so the exposure is +# a man-in-the-middle presenting a chain through such an intermediate while an +# admin runs the files migration (`occ migrate:to-ocis:migrate:files`, the only +# step where rclone connects). With --insecure (-k) certificates are not +# verified at all, so the denylist would not help there either. Accepted for +# 11.1.0 in owncloud/server-release's spec check and in migrate_to_ocis's own +# scan (owncloud/migrate_to_ocis#80), both until 2026-11-30. Do not carry this +# into the next 11.x file once its bundle ships a migrate_to_ocis whose rclone +# is built with go >= 1.26.10. The exp: date makes this image's scan fail on the +# same day the other two acceptances lapse. +CVE-2026-111943 exp:2026-11-30