From 6662e6dda572565c39c71ec5288c2b264f92f4cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 11:03:28 +0100 Subject: [PATCH 1/4] feat(server): update 11.0.1 to 11.1.0 image from GitHub release tarball MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Build the 11.x image from the owncloud-complete-20261103 bundle on the v11.1.0 release and publish it as 11.1.0, 11.1 and 11. The 11.0 tag stays on 11.0.1. Move the line's .trivyignore and acceptance expected-failure lists to the new version. migrate_to_ocis v3.0.3 bundles rclone v1.75.2, which fixes CVE-2026-84445, CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031, so those entries are not carried over. CVE-2026-111943 stays (rclone is still built with go1.26.9). A local trivy 0.70.0 scan of the built image without the file reports exactly CVE-2024-4367 and CVE-2026-111943; with it, nothing. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- ...ll.md => expected-failures-11.1.0-full.md} | 2 +- ...e.md => expected-failures-11.1.0-smoke.md} | 2 +- .github/workflows/main.yml | 14 ++--- CHANGELOG.md | 7 +++ README.md | 2 +- agents.md | 4 +- v24.04/11.0.1/.trivyignore | 53 ------------------- v24.04/11.1.0/.trivyignore | 25 +++++++++ 8 files changed, 44 insertions(+), 65 deletions(-) rename .github/acceptance/{expected-failures-11.0.1-full.md => expected-failures-11.1.0-full.md} (96%) rename .github/acceptance/{expected-failures-11.0.1-smoke.md => expected-failures-11.1.0-smoke.md} (95%) delete mode 100644 v24.04/11.0.1/.trivyignore create mode 100644 v24.04/11.1.0/.trivyignore diff --git a/.github/acceptance/expected-failures-11.0.1-full.md b/.github/acceptance/expected-failures-11.1.0-full.md similarity index 96% rename from .github/acceptance/expected-failures-11.0.1-full.md rename to .github/acceptance/expected-failures-11.1.0-full.md index cf3b403..8436201 100644 --- a/.github/acceptance/expected-failures-11.0.1-full.md +++ b/.github/acceptance/expected-failures-11.1.0-full.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this # image (full run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` diff --git a/.github/acceptance/expected-failures-11.0.1-smoke.md b/.github/acceptance/expected-failures-11.1.0-smoke.md similarity index 95% rename from .github/acceptance/expected-failures-11.0.1-smoke.md rename to .github/acceptance/expected-failures-11.1.0-smoke.md index 20bd661..4c4606f 100644 --- a/.github/acceptance/expected-failures-11.0.1-smoke.md +++ b/.github/acceptance/expected-failures-11.1.0-smoke.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this # image (smoke run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index eb02c02..9b2e296 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -36,9 +36,9 @@ jobs: qa-sha256: 5b1bfa2ffc9b0156bf1cee446e56744883b69415948f634baf2bfa4c2d0ea0df base: v22.04 php: "7.4" - - version: 11.0.1 - tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2 - qa-sha256: 932006415aa75d7cc6161594997dab88cb1cef1960c62eef79d45436700942dc + - version: 11.1.0 + tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2 + qa-sha256: 3c063d72422938c71f2ce53900b0d719ab418f49a9b5dda65fafc76630b2e45b base: v24.04 php: "8.3" @@ -83,12 +83,12 @@ jobs: 10 latest smoke-version-jq: ".versionstring" - - version: 11.0.1 - tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2 + - version: 11.1.0 + tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2 base: v24.04 - trivy-ignore: v24.04/11.0.1/.trivyignore + trivy-ignore: v24.04/11.1.0/.trivyignore extra-tags: | - 11.0 + 11.1 11 smoke-version-jq: ".versionstring" diff --git a/CHANGELOG.md b/CHANGELOG.md index 403637b..e6e3c9c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 2026-11-03 + +* Added + * Publish the floating `11.1` tag for the 11.x image; `11.0` stays on 11.0.1 +* Changed + * Update 11.0.1 to 11.1.0 built from the GitHub release tarball + ## 2026-10-06 * Changed diff --git a/README.md b/README.md index db899ef..11ee91d 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links - [`10.16.6`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.6` -- [`11.0.1`, `11.0`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.1` +- [`11.1.0`, `11.1`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.1.0` ## Default volumes diff --git a/agents.md b/agents.md index 9f0a5ab..67dcf64 100644 --- a/agents.md +++ b/agents.md @@ -20,7 +20,7 @@ GitHub Actions. - `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`) - `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty - `v22.04//.trivyignore` — accepted-CVE exclusions for the Trivy scan -- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.1) +- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.1.0) - `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04//.trivyignore` — as above - `docs/` — design/spec notes - `images/` — README screenshots @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.6` (base `v22.04`) and `11.0.1` +- Matrix builds two releases: `10.16.6` (base `v22.04`) and `11.1.0` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v24.04/11.0.1/.trivyignore b/v24.04/11.0.1/.trivyignore deleted file mode 100644 index 669cba6..0000000 --- a/v24.04/11.0.1/.trivyignore +++ /dev/null @@ -1,53 +0,0 @@ -# already fixed in the vendored copy: pdfjs-dist 2.10.0 reported from -# apps/files_pdfviewer/js/vendor/pdfjs/package.json (files_pdfviewer v1.1.2). The -# /FontMatrix fix was backported into build/pdf.js and build/pdf.worker.js in -# owncloud/files_pdfviewer#351 (v1.1.1) and is guarded there by a regression test -# against a PoC PDF. The vendored package.json deliberately keeps reporting the -# upstream version so scanners can inventory the library, which is why the row -# appears at all -- v1.1.1 shipped no package.json and so was never scanned. -# Drops out when the vendored copy is regenerated from pdf.js >= 4.2.67 -# (owncloud/files_pdfviewer#363). -CVE-2024-4367 - -# not fixed in this bundle: google.golang.org/grpc v1.84.0-dev, reported from -# apps/migrate_to_ocis/bin/rclone_linux_amd64 (migrate_to_ocis v3.0.2, which -# bundles upstream rclone v1.75.1). rclone v1.75.2 carries the fixed -# v1.85.0-dev, but no released migrate_to_ocis bundles it yet. Not reachable: -# the panic is in the xDS routing interceptor, installed only by servers built -# with xds.NewGRPCServer(), and needs an inbound RPC carrying neither :authority -# nor Host -- the app shells out to `rclone sync` and `rclone obscure` and never -# serves gRPC. Do not carry this into the next 11.0.x file once its bundle ships -# a migrate_to_ocis with rclone >= v1.75.2 (owncloud/migrate_to_ocis#74). -CVE-2026-84445 - -# not fixed in this bundle: Go standard library go1.26.8 and golang.org/x/net -# v0.57.0, reported from the same apps/migrate_to_ocis/bin/rclone_linux_amd64 -# (rclone v1.75.1). rclone v1.75.2 is built with the fixed go1.26.9 and x/net -# v0.60.0, but no released migrate_to_ocis bundles it yet. -# CVE-2026-78667 (Range header parsing in FileServer/ServeContent/ServeFile) and -# CVE-2026-97031 (ECH extension handling in a crypto/tls server) are server-side -# only and not reachable: the app runs rclone purely as a client. -# CVE-2026-78669 (HTTP/2 SETTINGS flood) does affect clients. It needs a -# malicious HTTP/2 peer: the oCIS target or the ownCloud source URL rclone is -# pointed at. If `occ migrate:to-ocis:init` ran with --insecure (-k), the app -# stores that and passes rclone --no-check-certificate for both remotes on -# every later files run, so anyone on the network path to either can be that -# peer. The impact is CPU load on the app server across the files migration, -# which runs one `rclone sync` per user and can take hours. No data is exposed. -# Do not carry these into the next 11.0.x file under the same condition as -# CVE-2026-84445 above. -CVE-2026-78667 -CVE-2026-78669 -CVE-2026-97031 - -# not fixed in this bundle: Go standard library go1.26.8, reported from the same -# apps/migrate_to_ocis/bin/rclone_linux_amd64 (rclone v1.75.1). Fixed in -# go1.26.10, which no rclone release is built with yet (v1.75.2 uses go1.26.9). -# GO-2026-6809 adds a crypto/x509 denylist of compromised intermediate CAs. rclone -# is only a client here, so the exposure is a man-in-the-middle presenting a chain -# through such an intermediate while an admin runs the files migration -# (`occ migrate:to-ocis:migrate:files`, the only step where rclone connects). With -# --insecure (-k) certificates are not verified at all, so the denylist would not -# help there either. Do not carry this into the next 11.0.x file once its bundle -# ships a migrate_to_ocis whose rclone is built with go >= 1.26.10. -CVE-2026-111943 diff --git a/v24.04/11.1.0/.trivyignore b/v24.04/11.1.0/.trivyignore new file mode 100644 index 0000000..fc2daca --- /dev/null +++ b/v24.04/11.1.0/.trivyignore @@ -0,0 +1,25 @@ +# already fixed in the vendored copy: pdfjs-dist 2.10.0 reported from +# apps/files_pdfviewer/js/vendor/pdfjs/package.json (files_pdfviewer v1.1.2). The +# /FontMatrix fix was backported into build/pdf.js and build/pdf.worker.js in +# owncloud/files_pdfviewer#351 (v1.1.1) and is guarded there by a regression test +# against a PoC PDF. The vendored package.json deliberately keeps reporting the +# upstream version so scanners can inventory the library, which is why the row +# appears at all -- v1.1.1 shipped no package.json and so was never scanned. +# Drops out when the vendored copy is regenerated from pdf.js >= 4.2.67 +# (owncloud/files_pdfviewer#363). +CVE-2024-4367 + +# not fixed in this bundle: Go standard library go1.26.9, reported from +# apps/migrate_to_ocis/bin/rclone_linux_amd64 (migrate_to_ocis v3.0.3, which +# bundles upstream rclone v1.75.2). Fixed in go1.26.10 / 1.27.3, which no rclone +# release is built with yet. GO-2026-6809 adds a crypto/x509 denylist of +# compromised intermediate CAs. rclone is only a client here, so the exposure is +# a man-in-the-middle presenting a chain through such an intermediate while an +# admin runs the files migration (`occ migrate:to-ocis:migrate:files`, the only +# step where rclone connects). With --insecure (-k) certificates are not +# verified at all, so the denylist would not help there either. Accepted for +# 11.1.0 in owncloud/server-release's spec check and in migrate_to_ocis's own +# scan (owncloud/migrate_to_ocis#80), both until 2026-11-30. Do not carry this +# into the next 11.x file once its bundle ships a migrate_to_ocis whose rclone +# is built with go >= 1.26.10. +CVE-2026-111943 From 473fbd9a7d819b8e1f81078970e9508411bc3f12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 11:08:06 +0100 Subject: [PATCH 2/4] ci(trivy): expire the CVE-2026-111943 acceptance on 2026-11-30 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Match the expiry of the same acceptance in owncloud/server-release and owncloud/migrate_to_ocis#80, so the image gate does not keep suppressing it after those lapse. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- v24.04/11.1.0/.trivyignore | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/v24.04/11.1.0/.trivyignore b/v24.04/11.1.0/.trivyignore index fc2daca..0106008 100644 --- a/v24.04/11.1.0/.trivyignore +++ b/v24.04/11.1.0/.trivyignore @@ -21,5 +21,6 @@ CVE-2024-4367 # 11.1.0 in owncloud/server-release's spec check and in migrate_to_ocis's own # scan (owncloud/migrate_to_ocis#80), both until 2026-11-30. Do not carry this # into the next 11.x file once its bundle ships a migrate_to_ocis whose rclone -# is built with go >= 1.26.10. -CVE-2026-111943 +# is built with go >= 1.26.10. The exp: date makes this image's scan fail on the +# same day the other two acceptances lapse. +CVE-2026-111943 exp:2026-11-30 From 843867ce5c8a3f04f7d5c6c16746a3492730c465 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 13:44:04 +0100 Subject: [PATCH 3/4] ci(acceptance): expect 11.1.0's stale repair-step count to fail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 11.1.0 registers UpdateCertificateStore as a 17th repair step, but its own cliMain/maintenance.feature:9 still asserts 16. owncloud/core#41965 fixes the test; the 11.1.0 QA tarball keeps the stale one. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- .github/acceptance/expected-failures-11.1.0-full.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/acceptance/expected-failures-11.1.0-full.md b/.github/acceptance/expected-failures-11.1.0-full.md index 8436201..03b6463 100644 --- a/.github/acceptance/expected-failures-11.1.0-full.md +++ b/.github/acceptance/expected-failures-11.1.0-full.md @@ -13,6 +13,10 @@ - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19) - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8) +# Stale in 11.1.0's tests: they still expect 16 repair steps, but 11.1.0 registers a +# 17th (UpdateCertificateStore). Fixed in core by owncloud/core#41965. +- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9) + ## API # From local full runs: these failed in the suite and fail again on their own against From 44bc9d2c493e67904b96de0b3177c109c3882d6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 13:45:51 +0100 Subject: [PATCH 4/4] ci(acceptance): list the stale repair-step scenario for smoke runs too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CLI suite runs in full on PRs and pushes as well, against the smoke list, which is where #753's failing job looked it up. Also say the core fix is proposed, not merged. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- .github/acceptance/expected-failures-11.1.0-full.md | 4 ++-- .github/acceptance/expected-failures-11.1.0-smoke.md | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/acceptance/expected-failures-11.1.0-full.md b/.github/acceptance/expected-failures-11.1.0-full.md index 03b6463..421af2f 100644 --- a/.github/acceptance/expected-failures-11.1.0-full.md +++ b/.github/acceptance/expected-failures-11.1.0-full.md @@ -13,8 +13,8 @@ - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19) - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8) -# Stale in 11.1.0's tests: they still expect 16 repair steps, but 11.1.0 registers a -# 17th (UpdateCertificateStore). Fixed in core by owncloud/core#41965. +# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0 +# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965. - [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9) ## API diff --git a/.github/acceptance/expected-failures-11.1.0-smoke.md b/.github/acceptance/expected-failures-11.1.0-smoke.md index 4c4606f..e997808 100644 --- a/.github/acceptance/expected-failures-11.1.0-smoke.md +++ b/.github/acceptance/expected-failures-11.1.0-smoke.md @@ -12,3 +12,7 @@ - [cliManageApps/appsPath.feature:47](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L47) - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19) - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8) + +# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0 +# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965. +- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9)