sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

fix(forgejo): update to 16.0.4 for two security fixes #760

Merged
binjovi-bot merged 1 commit from fix/forgejo-16.0.4 into trunk 2026-09-14 17:08:09 +00:00
Conversation 0 Commits 1 Files changed 4 +14 -14
sean commented 2026-09-14 17:02:33 +00:00
Owner
Copy link

Forgejo 16.0.2 → 16.0.4 on the cluster. 16.0.4 is a security release: an RCE
through template expansion (a malicious template repo creating a .git folder
during variable expansion, reading arbitrary data and running processes on the
host) and an authorization bypass letting a repo-scoped API token edit pull
requests past its restrictions.

Same shape as e430e004 (16.0.2), plus the two pins that did not exist then:

  • forgejo-app/deployment.yaml — five tag pins move together.
  • binjovi/integration-bootstrap.yaml — the digest-pinned publisher moves to the
    16.0.4-rootless index digest sha256:a263a129…, and because a Job template
    is immutable the generation moves v32 → v33 in all four places.
  • tests/binjovi.sh — count, retired-generation refute (now v32) and the template
    fingerprint (2484060452 18830) re-pinned under the new name.
  • tests/upstream-inventory.txt — the record moves; count stays 6.

Rollout is the migration: Recreate, one replica, gitea migrate in the
configure-gitea init container — expect a short outage of code.sean.farm.

Verified: tests/upstream-inventory.sh ok, tests/binjovi.sh ok, full
tests/check.sh exit 0.

First step of putting all three tiers of the off-cluster mirror chain on the
same Forgejo release; the FreeBSD and OmniOS tiers follow from source.

https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

Forgejo **16.0.2 → 16.0.4** on the cluster. 16.0.4 is a security release: an RCE through template expansion (a malicious template repo creating a `.git` folder during variable expansion, reading arbitrary data and running processes on the host) and an authorization bypass letting a repo-scoped API token edit pull requests past its restrictions. Same shape as `e430e004` (16.0.2), plus the two pins that did not exist then: - `forgejo-app/deployment.yaml` — five tag pins move together. - `binjovi/integration-bootstrap.yaml` — the digest-pinned publisher moves to the 16.0.4-rootless **index** digest `sha256:a263a129…`, and because a Job template is immutable the generation moves **v32 → v33** in all four places. - `tests/binjovi.sh` — count, retired-generation refute (now v32) and the template fingerprint (`2484060452 18830`) re-pinned under the **new** name. - `tests/upstream-inventory.txt` — the record moves; count stays 6. Rollout is the migration: `Recreate`, one replica, `gitea migrate` in the `configure-gitea` init container — expect a short outage of `code.sean.farm`. Verified: `tests/upstream-inventory.sh` ok, `tests/binjovi.sh` ok, full `tests/check.sh` exit 0. First step of putting all three tiers of the off-cluster mirror chain on the same Forgejo release; the FreeBSD and OmniOS tiers follow from source. https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
fix(forgejo): update to 16.0.4 for two security fixes
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
0d6b1c71cd
 
16.0.4 (2026-09-10) closes a remote code execution through template expansion
-- a malicious template repository could create a .git folder during variable
expansion and read arbitrary data from, and run processes on, the Forgejo host
-- and an authorization bypass where a repo-scoped API token could edit pull
requests past its restrictions. Same precedent as e430e004 (16.0.2).

Six references move together, as tests/upstream-inventory.txt requires: five
tag pins in forgejo-app/deployment.yaml and the digest-pinned publisher in
binjovi/integration-bootstrap.yaml, whose digest is the 16.0.4-rootless index
sha256:a263a129... resolved from the registry.

That Job's template is immutable, so its generation moves v32 -> v33 in all
four places, and tests/binjovi.sh re-pins the count, the retired name (now v32)
and the template fingerprint (2484060452 18830). Re-pinning under the old name
is the exact defect that pin exists to catch (2026-09-02, two deploys rolled
back).

Rollout is the migration: the Deployment is Recreate with a single replica and
`gitea migrate` runs in the configure-gitea init container, so expect a short
outage of code.sean.farm while the schema moves.

This is the first step of putting every tier of the off-cluster mirror chain
on the same Forgejo release.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
binjovi-bot deleted branch fix/forgejo-16.0.4 2026-09-14 17:08:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!760
No description provided.