{"uuid": "1ceea924-9112-43a2-9f4d-bbbf721fcdd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27171", "type": "seen", "source": "https://gist.github.com/citadelculture/f97a518fd9863464f47fb67323ba03ad", "content": "# CorbanuTerminal Ubuntu Bazel zlib 404: exact pin, cause, and minimal repair\n\nRead-only investigation for Tasknode `task_c2e9100585b46fdddf8f4d4a7a5c590a`, observed September 26, 2026. No Corbanu repository files were changed, no PR/commit was created for this investigation, and nothing was pushed. Downloaded Debian packages were hashed, not installed or executed. The recommendations below are maintainer actions, not claims of an applied fix or passing CI.\n\n## Result\n\n`rules_rs` 0.0.102 hard-codes a Noble zlib package that Ubuntu superseded on August 31 and removed from its rolling archive on September 1. The package filename was valid; its original rolling-archive URL is now unavailable. The exact pin is in the **transitive `rules_rs` source**, not Corbanu's root Bazel lockfile.\n\nThe smallest byte-preserving recovery changes one URL to the verified official Ubuntu snapshot and keeps the existing hash. The recommended current-package repair changes the URL to `2.2` and the SHA-256 together; that version includes Ubuntu's August security update. Neither repair has been applied or run through Bazel in this read-only task.\n\n## 1. Pinned CI evidence and a correction to the brief\n\nCurrent Corbanu main is [`c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b`](https://github.com/CorbanuCore/CorbanuTerminal/commit/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b). PR126 head is [`74c908230d854a33ecf0a227bfa60547e1f02179`](https://github.com/CorbanuCore/CorbanuTerminal/pull/126).\n\nThe brief calls run `36008538634` a main run. GitHub identifies it as the **PR126 `pull_request` run**, on `74c908\u2026`, created September 24. The exact main `push` run is [`35788214243`](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243), on `c9f358\u2026`, created September 22. Both have the same failure. This distinction does not change the root cause.\n\nLiteral line freshly retrieved from the PR run's [Ubuntu verify-release job 107662920525](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/36008538634/job/107662920525):\n\n```text\n2026-09-24T13:52:14.2905056Z WARNING: Download from https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb failed: class java.io.FileNotFoundException GET returned 404 Not Found\n```\n\nThe following traceback locates `rules_rs+/rs/private/rustc_repository.bzl:69` (`rctx.download_and_extract`), called by `_add_linux_zlib` at line 88 while fetching `rules_rs++toolchains+rustc_linux_x86_64_1_95_0`. The build aborts during repository analysis, before intended compilation/tests.\n\nThe same error appears on exact main in the [clippy](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959375758), [GNU tests](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376397), [musl tests](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376021), [verify-release](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376059), and [SDK](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376091) logs. This is shared build infrastructure, not an OpenTelemetry bump or PR126 logic regression.\n\n## 2. Exact source of the pin\n\nCorbanu main [`MODULE.bazel:93\u2013101`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/MODULE.bazel#L93) selects `rules_rs` **0.0.102** in both `bazel_dep` and `single_version_override`. That override already applies `rules_rs_build_script_deps_annotation.patch`. [`MODULE.bazel:189\u2013196`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/MODULE.bazel#L189) selects its Rust **1.95.0** toolchain extension.\n\nThe [Bazel Central Registry source mapping](https://bcr.bazel.build/modules/rules_rs/0.0.102/source.json) points to the official `rules_rs-v0.0.102.tar.gz` release. Its source integrity is `sha256-suVfd5SpujPSYlZtCGasyDOSEFcH+FZgtCKsJn2V2RE=`. The matching upstream tag resolves to **`e3ca3bafd5d1617d9188c7f743c26cd2c4cb01ec`**.\n\nThe literal amd64 pin is [`rs/private/rustc_repository.bzl:60\u201364`](https://github.com/hermeticbuild/rules_rs/blob/e3ca3bafd5d1617d9188c7f743c26cd2c4cb01ec/rs/private/rustc_repository.bzl#L60):\n\n```starlark\n    \"x86_64\": struct(\n        libdir = \"usr/lib/x86_64-linux-gnu\",\n        sha256 = \"7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20\",\n        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\",\n    ),\n```\n\nThus **line 62 is the package checksum and line 63 is the package URL**. Lines 69\u201373 pass that checksum to the download. Lines 83\u201388 select by execution architecture; lines 106\u2013107 explain that the upstream Linux Rust compiler's LLVM library requires `libz.so.1`.\n\nA tracked-tree search at exact Corbanu main finds no literal `zlib1g_1.3.dfsg-3.1ubuntu2.1` pin. The broad `archive.ubuntu.com` search finds unrelated QA Linux-header/archive-list probes, not this toolchain dependency. Root `MODULE.bazel.lock` records registry/Rust metadata; it does not contain the zlib literal to edit. Do not fabricate a Corbanu file:line match or patch a generated cache path by hand.\n\n## 3. Why it disappeared; current verified package\n\nThe [exact Noble amd64 publication](https://api.launchpad.net/1.0/ubuntu/+archive/primary/+binarypub/213776678) records old version `1:1.3.dfsg-3.1ubuntu2.1`, status `Superseded`, superseded at **2026-08-31 14:08:01 UTC**, and removed at **2026-09-01 18:10:11 UTC**. This is direct publication metadata; no mirror-maintenance process was observed.\n\n[Noble Updates Packages.xz](https://archive.ubuntu.com/ubuntu/dists/noble-updates/main/binary-amd64/Packages.xz), [Noble Security Packages.xz](https://security.ubuntu.com/ubuntu/dists/noble-security/main/binary-amd64/Packages.xz), and the [Ubuntu package page](https://packages.ubuntu.com/noble/amd64/zlib1g/download) agree on:\n\n```text\nVersion: 1:1.3.dfsg-3.1ubuntu2.2\nArchitecture: amd64\nFilename: pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb\nSize: 62988\nSHA256: 84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273\nDepends: libc6 (>= 2.14)\n```\n\nThe version epoch `1:` is intentionally absent from Debian's filename. [USN-8706-1](https://ubuntu.com/security/notices/USN-8706-1), published August 31, identifies `2.2` as the Noble fix for CVE-2026-27171. The [archive directory](https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/) lists the replacement.\n\nReal HTTPS GET observations on September 26:\n\n| Resource | Result | Independently hashed bytes |\n|---|---|---|\n| Original `archive.ubuntu.com` `2.1` URL |404|No package|\n| Same path on `security.ubuntu.com` |404|No package; host swap alone fails|\n| Same path on `old-releases.ubuntu.com` |404|No verified relocation there|\n| [Archive `2.2` amd64](https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb) |200|62,988 bytes; SHA-256 `84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273`|\n| [Official snapshot `2.1`, August 30](https://snapshot.ubuntu.com/ubuntu/20260830T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb) |200|62,850 bytes; SHA-256 `7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20`|\n\nThe [snapshot's Packages index](https://snapshot.ubuntu.com/ubuntu/20260830T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz) independently matches the old package's version, size and hash. Downloaded old/new bytes match the respective authoritative index hashes exactly. Ubuntu documents its [official snapshot service](https://snapshot.ubuntu.com/) for past archive states. This establishes removal from the rolling pool and recovery from a timestamped archive, not a transient HTTP outage.\n\n## 4. Exact minimal maintainer changes\n\n### Recommended current-package repair\n\nPatch the `x86_64` entry in `rules_rs` 0.0.102's `rs/private/rustc_repository.bzl`, keeping `libdir` unchanged:\n\n```diff\n-        sha256 = \"7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20\",\n-        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\",\n+        sha256 = \"84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273\",\n+        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb\",\n```\n\nCorbanu's existing root override provides a narrow application point: add a maintainer-created `patches/rules_rs_zlib_noble_amd64.patch`, export it alongside existing files in [`patches/BUILD.bazel`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/patches/BUILD.bazel), and append `\"//patches:rules_rs_zlib_noble_amd64.patch\"` to the existing `single_version_override.patches` list at `MODULE.bazel:97\u201399`, retaining its existing patch and `patch_strip = 1`. Use a diff with `a/rs/private/rustc_repository.bzl` and `b/rs/private/rustc_repository.bzl` paths. This proposed patch filename is new, not an existing source location. This avoids a speculative whole-toolchain upgrade.\n\nThis task proves the new package's availability/integrity and declared libc dependency, not execution compatibility. Validate extraction of `usr/lib/x86_64-linux-gnu/libz.so.1` and the Linux compiler/build on Ubuntu before merging. The separate aarch64 entry at upstream lines 55\u201358 is outside this amd64 failure; do not reuse an amd64 checksum for it.\n\n### Smallest byte-preserving recovery\n\nIf the maintainer intentionally needs the identical frozen toolchain bytes, change only line 63 to:\n\n```text\nhttps://snapshot.ubuntu.com/ubuntu/20260830T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\n```\n\nKeep the original `7074b6a2\u2026d6c20` SHA-256 in full as shown above; it matches the fetched snapshot bytes. Apply via the same root override patch mechanism. This restores the missing download but retains a pre-security-update package. It is not the recommended security refresh, and no perpetual snapshot retention guarantee is made.\n\n### Lock and integrity regeneration\n\nUse the project's pinned Bazel **9.0.0** from [`.bazelversion`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.bazelversion), after adding the intended override patch:\n\n```sh\nbazel mod deps --lockfile_mode=update\ngit diff -- MODULE.bazel MODULE.bazel.lock patches/BUILD.bazel patches/rules_rs_zlib_noble_amd64.patch\n```\n\n[Bazel's documented command](https://bazel.build/external/lockfile#best-practices) re-evaluates dependencies/extensions and updates the lockfile as needed. Review and commit generated lock changes if any; do not invent a zlib lock entry or manually alter registry integrity. A local source patch does not change the BCR release archive's hash. The exact `.deb` checksum remains in the repository rule; changing package bytes requires changing that checksum, not disabling it. If Bazel emits no lockfile delta, preserve the unchanged file rather than claiming regeneration must produce a particular hash.\n\nThen fetch/analyze/build the affected Linux toolchain and rerun the same Ubuntu GNU/musl, clippy and verify-release jobs from [the pinned Bazel workflow](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.github/workflows/bazel.yml), plus the SDK job from [the pinned SDK workflow](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.github/workflows/sdk.yml). Use a clean test output base/cache boundary to demonstrate the download rather than relying solely on preexisting compiler artifacts. Other baseline CI failures can remain after this 404 is corrected.\n\n## Evidence limits\n\nThis report establishes current source pins, literal hosted failures, Ubuntu publication history, live/snapshot availability, and matching package hashes. It does not claim an applied patch, regenerated lockfile, fixed deployment, full CI pass, installed package, or verified package execution. Ubuntu index GPG signatures were not independently verified; all sources and package/index fetches used official HTTPS endpoints, with independent byte-hash matching. No credentials or private Tasknode packets are included. The earlier CI triage identified the symptom; this distinct assigned investigation traces the transitive pin and proves exact repair metadata.\n", "creation_timestamp": "2026-09-26T09:14:21.000000Z"}