From 6d32815071ef88298ee501d2f415c31c8d116b91 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Wed, 23 Sep 2026 15:27:59 +0200 Subject: [PATCH] chore(agent-isolation): pin bubblewrap 0.13.0 with a 1-day cooldown Move the bubblewrap pin from 0.11.2 to 0.13.0 (released 2026-09-22). The 0.12.0 release it builds on fixes GHSA-pxhw-h44j-8pfx: during sandbox setup, files or directories could be created through parent symlinks outside the sandbox. 0.13.0 adds mount_setattr() remounts on kernel 5.12+ and rejects empty path arguments. bubblewrap gets a per-tool cooldown_days = 1 so the pin can move a day after release; the 7-day framework default is unchanged. The setup doc's install lines and version table follow the pin. The Debian bookworm caveat becomes a note that distro packages lag the pin, with the build-from-source path. The Ubuntu Noble shortcut now names the current 0.9.0-1ubuntu0.3 package, as 0.9.0-1ubuntu0.1 no longer resolves. Generated-by: Claude Opus 5 --- docs/adapters/gemini.md | 2 +- docs/setup/secure-agent-setup.md | 31 ++++++++++++---------- tools/agent-isolation/pinned-versions.toml | 17 +++++++----- 3 files changed, 29 insertions(+), 21 deletions(-) diff --git a/docs/adapters/gemini.md b/docs/adapters/gemini.md index e499a3963..ac5f43f67 100644 --- a/docs/adapters/gemini.md +++ b/docs/adapters/gemini.md @@ -364,7 +364,7 @@ Apply the approved cleanup before removing the framework source so no known hook Repeat verification after upgrades. - **Validation scope:** native API tests cover policy decisions across four approval modes and interactive/headless execution. The Linux adopter pilot exercised skill loading, the setup lifecycle, guard behavior, and shell/native-edit approval; interactive Plan Mode and authenticated MCP workflows remain unverified. - The pilot and live sandbox probes used bubblewrap 0.6.1, below the framework's 0.11.2 pin, so they do not establish validation with the [pinned primitives](../../tools/agent-isolation/pinned-versions.toml). + The pilot and live sandbox probes used bubblewrap 0.6.1, below the framework's 0.13.0 pin, so they do not establish validation with the [pinned primitives](../../tools/agent-isolation/pinned-versions.toml). ## Developer checks diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md index 1393f8b44..e43a8236a 100644 --- a/docs/setup/secure-agent-setup.md +++ b/docs/setup/secure-agent-setup.md @@ -204,7 +204,7 @@ The same flow, condensed to commands you run yourself: # section: "Required tools" below. claude-code is unpinned — # always install the latest for the newest security fixes. sudo apt-get install --no-install-recommends \ - bubblewrap=0.11.2-* socat=1.8.1.3-* + bubblewrap=0.13.0-* socat=1.8.1.3-* npm install -g --no-save @anthropic-ai/claude-code@latest # 2. Project-scope `.claude/settings.json`. Copy the framework's @@ -273,7 +273,7 @@ The current pins live in machine-readable form in | Tool | Pinned version | Released | Cooldown | Purpose | |---|---|---|---|---| -| `bubblewrap` | 0.11.2 | 2026-04-23 | 7d (default) | Linux user-namespace sandbox (filesystem layer). Required on Linux; macOS uses Seatbelt instead. | +| `bubblewrap` | 0.13.0 | 2026-09-22 | 1d | Linux user-namespace sandbox (filesystem layer). Required on Linux; macOS uses Seatbelt instead. | | `socat` | 1.8.1.3 | 2026-06-26 | 7d (default) | TCP relay for the sandbox network allowlist. Linux only. | | `claude-code` | *(unpinned — `@latest`)* | — | none | Agent harness. Installed at the latest release so it always carries the newest permission-rule / sandbox / prompt-injection fixes; not in the pin manifest. | @@ -307,25 +307,28 @@ distro. Choose whichever applies to your host. ```bash sudo apt-get update sudo apt-get install --no-install-recommends \ - bubblewrap=0.11.2-* \ + bubblewrap=0.13.0-* \ socat=1.8.1.3-* ``` -> **Debian stable (bookworm) caveat.** The pinned `bubblewrap 0.11.2` -> is not available on Debian bookworm — bookworm ships an older -> `bubblewrap`, and an adopter reported the `0.11.x` line not working -> there. `0.11.x` ships in **Debian trixie**, so the supported path is -> to run the secure setup on **trixie** (or newer). If you must stay on -> bookworm, install the older distro `bubblewrap` and accept the same +> **Distro packages lag the pin.** The pinned `bubblewrap 0.13.0` +> is newer than most distributions package, so the `apt` / `dnf` +> lines above resolve only once your distribution ships it. Until +> then, build it from the +> [release tarball](https://github.com/containers/bubblewrap/releases/tag/v0.13.0) +> (`meson setup _build && meson compile -C _build && sudo meson install -C _build`), +> or install the distribution's own `bubblewrap` and accept the same > LTS trade-off documented in the Ubuntu Noble shortcut below — the > sandbox flags don't depend on a specific bubblewrap version (the > `denyRead`/`allowRead` API has been stable since `0.6.x`). +> On Debian, an adopter reported the `0.11.x` line not working on +> **bookworm**, so run the secure setup on **trixie** (or newer). **Fedora / RHEL (dnf)**: ```bash sudo dnf install \ - bubblewrap-0.11.2 \ + bubblewrap-0.13.0 \ socat-1.8.1.3 ``` @@ -343,10 +346,10 @@ npm install -g --no-save @anthropic-ai/claude-code@latest ### Distro-specific shortcut — Linux Mint 22.x / Ubuntu 24.04 Noble -The pinned versions above (bubblewrap `0.11.2`, socat `1.8.1.3`) are +The pinned versions above (bubblewrap `0.13.0`, socat `1.8.1.3`) are the *upstream* releases that have aged past the framework's 7-day cooldown. **They are not in Ubuntu Noble's main repos** — Noble -ships `bubblewrap 0.9.0` (`0.9.0-1ubuntu0.1`) and +ships `bubblewrap 0.9.0` (`0.9.0-1ubuntu0.3`) and `socat 1.8.0.0` (`1.8.0.0-4build3`). Both Noble-shipped versions pre-date the framework's pins by months @@ -361,7 +364,7 @@ If you accept the trade-off, install via apt: ```bash sudo apt-get update sudo apt-get install --no-install-recommends \ - bubblewrap=0.9.0-1ubuntu0.1 \ + bubblewrap=0.9.0-1ubuntu0.3 \ socat=1.8.0.0-4build3 ``` @@ -370,7 +373,7 @@ sandbox flags don't depend on a specific bubblewrap version (the `denyRead`/`allowRead` API has been stable since `0.6.x`). The framework's `tools/agent-isolation/check-tool-updates.sh` will -still report upstream `0.11.2` / `1.8.1.3` as the pinned versions — +still report upstream `0.13.0` / `1.8.1.3` as the pinned versions — that's the manifest's view of what's *upstream-current*, not what your distro shipped. If you want to silence the drift, override the manifest locally with a `pinned-versions.local.toml` (gitignored) diff --git a/tools/agent-isolation/pinned-versions.toml b/tools/agent-isolation/pinned-versions.toml index caf9a40fe..ea5a74831 100644 --- a/tools/agent-isolation/pinned-versions.toml +++ b/tools/agent-isolation/pinned-versions.toml @@ -62,11 +62,16 @@ # When this file was last touched. The check script uses this as the # minimum age the entries below claim to satisfy. -pinned_at = "2026-07-08" +pinned_at = "2026-09-23" [tools.bubblewrap] -version = "0.11.2" -released = "2026-04-23" +version = "0.13.0" +released = "2026-09-22" +# Shorter than the 7-day default so 0.13.0 could be adopted a day +# after release; it carries the 0.12.0 sandbox-setup symlink fix +# (GHSA-pxhw-h44j-8pfx). Raise it back to the default if a later +# release needs a fix-forward. +cooldown_days = 1 purpose = """ Linux user-namespace sandbox. The strongest layer of credential isolation: enforces the `denyRead` / `allowRead` filesystem rules @@ -80,10 +85,10 @@ upstream_releases = "https://api.github.com/repos/containers/bubblewrap/releases # Install commands per distro (use the package manager's syntax for # requesting a specific version where supported). See # `docs/setup/secure-agent-setup.md` for adopter-facing install steps. -install.apt = "apt-get install --no-install-recommends bubblewrap=0.11.2-*" -install.dnf = "dnf install bubblewrap-0.11.2" +install.apt = "apt-get install --no-install-recommends bubblewrap=0.13.0-*" +install.dnf = "dnf install bubblewrap-0.13.0" install.brew = "# macOS does not need bubblewrap; it uses Seatbelt." -install.from_source = "https://github.com/containers/bubblewrap/releases/tag/v0.11.2" +install.from_source = "https://github.com/containers/bubblewrap/releases/tag/v0.13.0" [tools.socat] version = "1.8.1.3"