From 299be913a100acfc2a1715a6b30db82120f24ae5 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 16 Sep 2026 10:30:50 +0000 Subject: [PATCH 1/4] Update embedded curl to 8.22.0 and adapt its Bazel overlay --- deps/curl/BUILD.bazel | 4 +- deps/curl/curl.MODULE.bazel | 6 +- deps/curl/overlay/lib_contents.bzl | 65 +++++++++++-------- deps/curl/overlay/overlay.BUILD.bazel | 4 -- .../notes/curl-8-22-0-7385f21bfe471ecc.yaml | 4 ++ 5 files changed, 47 insertions(+), 36 deletions(-) create mode 100644 releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml diff --git a/deps/curl/BUILD.bazel b/deps/curl/BUILD.bazel index 8b09f725c069..42b418295cc5 100644 --- a/deps/curl/BUILD.bazel +++ b/deps/curl/BUILD.bazel @@ -1,13 +1,13 @@ load("@bazel_skylib//rules:diff_test.bzl", "diff_test") load("//bazel/tools:generate_module_bazel.bzl", "generate_module_bazel") -VERSION = "8.21.0" +VERSION = "8.22.0" generate_module_bazel( name = "curl_module_bazel_new", out = "curl.MODULE.bazel.new", module = "curl", - sha256 = "d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb", + sha256 = "d54dd598bf05927a726deb38df31c6a255ba83ff1de57c5d1464dac3ed8f44a1", strip_prefix = "curl-%s" % VERSION, tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], diff --git a/deps/curl/curl.MODULE.bazel b/deps/curl/curl.MODULE.bazel index 6fd0a53d7ea9..6f0a6c0b29e6 100644 --- a/deps/curl/curl.MODULE.bazel +++ b/deps/curl/curl.MODULE.bazel @@ -10,7 +10,7 @@ http_archive( "lib_contents.bzl": "//deps/curl:overlay/lib_contents.bzl", "linux/lib/curl_config.h": "//deps/curl:overlay/linux/lib/curl_config.h", }, - sha256 = "d9b327997999045a24cda50f3983e69e51c516bd8be6ef9842fc7f99135e33bb", - strip_prefix = "curl-8.21.0", - url = "https://curl.haxx.se/download/curl-8.21.0.tar.gz", + sha256 = "d54dd598bf05927a726deb38df31c6a255ba83ff1de57c5d1464dac3ed8f44a1", + strip_prefix = "curl-8.22.0", + url = "https://curl.haxx.se/download/curl-8.22.0.tar.gz", ) diff --git a/deps/curl/overlay/lib_contents.bzl b/deps/curl/overlay/lib_contents.bzl index d1b18fc7adf9..dcfd52245a5b 100644 --- a/deps/curl/overlay/lib_contents.bzl +++ b/deps/curl/overlay/lib_contents.bzl @@ -18,12 +18,16 @@ PUBLIC_HDRS = [ HDRS = [ "lib/altsvc.h", + "lib/api.h", + "lib/curl_ed25519.h", + "lib/http_httpsig.h", + "lib/uint-hashset.h", "lib/amigaos.h", "lib/arpa_telnet.h", - "lib/asyn.h", + "lib/vdns/asyn.h", "lib/bufq.h", "lib/bufref.h", - "lib/cf-dns.h", + "lib/vdns/cf-dns.h", "lib/cf-h1-proxy.h", "lib/cf-h2-proxy.h", "lib/cf-haproxy.h", @@ -35,7 +39,6 @@ HDRS = [ "lib/cfilters.h", "lib/config-mac.h", "lib/config-os400.h", - "lib/config-riscos.h", "lib/config-win32.h", "lib/conncache.h", "lib/connect.h", @@ -89,8 +92,8 @@ HDRS = [ "lib/cw-out.h", "lib/cw-pause.h", "lib/dict.h", - "lib/dnscache.h", - "lib/doh.h", + "lib/vdns/dnscache.h", + "lib/vdns/doh.h", "lib/dynhds.h", "lib/easy_lock.h", "lib/easyif.h", @@ -108,7 +111,7 @@ HDRS = [ "lib/gopher.h", "lib/hash.h", "lib/headers.h", - "lib/hostip.h", + "lib/vdns/hostip.h", "lib/hsts.h", "lib/http_aws_sigv4.h", "lib/http_chunks.h", @@ -119,7 +122,7 @@ HDRS = [ "lib/http.h", "lib/http1.h", "lib/http2.h", - "lib/httpsrr.h", + "lib/vdns/httpsrr.h", "lib/idn.h", "lib/if2ip.h", "lib/imap.h", @@ -368,13 +371,17 @@ LIB_CURLTOOL_SRCS_LINUX = [ LIB_CURLU_SRCS_DARWIN = [ "lib/altsvc.c", + "lib/api.c", + "lib/curl_ed25519.c", + "lib/http_httpsig.c", + "lib/uint-hashset.c", "lib/amigaos.c", - "lib/asyn-ares.c", - "lib/asyn-base.c", - "lib/asyn-thrdd.c", + "lib/vdns/asyn-ares.c", + "lib/vdns/asyn-base.c", + "lib/vdns/asyn-thrdd.c", "lib/bufq.c", "lib/bufref.c", - "lib/cf-dns.c", + "lib/vdns/cf-dns.c", "lib/cf-h1-proxy.c", "lib/cf-h2-proxy.c", "lib/cf-haproxy.c", @@ -426,8 +433,8 @@ LIB_CURLU_SRCS_DARWIN = [ "lib/cw-out.c", "lib/cw-pause.c", "lib/dict.c", - "lib/dnscache.c", - "lib/doh.c", + "lib/vdns/dnscache.c", + "lib/vdns/doh.c", "lib/dynhds.c", "lib/easy.c", "lib/easygetopt.c", @@ -445,9 +452,9 @@ LIB_CURLU_SRCS_DARWIN = [ "lib/hash.c", "lib/headers.c", "lib/hmac.c", - "lib/hostip.c", - "lib/hostip4.c", - "lib/hostip6.c", + "lib/vdns/hostip.c", + "lib/vdns/hostip4.c", + "lib/vdns/hostip6.c", "lib/hsts.c", "lib/http_aws_sigv4.c", "lib/http_chunks.c", @@ -458,7 +465,7 @@ LIB_CURLU_SRCS_DARWIN = [ "lib/http.c", "lib/http1.c", "lib/http2.c", - "lib/httpsrr.c", + "lib/vdns/httpsrr.c", "lib/idn.c", "lib/if2ip.c", "lib/imap.c", @@ -550,13 +557,17 @@ LIB_CURLU_SRCS_DARWIN = [ LIB_CURLU_SRCS_LINUX = [ "lib/altsvc.c", + "lib/api.c", + "lib/curl_ed25519.c", + "lib/http_httpsig.c", + "lib/uint-hashset.c", "lib/amigaos.c", - "lib/asyn-ares.c", - "lib/asyn-base.c", - "lib/asyn-thrdd.c", + "lib/vdns/asyn-ares.c", + "lib/vdns/asyn-base.c", + "lib/vdns/asyn-thrdd.c", "lib/bufq.c", "lib/bufref.c", - "lib/cf-dns.c", + "lib/vdns/cf-dns.c", "lib/cf-h1-proxy.c", "lib/cf-h2-proxy.c", "lib/cf-haproxy.c", @@ -608,8 +619,8 @@ LIB_CURLU_SRCS_LINUX = [ "lib/cw-out.c", "lib/cw-pause.c", "lib/dict.c", - "lib/dnscache.c", - "lib/doh.c", + "lib/vdns/dnscache.c", + "lib/vdns/doh.c", "lib/dynhds.c", "lib/easy.c", "lib/easygetopt.c", @@ -627,9 +638,9 @@ LIB_CURLU_SRCS_LINUX = [ "lib/hash.c", "lib/headers.c", "lib/hmac.c", - "lib/hostip.c", - "lib/hostip4.c", - "lib/hostip6.c", + "lib/vdns/hostip.c", + "lib/vdns/hostip4.c", + "lib/vdns/hostip6.c", "lib/hsts.c", "lib/http_aws_sigv4.c", "lib/http_chunks.c", @@ -640,7 +651,7 @@ LIB_CURLU_SRCS_LINUX = [ "lib/http.c", "lib/http1.c", "lib/http2.c", - "lib/httpsrr.c", + "lib/vdns/httpsrr.c", "lib/idn.c", "lib/if2ip.c", "lib/imap.c", diff --git a/deps/curl/overlay/overlay.BUILD.bazel b/deps/curl/overlay/overlay.BUILD.bazel index f5bf258d0305..cbe194d7698d 100644 --- a/deps/curl/overlay/overlay.BUILD.bazel +++ b/deps/curl/overlay/overlay.BUILD.bazel @@ -21,8 +21,6 @@ package( default_visibility = ["@@//packages:__subpackages__"], ) -VERSION = "8.18.0" - SO_VERSION = "4.8.0" license( @@ -33,8 +31,6 @@ license( visibility = ["//visibility:public"], ) -SONAME = "libcurl.so.%s" % VERSION - PUBLIC_HEADERS = [ "include/curl/curl.h", "include/curl/curlver.h", diff --git a/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml b/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml new file mode 100644 index 000000000000..3d92a211d4ea --- /dev/null +++ b/releasenotes/notes/curl-8-22-0-7385f21bfe471ecc.yaml @@ -0,0 +1,4 @@ +--- +security: + - | + Update embedded curl to 8.22.0. From 497230cdec30ac3fe7073fb256973fe3c242fc63 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 16 Sep 2026 10:33:51 +0000 Subject: [PATCH 2/4] Match upstream Linux feature flags for TLS hostname validation --- deps/curl/overlay/overlay.BUILD.bazel | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/deps/curl/overlay/overlay.BUILD.bazel b/deps/curl/overlay/overlay.BUILD.bazel index cbe194d7698d..1f1c09d0e561 100644 --- a/deps/curl/overlay/overlay.BUILD.bazel +++ b/deps/curl/overlay/overlay.BUILD.bazel @@ -62,7 +62,11 @@ LOCAL_DEFINES = [ "SM4_ASM", "VPAES_ASM", "VPSM4_ASM", -] +] + select({ + # Match configure.ac: glibc extension prototypes require this feature macro. + "@platforms//os:linux": ["_GNU_SOURCE"], + "//conditions:default": [], +}) copy_file( name = "copy_config_h", From e33054cf651aab81ca29614af3082ae1aa9ec1a4 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 16 Sep 2026 10:42:26 +0000 Subject: [PATCH 3/4] Let Bazel validate dependency inputs on warm Omnibus builds --- AGENTS.md | 2 +- deps/curl/Makefile | 2 +- docs/dev/stac-24773-bazel-migration.md | 8 ++++++++ omnibus/config/software/datadog-agent-dependencies.rb | 5 ++++- 4 files changed, 14 insertions(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index aeb226e590a2..9fc1607dc889 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -175,7 +175,7 @@ Go build tags control feature inclusion, some examples are: - Release automation workflows ### Contributing -PRs should follow `.github/PULL_REQUEST_TEMPLATE.md` and the guidelines in +PRs should follow the guidelines in `docs/public/guidelines/` (contributing, coding style, components, etc.). When a PR changes behavior, configuration options, or APIs, update the corresponding documentation in the same PR — not as a follow-up. diff --git a/deps/curl/Makefile b/deps/curl/Makefile index 05659f24cccd..080fd8eaf086 100644 --- a/deps/curl/Makefile +++ b/deps/curl/Makefile @@ -6,7 +6,7 @@ # A tool to look at configure output and create parts to support bazel targets C2B=$(HOME)/ws/experimental/teams/agent-supply-chain/configure2bazel -PRISTINE=curl-8.18.0 +PRISTINE=curl-8.22.0 next: echo Do both steps on each platform. diff --git a/docs/dev/stac-24773-bazel-migration.md b/docs/dev/stac-24773-bazel-migration.md index dcd32d5c15ca..043536fdd4ca 100644 --- a/docs/dev/stac-24773-bazel-migration.md +++ b/docs/dev/stac-24773-bazel-migration.md @@ -49,6 +49,14 @@ Also pass `flavor_flag` (`--//packages/agent:flavor=fips` or heroku) where upstr ## Core patterns +### Cache ownership + +Keep `always_build true` in `datadog-agent-dependencies.rb`. Omnibus fingerprints +its Ruby recipes, but does not track the Bazel dependency manifests and overlays. +The stage must invoke Bazel on every package build so Bazel can validate its own +cache against those inputs. After a native dependency update, verify the version +inside the resulting DEB or image, including when Omnibus restores a warm cache. + ### Shared libraries → `install` + `replace_prefix` **Do not** ship Bazel-built `.so` files only via `//packages/agent/dependencies:install` / `pkg_filegroup all_files` if they need to live under `/opt/stackstate-agent/embedded/lib` with embedded RPATH. That failed omnibus health check (C2 pipeline 2619669055): `DT_NEEDED` pointed at system `/lib` for `libz` / `liblzma`. diff --git a/omnibus/config/software/datadog-agent-dependencies.rb b/omnibus/config/software/datadog-agent-dependencies.rb index dee1d9be3d2f..a63de21e7db3 100644 --- a/omnibus/config/software/datadog-agent-dependencies.rb +++ b/omnibus/config/software/datadog-agent-dependencies.rb @@ -1,6 +1,9 @@ name 'datadog-agent-dependencies' -description "Enforce building dependencies as soon as possible so they can be cached" +description "Build and install the Bazel-managed agent dependencies" + +# Omnibus does not fingerprint Bazel inputs; let Bazel validate its own cache. +always_build true # [sts] STAC-24773: Bazel migration. The remaining `dependency '...'` lines below # (jmxfetch, libpcap, systemd, snmp-traps, procps-ng) are progressively replaced by From 87919b7211d9de107272501d064ca619cf01d578 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Wed, 16 Sep 2026 10:43:50 +0000 Subject: [PATCH 4/4] Refresh mutable base images before agent image builds --- .github/workflows/build-binaries.yml | 2 +- .github/workflows/build-deb.yml | 2 +- docs/dev/stac-24773-bazel-migration.md | 2 ++ omnibus/package-scripts/publish_image.sh | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index d995d4f2a76f..e618fd5c85ac 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -229,7 +229,7 @@ jobs: # puts that directory on PATH so CMD can exec `stackstate-cluster-agent` # by name. Flattening it to a bare binary breaks the image. cp -r bin/stackstate-cluster-agent Dockerfiles/cluster-agent/ - docker build -t "${LOCAL_IMAGE}" Dockerfiles/cluster-agent + docker build --pull -t "${LOCAL_IMAGE}" Dockerfiles/cluster-agent - name: Smoke test cluster-agent image run: | diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index 825037edee99..6cea8a3f95ed 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -313,7 +313,7 @@ jobs: cp "${debs[0]}" Dockerfiles/agent/ # publish_image.sh also passes --build-arg S6_ARCH; the agent Dockerfile # declares no such ARG, so it is dropped here rather than kept as a warning. - docker build --build-arg ARCH="${ARCH}" -t "${LOCAL_IMAGE}" Dockerfiles/agent + docker build --pull --build-arg ARCH="${ARCH}" -t "${LOCAL_IMAGE}" Dockerfiles/agent - name: Smoke test agent image run: | diff --git a/docs/dev/stac-24773-bazel-migration.md b/docs/dev/stac-24773-bazel-migration.md index 043536fdd4ca..e40b3f35ead4 100644 --- a/docs/dev/stac-24773-bazel-migration.md +++ b/docs/dev/stac-24773-bazel-migration.md @@ -56,6 +56,8 @@ its Ruby recipes, but does not track the Bazel dependency manifests and overlays The stage must invoke Bazel on every package build so Bazel can validate its own cache against those inputs. After a native dependency update, verify the version inside the resulting DEB or image, including when Omnibus restores a warm cache. +Image builds using mutable base tags must pull those tags before building so +cached base images do not hide distribution security updates. ### Shared libraries → `install` + `replace_prefix` diff --git a/omnibus/package-scripts/publish_image.sh b/omnibus/package-scripts/publish_image.sh index 1858c971bf67..1483b2d2fb6b 100755 --- a/omnibus/package-scripts/publish_image.sh +++ b/omnibus/package-scripts/publish_image.sh @@ -20,7 +20,7 @@ BUILD_TAG="${IMAGE_REPO}:${IMAGE_TAG}" docker login -u "${quay_user}" -p "${quay_password}" "${REGISTRY}" docker login -u "${REGISTRY_USER}" -p "${REGISTRY_PASSWORD}" "${REGISTRY_HOST}" -docker build --build-arg ARCH="${ARCH}" --build-arg S6_ARCH="${S6_ARCH}" -t "${BUILD_TAG}" "${DOCKERFILE_PATH}" +docker build --pull --build-arg ARCH="${ARCH}" --build-arg S6_ARCH="${S6_ARCH}" -t "${BUILD_TAG}" "${DOCKERFILE_PATH}" DOCKER_TAG="${REGISTRY}/${ORGANIZATION}/${IMAGE_REPO}:${IMAGE_TAG}"