v0.322.0: CHANGELOG; the build runs apt-get upgrade (Debian 12 security fixes newer than 12.13)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-16 18:56:27 +02:00
parent 52619e89bd
commit e9d0d723c1
2 changed files with 37 additions and 1 deletions
@@ -64,7 +64,9 @@ FROM debian:12.13-slim@sha256:67b30a61dc87758f0caf819646104f29ecbda97d920aaf5edc
 # - openssh-client: restic's sftp backend shells out to `ssh` (the SFTP transport); also ssh-copy-id/sftp
 #   for the SLICE-2 offsite apply-bridge key install
 # - sshpass: feeds the one-time storage-box password to ssh-copy-id -s -f (offsite apply-bridge)
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# R-972: `apt-get upgrade` first — the Debian security fixes newer than the base image's point release (gnutls, pcre2,
+# libcap2 were fixable on 12.13 on 2026-10-16). Within Debian 12 only, so restic stays 0.14.0.
+RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    gnupg \