# Tailscale Tailworm packaging floor — 2026-11-01

## Verified upstream position

- [TS-2026-014..017](https://tailscale.com/security-bulletins#ts-2026-014)
  require **1.104.4 or newer**. 014 concerns SSH Unix forwarding as root;
  015 SSH session memory exhaustion; 016 Serve privileged Unix sockets;
  017 cross-mount HTTP/2 capability-header races. `RunSSH=false` does not
  remove the Serve exposure.
- [Tailscale's October 28 findings](https://tailscale.com/blog/tailscale-ssh-findings-fixes)
  say **stable app connectors are unaffected**. The reported connector issue
  is in unreleased Conn25. Do not retain an unsupported blanket claim that
  stable app connectors await a fix; establish whether any node uses Conn25.
- [Headscale v0.29.7](https://github.com/juanfont/headscale/releases/tag/v0.29.7),
  published October 30, is a security release covering Tailworm and oss-scanner
  findings. Its recommendation is Headscale 0.29.7 **and** Tailscale >=1.104.4.
  Its minimum compatible client (1.80.0) is not a security floor. Confirm the
  actual coordination service and, if Headscale, deployed server version and
  SSH forwarding policy before assigning local remediation status.
- [Official stable package index](https://pkgs.tailscale.com/stable/?mode=json)
  retrieved November 1 advertises Version/TarballsVersion **1.104.4** but
  ContainersVersion **1.104.2**. A floating container tag is not proof of a fix.
  A future stable release meeting the floor still requires provenance and
  support review; the floor checker does not assert current vendor support.

## Source controls

`apps/tailscale/manifest.yml` now requests version 1.104.4 and exact image tag
`source.archipelago-foundation.org/lfg2025/tailscale:v1.104.4`. The previous
metadata was 1.78.0 with `:stable` plus `if-not-present`, allowing stale cached
images. This is a **required candidate**, not proof that the mirror contains it.
An anonymous manifest lookup returned HTTP 401; existence, digest, architectures
and actual binary versions remain unverified. Release owner must qualify the
image and regenerate/review both catalogs before signing. Never fall back to
`:stable` or relabel vulnerable bytes to satisfy the tag.

The offline guard requires explicit evidence and performs no installation,
daemon connection, restart, policy update or network operation:

```sh
python3 scripts/tailscale-security.py --manifest apps/tailscale/manifest.yml
python3 scripts/tailscale-security.py --version 1.104.4 --version 1.104.4
python3 -m unittest discover -s scripts/tests -p test_tailscale_security.py -v
```

Supply actual CLI and daemon/package versions, not copied example values.
Exit 0 means all supplied values meet the four-bulletin version floor; exit 1
means old/unknown/mismatched evidence; exit 2 means invalid invocation. Odd-minor
development releases, rc/dirty/vendor versions and unrecognized suffixes fail
closed. Numeric Debian revisions are accepted. No backport is inferred.

## Required ISO/release integration (lead and kernel lane)

At `image-recipe/_archived/build-auto-installer-iso.sh`'s Tailscale apt install
(around lines 457–459), fail the build unless installed package status is
`install ok installed`, its version meets this guard's 1.104.4 floor, and both
`tailscale version` and `/usr/sbin/tailscaled --version` first-line versions meet
the same floor. Run the helper using builder-side Python if Python is absent in
the target root. Capture each command's exit before parsing: no empty value,
pipeline failure, warning or missing package may become a pass. Verify package
origin/signatures and archive exact package version/hash in artifact evidence.

Apply again to the final extracted squashfs/installed disk; an earlier builder
layer is insufficient. For bundled `tailscale.tar` / `TAILSCALE_IMAGE`, resolve
the reviewed exact image, record its digest and platform, and check **both**
binary versions in a disposable networkless container with no host sockets,
credentials or persisted node state. Do not start tailscaled to inspect versions.
Reject an old cache even if host apt Tailscale passes. Ensure generated catalogs
and bundled image agree. These integration edits belong to other lanes and are
not installed automatically by the standalone helper.

## Node acceptance and operator decisions

For each node, retain dated pre/post evidence of installed package, CLI binary,
**running daemon** version (LocalAPI status Version), package origin, service
health and tailnet identity/IP. Inspect preferences privately and record only
`RunSSH`, auto-update policy, coordination-server classification and connector
role; do not publish credentials or whole preference/state dumps. Inspect Serve
configuration for Unix socket backends and TLS mounts with differing app
capabilities. Host daemon and optional Tailscale app container are separate
inventories; upgrading one does not patch the other.

Before a lead-authorized upgrade: preserve Tailscale state, operator prefs,
identity, wallets, app data and uninstall intent; establish reconnect/out-of-band
access. Lead stages detached package work and verifies completion after reconnect,
then compares identity/IP, tailscaled and archipelago service health, management
reachability and application preservation. A package version alone cannot prove
the running daemon was replaced. An offline node remains unverified, with last
contact and an operator recovery plan recorded.

Keep `RunSSH` off unless the operator explicitly chooses and audits otherwise.
Record a separate decision on automatic upgrades (maintenance/reconnect strategy,
Tailscale client update preference and unattended-upgrades origin policy).
Do not infer authorization from a security fix or silently enable either policy.