archy/docs/security/tailscale-tailworm-20261101.md

Tailscale Tailworm packaging floor — 2026-11-01

Verified upstream position

• TS-2026-014..017 require 1.104.4 or newer. 014 concerns SSH Unix forwarding as root; 015 SSH session memory exhaustion; 016 Serve privileged Unix sockets; 017 cross-mount HTTP/2 capability-header races. RunSSH=false does not remove the Serve exposure.
• Tailscale's October 28 findings say stable app connectors are unaffected. The reported connector issue is in unreleased Conn25. Do not retain an unsupported blanket claim that stable app connectors await a fix; establish whether any node uses Conn25.
• Headscale v0.29.7, published October 30, is a security release covering Tailworm and oss-scanner findings. Its recommendation is Headscale 0.29.7 and Tailscale >=1.104.4. Its minimum compatible client (1.80.0) is not a security floor. Confirm the actual coordination service and, if Headscale, deployed server version and SSH forwarding policy before assigning local remediation status.
• Official stable package index retrieved November 1 advertises Version/TarballsVersion 1.104.4 but ContainersVersion 1.104.2. A floating container tag is not proof of a fix. A future stable release meeting the floor still requires provenance and support review; the floor checker does not assert current vendor support.

Source controls

apps/tailscale/manifest.yml now requests version 1.104.4 and exact image tag source.archipelago-foundation.org/lfg2025/tailscale:v1.104.4. The previous metadata was 1.78.0 with :stable plus if-not-present, allowing stale cached images. This is a required candidate, not proof that the mirror contains it. An anonymous manifest lookup returned HTTP 401; existence, digest, architectures and actual binary versions remain unverified. Release owner must qualify the image and regenerate/review both catalogs before signing. Never fall back to :stable or relabel vulnerable bytes to satisfy the tag.

The offline guard requires explicit evidence and performs no installation, daemon connection, restart, policy update or network operation:

python3 scripts/tailscale-security.py --manifest apps/tailscale/manifest.yml
python3 scripts/tailscale-security.py --version 1.104.4 --version 1.104.4
python3 -m unittest discover -s scripts/tests -p test_tailscale_security.py -v

Supply actual CLI and daemon/package versions, not copied example values. Exit 0 means all supplied values meet the four-bulletin version floor; exit 1 means old/unknown/mismatched evidence; exit 2 means invalid invocation. Odd-minor development releases, rc/dirty/vendor versions and unrecognized suffixes fail closed. Numeric Debian revisions are accepted. No backport is inferred.

Required ISO/release integration (lead and kernel lane)

At image-recipe/_archived/build-auto-installer-iso.sh's Tailscale apt install (around lines 457–459), fail the build unless installed package status is install ok installed, its version meets this guard's 1.104.4 floor, and both tailscale version and /usr/sbin/tailscaled --version first-line versions meet the same floor. Run the helper using builder-side Python if Python is absent in the target root. Capture each command's exit before parsing: no empty value, pipeline failure, warning or missing package may become a pass. Verify package origin/signatures and archive exact package version/hash in artifact evidence.

Apply again to the final extracted squashfs/installed disk; an earlier builder layer is insufficient. For bundled tailscale.tar / TAILSCALE_IMAGE, resolve the reviewed exact image, record its digest and platform, and check both binary versions in a disposable networkless container with no host sockets, credentials or persisted node state. Do not start tailscaled to inspect versions. Reject an old cache even if host apt Tailscale passes. Ensure generated catalogs and bundled image agree. These integration edits belong to other lanes and are not installed automatically by the standalone helper.

Node acceptance and operator decisions

For each node, retain dated pre/post evidence of installed package, CLI binary, running daemon version (LocalAPI status Version), package origin, service health and tailnet identity/IP. Inspect preferences privately and record only RunSSH, auto-update policy, coordination-server classification and connector role; do not publish credentials or whole preference/state dumps. Inspect Serve configuration for Unix socket backends and TLS mounts with differing app capabilities. Host daemon and optional Tailscale app container are separate inventories; upgrading one does not patch the other.

Before a lead-authorized upgrade: preserve Tailscale state, operator prefs, identity, wallets, app data and uninstall intent; establish reconnect/out-of-band access. Lead stages detached package work and verifies completion after reconnect, then compares identity/IP, tailscaled and archipelago service health, management reachability and application preservation. A package version alone cannot prove the running daemon was replaced. An offline node remains unverified, with last contact and an operator recovery plan recorded.

Keep RunSSH off unless the operator explicitly chooses and audits otherwise. Record a separate decision on automatic upgrades (maintenance/reconnect strategy, Tailscale client update preference and unattended-upgrades origin policy). Do not infer authorization from a security fix or silently enable either policy.