[sembrestels]

Web3Signer 2.0.18 updates Brain and the signer application but still ships Validator Tracker built with Go 1.24.9 and Flyway running Java 21.0.7+6. The signer Java store retains emSign Root CA - G1, while Flyway also retains the G3 and AAA roots covered by the incident mitigation.

This change rebuilds the same Tracker 0.1.5 source commit with Go 1.27.3, defaults its MPTCP use off with GODEBUG=multipathtcp=0, and updates Flyway to checksum-verified Temurin 21.0.13+9 artifacts for amd64 and ARM64. It retains the signer's Java 25.0.5+8 runtime and removes all four roots listed in the current Oracle guidance from both Java stores, independent of aliases. It also refreshes the complete OS trust files in the three affected services.

Web3Signer 26.10.2, Brain 0.1.33, the PostgreSQL images/data format, network variants, entrypoints, and existing host allowlists are retained. TRACKER_COMMIT must be updated alongside future TRACKER_VERSION bumps.

Validation completed locally on amd64:

• All three changed images build; all four variants' Compose configurations parse.
• Tracker executable reports Go 1.27.3 and the image defaults GODEBUG=multipathtcp=0.
• All three OS bundles contain none of the incident's three blocked public-key hashes.
• Both Java stores contain 117 trusted roots and none of the four roots listed by Oracle.
• Synthetic JKS and PKCS12 fixtures verify removal with unrelated aliases, preservation of an unrelated root, idempotency, and rejection of an implausibly small store.
• Tracker initializes against a mock beacon and initializes again after restart.
• The real signer health/public-key APIs work with an empty key directory before and after restart.
• Flyway completes fresh slashing-protection migrations on PostgreSQL 14, creates seven public tables, and performs a repeated no-op migration.

Run: python3 tests/security.py

The added CI workflow runs the suite on native amd64 and ARM64 runners. ARM64 has not been executed locally. The empty-key signer test disables slashing protection only in its isolated fixture; database migrations are exercised separately, without production keys or existing databases. This does not establish complete production signer/database integration or an existing-database upgrade.

CVE-2026-98432 still requires a patched host kernel. The Tracker GODEBUG setting reduces its default MPTCP exposure and does not change Docker daemon-owned DNS sockets or host sysctls. Application-supplied custom Java trust stores need their own cleanup.

References:

• https://ops.java/emudhra
• https://cr.openjdk.org/~mr/CheckCerts.java
• https://go.dev/src/net/dial.go