fix(docker): make app-shipped binaries executable

[DeepDiver1975]

Draft on purpose — do not merge yet. See "Merge gate" below: this change makes CI go red until a complete tarball with the updated rclone exists.

Why

apps/migrate_to_ocis/bin/rclone_linux_amd64 arrives in the image at 0644. Two problems:

1. The app cannot execute it; appinfo/install.php papers over this with a runtime chmod 0755.

2. The image scan never sees it. Trivy's gobinary analyzer gates on the exec bit:

   // pkg/fanal/analyzer/language/golang/binary/binary.go:37
   func (a gobinaryLibraryAnalyzer) Required(_ string, fileInfo os.FileInfo) bool {
       return utils.IsExecutable(fileInfo)   // mode.Perm()&0111 != 0
   }

   So owncloud/server:11.0.0 scans green while shipping a Go 1.22.4 rclone with 23 HIGH/CRITICAL vulnerabilities (incl. CVE-2025-68121, CVE-2024-45337, CVE-2026-33186). Not ignored, not filtered — invisible.

The bit is correct in the app's git tree (100755) and in the app release tarball (-rwxrwxr-x); it is lost when the complete tarball is assembled. owncloud/server-release#52 fixes that root cause. This PR is the defence-in-depth layer, so the image is correct and the scan is meaningful for tarballs built before that fix.

What

One RUN per base, after the existing ownership pass:

RUN find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -type f -path '*/bin/*' -exec chmod 755 {} \;

-mindepth/-maxdepth 3 scopes it to apps/<app>/bin/<file>. 10.16.4 bundles no migrate_to_ocis, so only v24.04 changes behaviour today; both bases get it for consistency.

Testing

Built v24.04 against the current owncloud-complete-20260730.tar.bz2:

$ stat -c %a .../apps/migrate_to_ocis/bin/rclone_linux_amd64
755
$ find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -path "*/bin/*" -type f -printf "%m %p\n"
755 /var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64      # the only file touched
$ find /var/www/owncloud/apps -path "*/vendor/*/bin/*" -type f -printf "%m %p\n" | head -2
644 .../files_primary_s3/vendor/mtdowling/jmespath.php/bin/perf.php    # vendored scripts untouched
644 .../files_primary_s3/vendor/mtdowling/jmespath.php/bin/jp.php

Scan of that image, with the existing v24.04/11.0.0/.trivyignore:

oc11-chmodtest (ubuntu 24.04)                                    Total: 0
var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64 (gobinary)
                                                                 Total: 23 (HIGH: 20, CRITICAL: 3)

Every other target is 0, so the new red is exactly and only the rclone binary — which is the point: the blind spot is gone.

Same image with upstream rclone v1.75.0 (owncloud/migrate_to_ocis#56) swapped in:

gobinary targets: usr/bin/gomplate 0 | usr/bin/wait-for 0 | .../migrate_to_ocis/bin/rclone_linux_amd64 0
trivy exit: 0

The gobinary analyzer running on that path and reporting clean is the proof the loop is closed.

Merge gate

Merge order matters:

1. fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56 — replace the bundled rclone with upstream v1.75.0
2. owncloud/server-release#52 — stop stripping the exec bit
3. a new owncloud-complete-*.tar.bz2 cut with 1., and main.yml pointed at it
4. this PR

Merged before step 3, it turns the 11.0.0 image build red (23 findings, exit-code: 1) — correctly, but with no fix available in the image.

Follow-up (not in this PR)

owncloud-docker/ubuntu's docker-build.yml passes skip-files: /usr/bin/gomplate,/usr/bin/wait-for, suppressing those two Go binaries outright instead of tracking their CVEs. Both are clean today, so the skip is buying nothing and hiding future findings.

🤖 Generated with Claude Code

[DeepDiver1975]

Added the second half of this change: v24.04/11.0.0/.trivyignore.yaml.

Making apps/*/bin/* executable is what makes the bundled rclone binary visible to Trivy's gobinary analyzer in the first place — so this PR necessarily turns the 11.0.0 image scan red, and it has to say what is accepted and why:

• Now, against the current 11.0.0 tarball (old fork build, go1.22.4): 48 HIGH/CRITICAL, incl. CVE-2025-68121 and CVE-2026-33186. Not accepted — this is the finding. Red is correct until the tarball ships the fixed binary.
• After the tarball ships upstream rclone v1.75.0 (fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56): 8 HIGH, all go1.26.5 stdlib, fixed in go 1.25.13 / 1.26.6, which no rclone release has been built with yet. Those eight are what the ignorefile accepts.

The file is YAML rather than the plain format so entries can carry expired_at: 2026-11-01 and a path scope (var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64) — an acceptance that expires by itself and cannot spread to another component. Verified both against Trivy: an expired entry is reported again, and the in-image path form matches. Plain and YAML files cannot be mixed in one scan, so the existing CVE-2024-51736 entry moved across with its justification; v22.04/10.16.4 is untouched (it does not bundle migrate_to_ocis).

Merge order is unchanged and this PR stays draft until it is satisfied:

1. fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56 — upstream rclone v1.75.0
2. owncloud/server-release#52 — stop stripping the exec bit from apps/*/bin/*
3. a new complete tarball built with both, and the main.yml matrix bumped to it
4. this PR

[DeepDiver1975]

Note on the red build here: the 10.16.4 job fails on guzzlehttp/guzzle CVE-2026-69246 (HIGH, fixed in 7.15.2/8.0.1) found in the released tarball's composer trees — not on anything this PR changes. master fails identically (run 32041538709, same single finding), so it predates this branch. The 11.0.0 job is cancelled because the matrix fail-fast kills the sibling, not because it failed.

Two consequences worth separating from this PR:

• guzzle in the shipped 10.16.4 tarball needs an update in core — that is the only thing keeping owncloud-docker/server master red today, and it is unrelated to the exec-bit blind spot.
• Because fail-fast cancels 11.0.0 as soon as 10.16.4 dies, the image scan this PR exists to make meaningful currently does not get to run at all on this branch. That is a second reason the merge gate above still holds.

[oc-tmueller]

Closing: obsolete. The root cause was fixed at source and the image is already correct without this change.

Verified against the shipped 11.0.1 bundle (owncloud-complete-20260925.tar.bz2, tag v11.0.1):

$ curl -sL https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2 \
    | tar -tvjf - | grep -E 'apps/[^/]+/bin/'
-rwxr-xr-x nobody/nogroup 85360802 2026-09-23 17:22 owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64

0755 already, and the only apps/<app>/bin/* file in the bundle — so the chmod here would touch exactly one file that needs nothing. The scan is not blind either: v24.04/11.0.1/.trivyignore accepts CVE-2026-84445 reported from that path, and Trivy's gobinary analyzer only inspects files carrying an exec bit.

What made it obsolete:

• owncloud/server-release#52 (merged 2026-08-18) restores the exec bit during assembly — the same find -mindepth 3 -maxdepth 3 -path '*/bin/*' -exec chmod 755 this PR added to the Dockerfiles — and is guarded by a test asserting the call exists, is scoped, and runs after the blanket chmod 644.
• fix(rclone): bump the bundled binary to upstream v1.75.1 owncloud/migrate_to_ocis#67 bumped the bundled binary to upstream rclone v1.75.1 (go 1.26.8), shipped as v3.0.2. That clears the eight go1.26.5 stdlib CVEs the second commit here accepted, so the .trivyignore.yaml has nothing left to carry.
• 10.16.5 bundles no migrate_to_ocis, so the v22.04 hunk was only ever symmetry.

The "Merge gate" this draft was waiting on is therefore fully satisfied, and what it was gating no longer needs the gate.

Two observations from this PR that do not die with it:

1. owncloud-docker/ubuntu's .github/workflows/docker-build.yml still passes skip-files: /usr/bin/gomplate,/usr/bin/wait-for, suppressing those two Go binaries outright in every consumer's scan instead of tracking their CVEs. Both are clean today, so the skip buys nothing and hides future findings. Filed as ci: stop blanket-skipping gomplate and wait-for in the Trivy scan ubuntu#315.
2. The .trivyignore files here are the plain format, so every entry is image-wide and cannot carry expired_at or paths: scoping the way server-release's YAML one does (owncloud/server-release#64). Not carried forward: neither of 11.0.1's two current acceptances has a natural expiry date, so there is nothing for expired_at to express yet. Worth revisiting when a temporary acceptance appears.