fix(docker): make app-shipped binaries executable

[DeepDiver1975]

Draft on purpose — do not merge yet. See "Merge gate" below: this change makes CI go red until a complete tarball with the updated rclone exists.

Why

apps/migrate_to_ocis/bin/rclone_linux_amd64 arrives in the image at 0644. Two problems:

1. The app cannot execute it; appinfo/install.php papers over this with a runtime chmod 0755.

2. The image scan never sees it. Trivy's gobinary analyzer gates on the exec bit:

   // pkg/fanal/analyzer/language/golang/binary/binary.go:37
   func (a gobinaryLibraryAnalyzer) Required(_ string, fileInfo os.FileInfo) bool {
       return utils.IsExecutable(fileInfo)   // mode.Perm()&0111 != 0
   }

   So owncloud/server:11.0.0 scans green while shipping a Go 1.22.4 rclone with 23 HIGH/CRITICAL vulnerabilities (incl. CVE-2025-68121, CVE-2024-45337, CVE-2026-33186). Not ignored, not filtered — invisible.

The bit is correct in the app's git tree (100755) and in the app release tarball (-rwxrwxr-x); it is lost when the complete tarball is assembled. owncloud/server-release#52 fixes that root cause. This PR is the defence-in-depth layer, so the image is correct and the scan is meaningful for tarballs built before that fix.

What

One RUN per base, after the existing ownership pass:

RUN find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -type f -path '*/bin/*' -exec chmod 755 {} \;

-mindepth/-maxdepth 3 scopes it to apps/<app>/bin/<file>. 10.16.4 bundles no migrate_to_ocis, so only v24.04 changes behaviour today; both bases get it for consistency.

Testing

Built v24.04 against the current owncloud-complete-20260730.tar.bz2:

$ stat -c %a .../apps/migrate_to_ocis/bin/rclone_linux_amd64
755
$ find /var/www/owncloud/apps -mindepth 3 -maxdepth 3 -path "*/bin/*" -type f -printf "%m %p\n"
755 /var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64      # the only file touched
$ find /var/www/owncloud/apps -path "*/vendor/*/bin/*" -type f -printf "%m %p\n" | head -2
644 .../files_primary_s3/vendor/mtdowling/jmespath.php/bin/perf.php    # vendored scripts untouched
644 .../files_primary_s3/vendor/mtdowling/jmespath.php/bin/jp.php

Scan of that image, with the existing v24.04/11.0.0/.trivyignore:

oc11-chmodtest (ubuntu 24.04)                                    Total: 0
var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64 (gobinary)
                                                                 Total: 23 (HIGH: 20, CRITICAL: 3)

Every other target is 0, so the new red is exactly and only the rclone binary — which is the point: the blind spot is gone.

Same image with upstream rclone v1.75.0 (owncloud/migrate_to_ocis#56) swapped in:

gobinary targets: usr/bin/gomplate 0 | usr/bin/wait-for 0 | .../migrate_to_ocis/bin/rclone_linux_amd64 0
trivy exit: 0

The gobinary analyzer running on that path and reporting clean is the proof the loop is closed.

Merge gate

Merge order matters:

1. fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56 — replace the bundled rclone with upstream v1.75.0
2. owncloud/server-release#52 — stop stripping the exec bit
3. a new owncloud-complete-*.tar.bz2 cut with 1., and main.yml pointed at it
4. this PR

Merged before step 3, it turns the 11.0.0 image build red (23 findings, exit-code: 1) — correctly, but with no fix available in the image.

Follow-up (not in this PR)

owncloud-docker/ubuntu's docker-build.yml passes skip-files: /usr/bin/gomplate,/usr/bin/wait-for, suppressing those two Go binaries outright instead of tracking their CVEs. Both are clean today, so the skip is buying nothing and hiding future findings.

🤖 Generated with Claude Code

[DeepDiver1975]

Added the second half of this change: v24.04/11.0.0/.trivyignore.yaml.

Making apps/*/bin/* executable is what makes the bundled rclone binary visible to Trivy's gobinary analyzer in the first place — so this PR necessarily turns the 11.0.0 image scan red, and it has to say what is accepted and why:

• Now, against the current 11.0.0 tarball (old fork build, go1.22.4): 48 HIGH/CRITICAL, incl. CVE-2025-68121 and CVE-2026-33186. Not accepted — this is the finding. Red is correct until the tarball ships the fixed binary.
• After the tarball ships upstream rclone v1.75.0 (fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56): 8 HIGH, all go1.26.5 stdlib, fixed in go 1.25.13 / 1.26.6, which no rclone release has been built with yet. Those eight are what the ignorefile accepts.

The file is YAML rather than the plain format so entries can carry expired_at: 2026-11-01 and a path scope (var/www/owncloud/apps/migrate_to_ocis/bin/rclone_linux_amd64) — an acceptance that expires by itself and cannot spread to another component. Verified both against Trivy: an expired entry is reported again, and the in-image path form matches. Plain and YAML files cannot be mixed in one scan, so the existing CVE-2024-51736 entry moved across with its justification; v22.04/10.16.4 is untouched (it does not bundle migrate_to_ocis).

Merge order is unchanged and this PR stays draft until it is satisfied:

1. fix(rclone): replace the forked binary with upstream v1.75.0 owncloud/migrate_to_ocis#56 — upstream rclone v1.75.0
2. owncloud/server-release#52 — stop stripping the exec bit from apps/*/bin/*
3. a new complete tarball built with both, and the main.yml matrix bumped to it
4. this PR

[DeepDiver1975]

Note on the red build here: the 10.16.4 job fails on guzzlehttp/guzzle CVE-2026-69246 (HIGH, fixed in 7.15.2/8.0.1) found in the released tarball's composer trees — not on anything this PR changes. master fails identically (run 32041538709, same single finding), so it predates this branch. The 11.0.0 job is cancelled because the matrix fail-fast kills the sibling, not because it failed.

Two consequences worth separating from this PR:

• guzzle in the shipped 10.16.4 tarball needs an update in core — that is the only thing keeping owncloud-docker/server master red today, and it is unrelated to the exec-bit blind spot.
• Because fail-fast cancels 11.0.0 as soon as 10.16.4 dies, the image scan this PR exists to make meaningful currently does not get to run at all on this branch. That is a second reason the merge gate above still holds.