From e3d490a5a9feceb8e7bf5043ef0bf37a573d9af3 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Mon, 26 Oct 2026 09:51:34 -0300 Subject: [PATCH 1/2] versions: kernel 7.3, cosign v3.1.4, buildkit, git-lfs, snapshot and base images kernel: 7.3-rc5 -> 7.3. 7.3 is released; the source goes back to cdn.kernel.org's .tar.xz, as the entry's note says, and kernel/config-7.3-rc5-x86_64 is kernel/config-7.3-x86_64 in the same commit. Until kernel.org lists a 7.3.y stable, `task versions` keeps reporting the series as a decision. cosign: v3.0.6 -> v3.1.4 git-lfs: 3.8.0 -> 3.8.1 buildkit: 0.34.0 -> 0.34.1 debian-snapshot: 20261014T000000Z -> 20261026T000000Z debian: trixie, alpine: 3.24, ubuntu: 26.04 at today's digests Co-Authored-By: Claude Fable 5.1 --- ...onfig-7.3-rc5-x86_64 => config-7.3-x86_64} | 0 versions.yaml | 24 +++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) rename kernel/{config-7.3-rc5-x86_64 => config-7.3-x86_64} (100%) diff --git a/kernel/config-7.3-rc5-x86_64 b/kernel/config-7.3-x86_64 similarity index 100% rename from kernel/config-7.3-rc5-x86_64 rename to kernel/config-7.3-x86_64 diff --git a/versions.yaml b/versions.yaml index 0b24aee..56c1dcb 100644 --- a/versions.yaml +++ b/versions.yaml @@ -55,7 +55,7 @@ kind: image source: mirror.gcr.io/library/alpine version: '3.24' - pin: sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 + pin: sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a track: digest note: >- the musl builder of the static QEMU and e2fsprogs, and the base of the QEMU runtime image. @@ -67,9 +67,9 @@ - name: kernel kind: download - source: https://git.kernel.org/torvalds/t/linux-{version}.tar.gz - version: 7.3-rc5 - pin: 382d6aa48640351df7da6321e156c39155b4a99b0985d4370f7e608729987453 + source: https://cdn.kernel.org/pub/linux/kernel/v{major}.x/linux-{version}.tar.xz + version: 7.3 + pin: 87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953 track: kernel-stable note: >- kernel/Dockerfile. A new kernel for every guest's next boot; checkpoints keep resuming, each @@ -84,7 +84,7 @@ kind: image source: mirror.gcr.io/library/debian version: trixie - pin: sha256:913f6706df59a68922d1dd08f78c2476560a8d367897200a6005b00e5f67c2d5 + pin: sha256:4c25275446ca371766b8b093c696782eabce06263fccacb8d5d813b3dc44b308 track: digest note: >- the kernel's toolchain (and qboot's and the floor kernel's), with its packages from @@ -107,7 +107,7 @@ - name: debian-snapshot kind: date - version: 20261014T000000Z + version: 20261026T000000Z track: today note: >- the Debian archive the kernel's toolchain is installed from, as it stood then, and the @@ -130,7 +130,7 @@ kind: image source: mirror.gcr.io/library/ubuntu version: '26.04' - pin: sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7 + pin: sha256:c098726dd9b9733f3e885f8de0ef375206a311b0a317eadc40d347b1115fb944 track: digest note: >- image/Dockerfile: the container mkosi runs in, and where its apt and keyring come from. @@ -163,8 +163,8 @@ - name: git-lfs kind: download source: https://github.com/git-lfs/git-lfs/releases/download/v{version}/git-lfs-linux-amd64-v{version}.tar.gz - version: 3.8.0 - pin: e455e00f15d9b95661b8d53498ffb0c3367962cf1ec73c31ab7369516cd6ab8d + version: 3.8.1 + pin: e72cf723a4a660438862282e8aecf3885fc8123e88bfcad534cf6b941a354b75 track: tags https://github.com/git-lfs/git-lfs.git note: >- image/Dockerfile hands it to install-dev-tools.sh, as task. The pin can be checked against @@ -173,8 +173,8 @@ - name: buildkit kind: download source: https://github.com/moby/buildkit/releases/download/v{version}/buildkit-v{version}.linux-amd64.tar.gz - version: 0.34.0 - pin: 14813b1fb2a40082114e6d386c6fc5e7dd5298176ce7ee1a18bc33e73e109ac3 + version: 0.34.1 + pin: a59539daf547fe0958efe2d07e41c0a6944e1112a66d7e519ec1cf5b673ef15b track: tags https://github.com/moby/buildkit.git note: >- image/Dockerfile hands it to install-dev-tools.sh, as task: buildctl and buildkitd. The @@ -212,7 +212,7 @@ - name: cosign kind: module source: github.com/sigstore/cosign/v3/cmd/cosign - version: v3.0.6 + version: v3.1.4 track: github-release https://github.com/sigstore/cosign note: >- task boot:compat checks the release it fetches with it, on the KVM runner, which has no From 19ed8c3bfb86f2a937e5fcac4b249c473c6f1db9 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Mon, 26 Oct 2026 10:02:03 -0300 Subject: [PATCH 2/2] alpine 3.24 at today's digest: the apk locks and QEMU's build cache follow The first build on the new base failed in `apk add`: both apk.lock files named the versions the old mirror served, and the new one serves others (musl 1.2.6-r2, alpine-release 3.24.2-r0). `task apk:lock` on the pinned image rewrites them, and QEMU_CONFIG_REV moves so QEMU's build directory is not the cache mount configured under the old base, as the alpine entry's note says. Co-Authored-By: Claude Fable 5.1 --- e2fsprogs/apk.lock | 32 ++++++++++++++++---------------- qemu/Dockerfile | 2 +- qemu/apk.lock | 24 ++++++++++++------------ 3 files changed, 29 insertions(+), 29 deletions(-) diff --git a/e2fsprogs/apk.lock b/e2fsprogs/apk.lock index cfd6b75..e39e4d7 100644 --- a/e2fsprogs/apk.lock +++ b/e2fsprogs/apk.lock @@ -4,21 +4,21 @@ acl-static=2.3.2-r1 alpine-baselayout-data=3.7.2-r1 alpine-baselayout=3.7.2-r1 alpine-keys=2.6-r0 -alpine-release=3.24.2-r0 +alpine-release=3.24.3-r0 apk-tools=3.0.8-r0 binutils=2.45.1-r1 -brotli-libs=1.2.0-r1 +brotli-libs=1.2.1-r0 build-base=0.5-r4 busybox-binsh=1.37.0-r31 busybox=1.37.0-r31 bzip2-dev=1.0.8-r6 bzip2-static=1.0.8-r6 -c-ares=1.34.8-r0 -ca-certificates-bundle=20260909-r0 -curl=8.22.0-r0 -expat-dev=2.8.5-r0 -expat-static=2.8.5-r0 -expat=2.8.5-r0 +c-ares=1.34.9-r0 +ca-certificates-bundle=20261020-r0 +curl=8.23.0-r0 +expat-dev=2.9.0-r0 +expat-static=2.9.0-r0 +expat=2.9.0-r0 file=5.47-r2 fortify-headers=3.0.1-r2 g++=15.2.0-r5 @@ -27,14 +27,14 @@ gmp=6.3.0-r4 isl26=0.26-r2 jansson=2.15.0-r0 libapk=3.0.8-r0 -libarchive-dev=3.8.7-r0 -libarchive-static=3.8.7-r0 -libarchive=3.8.7-r0 +libarchive-dev=3.8.10-r0 +libarchive-static=3.8.10-r0 +libarchive=3.8.10-r0 libatomic=15.2.0-r5 libbz2=1.0.8-r6 libcrypto3=3.5.9-r0 -libcurl=8.22.0-r0 -libexpat=2.8.5-r0 +libcurl=8.23.0-r0 +libexpat=2.9.0-r0 libgcc-static=15.2.0-r5 libgcc=15.2.0-r5 libgomp=15.2.0-r5 @@ -52,9 +52,9 @@ lz4-static=1.10.0-r1 make=4.4.1-r4 mpc1=1.3.1-r1 mpfr4=4.2.2-r0 -musl-dev=1.2.6-r2 -musl-utils=1.2.6-r2 -musl=1.2.6-r2 +musl-dev=1.2.6-r3 +musl-utils=1.2.6-r3 +musl=1.2.6-r3 nghttp2-libs=1.70.0-r0 openssl-dev=3.5.9-r0 openssl-libs-static=3.5.9-r0 diff --git a/qemu/Dockerfile b/qemu/Dockerfile index 4939ac6..c0b22ec 100644 --- a/qemu/Dockerfile +++ b/qemu/Dockerfile @@ -85,7 +85,7 @@ ARG JOBS=8 # configured under the old base, skipped configure, relinked, and produced a dynamically # linked binary from a Dockerfile that says --static on every other line. The assertion # below is what caught it. -ARG QEMU_CONFIG_REV=6 +ARG QEMU_CONFIG_REV=7 SHELL ["/bin/sh", "-o", "pipefail", "-c"] diff --git a/qemu/apk.lock b/qemu/apk.lock index d605a38..1acc83f 100644 --- a/qemu/apk.lock +++ b/qemu/apk.lock @@ -3,24 +3,24 @@ acpica=20250807-r0 alpine-baselayout-data=3.7.2-r1 alpine-baselayout=3.7.2-r1 alpine-keys=2.6-r0 -alpine-release=3.24.2-r0 +alpine-release=3.24.3-r0 apk-tools=3.0.8-r0 bash=5.3.9-r1 binutils=2.45.1-r1 bison=3.8.2-r3 -brotli-libs=1.2.0-r1 +brotli-libs=1.2.1-r0 bsd-compat-headers=0.7.2-r6 build-base=0.5-r4 busybox-binsh=1.37.0-r31 busybox=1.37.0-r31 bzip2-dev=1.0.8-r6 -c-ares=1.34.8-r0 -ca-certificates-bundle=20260909-r0 +c-ares=1.34.9-r0 +ca-certificates-bundle=20261020-r0 coreutils-env=9.11-r0 coreutils-fmt=9.11-r0 coreutils-sha512sum=9.11-r0 coreutils=9.11-r0 -curl=8.22.0-r0 +curl=8.23.0-r0 docbook-xml=4.5-r10 docbook-xsl-nons=1.79.2-r13 docbook-xsl-ns=1.79.2-r13 @@ -56,12 +56,12 @@ libbz2=1.0.8-r6 libcap-ng-dev=0.8.5-r2 libcap-ng-static=0.8.5-r2 libcap-ng=0.8.5-r2 -libcrypto3=3.5.8-r0 -libcurl=8.22.0-r0 +libcrypto3=3.5.9-r0 +libcurl=8.23.0-r0 libeconf=0.8.3-r0 libedit-dev=20260508.3.1-r1 libedit=20260508.3.1-r1 -libexpat=2.8.5-r0 +libexpat=2.9.0-r0 libfdisk=2.42.3-r1 libffi-dev=3.5.2-r1 libffi=3.5.2-r1 @@ -85,7 +85,7 @@ libseccomp-dev=2.6.1-r0 libseccomp-static=2.6.1-r0 libseccomp=2.6.1-r0 libsmartcols=2.42.3-r1 -libssl3=3.5.8-r0 +libssl3=3.5.9-r0 libstdc++-dev=15.2.0-r5 libstdc++=15.2.0-r5 libunistring=1.4.2-r0 @@ -105,9 +105,9 @@ meson=1.11.1-r0 mpc1=1.3.1-r1 mpdecimal=4.0.1-r0 mpfr4=4.2.2-r0 -musl-dev=1.2.6-r2 -musl-utils=1.2.6-r2 -musl=1.2.6-r2 +musl-dev=1.2.6-r3 +musl-utils=1.2.6-r3 +musl=1.2.6-r3 ncurses-dev=6.6_p20260516-r0 ncurses-terminfo-base=6.6_p20260516-r0 nghttp2-libs=1.70.0-r0