image-versions.yaml

images:
  - name: centos-bootc
    image: quay.io/centos-bootc/centos-bootc
    tag: c10s
    digest: sha256:9aedf2d189b85c498697f9b83112c893b084d359268da7dd6d5d848478d260de
  - name: common
    image: ghcr.io/projectbluefin/common
    tag: latest
    digest: sha256:f7934f263b4357cba6ad253e7a3ce8d667cd478798a137be8f3a18c04806cbee
  - name: brew
    image: ghcr.io/ublue-os/brew
    tag: latest
    digest: sha256:393b567da078f0f0638450c388e229011dae06f94a90017cb7525b57d9faa46e

  # RFC 010: pre-built Zirconium image for DMS/Niri system files
  # on grouper (Ubuntu) — not available from Ubuntu apt.
  - name: zirconium
    image: ghcr.io/zirconium-dev/zirconium
    tag: latest
    digest: sha256:f2c2085f82be014aa49ec625eda74299e6164b63ff6c7e5ad6b11634dc8d1253

  # Bluefin's GNOME 51 for Hummingbird (projectbluefin/utah-packages): a
  # createrepo_c repository shipped as an OCI image (`/repository`), signed
  # with cosign, built in Hummingbird's own root (Fedora 44 + public-
  # hummingbird by priority). hummingbird:gnome consumes it by digest the
  # way every other upstream payload here is consumed, instead of building a
  # second GNOME 51 for the same base in tunaos-packages
  # (tuna-os/tunaos-packages#629, docs/HUMMINGBIRD-TARGET.md there).
  # x86_64 only; hummingbird's desktop flavors are amd64-only in
  # .github/build-config.yml for the same reason.
  - name: utah-packages
    image: ghcr.io/projectbluefin/utah-packages
    tag: latest
    digest: sha256:7e363747dde4932568fd7363a75380e4850db863d229025a2eabce3ac479d64a

  # tunaOS' own GNOME 50 for EL10, from the gnome50-el10-x86_64 build chain in
  # tuna-os/tunaos-packages: a createrepo_c repository shipped as an OCI image
  # (`/repository`), exactly the shape utah-packages uses above. Built in a
  # CentOS Stream 10 mock root in GitHub Actions and signed with the tunaOS
  # key; here the digest is what is trusted.
  #
  # This replaces the https tier at repo.tunaos.org/gnome50/10-stream-x86_64.
  # That prefix was never factory output -- the since-deleted
  # refresh-gnome50-r2.yml rclone-synced the jreilly1821/c10s-gnome-50 COPR
  # into it, so its packages carried the COPR project key and a gpgcheck=1
  # consumer could not install one (yellowfin run 33750514082 died at "GPG
  # check FAILED ... glib2-2.88.0-4.el10"). tunaos-packages#676 gave the family
  # its own prefix and evicted the foreign content; #682 fixed the buildroot so
  # the chain could rebuild what the eviction removed. This digest is the first
  # index that is both factory-signed and a complete stack: 345 packages,
  # gnome-shell 50.0-3, mutter 50.0-4, gdm 50.0-3, gtk4 4.21.6, glib2 2.88.0-1
  # (tunaos-packages run 33857079036).
  #
  # x86_64 only: the chain has no aarch64 leg, so EL10 GNOME stays off on
  # Apple Silicon until one exists.
  - name: gnome50-el10-packages
    image: ghcr.io/tuna-os/tunaos-packages
    tag: gnome50-el10-x86_64
    digest: sha256:b279ab7c95e48fdc14ad083169fd79cd87b04a5d2aba90d3a8ba1580f7de944d

# Package ceilings carried until their upstream regressions are fixed.
packages:
  # libselinux 3.11-1.el10 prevents dbus-broker, systemd-logind and
  # pam_selinux from opening their SELinux context handles on the rolling EL10
  # bases (tunaOS#2485). skipjack:gnome changed from a dead system bus to
  # TUNAOS_DESKTOP_CONTRACT_OK when only libselinux was moved back to 3.10 in
  # run 35191766126. 3.10-2 contains only the subsequent restorecon ENOENT fix
  # (RHEL-110181), so keep the rolling bases on the latest 3.10 build until an
  # upstream 3.11+ build is demonstrated by the same boot contract.
  el10_rolling_libselinux: "3.10-2.el10"

# Pinned binary downloads (managed by Renovate)
downloads:
  # Independent schema oracle for contract tests; not an image runtime package.
  # renovate: datasource=pypi depName=jsonschema
  jsonschema: "4.26.0"
  # renovate: datasource=github-releases depName=ublue-os/uupd
  uupd: "v1.5.1"
  # renovate: datasource=github-releases depName=ledif/kcm_ublue
  kcm_ublue: "v0.6.1"
  # renovate: datasource=github-releases depName=mvdan/sh
  #
  # shfmt is a FORMATTER, so its version is part of the repo's formatting.
  # `just fix` runs it over every shell script and `just check` fails on drift,
  # which means two contributors on different shfmt versions produce different
  # trees and each sees the other's as unformatted.
  #
  # This is not hypothetical: `just fix` once rewrote 145 files and 12,277
  # lines on a clean main because .editorconfig disagreed with the code
  # (fixed separately). An unpinned formatter is the same failure waiting on a
  # release rather than on a config edit -- and AGENTS.md makes
  # `just fix && just check` mandatory before every commit, so everyone hits
  # it at once.
  shfmt: "v3.14.1"
  # renovate: datasource=github-releases depName=hivecommons/spektacular
  # The spec, plan and build workflows (RFC 011, ADR 0010). Its version must
  # match `written_by` in .spektacular/config.yaml; `spektacular version check`
  # reports a mismatch, and `spektacular migrate` upgrades the project files.
  spektacular: "v0.20.0"
  # renovate: datasource=github-releases depName=twpayne/chezmoi
  chezmoi: "v2.73.1"
  chezmoi_sha256:
    amd64: "74c239da8b55ae9955a833304b87adc4cf82336647f31d317ccbb7952ad58d46"
    arm64: "4b5df8d925b79abbe265af25e4c585a4da91aadbae573a0dcc8e2bfcf63e6f1a"
  # The boot gate's harness (scripts/corral-boot-gate.sh, installed by
  # scripts/install-corral.sh). The commit of the v0.7.0 tag, the first release
  # with `vmtest --fail-marker`/`--karg` and local composefs builds. corral
  # publishes no binaries, so install-corral.sh builds this commit from source.
  # renovate: datasource=git-refs depName=tuna-os/corral
  corral: "388342bec8a54e4c09e265f41fcea4d92597ea47"
  # renovate: datasource=git-refs depName=tuna-os/tacklebox
  # This is the fallback every caller that does not set TACKLEBOX_SHA gets
  # (scripts/lib/common.sh:229) — installer-smoke.yml among them.
  #
  # FLOOR, not a ceiling: below fd95174, tacklebox bakes `--omit "tpm2-tss
  # pcsc"` into the dracut command line, which aborts the rebuild on any EL
  # image that force-adds clevis (see luks-e2e.yml). fd95174 is the commit
  # that replaced it with a per-image probe, and initramfs_test.go pins the
  # baked-in form gone. So never move this pin below fd95174 — moving it
  # ABOVE has always been fine, and a Renovate bump to an older-but-clean
  # digest is the thing to watch (tuna-os/iso-builder#43).
  #
  # At 4fa6041 for the live-boot fix: below it, the embedded initrd overlay
  # cannot mount the live root at all. $hookdir is on the image's read-only
  # /usr, so the queue directories cannot be created, tbox-live-root never
  # runs, and the boot dies in emergency on `overlayfs: failed to resolve
  # '/run/rootfsbase'`. Proven both ways by named runs: broken at
  # tacklebox 30629145076, booting to login at 30630284339.
  tacklebox: "ae93e9b5bacef49746cb1b08dc805c3149d7c9c8"
  # ae93e9b (tuna-os/tacklebox#300) makes the post-customize commit deadline
  # settable with TBOX_CUSTOMIZE_COMMIT_TIMEOUT; before it, a literal 600s
  # killed multi-GB desktop commits on CI (tunaOS#1893), and
  # scripts/lib/tacklebox.sh now passes 1800 by default. It descends from
  # fd95174, 4fa6041 and f3dd168 (checked with git merge-base
  # --is-ancestor), so it keeps f3dd168's k8s-file log-driver fix: the runner
  # images lack journald for the container, and the customize/initramfs/commit
  # steps otherwise die in conmon.

  # AvengeMedia's EL10 dms-greeter 1.6 RPM is a runtime-sync launcher and
  # carries no QML. Keep the same source payload and checksum as the pending
  # tunaos-packages dms/dms-greeter recipes for the offline-build fallback.
  #
  # The checksum here was wrong from the day it landed and could not be
  # noticed, because the only caller of install-dms-qml-fallback.sh was
  # build_scripts/desktop/niri.sh -- the legacy installer, which the manifest
  # build path never sources. The first build that actually ran the fallback
  # died on it (yellowfin:niri arm64, run 34602178178):
  #
  #   sha256sum: WARNING: 1 computed checksum did NOT match
  #   /tmp/tmp.5NcpUhiidJ/dms-qml.tar.gz: FAILED
  #
  # Upstream publishes its own checksum next to the asset, so this one is
  # copied from the source of truth rather than computed from a download and
  # trusted on its own:
  #
  #   curl -sSL https://github.com/AvengeMedia/DankMaterialShell/releases/\
  #     download/v1.6.1/dms-qml.tar.gz.sha256
  #   904ad2709a2075f10dbb089b42a9f4eb39d8f06cb2634fd4c95fa739ef9c4a2d  dms-qml.tar.gz
  #
  # That value matches the asset on two separate fetches, and the archive
  # holds what the fallback asserts: DMSGreeter.qml, and a
  # Modules/Greetd/assets/dms-greeter that is a shell script, so one payload
  # serves every architecture. Re-derive from the .sha256 asset, never from a
  # local sha256sum of whatever arrived, whenever this version moves.
  # renovate: datasource=github-releases depName=AvengeMedia/DankMaterialShell
  dms_qml: "v1.6.3"
  dms_qml_sha256: "f8f3884aff9d29b008a50fd0d164b512a680a6cce209a8b62a690534fdfd4c80"

  # Zirconium's mkosi.extra payload, fetched as a source tarball by
  # build_scripts/install-zirconium.sh (niri stages only). Pinned to a commit
  # for the same reason every other download here is: `main` moves, so an
  # unpinned fetch makes niri builds non-reproducible and puts whatever landed
  # upstream in the last hour into the image. A tarball checksum is not an
  # option on top of this — GitHub generates the archive on demand and its
  # bytes are not stable — but the commit itself is content-addressed, so the
  # pin is what fixes the file set.
  # renovate: datasource=git-refs depName=zirconium-dev/zirconium
  zirconium_src: "d2cfb176433cd214a26d02abe572c1b9d9fcc72e"

  # Bootc toolchain built from source (see toolchain/) and published to
  # ghcr.io/tuna-os/bootc-toolchain-<base> as OCI artifacts via ORAS.
  # These pins drive both the toolchain builds and the version tags consumers
  # request. Renovate bumps them; the toolchain workflow rebuilds on bump.
  # renovate: datasource=github-releases depName=bootc-dev/bootc
  #
  # CEILING, not a floor -- the opposite of the tacklebox pin below. Do not
  # move this above v1.16.10 until bootc makes selinux optional again, or
  # Arch ships libselinux.
  #
  # v1.16.11 added `selinux = { workspace = true }` to crates/lib/Cargo.toml
  # as a hard dependency with no feature flag. selinux-sys' build script needs
  # selinux/selinux.h, and Arch does not ship it: `libselinux` is not in the
  # official repos at all (`pacman -Si libselinux` -> "package not found"), so
  # there is nothing to add to Containerfile.arch's bootc-builder stage.
  # Every marlin build therefore dies with
  #   selinux-sys: Failed to find 'selinux/selinux.h'
  # Renovate bumped this on 2026-09-03 and Build Marlin has been red on every
  # run since, on both arches.
  #
  # Verified by building Containerfile.arch's bootc-builder stage at both
  # versions on a clean archlinux:latest: v1.16.11 fails as above, v1.16.10
  # completes. renovate.json carries a matching allowedVersions ceiling so
  # this cannot be silently bumped back.
  bootc: "v1.16.10"
  # renovate: datasource=github-releases depName=coreos/bootupd
  bootupd: "v0.3.2"
  # ostree from source only for bases whose packaged ostree is older than
  # bootc's required libostree (e.g. Debian trixie ships 2025.2 < 2025.3).
  # ostree is built from source (with its vendored composefs submodule) only for
  # bases whose packaged libostree is older than bootc's required 2025.3 — e.g.
  # Debian trixie ships 2025.2. Newer bases (sid) use the packaged libostree.
  # renovate: datasource=github-releases depName=ostreedev/ostree
  ostree: "v2026.4"
  # composefs: built from source (meson) and pkg-config-installed so the source
  # ostree can configure --with-composefs, on bases that don't package it (trixie).
  # renovate: datasource=github-releases depName=containers/composefs
  composefs: "v1.0.8"