Tags

Tags give the ability to mark specific points in history as being important

  • v9.4.0

    protected
    e2c0d604 · release: prepare v9.4.0 - bump doc pins and clone literals ·
    Release: v9.4.0 
    v9.4.0 — OCI media types end to end (composefs/bootc#1703 fix)

Every image the catalog builds is now OCI
(application/vnd.oci.image.manifest.v1+json + application/vnd.oci.image.config.v1+json)
instead of Docker schema2 (v2s2).

bootc's composefs backend re-reads the image config blob at `bootc install`
and again on day-2 `bootc upgrade`/`switch`; a v2s2 image fails that read
(bootc-dev/bootc#1703, and the adjacent #2318) — "GetBlob ... file does not
exist" at install, "blob unknown to registry" on day-2. Install had a
local-OCI-staging workaround (--source-imgref oci:...); day-2 had none, so
registry-direct upgrades were blocked outright. Native OCI media types remove
the failing read at the source: the config blob is a proper OCI config the
composefs backend can materialize, so install and day-2 both work
registry-direct with a bare image ref — no local OCI staging, no
--source-imgref.

Changed:
- base-build-scratch, seal, container-build, and supply-chain's shared
  .buildah_job template (which instance's build extends) set
  BUILDAH_FORMAT=oci (was docker). buildah's own upstream default is OCI. The
  dialect is set at BUILD and never converted after gating, so the digest the
  gates test is the digest promoted. Copies (promote, skopeo copy) preserve.

Added:
- Permanent OCI media-type assertion (creep-detector) so a v2s2 image can never
  regress into a promoted tag. base-build-scratch promote asserts each candidate
  layer is OCI (manifest + config) before moving :stable/:latest, on the exact
  digest smoke/smoke-sb tested; seal asserts the sealed artifact is OCI, read
  locally from containers-storage before push.

Minor bump: published images change media type v2s2 -> OCI; layer contents and
layer digests are unchanged.

  • v9.3.1

    protected
    63daebac · release: prepare v9.3.1 - bump doc pins and clone literals ·
    Release: v9.3.1 
    v9.3.1 -- fix installer-anaconda-iso/qcow2-bake digest-pinning bug

Both components could not actually carry a digest-qualified `image`
input (repo@sha256:...): the docker pull + docker-daemon skopeo bridge
failed closed on every digest-qualified reference (Docker Engine's
classic local image store does not preserve original registry manifest
bytes). Fixed by fetching directly via skopeo's docker:// transport into
containers-storage, bypassing docker pull and the docker-daemon bridge
entirely. Also corrects both components' header comments (and the
catalog README) about triggering a standalone config file: a
CI_CONFIG_PATH pipeline variable does not work, per confirmed GitLab
limitations gitlab-org/gitlab-foss#60331 and gitlab-org/gitlab#27987.

Patch bump: no existing consumer passes a digest-qualified image today,
so nothing working changes behavior.

  • v9.3.0

    protected
    22ee08f2 · release: prepare v9.3.0 - bump doc pins and clone literals ·
    Release: v9.3.0 
    v9.3.0 — opt-in own-key cosign sign-at-promote (instance)

The `instance` promote job can now sign the promoted image digest with
an own cosign key when a consumer sets `sign_on_promote: "true"`
(cosign v2, `--tlog-upload=false`, key from protected+masked group
vars). Own-key signing verifies at pull time against a committed public
key, unlike the keyless flow dropped in v4.3.0, so a reject-by-default
`sigstoreSigned` policy.json (cairn/example-evidence) can finally
enforce. Off by default; existing instance consumers are unaffected.

- inputs `sign_on_promote` (default "false") and `cosign_version` ("2.6.3").
- Digest signed once; matchRepository covers :latest and :stable.
- cosign pinned to v2.x (v3 refuses --tlog-upload=false; example-evidence D4).
- Validated sim-first: sign + verify + reject-by-default policy matrix
  against an ephemeral registry with cosign v2.

  • v9.2.0

    protected
    005fc433 · release: prepare v9.2.0 - bump doc pins and clone literals ·
    Release: v9.2.0 
    v9.2.0 — qcow2-bake component + supply-chain/brand housekeeping

New `qcow2-bake` component: converts a promoted bootc image to a qcow2
disk image via bootc-image-builder, in the same standalone-invocation
shape as `installer-anaconda-iso` (separate CI config, web/API/manual
trigger, Package Registry publish). Produces the disk image only;
boot-verifying it needs /dev/kvm and stays a consumer-owned gate on a
self-managed nested-KVM lane. Additive, no consumer behavior change.

Housekeeping in the same release:
- Dropped the dead cosign install (and COSIGN_VERSION/COSIGN_YES) from
  the buildah-fedora builder image; signing left the catalog in v4.3.0
  and cairn's real signing path is the seal component.
- Pinned syft via a syft_version component input instead of fetching
  releases/latest at CI runtime, with a matching Renovate customManager.
- Pinned the remaining floating third-party :latest image refs
  (buildah, skopeo, docker/dind, bootc-image-builder) to version/digest.
- Dropped two unreferenced pre-cairn brand PNGs.

  • v9.1.0

    protected
    6c133f43 · release: prepare v9.1.0 - bump clone literals and doc pins ·
    Release: v9.1.0 
    feat: seal component for the sealed UKI rung

Adds `seal`: convert a built bootc base image into the sealed stack. It
produces db-signed systemd-boot (bootupd removed), a db-signed Unified
Kernel Image carrying the computed composefs= digest on its cmdline, and
a signed PCR11 policy embedded in the UKI, so a TPM2 LUKS slot keeps
auto-unlocking across OS updates. Minor bump: purely additive, with no
change to existing components or their include paths.

- templates/seal/ ships the sealing Containerfile plus the component. The
  job runs `bootc container ukify` with systemd-sbsign (Secure Boot) and
  systemd-measure sign (PCR11), decoding two group-level masked and
  protected variables (UKI_SIGNING_KEY_B64, PCR11_PRIVATE_PEM_B64) to
  build secrets. It fails closed if either is absent and, after the
  build, verifies composefs= present, .pcrsig present, and the UKI
  verifies against the db certificate.
- Self-test seals quay.io/fedora/fedora-bootc:44 at the commit under test
  on saas-linux-xlarge-amd64 (push disabled).
- release-check now guards the seal catalog_ref pin; the kickstart and
  summary clone literals and the README pins bump to v9.1.0.
- Boot-gating (enforcing-Secure-Boot KVM boot and install-time composefs
  digest match) is the planned next rung.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

  • v9.0.1

    protected
    68a901f6 · fix(base-build-scratch): invoke cairn-verify in promote re-verify ·
    Release: v9.0.1 
    fix: invoke cairn-verify in the promote re-verify

Patch fix for a v9.0.0 carry-forward rename miss. The base-build-scratch
promote lane re-verifies the image after its registry round-trip by
running the verify binary baked into the final layer. It invoked the
immutable-era `/usr/bin/basef-verify`, which cairn base images do not
ship — they bake `/usr/bin/cairn-verify`. Cairn base builds passed
boot-smoke, then failed at promote with
`fork/exec /usr/bin/basef-verify: no such file or directory`.

- `base-build-scratch` promote now runs `/usr/bin/cairn-verify`; the two
  describing comments updated to match. No other component affected.

  • v9.0.0

    protected
    d5fb5d5e · release: prepare v9.0.0 — bump clone literals and doc pins ·
    Release: v9.0.0 
    feat: carry the catalog forward into the cairn estate

First release under dunn.dev/cairn/pipeline. Carried forward from
dunn.dev/immutable/pipeline at v8.4.0 with full git history and every
release tag intact — the tags below v9 document the design arc that
produced this catalog.

No component was redesigned; this is a home move plus an identity
repoint. The major bump reflects the one breaking change: component
include paths move namespace. Consumers pinning
`dunn.dev/immutable/pipeline/<component>@<tag>` must repoint to
`dunn.dev/cairn/pipeline/<component>@<tag>`.

- Registry image references, component include examples, pipeline and
  release badges, the kickstart/summary clone-URL literals, CI comments,
  and container LABELs repointed to the cairn namespace.
- Estate-identity prose (README, CONTRIBUTING, the builder-image header)
  and the brand SVGs now name the cairn estate.
- README records the carry-forward lineage from immutable/pipeline.

- All dated CHANGELOG entries and annotated-tag release notes below v9.
- Cross-estate references to the still-live immutable basef/instance
  projects and the immutable.dunn.dev estate site.
- The just-recipe (catalog CI) / inline-YAML (component templates) /
  POSIX-sh (release scripts) boundaries.

  • v8.4.0

    protected
    db534fd0 · Merge branch 'feat/instance-runner-tag-split' into 'main' · 
    v8.4.0 — instance component: promote_runner_tag + vm_size inputs

Catches the instance component up to base-build-scratch's estate-runner
inputs (promote-lane split from v8.3.0 + VM sizing from v8.2.0). Fixes the
MR-pipeline wedge where pinning the whole component to the ref_protected
crucible runner left detect-changes stuck_pending_no_matching_runners on
unprotected MR refs. See CHANGELOG.md.

  • v8.3.0

    protected
    fd725b09 · base-build-scratch: promote_runner_tag input — dedicated credentialed lane for promote · 
    base-build-scratch: promote_runner_tag input — dedicated runner lane for promote

  • v8.2.0

    protected
    8f75808c · base-build-scratch: vm_size input — estate-runner VM sizing for the heavy jobs · 
    base-build-scratch: vm_size input — estate-runner VM sizing for the heavy jobs

New optional vm_size input sets the VM_SIZE variable on the five heavy
build jobs (build-base, kmod-zfs, kmod-nvidia, build-base-zfs,
build-base-zfs-nvidia); the estate custom executor's prepare hook maps
it to VM vCPU/memory/disk (small|medium|large). Inert on SaaS runners
and at the default empty value. promote deliberately keeps the executor
default (network-bound). Pairs with runner_tag: anvil for routing
compose/kmod builds onto estate hardware. Non-breaking.

Built for basef#22 (SaaS-exit Stage 2). E2E validated: ci/lint synthetic
consumers at 8f75808 — vm_size=large path (five jobs get VM_SIZE=large,
promote unset) and the default/current-basef path (VM_SIZE empty, inert).

  • v8.1.1

    protected
    5b4ad190 · fix(instance): inspect external/public base images anonymously · 
    fix(instance): anonymous inspect for external/public base images (unblocks quay.io bases e.g. roon-bootc)

  • v8.1.0

    protected
    848e3e64 · Merge branch 'feat/kmod-signing' into 'main' · 
    v8.1.0 — optional kmod module-signing secret plumbing

MOK_SIGNING_KEY_B64 convention on base-build-scratch kmod jobs: decode
to tmpfile, buildah --secret id=mok; consumers opt in via
RUN --mount=type=secret,id=mok. Non-breaking. For basef#19.

  • v8.0.0

    protected
    e2e7e790 · Merge branch 'feat/v8-fold-validate' into 'main' · 
    v8.0.0 — fold validate into instance promote

The validate component (mock exists-check + retag) is removed; instance
promote moves :latest and :stable together in one idempotent step.
Instances deliberately don't boot-smoke — basef's earned :stable is the
quality bar. Also: kickstart/summary clone literals bumped + release-check
guard; earned-stable.svg timing rot removed; README accuracy pass.
BREAKING: removes the validate component.

  • v7.0.0

    protected
    0d0fa939 · Merge branch 'feat/instance-validate-autogate' into 'main' · 
    v7.0.0 — instance + validate promote auto-gate on a path list

Extends the v6.0.0 base-build-scratch fix to instance and validate. Removes
instance.promote_job_rules and validate.job_rules; both gate internally on a
path list (instance reuses build_change_paths, validate gets change_paths) via
.promote-rules / .validate-rules anchors (build rules minus merge_request).
promote and validate-and-promote fire on identical conditions. BREAKING:
removes those two inputs. carmine re-pins and drops its overrides.

  • v6.0.0

    protected
    cd83d304 · Merge branch 'feat/promote-autogated' into 'main' · 
    v6.0.0 — base-build-scratch promote auto-gates on build_change_paths

Removes the promote_job_rules input; promote shares the build jobs' change-path
gate (heavy-job-rules minus merge_request) via an internal .promote-rules anchor.
A docs/CI-only push no longer runs promote or fires a cascade, and build and
promote can't drift. BREAKING: consumers passing promote_job_rules must drop it.
Backfills v5.0.0/v5.0.1 CHANGELOG entries.

  • v5.0.1

    protected
    2ec56788 · Merge branch 'fix/kmod-sha-tag' into 'main' · 
    catalog v5.0.1: sha-tag kmod images (end cross-pipeline race)

  • v5.0.0

    protected
    fe842838 · Merge branch 'fix/release-notes-sh' into 'main' · 
    v5.0.0 — :stable must be earned

   promotion behind a verification job (basef boot-smoke). A failed gate skips
   promote, so :stable never moves and the cascade never fires; a passing gate
   promotes and pins :stable to the exact smoke-validated digest.
   consumer's preflight responsibility). Justifies the major bump.

Catalog's own CI migrated to composable just recipes (component templates
remain inline YAML — they ship to consumers). Proven end-to-end on the
crucible nested-KVM runner in both directions (fail blocks, pass promotes).

  • v4.8.0

    protected
    81421dd4 · Merge branch 'factor-kickstart-validation' into 'main' · 
    factor validate-kickstart into shared script — single source of truth across CI + operator-local; consumers (carmine, crimson) reuse the same shell+python via clone or sibling path

  • v4.7.0

    protected
    00776045 · Merge branch 'add-proceed-var-input' into 'main' · 
    v4.7.0 — proceed_var input for upstream-alignment gating

  • v4.6.0

    protected
    235f90dc · Merge branch 'migrate-scripts-to-catalog' into 'main' · 
    v4.6.0 — extract kickstart + summary components from carmine