Skip to content

chore(deps): Bump the docker-images group across 1 directory with 2 updates #2553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Bump the docker-images group across 1 directory with 2 updates #2553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.breg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -37,7 +37,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& install -m 0644 /workspace/THIRD_PARTY_NOTICES /workspace/runtime-root/licenses/breg/THIRD_PARTY_NOTICES \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Renew the advisory baselines for the new runtime base

When the release-candidate workflow scans these rebuilt images, every release/security/*-advisory-baseline.json still identifies the previous e792ab3d... Distroless image and its ordered layer IDs. check-advisory-baselines.py compares the candidate OCI layers and runtime definition against those reviewed fingerprints and rejects a runtime-base change, so candidates built from this new digest cannot pass advisory acceptance until the baselines are regenerated and reviewed through the renewal workflow.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the adopter stages to the same Distroless digest

When DISTROLESS_RUNTIME is updated to accept this new pin, the same CI gate iterates ADOPTER_DOCKERFILES and requires every Distroless stage to use that exact base (release/scripts/check-debian13-images.py:561-628). The Evidence and Casework stages in docker/Dockerfile:77,119 still use e792ab3d...; with the checker constants corrected, both are reported as mismatches, so those adopter stages must be updated as part of this bump or the required image-contract check remains failing.

Useful? React with 👍 / 👎.


LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.breg-mcp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -35,7 +35,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/breg-mcp \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.breg-review
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -34,7 +34,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/breg-review \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.casework
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -38,7 +38,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-casework/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.coordinator
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -38,7 +38,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-coordinator \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.discovery
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand All @@ -29,7 +29,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& install -m 0644 /workspace/LICENSE /workspace/runtime-root/licenses/discovery/LICENSE \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.evidence
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -32,7 +32,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
/workspace/runtime-root/var/lib/registry-evidence/authority \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.evidence-oid4vci
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -34,7 +34,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-evidence-oid4vci \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.messaging
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -38,7 +38,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-messaging/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.registry-render
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -33,7 +33,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-render/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.scheduling
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

ARG SOURCE_DATE_EPOCH=0

FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime-root
FROM docker.io/library/debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2 AS runtime-root
ARG SOURCE_DATE_EPOCH

ADD --checksum=sha256:967aa62605721081c3eb2a17650611a792aa802d76a6511d1840242623d204c9 https://snapshot.debian.org/archive/debian/20260913T000000Z/pool/main/g/glibc/libc6_2.41-12+deb13u4_amd64.deb /workspace/runtime-packages/libc6_2.41-12+deb13u4_amd64.deb
Expand Down Expand Up @@ -38,7 +38,7 @@ RUN --mount=type=bind,source=dist/image-bin,target=/workspace/image-bin \
&& chmod 0700 /workspace/runtime-root/var/lib/registry-scheduling/audit \
&& find /workspace/runtime-root -exec touch -h --date="@${SOURCE_DATE_EPOCH}" {} +

FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS runtime
FROM gcr.io/distroless/cc-debian13:nonroot@sha256:08476c244888bfb425bae1ae4dd7c17f093e972aab8426883d97f3c6f280f7c1 AS runtime

LABEL org.registrystack.runtime.uid="65532" \
org.registrystack.runtime.gid="65532"
Expand Down
Loading