Conversation
The loong64 mirror removed archlinux-lcpu-keyring-20241126-1 on 2026-09-06, so every build since then failed at install-port-keyring with a 404. A port removes a superseded keyring package rather than keeping it, so the pin falls behind the moment the port rebuilds its keyring. The mirror now serves archlinux-lcpu-keyring-20260906-1 and the pin follows it. Only the package name and the sha256 move: scripts/check-keyring-pin reports no fingerprint added or removed, so the trusted set is the same ten keys and every one keeps its expiry. mirror https://loongarchlinux.lcpu.dev/loongarch/archlinux/core/os/loong64 package archlinux-lcpu-keyring-20260906-1-any.pkg.tar.zst (17953 bytes) sha256 09ab1bfa4e4e5c06863f3ce21e5bc8a734c05f88eacbb58ee7de13603cddf42f docker.io/library/archlinux:latest also moved on from the digest the Dockerfile pinned, which freshness-image-pins has been reporting since 2026-09-08. Bumped to what the tag resolves to now, read through the same registry flow the check uses. before sha256:b860afd5823683f7ea389ba5f00d812f4fe55f6f286dea329d2abeefa535e309 after sha256:63c7b061c0c001cb7ce4f8d11b63d351c23e7f97121bc5c8bd5d9f431e615d7d tests/run.sh static leaves both the Dockerfile digest assertion and the keyring pin derivation passing. ⚠ This does not on its own make build-deploy green: since 2026-09-18 the Resolve inputs job cannot read the ArchPOWER databases from a GitHub runner, because the origin and the api.rv.pkgforge.dev fall-through both answer 403 with a Cloudflare challenge. That is a network path, not a pin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The loong64 mirror removed archlinux-lcpu-keyring-20241126-1 on 2026-09-06, so
every build since then failed at install-port-keyring with a 404. A port removes
a superseded keyring package rather than keeping it, so the pin falls behind the
moment the port rebuilds its keyring. The mirror now serves
archlinux-lcpu-keyring-20260906-1 and the pin follows it. Only the package name
and the sha256 move: scripts/check-keyring-pin reports no fingerprint added or
removed, so the trusted set is the same ten keys and every one keeps its expiry.
mirror https://loongarchlinux.lcpu.dev/loongarch/archlinux/core/os/loong64
package archlinux-lcpu-keyring-20260906-1-any.pkg.tar.zst (17953 bytes)
sha256 09ab1bfa4e4e5c06863f3ce21e5bc8a734c05f88eacbb58ee7de13603cddf42f
docker.io/library/archlinux:latest also moved on from the digest the Dockerfile
pinned, which freshness-image-pins has been reporting since 2026-09-08. Bumped
to what the tag resolves to now, read through the same registry flow the check
uses.
before sha256:b860afd5823683f7ea389ba5f00d812f4fe55f6f286dea329d2abeefa535e309
after sha256:63c7b061c0c001cb7ce4f8d11b63d351c23e7f97121bc5c8bd5d9f431e615d7d
tests/run.sh static leaves both the Dockerfile digest assertion and the keyring
pin derivation passing. ⚠ This does not on its own make build-deploy green:
since 2026-09-18 the Resolve inputs job cannot read the ArchPOWER databases from
a GitHub runner, because the origin and the api.rv.pkgforge.dev fall-through both
answer 403 with a Cloudflare challenge. That is a network path, not a pin.
Requested by Samueru via errand.
Conversation: https://discord.com/channels/1313385177703256064/1551591129903009815