Skip to content

Bump the loong64 keyring pin and the pinned archlinux base image #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nemo-010 wants to merge 1 commit into
base: main
Choose a base branch
from
+10 −3
Open

Bump the loong64 keyring pin and the pinned archlinux base image #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# against what that tag resolves to now. A Dockerfile instruction takes no
# trailing comment, so the marker sits on its own line directly above.
# tag: latest
FROM --platform=$BUILDPLATFORM docker.io/library/archlinux@sha256:b860afd5823683f7ea389ba5f00d812f4fe55f6f286dea329d2abeefa535e309 AS bootstrap
FROM --platform=$BUILDPLATFORM docker.io/library/archlinux@sha256:63c7b061c0c001cb7ce4f8d11b63d351c23e7f97121bc5c8bd5d9f431e615d7d AS bootstrap

ARG TARGETARCH
ARG TARGETVARIANT
Expand Down
11 changes: 9 additions & 2 deletions bootstrap/keyrings/archlinux-lcpu.pin
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,19 @@
# package when it lists.
#
# Adopted 2026-08-28. Verified on that date against the mirror below.
#
# ⚠ Re-measured 2026-09-21. The mirror removed archlinux-lcpu-keyring-20241126-1
# on 2026-09-06 and every loong64 build since then failed at install-port-keyring
# with a 404, because a port removes a superseded keyring package rather than
# keeping it. The mirror now serves archlinux-lcpu-keyring-20260906-1, so the pin
# follows it. scripts/check-keyring-pin reports no fingerprint added or removed:
# the trusted set is the same ten keys and every one keeps its expiry.

keyring = archlinux-lcpu
arch = loong64
mirror = https://loongarchlinux.lcpu.dev/loongarch/archlinux/core/os/loong64
package = archlinux-lcpu-keyring-20241126-1-any.pkg.tar.zst
sha256 = cfdd65dceddbc5824df091787bd8546143beae9adb12f8ecccc25fbb67baa303
package = archlinux-lcpu-keyring-20260906-1-any.pkg.tar.zst
sha256 = 09ab1bfa4e4e5c06863f3ce21e5bc8a734c05f88eacbb58ee7de13603cddf42f
trusted = 49E74F2DF61CFF4217AB8EB737EFC8DBFB4CC627 2029-02-24
trusted = 5CDE9ADCBD04454BAF547A1C40D0304E1192746B 2026-04-24
trusted = 60922C5D40F6297BC1616C270A8F993ECADF8CE7 2026-07-14
Expand Down
Loading