Skip to content

fix(os): move the mkosi guest OS to a post-emSign snapshot and Go 1.26.10 #1465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 2 commits into from
Oct 23, 2026
+11 −10
Merged

fix(os): move the mkosi guest OS to a post-emSign snapshot and Go 1.26.10 #1465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa06330
fix(os): move the mkosi guest OS to a post-emSign snapshot and Go 1.2…
Leechael Oct 22, 2026
3f2254e
Merge branch 'next' into security/emsign-guest-os
kvinwang Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion os/mkosi/mkosi.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ MinimumVersion=26
Distribution=debian
Release=trixie
Architecture=x86-64
Snapshot=20260721T000000Z
Snapshot=20261021T000000Z
Repositories=main,contrib,non-free-firmware

[Output]
Expand Down
2 changes: 1 addition & 1 deletion os/mkosi/mkosi.tools.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: Apache-2.0
[Distribution]
Snapshot=20260721T000000Z
Snapshot=20261021T000000Z
Repositories=main
11 changes: 6 additions & 5 deletions os/mkosi/tests/acceptance.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,16 +268,17 @@ grep -q 'scripts/build-components.sh' "$D/mkosi.build"
grep -q '^BuildPackages=' "$D/mkosi.conf"
grep -q '^ToolsTree=yes$' "$D/mkosi.conf"
grep -q '^ToolsTreeProfiles=misc$' "$D/mkosi.conf"
grep -q '^Snapshot=20260721T000000Z$' "$D/mkosi.tools.conf"
grep -q '^Snapshot=20261021T000000Z$' "$D/mkosi.tools.conf"
grep -q 'clean -f' "$D/build.sh"
grep -q 'install-toolchains.sh' "$D/mkosi.build"
grep -q '^RUST_TOOLCHAIN_VERSION=1.92.0$' "$D/versions.env"
# Tracks the Go that oe-core pins for the production Yocto backend, so both
# backends compile the same Go components with the same toolchain. It must also
# stay >= the highest 'go' directive among them (nvidia-container-toolkit
# Go 1.26.10 carries the CVE-2026-111943 fix (crypto/x509 rejects chains with
# the compromised eMudhra/emSign intermediate CA keys), so this is ahead of the
# Go that oe-core pins for the production Yocto backend. It must also stay >=
# the highest 'go' directive among the Go components (nvidia-container-toolkit
# currently declares go 1.25.0); GOTOOLCHAIN=local turns a violation into a
# build failure rather than a silent download.
grep -q '^GO_TOOLCHAIN_VERSION=1.26.2$' "$D/versions.env"
grep -q '^GO_TOOLCHAIN_VERSION=1.26.10$' "$D/versions.env"
for component in dstack-rust image-tools container-stack sysbox nvattest kernel nvidia zfs ovmf; do
definition="$D/components/$component/$component.sh"
grep -q "^COMPONENT_NAME=$component$" "$definition"
Expand Down
6 changes: 3 additions & 3 deletions os/mkosi/versions.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
KERNEL_VERSION=6.18.40
KERNEL_SHA256=3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431
DEBIAN_RELEASE=trixie
DEBIAN_SNAPSHOT=20260721T000000Z
DEBIAN_SNAPSHOT=20261021T000000Z
# Base of the kernel module builder image. It must predate DEBIAN_SNAPSHOT:
# apt pinned to the snapshot cannot downgrade packages the base already ships.
DEBIAN_BASE_IMAGE=debian:trixie-20260713-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
Expand All @@ -17,8 +17,8 @@ RUST_TOOLCHAIN_VERSION=1.92.0
RUSTC_TOOLCHAIN_SHA256=78b2dd9c6b1fcd2621fa81c611cf5e2d6950690775038b585c64f364422886e0
CARGO_TOOLCHAIN_SHA256=e5e12be2c7126a7036c8adf573078a28b92611f5767cc9bd0a6f7c83081df103
RUST_STD_TOOLCHAIN_SHA256=5f106805ed86ebf8df287039e53a45cf974391ef4d088c2760776b05b8e48b5d
GO_TOOLCHAIN_VERSION=1.26.2
GO_TOOLCHAIN_SHA256=990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282
GO_TOOLCHAIN_VERSION=1.26.10
GO_TOOLCHAIN_SHA256=ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5
NITRO_TPM_TOOLS_REVISION=d76d6eeebd4169b00a3c3af9858852d48f40e748
DSTACK_VERSION=0.6.1
DSTACK_CODENAME=trixie
Expand Down
Loading