Skip to content

ci(ubi9-upstream-digests): update red hat ubi9 base image digests - #63

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/red-hat-ubi9-base-image-digests
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/red-hat-ubi9-base-image-digests

Conversation

@renovate

@renovate renovate Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
registry.access.redhat.com/ubi9/ubi-micro digest 35de56a7a0454c
registry.access.redhat.com/ubi9/ubi-micro final digest 35de56a7a0454c
registry.access.redhat.com/ubi9/ubi-micro stage digest 35de56a7a0454c
registry.access.redhat.com/ubi9/ubi-minimal digest 463cae37b8e25a
registry.access.redhat.com/ubi9/ubi-minimal stage digest 463cae37b8e25a

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from NWarila as a code owner July 12, 2026 16:43
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 3 times, most recently from 8c571db to 6114905 Compare July 12, 2026 19:00
NWarila added a commit that referenced this pull request Jul 12, 2026
…digests (#79)

## Summary

- Refresh the digest-pinned Red Hat UBI 9 minimal and micro base images
across all nine configured sites.
- Update the architecture-specific canonical rootfs reproducibility
baselines proven by the prior refresh run.
- Record the artifact-changing refresh in the changelog.

## Digest changes

- `ubi9/ubi-minimal`:
`ae09ecc3d754bc1726cbda3e2599cc7839e09fe1cc547ce173cf669b645be3cc` →
`463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c`
- `ubi9/ubi-micro`:
`b498b3ea26111ab4b81d65139f2ebd2ef9a2abb7a4588b7fdcc54889f95e9caa` →
`35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f`
- amd64 canonical rootfs:
`02ebc1b90cae0c06836b12d0536d52249ee4c8da029c47f8de7bbebe67c04c1b` →
`3b2a8a220847d9edc939c126208697b9de221b7a7371b26521857534a0179bea`
- arm64 canonical rootfs:
`851544a92f4cadef30e28048405f154558b70e2ecbe71e517b80c73307605af4` →
`4f4d1b58c0352d8d3a6c2435b5bde2f802f0eb93e89593139d62a72d241626d5`

## Reproducibility evidence

PR #63 reproducibility run 29200750883 built each architecture
byte-identically twice with the refreshed bases and reported the new
canonical rootfs values above. It also re-proved the recorded rpmdb
hashes unchanged: amd64
`610f66e9974a9c970323b08b9bee54ae3900d85cd54142baabf832960adebcf6`,
arm64
`af600c390b5d0cb9d0dbf20dc13d74936f610d170b145ea1c3e18ff13359b60c`. The
recorded `fips_so_sha256` values were likewise re-proven unchanged for
both architectures.

Because main now uses Dockerfile frontend 1.25 and Buildx v4, this PR
seeds the #63 rootfs values as predictions; this PR’s own
reproducibility gates are authoritative and will prove or correct them.

## Verification

- `python3 tools/verify.py`
@NWarila

NWarila commented Jul 12, 2026

Copy link
Copy Markdown
Owner

Superseded by #79 (F8b), which adopted this UBI9 base refresh across all nine digest sites plus the coupled reproducibility-baseline supersession, merged to main. This PR's partial 4-file bump is obsolete.

@NWarila NWarila closed this Jul 12, 2026
@renovate renovate Bot changed the title ci(ubi9-upstream-digests): update red hat ubi9 base image digests ci(ubi9-upstream-digests): update red hat ubi9 base image digests - autoclosed Jul 12, 2026
@renovate
renovate Bot deleted the renovate/red-hat-ubi9-base-image-digests branch July 12, 2026 20:59
@renovate renovate Bot changed the title ci(ubi9-upstream-digests): update red hat ubi9 base image digests - autoclosed ci(ubi9-upstream-digests): update registry.access.redhat.com/ubi9/ubi-minimal:latest docker digest to 062c52f Jul 15, 2026
@renovate renovate Bot reopened this Jul 15, 2026
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 2 times, most recently from 6114905 to 647bd86 Compare July 15, 2026 12:52
@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

⚠️ NEEDS ATTENTION: required check build and hardening has non-success run(s): failure; required check missing: reproducibility gate (amd64); required check missing: reproducibility gate (arm64); +2 more

What changed: #63 — ci(ubi9-upstream-digests): update red hat ubi9 base image digests; 7 changed file(s)

Current posture

Arch STIG Secret findings Footprint passed
amd64 unavailable unavailable unavailable
arm64 unavailable unavailable unavailable

Footprint: amd64 unavailable ⚠️ · arm64 unavailable ⚠️

Open full run

@renovate renovate Bot changed the title ci(ubi9-upstream-digests): update registry.access.redhat.com/ubi9/ubi-minimal:latest docker digest to 062c52f ci(ubi9-upstream-digests): update registry.access.redhat.com/ubi9/ubi-minimal:latest docker digest to 6c79f4f Jul 21, 2026
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch from 647bd86 to ab3b7ac Compare July 21, 2026 02:13
@renovate renovate Bot changed the title ci(ubi9-upstream-digests): update registry.access.redhat.com/ubi9/ubi-minimal:latest docker digest to 6c79f4f ci(ubi9-upstream-digests): update red hat ubi9 base image digests Jul 22, 2026
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 3 times, most recently from 647c03d to 0facb1e Compare July 28, 2026 23:37
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 3 times, most recently from ac8752d to 227d965 Compare August 5, 2026 10:13
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 3 times, most recently from 3510a9f to 906cd4b Compare August 17, 2026 03:08
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch from 906cd4b to 96199f1 Compare August 17, 2026 21:05
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 2 times, most recently from 79c528e to 0bef615 Compare August 26, 2026 23:10
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 2 times, most recently from d9e2fd5 to 092aae3 Compare September 3, 2026 21:58
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 4 times, most recently from 7dc0369 to a5d477f Compare September 14, 2026 05:48
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch 2 times, most recently from 915e06f to d105a95 Compare September 15, 2026 15:57
@renovate
renovate Bot force-pushed the renovate/red-hat-ubi9-base-image-digests branch from d105a95 to a7e6b87 Compare September 16, 2026 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant