# Pinned build inputs for packaging/void/build.sh.
#
# Same contract as packaging/appimage/tool_checksums.txt and
# packaging/native/tool_checksums.txt: everything the package build
# downloads or runs inside is pinned and verified here, so two builds of
# the same commit cannot differ.
#
# Columns: name, kind, value, source — parseable by awk.
#
#   sha256   the file downloaded from <source> must hash to <value>
#   docker   build inside image <value>; <source> records the tag it came from
#   version  pinned commit or tag; <source> says where it was taken from
#
# To bump the base image: pull the new void-glibc-full tag, read the digest
# from `podman inspect` (Digest, not the config hash), and replace <value>.
# The image digest comes from `podman inspect
# ghcr.io/void-linux/void-glibc-full:latest` (use the manifest digest — the
# same line has to work on x86_64; only glibc x86_64 is published).
# To bump void-packages: set <value> to the new commit; build.sh checks out
# exactly that commit.

base-image              docker  ghcr.io/void-linux/void-glibc-full@sha256:306f0cdd27a0c35c4a0089318235ce36ee21d43565721376b3f710c6f9780322  void-glibc-full:latest
void-packages           version 4384dad29775c7194ff5a7a6054570406ac32e54                                                              void-packages master as of 2026-11-05