xavierk
b47a65c91e
Every release is built from its tag alone by packaging/void/build-release.sh, shared by the tag workflow and local dry runs. Signs in a network-less container with the key mounted read-only and publishes to the tag release and the rolling latest release.
24 lines
1.4 KiB
Plaintext
24 lines
1.4 KiB
Plaintext
# Pinned build inputs for packaging/void/build-release.sh (and smoke.sh, which calls it).
|
|
#
|
|
# Same contract as packaging/appimage/tool_checksums.txt and
|
|
# packaging/native/tool_checksums.txt: everything the package build
|
|
# downloads or runs inside is pinned and verified here, so two builds of
|
|
# the same commit cannot differ.
|
|
#
|
|
# Columns: name, kind, value, source — parseable by awk.
|
|
#
|
|
# sha256 the file downloaded from <source> must hash to <value>
|
|
# docker build inside image <value>; <source> records the tag it came from
|
|
# version pinned commit or tag; <source> says where it was taken from
|
|
#
|
|
# To bump the base image: pull the new void-glibc-full tag, read the digest
|
|
# from `podman inspect` (Digest, not the config hash), and replace <value>.
|
|
# The image digest comes from `podman inspect
|
|
# ghcr.io/void-linux/void-glibc-full:latest` (use the manifest digest — the
|
|
# same line has to work on x86_64; only glibc x86_64 is published).
|
|
# To bump void-packages: set <value> to the new commit; build.sh checks out
|
|
# exactly that commit.
|
|
|
|
base-image docker ghcr.io/void-linux/void-glibc-full@sha256:306f0cdd27a0c35c4a0089318235ce36ee21d43565721376b3f710c6f9780322 void-glibc-full:latest
|
|
void-packages version 4384dad29775c7194ff5a7a6054570406ac32e54 void-packages master as of 2026-11-05
|