Repository navigation
chore(release): sync eMudhra packaging fixes for 0.45.2 - #4052
Merged
poiana merged 6 commits intoOct 28, 2026
Merged
Conversation
Bump the container plugin to 0.7.6 and falcoctl to 0.14.3 using the verified release archives for both architectures. Require patched Wolfi and Debian CA packages and retain the Buster loader with persistent exclusions for the affected trust anchors. Refresh external bases while preserving the loader's local Debian parent, and check certificate trust before publishing image artifacts. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Member
Author
|
@sgaist PTAL 🙏 |
This was referenced Oct 27, 2026
Move the bundled TLS library from OpenSSL 3.1.4 to the supported 3.5 LTS series. Update the source archive checksum to the verified upstream value. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Ubuntu 26.04's rpm package owns sysusers.attr, which conflicts with the systemd-rpm-macros package installed through Alien. This fails before checkout and prevents release packages from building. Restore the runner version on which the same package setup succeeds. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
The sanitizer package links against libasan.so.8. Install libasan8 instead of libasan5, which is unavailable on the current Ubuntu runner and prevents the package tests from starting. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
The pinned event-generator creates child executables by hard-linking its binary from RUNNER_TEMP into /tmp. Ubuntu 26.04 runners place these paths on different filesystems, causing test setup to fail with EXDEV. Restore the Ubuntu 24.04 runner on which both driver suites passed. Keep the sanitizer tests on their current runner to match the sanitizer build. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
sgaist
previously approved these changes
Oct 27, 2026
Contributor
|
LGTM label has been added. DetailsGit tree hash: 41e7f8906951117d9cda6c84a9295655b28d31cf |
The amd64 image tags can contain OCI image indexes. Docker manifest create rejects these inputs and stops publication before the combined tags and ECR copies are created. Use the existing Buildx installation to combine the architecture images and indexes for all four image variants. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Member
Author
|
@sgaist can you approve again? 🙏 |
sgaist
approved these changes
Oct 27, 2026
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: leogr, sgaist The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
|
LGTM label has been added. DetailsGit tree hash: ebb10dab6b23d513bde2289157a11dff3b924c1a |
Member
Author
|
/remove-hold |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind release
Any specific area of the project related to this PR?
/area build
What this PR does / why we need it:
Syncs the packaging, OpenSSL, and CI fixes to
release/0.45.xfor0.45.2:0.7.6andfalcoctl0.14.3, with verified archive hashes.3.1.4to3.5.9 LTS, with its verified upstream checksum.ubuntu-24.04, avoiding the Ubuntu 26.04 RPM file conflict.libasan8, matching the built binary.ubuntu-24.04, avoiding hard-link failures across filesystems.docker buildx imagetools createto combine architecture tags that can already contain OCI indexes.All patches match their source commits; unrelated
masterchanges are excluded.Special notes for your reviewer:
Source PRs:
Hold until the image publication fix lands and its
masterpublication succeeds. Fresh CI and renewed review are needed at148c714ef118eaade3d421b3c39637ebd5cf6d4a.All six workflows passed at the previous head
9270c39b72e73af66544ebebd74cd8e89a1cff42, including package, event-generator, sanitizer, and image trust checks. The new publication commands passactionlintand all four Buildx0.38.0dry runs against the current architecture tags, preserving both platforms and existing attestations. PR CI does not publish images.Inspection of both Linux CI tar packages confirms embedded OpenSSL
3.5.9and byte-identical verified container0.7.6and Falcoctl0.14.3binaries. The mergedmasteramd64 Zig build also retains Falco's GLIBC2.17requirement and the same dynamic dependencies as0.45.1. Final tagged-release artifact checks remain necessary, including the release allocator configuration. Image trust CI uses published0.45.1packages to test the packaging changes.N.B. OpenSSL now defaults to TLS security level
2. Custom TLS certificates and parameters must meet the stronger minimum key sizes documented in the source PR and release note./hold
Does this PR introduce a user-facing change?: