CONSTRUCT 20261015.2

CONSTRUCT 20261015.2

Built 2026-10-15 · GNOME Shell 51.0-r2 · Mesa 26.2.5-r1

Changes

10 changes since v20261015.1.

bolt

• the NHI table of its main branch

construct firmware

• name the image the sensor hub boots

gnome-settings-daemon

• no CRITICAL at login for unset keyboard options

gnome-software

• no abort at logout, no warnings for what nothing here does

gtk4-ding

• services start when called, not at login

image

• ldconfig leaves /etc's link to the loader's cache alone

initrd

• tpm2-tss does not log the NvPCRs systemd finds defined

kernel

• the VBT's own voltage swing tables, from drm-intel-next

keyd

• a stop is a success

vitals

• the Wi-Fi signal from NetworkManager

Packages

983 packages: 8 updated, 0 added, 0 removed.

Updated

• bolt 0.9.11-r0 → 0.9.11-r1
• gnome-settings-daemon 51.0-r1 → 51.0-r2
• gnome-shell-extension-gtk4-ding 100.29_git20261002-r2 → 100.29_git20261002-r3
• gnome-shell-extension-gtk4-ding-lang 100.29_git20261002-r2 → 100.29_git20261002-r3
• gnome-shell-extension-vitals 84.0.0-r4 → 84.0.0-r5
• gnome-software 51.0-r1 → 51.0-r2
• gnome-software-lang 51.0-r1 → 51.0-r2
• py3.13-more-itertools 11.2.0-r0 → 11.2.1-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	1
Medium	0	9
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 537 of 537 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261015.2.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261015.1

CONSTRUCT 20261015.1

Built 2026-10-15 · GNOME Shell 51.0-r2 · Mesa 26.2.5-r1

Changes

6 changes since v20261014.3.

dconf

• no smartcard sign-in on the lock screen

gdm

• a reauthentication the client leaves takes its conversations with it

image lifecycle

• the test CDN serves only what its indexes list

image test

• an unlock check that opens the prompt and drops its channel

mesa

• 26.2.5, as Wolfi now ships

readme

• for the person who finds the repository public

Packages

983 packages: 13 updated, 0 added, 0 removed.

Updated

• docker-cli 29.9.0-r0 → 29.9.1-r0
• gdm 51.0-r5 → 51.0-r6
• gdm-lang 51.0-r5 → 51.0-r6
• mesa 26.2.4-r2 → 26.2.5-r1
• mesa-egl 26.2.4-r2 → 26.2.5-r1
• mesa-gbm 26.2.4-r2 → 26.2.5-r1
• mesa-gl 26.2.4-r2 → 26.2.5-r1
• mesa-gles 26.2.4-r2 → 26.2.5-r1
• mesa-glx 26.2.4-r2 → 26.2.5-r1
• mesa-libgallium 26.2.4-r2 → 26.2.5-r1
• mesa-vulkan-ati 26.2.4-r2 → 26.2.5-r1
• mesa-vulkan-intel 26.2.4-r2 → 26.2.5-r1
• mesa-vulkan-swrast 26.2.4-r2 → 26.2.5-r1

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	1
Medium	0	9
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 538 of 538 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261015.1.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261014.3

CONSTRUCT 20261014.3

Built 2026-10-14 · GNOME Shell 51.0-r2 · Mesa 26.2.4-r2

Changes

5 changes since v20261014.2.

image test

• every PipeWire line while the screen is recorded is left out
• PipeWire's format lines while the screen is recorded are no error
• an unlock leaves nothing open in the session's GDM worker

gdm

• unexport from a connection only what is exported on it
• a reauthentication's D-Bus connection and server are closed with its session

Packages

983 packages: 8 updated, 0 added, 0 removed.

Updated

• gdm 51.0-r3 → 51.0-r5
• gdm-lang 51.0-r3 → 51.0-r5
• gst-plugins-base 1.29.2-r2 → 1.29.2-r3
• gst-plugins-base-lang 1.29.2-r2 → 1.29.2-r3
• libxcb 1.17.0-r16 → 1.17.0-r17
• libxcb-dev 1.17.0-r16 → 1.17.0-r17
• powertop 2.16-r0 → 2.16.1-r0
• vim 9.2.1186-r0 → 9.2.1189-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	1
Medium	0	9
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 539 of 539 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261014.3.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261014.2

CONSTRUCT 20261014.2

Built 2026-10-14 · GNOME Shell 51.0-r2 · Mesa 26.2.4-r2

Changes

8 changes since v20261014.1.

image test

• Firefox's page is shot once it is open, and an app is gone before the next
• the hover and pressed shots wait for GTK's frame

keys

• the variables signed again under the certificates of 5 October
• the Secure Boot certificates of 5 October, which machines hold

gnome-shell

• cancel a workspace's pending window additions when it is destroyed

image

• task release refuses a commit test:usb has not passed here

scan

• a rule keeps a fix only a third party can ship, listed with its reason

sign

• a Secure Boot certificate is made once; the variables are signed again under it

Packages

983 packages: 13 updated, 0 added, 0 removed.

Updated

• bubblewrap 0.13.0-r0 → 0.13.1-r0
• containerd-2 2.4.1-r2 → 2.4.2-r0
• containerd-service-2 2.4.1-r2 → 2.4.2-r0
• containerd-shim-runc-v2-2 2.4.1-r2 → 2.4.2-r0
• containerd-stress-2 2.4.1-r2 → 2.4.2-r0
• ctr-2 2.4.1-r2 → 2.4.2-r0
• curl 8.22.0-r4 → 8.23.0-r0
• gnome-shell 51.0-r1 → 51.0-r2
• gnome-shell-lang 51.0-r1 → 51.0-r2
• libarchive 3.8.9-r3 → 3.8.10-r0
• libcurl-openssl4 8.22.0-r4 → 8.23.0-r0
• libzip 1.12-r0 → 1.12.1-r0
• py3.13-more-itertools 11.1.0-r0 → 11.2.0-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	1
Medium	0	9
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 535 of 535 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261014.2.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261014.1

CONSTRUCT 20261014.1

Built 2026-10-14 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

39 changes since v20261013.2.

image

• the lifecycle's sudo check takes the lecture; the outro's screens half a second apart
• xprop, for at-spi2-core's Xwayland hook
• fwupd leaves db, dbx and KEK to the firmware's own keys
• the process helpers in exec.go, and three small ones
• two locals no longer shadow a function and a type
• check-langs' index fetch has a timeout; needles-propose says a checkout left behind
• the lifecycle's sudo check reads the exit status it asked for
• a walk of the root's tar that reads names reads headers alone
• the lock screen's extension checks read the shell's answer decoded
• a view says what it measures where it is shot
• one wait for the harness, until
• an S3 failure is neither a cache miss nor a log with nothing new
• needles-propose no longer retires desktop-dark
• prune keeps what the recipes make, and orders no version

taskfile

• keys:kms makes each half it lacks
• packages:prune, the prune and its index as one task
• rootfs refuses a recipe packages/ has not built
• melange.rsa.pub is the key's own, not the repository's
• one task makes a channel's index

construct

• install and disks report a bad flag as every command does
• a report says what it could not read, not something else
• kernel-profile's perf ends with the signal construct takes

qemu

• a VNC server for task boot alone
• a screenshot is checked whole, not slept on
• swtpm ends with a QEMU that never took it; Attach's VM waits for nobody

update

• a stick carries one release, at the root of its partition
• a cancelled install says so, not that the root is not xz

code

• no updater of its own

diagnose, securitykey

• one close on the way out, keys sorted by the library

image, watch

• the package docs name the commands and flags that exist

kernel

• perf without the debuginfod client

needle

• ChannelTolerance, no longer a name shared with pixels.ChannelDelta

onepassword

• an update that fails to move in leaves the app installed

other

• What only ever took one value takes none

program

• one runner for what construct and securitykey start

secureboot

• update KEK, PK, and db authentication files

sign

• Microsoft's KEK CAs in the KEK, for dbx

update, gpt

• what was written for nobody to read

watch

• the upstream reader is given its token where the client is

Packages

983 packages: 1 updated, 1 added, 0 removed.

Updated

• code 1.140.0-r2 → 1.140.0-r3

Added

• xprop 1.2.8-r5

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 509 of 509 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261014.1.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261013.2

CONSTRUCT 20261013.2

Built 2026-10-14 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

6 changes since v20261013.1.

image

• /var comes down at shutdown, its journal no longer replayed
• run -poweroff, to look at the disks a shutdown leaves

agents

• what pins /var at shutdown, and how to see it

deps

• bump the go group with 5 updates (#13)

kernel

• xtables' IPv4 and IPv6 families for iptables-nft

var

• ext4 made with the verity feature

Packages

982 packages: 2 updated, 0 added, 0 removed.

Updated

• firefox 157.0.1-r0 → 158.0-r0
• vim 9.2.1178-r0 → 9.2.1186-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 507 of 507 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261013.2.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261013.1

CONSTRUCT 20261013.1

Built 2026-10-13 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

86 changes since v20261009.2.

image

• the apko prune orders by is the image's, held by a test
• packages ordered as apko orders them, held to apko itself
• the signing commands' refusals held by tests
• moLookup fuzzed, and checked against GNU msgunfmt
• moLookup takes an empty first form for untranslated
• moLookup finds a plural entry by its singular, as gettext does
• the harness always draws on the X9-15's panel; -scale goes
• a shell view names its wake and its checks, not strings
• one reader of palette.json, for lf and Plymouth's theme
• Plymouth's prompt checks in their own file
• withoutBenchOOM's comment above withoutBenchOOM
• lf's checks no longer test for a nil lf
• the lifecycle's steps are methods, lifecycle their sequence
• test's system checks in their own method, -only parsed apart
• theme-dev's archive written by tar's AddFS
• run keeps -cred and -append on the test disk and the stick
• compare the run's views with the needles, not every PNG
• a pipeline that cannot start a program waits for the rest
• writeRelease names what it compresses and what it links
• the PAM check reads its files with eachLine
• one way to find the release usb-sign wrote
• fixed values are constants, and argumentless commands say so
• packages and cache take their mode as a subcommand
• the cache packs QEMU's image without a shell
• one helper runs a command for its output
• a directory layer has no prefix
• the update URL is read by the command and passed down
• the Plymouth theme reads the root's tarball once
• a recipe whose comments alone changed needs no new epoch

qemu

• why the boot film stays on PPM, measured
• DecodePPM fuzzed
• DecodePPM refuses a header it cannot hold
• screenshots are QEMU's own PNGs
• a screendump's PNG is written by pixels.WritePNG
• stop swtpm when no QEMU will connect to it
• unexport PPMToPNG

update

• the keyring's, the release's and the ESP's refusals held by tests
• Compare reads the character past a '~' as systemd's signed char
• Compare checked against systemd-analyze compare-versions
• one UUID formatter for the slots', /var's and random GUIDs
• Install answers only whether it installed
• partition numbers come from the layout alone
• unexport what nothing outside the package uses

construct

• usage is the one list of its commands
• firmware takes the file alone
• no flags that nothing passes
• install says why it could not read a disk's sector size
• the channel file written whole, through fsx
• a password or a PIN from a pipe keeps its spaces

securitykey

• a key's user cannot split pam_u2f's mappings
• what is no es256 credential, or no keyslot, is refused in tests
• ReadHeader decodes the header itself
• unexport the slots, mappings, origin and file names

build

• the harness's QEMU 11.1.2
• the builder's task 3.54.0 and gh 2.102.0
• the builder's Go is go.mod's, 1.27.2

ci

• gettext on check's runner, so the .mo reader meets msgunfmt
• Dependabot for Go's modules and the workflows' actions, weekly
• task check on every pull request

sign

• every refusal of a key, a policy and a binary held by a test
• the Secure Boot variables' names are a function, not a shared slice
• unexport the openers and the key check nothing outside calls

watch

• the pins in build/ behind upstream are one issue
• a kernel point release is an issue
• no flags for the repository's own paths

account

• home is the package's own
• a person cannot take a system user's name, or split passwd

bench

• apply and the parsers are the package's own
• a run's numbers are a Result, not a map of names

gpt

• every refusal of Write and Read held by a test
• unexport FirstUsable

onepassword

• Install and Installed, without options nobody varies
• extract through an os.Root, which no chain of links leaves

repo

• the hardware it was tried on named generally
• license Apache-2.0, add SECURITY.md

at-spi2-core

• 2.62.1, above Wolfi's again

freerdp-3

• 3.32.2, above Wolfi's again

fsx

• SyncDir, the directory sync WriteFile ends with, for update too

gap

• GNOME's desktop alone, and an index that stalls gives up

initrd

• /var's dm-crypt without workqueues

kernel

• 7.2.10

needle

• NoiseOf and the diff measure colours with pixels' helpers

other

• update dependencies in go.mod and go.sum to latest versions

power

• the RAPL counter's state is one value, not two bools

task, ipp-usb

• built again, with Go 1.27.2

test

• goleak checks the packages that start goroutines

Packages

982 packages: 205 updated, 0 added, 0 removed.

Updated (205)

• aom-libs 3.15.1-r0 → 3.15.2-r0
• at-spi2-core 2.62.0.1-r1 → 2.62.1-r1
• at-spi2-core-lang 2.62.0.1-r1 → 2.62.1-r1
• brotli 1.2.0-r5 → 1.2.0-r6
• brotli-dev 1.2.0-r5 → 1.2.0-r6
• busybox 1.38.0-r2 → 1.38.0-r3
• containerd-2 2.4.1-r1 → 2.4.1-r2
• containerd-service-2 2.4.1-r1 → 2.4.1-r2
• containerd-shim-runc-v2-2 2.4.1-r1 → 2.4.1-r2
• containerd-stress-2 2.4.1-r1 → 2.4.1-r2
• ctr-2 2.4.1-r1 → 2.4.1-r2
• dbus 1.16.2-r6 → 1.16.2-r7
• dbus-libs 1.16.2-r6 → 1.16.2-r7
• dmidecode 3.7-r3 → 3.7-r4
• docbook-xml 4.5-r7 → 4.5-r8
• docker-29 29.8.2-r3 → 29.9.0-r0
• docker-cli-buildx 0.38.0-r1 → 0.38.0-r2
• docker-compose 5.6.0-r1 → 5.6.0-r2
• docker-init-29 29.8.2-r3 → 29.9.0-r0
• dockerd-29 29.8.2-r3 → 29.9.0-r0
• dockerd-service-29 29.8.2-r3 → 29.9.0-r0
• dosfstools 4.2-r45 → 4.2-r46
• e2fsprogs 1.47.4-r2 → 1.47.4-r3
• e2fsprogs-extra 1.47.4-r2 → 1.47.4-r3
• e2fsprogs-libs 1.47.4-r2 → 1.47.4-r3
• ell 0.83-r2 → 0.83-r3
• enchant2 2.8.21-r0 → 2.8.21-r1
• font-noto-music-family 2.003-r0 → 2.004-r0
• font-noto-sans-mongolian 3.100-r0 → 3.103-r0
• freerdp-3-libs 3.32.1-r2 → 3.32.2-r1
• freetype 2.14.3-r6 → 2.14.3-r7
• freetype-dev 2.14.3-r6 → 2.14.3-r7
• fuse-overlayfs 1.18-r0 → 1.18-r1
• fuse3 3.18.3-r0 → 3.18.3-r1
• fuse3-libs 3.18.3-r0 → 3.18.3-r1
• gdbm 1.26-r6 → 1.26-r7
• gettext 1.0-r7 → 1.0-r8
• gettext-dev 1.0-r7 → 1.0-r8
• gettext-envsubst 1.0-r7 → 1.0-r8
• giflib 6.1.3-r1 → 6.1.3-r2
• gnupg-gpgconf 2.4.9-r11 → 2.4.9-r12
• gnutls 3.8.13-r1 → 3.8.13-r3
• gobject-introspection 1.86.0-r3 → 1.86.0-r4
• gobject-introspection-bin 1.86.0-r3 → 1.86.0-r4
• gobject-introspection-dev 1.86.0-r3 → 1.86.0-r4
• gpg 2.4.9-r11 → 2.4.9-r12
• gpg-agent 2.4.9-r11 → 2.4.9-r12
• gpgsm 2.4.9-r11 → 2.4.9-r12
• gptfdisk 1.0.10-r6 → 1.0.10-r7
• graphene 1.10.8-r9 → 1.10.8-r10
• graphite2 1.3.15-r2 → 1.3.15-r4
• gtk-3 3.24.52-r4 → 3.24.52-r5
• gtk-3-lang 3.24.52-r4 → 3.24.52-r5
• gtk-3-update-icon-cache 3.24.52-r4 → 3.24.52-r5
• heimdal-libs 7.8.0-r52 → 7.8.0-r53
• hicolor-icon-theme 0.18-r7 → 0.18-r8
• inih 62-r4 → 62-r5
• ip6tables 1.8.13-r4 → 1.8.13-r5
• ipp-usb 0.9.34-r0 → 0.9.34-r1
• iproute2 7.2.0-r0 → 7.2.0-r1
• iptables 1.8.13-r4 → 1.8.13-r5
• iptables-nft 1.8.13-r4 → 1.8.13-r5
• isl 0.28-r3 → 0.28-r4
• iso-codes 4.20.1-r3 → 4.20.1-r4
• jansson 2.15.1-r1 → 2.15.1-r2
• jbig2dec 0.20-r5 → 0.20-r6
• json-c 0.19-r1 → 0.19-r2
• just-newuidmap-newgidmap 4.20.2-r1 → 4.20.3-r0
• kbd 2.10.0-r3 → 2.10.0-r4
• keyutils-libs 1.6.3-r40 → 1.6.3-r41
• lame-libs 4.0-r1 → 4.0-r2
• lcms2 2.19.1-r2 → 2.19.1-r3
• less 710-r0 → 711-r0
• libLLVM-22 22.1.8-r4 → 22.1.8-r6
• libassuan 3.0.2-r9 → 3.0.2-r10
• libasyncns 0.8-r8 → 0.8-r9
• libatk-1.0 2.62.0.1-r1 → 2.62.1-r1
• libatk-bridge-2.0 2.62.0.1-r1 → 2.62.1-r1
• libattr1 2.6.0-r3 → 2.6.0-r4
• libaudit 4.2.1-r1 → 4.2.1-r2
• libbrotlicommon1 1.2.0-r5 → 1.2.0-r6
• libbrotlidec1 1.2.0-r5 → 1.2.0-r6
• libbrotlienc1 1.2.0-r5 → 1.2.0-r6
• libbsd 0.12.2-r8 → 0.12.2-r9
• libcap 2.78-r3 → 2.78-r4
• libcap-ng 0.9.6-r0 → 0.9.6-r1
• libcom_err 1.47.4-r2 → 1.47.4-r3
• libcrypto3 3.6.5-r1 → 3.6.5-r2
• libdav1d 1.5.4-r1 → 1.5.4-r2
• libdrm-libs 2.4.134-r2 → 2.4.134-r3
• libedit 3.1-r19 → 3.1-r20
• libedit-dev 3.1-r19 → 3.1-r20
• libepoxy 1.5.10-r9 → 1.5.10-r10
• libexif-libs 0.6.26-r2 → 0.6.26-r3
• libffi 3.8.0-r1 → 3.8.0-r2
• libffi-dev 3.8.0-r1 → 3.8.0-r2
• libflac 1.5.0-r1 → 1.5.0-r2
• libfontenc 1.1.9-r2 → 1.1.9-r3
• libglvnd 1.7.0-r11 → 1.7.0-r12
• libgpg-error 1.61-r3 → 1.61-r4
• libgphoto2 2.5.34-r3 → 2.5.34-r4
• libgphoto2-lang 2.5.34-r3 → 2.5.34-r4
• libice 1.1.2-r7 → 1.1.2-r8
• libice-dev 1.1.2-r7 → 1.1.2-r8
• libidn2 2.3.8-r9 → 2.3.8-r10
• libjpeg-turbo 3.2.0-r4 → 3.2.0-r5
• libksba 1.8.1-r1 → 1.8.1-r2
• libltdl 2.5.4-r4 → 2.5.4-r5
• liblz4-1 1.10.0-r10 → 1.10.0-r11
• libmnl 1.0.5-r8 → 1.0.5-r10
• libnftnl 1.3.2-r0 → 1.3.2-r1
• libnl3 3.12.0-r6 → 3.12.0-r7
• libnotify 0.8.8-r4 → 0.8.8-r5
• libnspr 4.40-r1 → 4.40-r2
• libnss 3.128-r2 → 3.131-r0
• libogg-libs 1.3.6-r9 → 1.3.6-r10
• libpaper 2.2.8-r2 → 2.2.8-r3
• libpciaccess 0.19-r3 → 0.19-r4
• libpsl 0.23.3-r1 → 0.23.3-r2
• libsdl2 2.32.10-r4 → 2.32.10-r5
• libseccomp 2.6.1-r1 → 2.6.1-r2
• libsecret 0.21.8.2-r0 → 0.21.8.2-r1
• libsecret-lang 0.21.8.2-r0 → 0.21.8.2-r1
• libsemanage 3.11-r2 → 3.11-r3
• libsigcplusplus 3.8.1-r2 → 3.8.1-r3
• libsm 1.2.6-r5 → 1.2.6-r6
• libsm-dev 1.2.6-r5 → 1.2.6-r6
• libsndfile 1.2.2-r5 → 1.2.2-r6
• libsodium 1.0.22-r1 → 1.0.22-r2
• libssl3 3.6.5-r1 → 3.6.5-r2
• libtasn1 4.21.0-r6 → 4.21.0-r7
• libtheora 1.2.0-r7 → 1.2.0-r8
• libtool 2.5.4-r4 → 2.5.4-r5
• libtraceevent 1.9.0-r5 → 1.9.0-r6
• libtracefs 1.8.3-r4 → 1.8.3-r5
• libunistring 1.4.2-r3 → 1.4.2-r4
• liburcu 0.15.7-r0 → 0.15.7-r1
• libusb 1.0.30-r2 → 1.0.30-r3
• libva 2.24.1-r2 → 2.24.1-r3
• libverto 0.3.2-r8 → 0.3.2-r9
• libvorbis 1.3.7-r11 → 1.3.7-r12
• libwebp 1.6.0-r6 → 1.6.0-r7
• libxau 1.0.12-r8 → 1.0.12-r9
• libxau-dev 1.0.12-r8 → 1.0.12-r9
• libxcomposite 0.4.7-r4 → 0.4.7-r5
• libxcrypt 4.5.2-r5 → 4.5.2-r6
• libxcrypt-dev 4.5.2-r5 → 4.5.2-r6
• libxcursor 1.2.3-r6 → 1.2.3-r7
• libxcvt 0.1.3-r9 → 0.1.3-r10
• libxdamage 1.1.7-r4 → 1.1.7-r5
• libxext 1.3.7-r3 → 1.3.7-r4
• libxext-dev 1.3.7-r3 → 1.3.7-r4
• libxfixes 6.0.2-r3 → 6.0.2-r4
• libxft 2.3.9-r7 → 2.3.9-r8
• libxi 1.8.3-r1 → 1.8.3-r2
• libxinerama-libs 1.1....

CONSTRUCT 20261009.2

CONSTRUCT 20261009.2

Built 2026-10-09 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

5 changes since v20261009.1.

image

• /var/roothome is provision.conf's alone
• the fonts' cache baked into /usr, valid on the EROFS

gtk4-ding

• an eject finishes nothing on a mount gvfs already disposed

test

• the fonts' cache is the root's, and tmpfiles.d declares each path once

update

• the reboot notice only in a person's desktop session; sudo starts no user manager

Packages

982 packages: 5 updated, 0 added, 0 removed.

Updated

• alsa-lib 1.2.16.1-r2 → 1.2.16.1-r3
• bash 5.3-r13 → 5.3-r14
• bash-binsh 5.3-r13 → 5.3-r14
• gnome-shell-extension-gtk4-ding 100.29_git20261002-r1 → 100.29_git20261002-r2
• gnome-shell-extension-gtk4-ding-lang 100.29_git20261002-r1 → 100.29_git20261002-r2

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 507 of 507 checks passed
• lifecycle: 62 of 62 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261009.2.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261009.1

CONSTRUCT 20261009.1

Built 2026-10-09 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

9 changes since v20261008.2.

firmware

• the BE211's Bluetooth DDC without its stray byte
• the sensor hub's firmware name worked out as the kernel does

diagnose

• a D-Bus service that started late is no authentication failure

gnome-settings-daemon

• no USB protection, print notifications, a quiet stop

gst-plugins-good

• vp8enc, so the screen can be recorded

lifecycle

• an SSH key made on the security key

openssh

• built-in FIDO, so an SSH key can live on a security key

orca

• a screen reader, so the Accessibility switch does something

orchis-theme

• an app folder opens whole

Packages

982 packages: 28 updated, 10 added, 0 removed.

Updated (28)

• bzip2 1.0.8-r24 → 1.0.8-r25
• bzip2-dev 1.0.8-r24 → 1.0.8-r25
• containerd-2 2.4.1-r0 → 2.4.1-r1
• containerd-service-2 2.4.1-r0 → 2.4.1-r1
• containerd-shim-runc-v2-2 2.4.1-r0 → 2.4.1-r1
• containerd-stress-2 2.4.1-r0 → 2.4.1-r1
• ctr-2 2.4.1-r0 → 2.4.1-r1
• docker-29 29.8.2-r2 → 29.8.2-r3
• docker-cli 29.8.2-r0 → 29.9.0-r0
• docker-cli-buildx 0.38.0-r0 → 0.38.0-r1
• docker-compose 5.6.0-r0 → 5.6.0-r1
• docker-init-29 29.8.2-r2 → 29.8.2-r3
• dockerd-29 29.8.2-r2 → 29.8.2-r3
• dockerd-service-29 29.8.2-r2 → 29.8.2-r3
• gnome-settings-daemon 51.0-r0 → 51.0-r1
• gst-plugins-good 1.29.2-r1 → 1.29.2-r2
• libacl1 2.4.0-r3 → 2.4.0-r4
• libbz2-1 1.0.8-r24 → 1.0.8-r25
• openssh-client 10.6_p1-r0 → 10.6_p1-r1
• openssh-keygen 10.6_p1-r0 → 10.6_p1-r1
• openssh-server 10.6_p1-r0 → 10.6_p1-r1
• openssh-server-config 10.6_p1-r0 → 10.6_p1-r1
• openssh-sk-helper 10.6_p1-r0 → 10.6_p1-r1
• orchis-theme 20260914-r16 → 20260914-r17
• orchis-theme-shell 20260914-r16 → 20260914-r17
• pkgconf 3.0.7-r0 → 3.0.8-r0
• runc 1.5.2-r0 → 1.5.2-r1
• tailscale 1.102.5-r0 → 1.104.1-r1

Added

• dotconf 1.4.1-r0
• espeak-ng 1.52.0-r0
• libvpx 1.17.0-r2
• orca 51.0-r0
• orca-lang 51.0-r0
• py3-dasbus 1.7-r0
• py3.13-psutil 7.2.2-r5
• pyatspi 2.58.2-r0
• speech-dispatcher 0.12.1-r0
• speech-dispatcher-lang 0.12.1-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 507 of 507 checks passed
• lifecycle: 62 of 62 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261009.1.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS

CONSTRUCT 20261008.2

CONSTRUCT 20261008.2

Built 2026-10-08 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

22 changes since v20261008.1.

diagnose

• the gathering and the reading in internal/diagnose
• a cut keeps letters whole, a failed archive is not left behind

harness

• the journal around each error, in journal-context.txt
• one wait for a guest to go, one quit, one wait for sshd

image

• one reader of apk's database
• the AWS CLI's two runners in aws.go, release-log reads new bytes once

power

• a machine with no RAPL counter is not told to use sudo
• Measure over a context, and the system's batteries with their health

securitykey

• a failed program's error ends with what it said, or nothing
• one reader of the LUKS2 header

gnome-shell-extension-gtk4-ding

• the desktop's file list is never null

install

• a key never touched is said by construct, not guessed by the installer

kernel

• 7.2.9

key

• construct key add asks again for a missed touch

keyd

• no empty AmbientCapabilities=, which is the default

lf

• each view measured, then checked

lifecycle

• the installed disk boots without the splash, and the TPM opens it

needles

• a sweep's areas are pixels.Rect

sysctl

• fq for every interface, under BBR

test

• the desktop's labels read by a probe of image/test's, not Python in a Go string

update

• the slot's UUIDs from its root hash in one place

usb

• a boot without the splash, as a second entry in systemd-boot's menu

Packages

972 packages: 10 updated, 0 added, 0 removed.

Updated

• avahi 0.9_rc5-r1 → 0.9_rc5-r2
• build-base 1-r9 → 1-r10
• cairomm 1.19.1-r1 → 1.19.1-r2
• gnome-shell-extension-gtk4-ding 100.29_git20261002-r0 → 100.29_git20261002-r1
• gnome-shell-extension-gtk4-ding-lang 100.29_git20261002-r0 → 100.29_git20261002-r1
• gstreamer 1.29.2-r2 → 1.29.2-r3
• libxdmcp 1.1.5-r11 → 1.1.5-r12
• libxdmcp-dev 1.1.5-r11 → 1.1.5-r12
• py3.13-pycparser 3.00-r6 → 3.01-r0
• vim 9.2.1169-r0 → 9.2.1172-r0

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 502 of 502 checks passed
• lifecycle: 61 of 61 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261008.2.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS