CONSTRUCT 20261013.1

CONSTRUCT 20261013.1

Built 2026-10-13 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

86 changes since v20261009.2.

image

• the apko prune orders by is the image's, held by a test
• packages ordered as apko orders them, held to apko itself
• the signing commands' refusals held by tests
• moLookup fuzzed, and checked against GNU msgunfmt
• moLookup takes an empty first form for untranslated
• moLookup finds a plural entry by its singular, as gettext does
• the harness always draws on the X9-15's panel; -scale goes
• a shell view names its wake and its checks, not strings
• one reader of palette.json, for lf and Plymouth's theme
• Plymouth's prompt checks in their own file
• withoutBenchOOM's comment above withoutBenchOOM
• lf's checks no longer test for a nil lf
• the lifecycle's steps are methods, lifecycle their sequence
• test's system checks in their own method, -only parsed apart
• theme-dev's archive written by tar's AddFS
• run keeps -cred and -append on the test disk and the stick
• compare the run's views with the needles, not every PNG
• a pipeline that cannot start a program waits for the rest
• writeRelease names what it compresses and what it links
• the PAM check reads its files with eachLine
• one way to find the release usb-sign wrote
• fixed values are constants, and argumentless commands say so
• packages and cache take their mode as a subcommand
• the cache packs QEMU's image without a shell
• one helper runs a command for its output
• a directory layer has no prefix
• the update URL is read by the command and passed down
• the Plymouth theme reads the root's tarball once
• a recipe whose comments alone changed needs no new epoch

qemu

• why the boot film stays on PPM, measured
• DecodePPM fuzzed
• DecodePPM refuses a header it cannot hold
• screenshots are QEMU's own PNGs
• a screendump's PNG is written by pixels.WritePNG
• stop swtpm when no QEMU will connect to it
• unexport PPMToPNG

update

• the keyring's, the release's and the ESP's refusals held by tests
• Compare reads the character past a '~' as systemd's signed char
• Compare checked against systemd-analyze compare-versions
• one UUID formatter for the slots', /var's and random GUIDs
• Install answers only whether it installed
• partition numbers come from the layout alone
• unexport what nothing outside the package uses

construct

• usage is the one list of its commands
• firmware takes the file alone
• no flags that nothing passes
• install says why it could not read a disk's sector size
• the channel file written whole, through fsx
• a password or a PIN from a pipe keeps its spaces

securitykey

• a key's user cannot split pam_u2f's mappings
• what is no es256 credential, or no keyslot, is refused in tests
• ReadHeader decodes the header itself
• unexport the slots, mappings, origin and file names

build

• the harness's QEMU 11.1.2
• the builder's task 3.54.0 and gh 2.102.0
• the builder's Go is go.mod's, 1.27.2

ci

• gettext on check's runner, so the .mo reader meets msgunfmt
• Dependabot for Go's modules and the workflows' actions, weekly
• task check on every pull request

sign

• every refusal of a key, a policy and a binary held by a test
• the Secure Boot variables' names are a function, not a shared slice
• unexport the openers and the key check nothing outside calls

watch

• the pins in build/ behind upstream are one issue
• a kernel point release is an issue
• no flags for the repository's own paths

account

• home is the package's own
• a person cannot take a system user's name, or split passwd

bench

• apply and the parsers are the package's own
• a run's numbers are a Result, not a map of names

gpt

• every refusal of Write and Read held by a test
• unexport FirstUsable

onepassword

• Install and Installed, without options nobody varies
• extract through an os.Root, which no chain of links leaves

repo

• the hardware it was tried on named generally
• license Apache-2.0, add SECURITY.md

at-spi2-core

• 2.62.1, above Wolfi's again

freerdp-3

• 3.32.2, above Wolfi's again

fsx

• SyncDir, the directory sync WriteFile ends with, for update too

gap

• GNOME's desktop alone, and an index that stalls gives up

initrd

• /var's dm-crypt without workqueues

kernel

• 7.2.10

needle

• NoiseOf and the diff measure colours with pixels' helpers

other

• update dependencies in go.mod and go.sum to latest versions

power

• the RAPL counter's state is one value, not two bools

task, ipp-usb

• built again, with Go 1.27.2

test

• goleak checks the packages that start goroutines

Packages

982 packages: 205 updated, 0 added, 0 removed.

Updated (205)

• aom-libs 3.15.1-r0 → 3.15.2-r0
• at-spi2-core 2.62.0.1-r1 → 2.62.1-r1
• at-spi2-core-lang 2.62.0.1-r1 → 2.62.1-r1
• brotli 1.2.0-r5 → 1.2.0-r6
• brotli-dev 1.2.0-r5 → 1.2.0-r6
• busybox 1.38.0-r2 → 1.38.0-r3
• containerd-2 2.4.1-r1 → 2.4.1-r2
• containerd-service-2 2.4.1-r1 → 2.4.1-r2
• containerd-shim-runc-v2-2 2.4.1-r1 → 2.4.1-r2
• containerd-stress-2 2.4.1-r1 → 2.4.1-r2
• ctr-2 2.4.1-r1 → 2.4.1-r2
• dbus 1.16.2-r6 → 1.16.2-r7
• dbus-libs 1.16.2-r6 → 1.16.2-r7
• dmidecode 3.7-r3 → 3.7-r4
• docbook-xml 4.5-r7 → 4.5-r8
• docker-29 29.8.2-r3 → 29.9.0-r0
• docker-cli-buildx 0.38.0-r1 → 0.38.0-r2
• docker-compose 5.6.0-r1 → 5.6.0-r2
• docker-init-29 29.8.2-r3 → 29.9.0-r0
• dockerd-29 29.8.2-r3 → 29.9.0-r0
• dockerd-service-29 29.8.2-r3 → 29.9.0-r0
• dosfstools 4.2-r45 → 4.2-r46
• e2fsprogs 1.47.4-r2 → 1.47.4-r3
• e2fsprogs-extra 1.47.4-r2 → 1.47.4-r3
• e2fsprogs-libs 1.47.4-r2 → 1.47.4-r3
• ell 0.83-r2 → 0.83-r3
• enchant2 2.8.21-r0 → 2.8.21-r1
• font-noto-music-family 2.003-r0 → 2.004-r0
• font-noto-sans-mongolian 3.100-r0 → 3.103-r0
• freerdp-3-libs 3.32.1-r2 → 3.32.2-r1
• freetype 2.14.3-r6 → 2.14.3-r7
• freetype-dev 2.14.3-r6 → 2.14.3-r7
• fuse-overlayfs 1.18-r0 → 1.18-r1
• fuse3 3.18.3-r0 → 3.18.3-r1
• fuse3-libs 3.18.3-r0 → 3.18.3-r1
• gdbm 1.26-r6 → 1.26-r7
• gettext 1.0-r7 → 1.0-r8
• gettext-dev 1.0-r7 → 1.0-r8
• gettext-envsubst 1.0-r7 → 1.0-r8
• giflib 6.1.3-r1 → 6.1.3-r2
• gnupg-gpgconf 2.4.9-r11 → 2.4.9-r12
• gnutls 3.8.13-r1 → 3.8.13-r3
• gobject-introspection 1.86.0-r3 → 1.86.0-r4
• gobject-introspection-bin 1.86.0-r3 → 1.86.0-r4
• gobject-introspection-dev 1.86.0-r3 → 1.86.0-r4
• gpg 2.4.9-r11 → 2.4.9-r12
• gpg-agent 2.4.9-r11 → 2.4.9-r12
• gpgsm 2.4.9-r11 → 2.4.9-r12
• gptfdisk 1.0.10-r6 → 1.0.10-r7
• graphene 1.10.8-r9 → 1.10.8-r10
• graphite2 1.3.15-r2 → 1.3.15-r4
• gtk-3 3.24.52-r4 → 3.24.52-r5
• gtk-3-lang 3.24.52-r4 → 3.24.52-r5
• gtk-3-update-icon-cache 3.24.52-r4 → 3.24.52-r5
• heimdal-libs 7.8.0-r52 → 7.8.0-r53
• hicolor-icon-theme 0.18-r7 → 0.18-r8
• inih 62-r4 → 62-r5
• ip6tables 1.8.13-r4 → 1.8.13-r5
• ipp-usb 0.9.34-r0 → 0.9.34-r1
• iproute2 7.2.0-r0 → 7.2.0-r1
• iptables 1.8.13-r4 → 1.8.13-r5
• iptables-nft 1.8.13-r4 → 1.8.13-r5
• isl 0.28-r3 → 0.28-r4
• iso-codes 4.20.1-r3 → 4.20.1-r4
• jansson 2.15.1-r1 → 2.15.1-r2
• jbig2dec 0.20-r5 → 0.20-r6
• json-c 0.19-r1 → 0.19-r2
• just-newuidmap-newgidmap 4.20.2-r1 → 4.20.3-r0
• kbd 2.10.0-r3 → 2.10.0-r4
• keyutils-libs 1.6.3-r40 → 1.6.3-r41
• lame-libs 4.0-r1 → 4.0-r2
• lcms2 2.19.1-r2 → 2.19.1-r3
• less 710-r0 → 711-r0
• libLLVM-22 22.1.8-r4 → 22.1.8-r6
• libassuan 3.0.2-r9 → 3.0.2-r10
• libasyncns 0.8-r8 → 0.8-r9
• libatk-1.0 2.62.0.1-r1 → 2.62.1-r1
• libatk-bridge-2.0 2.62.0.1-r1 → 2.62.1-r1
• libattr1 2.6.0-r3 → 2.6.0-r4
• libaudit 4.2.1-r1 → 4.2.1-r2
• libbrotlicommon1 1.2.0-r5 → 1.2.0-r6
• libbrotlidec1 1.2.0-r5 → 1.2.0-r6
• libbrotlienc1 1.2.0-r5 → 1.2.0-r6
• libbsd 0.12.2-r8 → 0.12.2-r9
• libcap 2.78-r3 → 2.78-r4
• libcap-ng 0.9.6-r0 → 0.9.6-r1
• libcom_err 1.47.4-r2 → 1.47.4-r3
• libcrypto3 3.6.5-r1 → 3.6.5-r2
• libdav1d 1.5.4-r1 → 1.5.4-r2
• libdrm-libs 2.4.134-r2 → 2.4.134-r3
• libedit 3.1-r19 → 3.1-r20
• libedit-dev 3.1-r19 → 3.1-r20
• libepoxy 1.5.10-r9 → 1.5.10-r10
• libexif-libs 0.6.26-r2 → 0.6.26-r3
• libffi 3.8.0-r1 → 3.8.0-r2
• libffi-dev 3.8.0-r1 → 3.8.0-r2
• libflac 1.5.0-r1 → 1.5.0-r2
• libfontenc 1.1.9-r2 → 1.1.9-r3
• libglvnd 1.7.0-r11 → 1.7.0-r12
• libgpg-error 1.61-r3 → 1.61-r4
• libgphoto2 2.5.34-r3 → 2.5.34-r4
• libgphoto2-lang 2.5.34-r3 → 2.5.34-r4
• libice 1.1.2-r7 → 1.1.2-r8
• libice-dev 1.1.2-r7 → 1.1.2-r8
• libidn2 2.3.8-r9 → 2.3.8-r10
• libjpeg-turbo 3.2.0-r4 → 3.2.0-r5
• libksba 1.8.1-r1 → 1.8.1-r2
• libltdl 2.5.4-r4 → 2.5.4-r5
• liblz4-1 1.10.0-r10 → 1.10.0-r11
• libmnl 1.0.5-r8 → 1.0.5-r10
• libnftnl 1.3.2-r0 → 1.3.2-r1
• libnl3 3.12.0-r6 → 3.12.0-r7
• libnotify 0.8.8-r4 → 0.8.8-r5
• libnspr 4.40-r1 → 4.40-r2
• libnss 3.128-r2 → 3.131-r0
• libogg-libs 1.3.6-r9 → 1.3.6-r10
• libpaper 2.2.8-r2 → 2.2.8-r3
• libpciaccess 0.19-r3 → 0.19-r4
• libpsl 0.23.3-r1 → 0.23.3-r2
• libsdl2 2.32.10-r4 → 2.32.10-r5
• libseccomp 2.6.1-r1 → 2.6.1-r2
• libsecret 0.21.8.2-r0 → 0.21.8.2-r1
• libsecret-lang 0.21.8.2-r0 → 0.21.8.2-r1
• libsemanage 3.11-r2 → 3.11-r3
• libsigcplusplus 3.8.1-r2 → 3.8.1-r3
• libsm 1.2.6-r5 → 1.2.6-r6
• libsm-dev 1.2.6-r5 → 1.2.6-r6
• libsndfile 1.2.2-r5 → 1.2.2-r6
• libsodium 1.0.22-r1 → 1.0.22-r2
• libssl3 3.6.5-r1 → 3.6.5-r2
• libtasn1 4.21.0-r6 → 4.21.0-r7
• libtheora 1.2.0-r7 → 1.2.0-r8
• libtool 2.5.4-r4 → 2.5.4-r5
• libtraceevent 1.9.0-r5 → 1.9.0-r6
• libtracefs 1.8.3-r4 → 1.8.3-r5
• libunistring 1.4.2-r3 → 1.4.2-r4
• liburcu 0.15.7-r0 → 0.15.7-r1
• libusb 1.0.30-r2 → 1.0.30-r3
• libva 2.24.1-r2 → 2.24.1-r3
• libverto 0.3.2-r8 → 0.3.2-r9
• libvorbis 1.3.7-r11 → 1.3.7-r12
• libwebp 1.6.0-r6 → 1.6.0-r7
• libxau 1.0.12-r8 → 1.0.12-r9
• libxau-dev 1.0.12-r8 → 1.0.12-r9
• libxcomposite 0.4.7-r4 → 0.4.7-r5
• libxcrypt 4.5.2-r5 → 4.5.2-r6
• libxcrypt-dev 4.5.2-r5 → 4.5.2-r6
• libxcursor 1.2.3-r6 → 1.2.3-r7
• libxcvt 0.1.3-r9 → 0.1.3-r10
• libxdamage 1.1.7-r4 → 1.1.7-r5
• libxext 1.3.7-r3 → 1.3.7-r4
• libxext-dev 1.3.7-r3 → 1.3.7-r4
• libxfixes 6.0.2-r3 → 6.0.2-r4
• libxft 2.3.9-r7 → 2.3.9-r8
• libxi 1.8.3-r1 → 1.8.3-r2
• libxinerama-libs 1.1.6-r6 → 1.1.6-r7
• libxkbcommon 1.13.2-r2 → 1.13.2-r3
• libxkbfile 1.2.0-r2 → 1.2.0-r3
• libxml2-16 2.15.4-r0 → 2.15.4-r1
• libxml2-utils 2.15.4-r0 → 2.15.4-r1
• libxrandr 1.5.5-r6 → 1.5.5-r7
• libxrender 0.9.12-r9 → 0.9.12-r10
• libxrender-dev 0.9.12-r9 → 0.9.12-r10
• libxshmfence 1.3.3-r4 → 1.3.3-r5
• libxslt 1.1.45-r4 → 1.1.45-r5
• libxt 1.3.1-r8 → 1.3.1-r9
• libxt-dev 1.3.1-r8 → 1.3.1-r9
• libxtst 1.2.5-r8 → 1.2.5-r9
• libxv 1.0.13-r6 → 1.0.13-r7
• libxxf86vm 1.1.7-r4 → 1.1.7-r5
• linux-headers 7.2.9-r0 → 7.2.10-r0
• lm-sensors 3.6.2-r3 → 3.6.2-r4
• lm-sensors-detect 3.6.2-r3 → 3.6.2-r4
• lsof 4.99.7-r2 → 4.99.7-r3
• lua5.4-libs 5.4.9-r1 → 5.4.9-r2
• lz4 1.10.0-r10 → 1.10.0-r11
• lzo 2.10-r9 → 2.10-r10
• ncurses 6.6.20260926-r0 → 6.6.20261010-r0
• ncurses-dev 6.6.20260926-r0 → 6.6.20261010-r0
• ncurses-terminfo-base 6.6.20260926-r0 → 6.6.20261010-r0
• openssl-4.0 4.0.3-r5 → 4.0.3-r6
• openssl-4.0-dev 4.0.3-r5 → 4.0.3-r6
• openssl-4.0-libcrypto 4.0.3-r5 → 4.0.3-r6
• openssl-4.0-libssl 4.0.3-r5 → 4.0.3-r6
• openssl-provider-legacy-allowed 4.0.2-r3 → 4.0.3-r1
• py3-pip-wheel 26.2.1-r2 → 26.2.1-r4
• py3.13-gobject3 3.58.0-r1 → 3.58.1-r0
• py3.13-pycparser 3.01-r0 → 3.11-r0
• py3.13-setuptools 84.0.0-r0 → 84.0.0-r1
• python-3.13 3.13.16_git20261002-r2 → 3.13.16_git20261009-r0
• python-3.13-base 3.13.16_git20261002-r2 → 3.13.16_git20261009-r0
• rav1e 0.8.1-r9 → 0.8.1-r10
• runc 1.5.2-r1 → 1.5.2-r3
• sgdisk 1.0.10-r6 → 1.0.10-r7
• shadow 4.20.2-r1 → 4.20.3-r0
• shadow-subids 4.20.2-r1 → 4.20.3-r0
• sqlite 3.53.4-r2 → 3.54.0-r0
• sqlite-dev 3.53.4-r2 → 3.54.0-r0
• sqlite-libs 3.53.4-r2 → 3.54.0-r0
• tailscale 1.104.1-r1 → 1.104.1-r2
• task 3.54.0-r4 → 3.54.0-r5
• vim 9.2.1172-r0 → 9.2.1178-r0
• zlib 1.3.2.1_rc20260917-r0 → 1.3.2.1_rc20260921-r0
• zlib-dev 1.3.2.1_rc20260917-r0 → 1.3.2.1_rc20260921-r0
• zram-generator 1.2.1-r2 → 1.2.1-r3

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 512 of 512 checks passed
• lifecycle: 64 of 64 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261013.1.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS