CONSTRUCT 20261014.1

CONSTRUCT 20261014.1

Built 2026-10-14 · GNOME Shell 51.0-r1 · Mesa 26.2.4-r2

Changes

39 changes since v20261013.2.

image

• the lifecycle's sudo check takes the lecture; the outro's screens half a second apart
• xprop, for at-spi2-core's Xwayland hook
• fwupd leaves db, dbx and KEK to the firmware's own keys
• the process helpers in exec.go, and three small ones
• two locals no longer shadow a function and a type
• check-langs' index fetch has a timeout; needles-propose says a checkout left behind
• the lifecycle's sudo check reads the exit status it asked for
• a walk of the root's tar that reads names reads headers alone
• the lock screen's extension checks read the shell's answer decoded
• a view says what it measures where it is shot
• one wait for the harness, until
• an S3 failure is neither a cache miss nor a log with nothing new
• needles-propose no longer retires desktop-dark
• prune keeps what the recipes make, and orders no version

taskfile

• keys:kms makes each half it lacks
• packages:prune, the prune and its index as one task
• rootfs refuses a recipe packages/ has not built
• melange.rsa.pub is the key's own, not the repository's
• one task makes a channel's index

construct

• install and disks report a bad flag as every command does
• a report says what it could not read, not something else
• kernel-profile's perf ends with the signal construct takes

qemu

• a VNC server for task boot alone
• a screenshot is checked whole, not slept on
• swtpm ends with a QEMU that never took it; Attach's VM waits for nobody

update

• a stick carries one release, at the root of its partition
• a cancelled install says so, not that the root is not xz

code

• no updater of its own

diagnose, securitykey

• one close on the way out, keys sorted by the library

image, watch

• the package docs name the commands and flags that exist

kernel

• perf without the debuginfod client

needle

• ChannelTolerance, no longer a name shared with pixels.ChannelDelta

onepassword

• an update that fails to move in leaves the app installed

other

• What only ever took one value takes none

program

• one runner for what construct and securitykey start

secureboot

• update KEK, PK, and db authentication files

sign

• Microsoft's KEK CAs in the KEK, for dbx

update, gpt

• what was written for nobody to read

watch

• the upstream reader is given its token where the client is

Packages

983 packages: 1 updated, 1 added, 0 removed.

Updated

• code 1.140.0-r2 → 1.140.0-r3

Added

• xprop 1.2.8-r5

Security

Grype over the release's root, on the day it was built:

severity	a version fixes it	nobody has yet
Critical	0	0
High	0	0
Medium	0	8
Low	0	0
Negligible	0	0
Unknown	0	0

The whole report is grype.md; Grype's own, grype.json; the packages, sbom.spdx.json.

Checked

• test: 509 of 509 checks passed
• lifecycle: 65 of 65 checks passed

Get it

An installed machine takes it by itself from its channel, and starts it at its next reboot.
A new machine: the USB stick, https://dl.constructlinux.org/construct_20261014.1.raw.xz, in the signed https://dl.constructlinux.org/SHA256SUMS; how to check it and write it to a stick is the README's Install.

Every file is in SHA256SUMS, signed with the release key (release.pgp):

gpg --import release.pgp && gpg --verify SHA256SUMS.gpg SHA256SUMS && sha256sum -c --ignore-missing SHA256SUMS