nucleus: v0.5.1

0.5.1 (2026-10-24)

Bug Fixes

• ci: build module checks against the same run's headers on pull requests (#249) (0dc98e4), closes #248
• ci: build scheduled module checks against the newest published release (f396b70), closes #252
• ci: check out the default branch in the release-triggered module checks (#266) (0687960), closes #265
• ci: install git in the OpenZFS module build container (#268) (da43025), closes #267
• ci: run the module release checks after publish-release (f396b70)
• ci: run the module release checks after publish-release (#253) (f396b70)
• deps: bump certifi to 2026.10.19 for PYSEC-2026-4320 (#245) (cbe9e90), closes #244
• deps: let renovate bump image env pins and unpin test SHAs (#259) (3d3628f)
• lifecycle: substitute the last published version for 7 days after a bump (#262) (79df301)

v7.2.11-realtime-lusoris1

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

v7.2.11-mainstream-lusoris1

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

v6.18.58-lts-lusoris1

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

nucleus: v0.5.0

0.5.0 (2026-10-21)

Features

• boot: load scx_simple under QEMU and require sched_ext enabled on x86_64 (#228) (7518688)
• kconfig: claim AMD ROCm on all four streams on x86_64 (#219) (3392531), closes #213

Bug Fixes

• ci: install envsubst before cosign-installer in container jobs (#236) (6d87a5a)
• ci: report the metadata gate on pushes to main (#232) (55a7298), closes #231
• ci: waive the metadata gate for Renovate's own pull requests (#235) (38a3025)

v7.2.10-realtime-lusoris4

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

v7.2.10-mainstream-lusoris4

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

v7.3-rc7-bleeding-lusoris4

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

v6.18.56-lts-lusoris4

The x86_64 Unified Kernel Image (linux-*-uki.efi) is unsigned for Secure Boot; arm64 and riscv64 ship no UKI with releases.

nucleus: v0.4.0

0.4.0 (2026-10-18)

Features

• boot: boot arm64 and riscv64 kernels under QEMU in the matrix (#170) (3e88a16)
• boot: refuse each leg's console when judged with another release (#188) (11ad0ee)
• build: sign kernel modules after the build with a recorded step (#183) (8582d5f)
• kconfig: build a Kubernetes node on every stream, and refuse a build without a claimed option (#138) (b7f1342)
• kconfig: build the eight options the reference node sets that lusoris2 left off (#145) (0949e1d), closes #144
• kconfig: claim Xe2 on xe for every stream on x86_64 (#200) (4b6b977), closes #193
• packaging: build the pinned NVIDIA open kernel modules in CI (#201) (67753ad), closes #194
• patches: carry BBRv3 from google/bbr pinned by commit (#196) (41fe429), closes #192
• release: publish the x86_64 UKI with each release (#210) (658c5a3)
• requirements: check one kernel configuration against a requirement (#176) (677dd40)
• requirements: verify module-abi against the build record (ADR-0015) (#165) (6e642de)
• uki: build a UKI from each leg's own kernel in the build matrix (#174) (1bf4330)

Bug Fixes

• boot-smoke: accept a printk timestamp after the release on the init's line (#127) (d57e889), closes #126
• ci: bound the required-checks wait by a wall-clock deadline (#185) (ee7e4dd)
• ci: clear the eleven HISS findings in existing files (#108) (b431d3e)
• ci: close the two open CodeQL notes (#149) (78511c0), closes #148
• ci: judge stale check statuses and wait for late checks in required-checks (#82) (47c9fdd)
• ci: pass a skipped job only when the change detector excluded it (#71) (dd825dc)
• ci: refuse to attest when supply-chain has no package (#68) (074432c)
• docker: build the builder container from the CI image and toolchain (#80) (84dd57c)
• gate: refuse an artifact above imago's 512 MiB per-artifact bound (#96) (f6e56a6), closes #95
• governance: name the praetor pin PRAETOR_REF so git hooks use it (#167) (125edb8)
• hindsight-mcp: flush only the bank's own buffered facts, refuse https instead of sending it in clear (#88) (328dcdf)
• kconfig: build BTF into riscv64 kernels and gate BTF on every arch (#159) (5b25755)
• kconfig: carry zlib deflate on every leg, and move all streams to current upstream (#106) (987043f), closes #105
• kconfig: enable sched-ext on riscv64 (#162) (d1ab20e)
• lint: make fmt-check, audit and the function-length check fail on findings (#75) (a83e1bc)
• package: date debian/changelog from SOURCE_DATE_EPOCH (#171) (8ad187a)
• patches: drop the carried patch that applied to no stream, and check the rest apply (#173) (331ab42)
• release: generate the artifact manifest in a tested script that proves every digest (#90) (3d10057)
• release: refuse to publish a tag whose release already exists (#100) (ed537d0), closes #99
• repro: compare two real build directories, and give no verdict on a dry run (#78) (a7b416a)
• supply-chain: verify each published release instead of re-signing nothing (#134) (89a192c), closes #133

Miscellaneous Chores

• release: release features as the next minor version (#212) (bfe5210)