Skip to content

stable-20260707: LTS

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 05:21
stable-20260707
a40f9f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Variants promoted

Variant Tag Digest
bluefin-lts :stable sha256:a7a87d752ac5
bluefin-lts-nvidia :stable sha256:e14cf4d9204e

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Release card

Key components

Component Version Change
Kernel (LTS) 7.0.11-200
GNOME Shell 50.0-3.el10
Flatpak 1.18.0-1.el10
bootc 1.16.2-1.el10

1 updated, 34 added, 7 removed since the previous release. 1497 packages total.

Package changes

↑ 1 updated packages
Package From To
highway 1.3.0-1.el10_2 1.3.0-2.el10
+ 34 added packages
Package Version
alsa-sof-firmware 2025.12.2-1.el10
cpuinfo 24.09.26-1.git1e83a2f.el10_1.1
fprintd 1.94.5-1.el10
fprintd-pam 1.94.5-1.el10
grub2-efi-x64 2.12-49.el10
grub2-pc 2.12-49.el10
grub2-pc-modules 2.12-49.el10
hypervfcopyd 0-0.51.20220731git.el10
intel-mediasdk 23.2.2-1.el10
intel-vpl-gpu-rt 26.1.6-1.el10_3
kmod-zfs 2.3.8-1
libfprint 1.94.9-3.el10
libnvpair3 2.3.8-1
libuutil3 2.3.8-1
libvmaf 3.0.0-2.el10_0
libvpl 2.16.0-1.el10_2
libzfs6 2.3.8-1
libzpool6 2.3.8-1
lm_sensors-libs 3.6.0-20.el10
mcelog 210-1.el10
microcode_ctl 20260210-1.el10
pcp-conf 7.1.5-2.el10
pcp-libs 7.1.5-2.el10
python3-pyzfs 2.3.8-1
python3.14 3.14.5-1.el10
python3.14-cffi 2.0.0-2.el10
python3.14-libs 3.14.5-1.el10
python3.14-pip-wheel 25.2-3.el10
python3.14-pycparser 2.22-4.el10
shim-x64 16.1-1.el10
svt-vp9-libs 0.3.0-13.el10_1
sysstat 12.7.6-4.el10
thermald 2.5.10-1.el10
zfs 2.3.8-1
− 7 removed packages
Package Last version
grub2-efi-aa64 2.12-49.el10
imath 3.1.10-4.el10
libasan 14.3.1-4.4.el10
libatomic 14.3.1-4.4.el10
libubsan 14.3.1-4.4.el10
opencsd 1.6.1-0.el10
shim-aa64 16.1-1.el10

Desktop Screenshot

Bluefin LTS desktop — stable-20260707

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a7a87d752ac52b39ed2a205383a8701b8b3eff7dfc95f85e25877323f186f93e

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a7a87d752ac52b39ed2a205383a8701b8b3eff7dfc95f85e25877323f186f93e

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a7a87d752ac52b39ed2a205383a8701b8b3eff7dfc95f85e25877323f186f93e \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a7a87d752ac52b39ed2a205383a8701b8b3eff7dfc95f85e25877323f186f93e \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20260707'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a7a87d752ac52b39ed2a205383a8701b8b3eff7dfc95f85e25877323f186f93e \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5
Loading