Release stable-20260719: LTS · projectbluefin/bluefin-lts

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:58293f46c890`
`bluefin-lts-nvidia`	`:stable`	`sha256:bc3036b2cad5`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.0.12-201`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-1.el10`
bootc	`1.16.2-1.el10`

49 updated, 34 added, 7 removed since the previous release. 1497 packages total.

Package changes

↑ 49 updated packages

Package	From	To
`NetworkManager`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-adsl`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-bluetooth`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-cloud-setup`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-libnm`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-tui`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-wifi`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`NetworkManager-wwan`	`1.56.1-1.el10`	`1.58~rc1-1.el10`
`cifs-utils`	`7.6-1.el10`	`7.6-2.el10`
`cjson`	`1.7.18-1.el10_0`	`1.7.19-1.el10_3`
`dracut`	`107-4.el10`	`107-9.el10`
`dracut-config-rescue`	`107-4.el10`	`107-9.el10`
`dracut-network`	`107-4.el10`	`107-9.el10`
`dracut-squash`	`107-4.el10`	`107-9.el10`
`highway`	`1.3.0-1.el10_2`	`1.3.0-2.el10`
`kernel-headers`	`6.12.0-246.el10`	`6.12.0-248.el10`
`kernel-tools`	`6.12.0-246.el10`	`6.12.0-248.el10`
`kernel-tools-libs`	`6.12.0-246.el10`	`6.12.0-248.el10`
`libipa_hbac`	`2.13.1-1.el10`	`2.13.1-2.el10`
`libsss_certmap`	`2.13.1-1.el10`	`2.13.1-2.el10`
`libsss_idmap`	`2.13.1-1.el10`	`2.13.1-2.el10`
`libsss_nss_idmap`	`2.13.1-1.el10`	`2.13.1-2.el10`
`libsss_sudo`	`2.13.1-1.el10`	`2.13.1-2.el10`
`libwayland-client`	`1.24.0-1.el10`	`1.25.0-1.el10`
`libwayland-cursor`	`1.24.0-1.el10`	`1.25.0-1.el10`
`libwayland-egl`	`1.24.0-1.el10`	`1.25.0-1.el10`
`libwayland-server`	`1.24.0-1.el10`	`1.25.0-1.el10`
`python3-perf`	`6.12.0-246.el10`	`6.12.0-248.el10`
`qemu-guest-agent`	`10.1.0-23.el10`	`10.1.0-24.el10`
`sssd`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-ad`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-client`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-common`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-common-pac`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-ipa`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-kcm`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-krb5`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-krb5-common`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-ldap`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-nfs-idmap`	`2.13.1-1.el10`	`2.13.1-2.el10`
`sssd-proxy`	`2.13.1-1.el10`	`2.13.1-2.el10`
`systemd`	`257-28.el10`	`257-29.el10`
`systemd-container`	`257-28.el10`	`257-29.el10`
`systemd-libs`	`257-28.el10`	`257-29.el10`
`systemd-oomd`	`257-28.el10`	`257-29.el10`
`systemd-pam`	`257-28.el10`	`257-29.el10`
`systemd-resolved`	`257-28.el10`	`257-29.el10`
`systemd-udev`	`257-28.el10`	`257-29.el10`
`tailscale`	`1.98.8-1`	`1.98.9-1`

+ 34 added packages

Package	Version
`alsa-sof-firmware`	`2025.12.2-1.el10`
`cpuinfo`	`24.09.26-1.git1e83a2f.el10_1.1`
`fprintd`	`1.94.5-1.el10`
`fprintd-pam`	`1.94.5-1.el10`
`grub2-efi-x64`	`2.12-49.el10`
`grub2-pc`	`2.12-49.el10`
`grub2-pc-modules`	`2.12-49.el10`
`hypervfcopyd`	`0-0.51.20220731git.el10`
`intel-mediasdk`	`23.2.2-1.el10`
`intel-vpl-gpu-rt`	`26.1.6-1.el10_3`
`kmod-zfs`	`2.3.8-1`
`libfprint`	`1.94.9-3.el10`
`libnvpair3`	`2.3.8-1`
`libuutil3`	`2.3.8-1`
`libvmaf`	`3.0.0-2.el10_0`
`libvpl`	`2.17.0-1.el10_3`
`libzfs6`	`2.3.8-1`
`libzpool6`	`2.3.8-1`
`lm_sensors-libs`	`3.6.0-20.el10`
`mcelog`	`210-1.el10`
`microcode_ctl`	`20260210-1.el10`
`pcp-conf`	`7.1.5-2.el10`
`pcp-libs`	`7.1.5-2.el10`
`python3-pyzfs`	`2.3.8-1`
`python3.14`	`3.14.5-1.el10`
`python3.14-cffi`	`2.0.0-2.el10`
`python3.14-libs`	`3.14.5-1.el10`
`python3.14-pip-wheel`	`25.2-5.el10`
`python3.14-pycparser`	`2.22-4.el10`
`shim-x64`	`16.1-1.el10`
`svt-vp9-libs`	`0.3.0-13.el10_1`
`sysstat`	`12.7.6-4.el10`
`thermald`	`2.5.10-1.el10`
`zfs`	`2.3.8-1`

− 7 removed packages

Package	Last version
`grub2-efi-aa64`	`2.12-49.el10`
`imath`	`3.1.10-4.el10`
`libasan`	`14.4.1-1.el10`
`libatomic`	`14.3.1-4.4.el10`
`libubsan`	`14.4.1-1.el10`
`opencsd`	`1.6.1-0.el10`
`shim-aa64`	`16.1-1.el10`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:58293f46c890e97836bed80b9e71bf47b0a17065844816f6e607f1190b04406f

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:58293f46c890e97836bed80b9e71bf47b0a17065844816f6e607f1190b04406f

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:58293f46c890e97836bed80b9e71bf47b0a17065844816f6e607f1190b04406f \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:58293f46c890e97836bed80b9e71bf47b0a17065844816f6e607f1190b04406f \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20260719'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:58293f46c890e97836bed80b9e71bf47b0a17065844816f6e607f1190b04406f \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

stable-20260719: LTS

Choose a tag to compare

Sorry, something went wrong.

Sorry, something went wrong.

Uh oh!

No results found

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!