stable-20260723: LTS

Key components

Component	Version	Change
Kernel (LTS)	7.0.12-201
GNOME Shell	50.0-3.el10
Flatpak	1.18.0-1.el10
bootc	1.16.2-1.el10

10 updated, 1 removed since the previous release. 1467 packages total.

Package changes

↑ 10 updated packages

Package	From	To
grub2-common	2.12-51.el10	2.12-52.el10
grub2-efi-aa64	2.12-51.el10	2.12-52.el10
grub2-tools	2.12-51.el10	2.12-52.el10
grub2-tools-minimal	2.12-51.el10	2.12-52.el10
libcap-ng	0.9.3-1.el10	0.9.3-2.el10
libnghttp2	1.68.0-4.el10	1.68.0-5.el10
openssh	9.9p1-27.el10	9.9p1-28.el10
openssh-clients	9.9p1-27.el10	9.9p1-28.el10
openssh-server	9.9p1-27.el10	9.9p1-28.el10
sos	4.11.2-1.el10	4.11.2-2.el10

− 1 removed packages

Package	Last version
libcap-ng-python3	0.9.3-1.el10

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

---

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:ae243d9f134ffd66af030f961f911059b49bf2cf4013909389f306125a1028d9

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

---

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:ae243d9f134ffd66af030f961f911059b49bf2cf4013909389f306125a1028d9

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

---

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:ae243d9f134ffd66af030f961f911059b49bf2cf4013909389f306125a1028d9 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

---

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:ae243d9f134ffd66af030f961f911059b49bf2cf4013909389f306125a1028d9 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20260723'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:ae243d9f134ffd66af030f961f911059b49bf2cf4013909389f306125a1028d9 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

---

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs