Release v25.08.13

Release v25.08.13

1. Specifications

• Upstream Junction: freedesktop-sdk.bst pinned to 25.08.13
• Architectures: linux/amd64, linux/arm64
• Repository: projectbluefin/fsdk-containers

2. Image Inventory

Image	Reference Tag	Virtual Size (Uncompressed)	Entrypoint
base	ghcr.io/projectbluefin/base:v25.08.13	40 MB	N/A
static	ghcr.io/projectbluefin/static:v25.08.13	40 MB	N/A
skopeo	ghcr.io/projectbluefin/skopeo:v25.08.13	95 MB	/usr/bin/skopeo
python	ghcr.io/projectbluefin/python:v25.08.13	105 MB	/usr/bin/python3
buildah	ghcr.io/projectbluefin/buildah:v25.08.13	186 MB	/usr/bin/buildah
lab-runner	ghcr.io/projectbluefin/lab-runner:v25.08.13	125 MB	/usr/bin/bash

3. Quality Verification Gates

The following gates have been successfully compiled, validated, and verified:

• Gate 1 (Distroless Assertion): Absence of shells (/usr/bin/bash, /usr/bin/sh) verified on base, static, skopeo, python, and buildah. Exception: lab-runner.
• Gate 2 (CA Trust): Trust store bundle at /etc/pki/tls/certs/ca-bundle.crt verified across all layers.
• Gate 3 (Timezone Compliance): Zoneinfo database usr/share/zoneinfo/UTC present.
• Gate 4 (Minimalism Audit): Automated removal of /usr/share/terminfo, GCC sanitizers (libasan, libtsan), and glibc locale archive data.

4. Automation & Security Metadata

• Dependency Tracking: Configured in renovate.json using custom regex managers matching # renovate: comments.
• Supply Chain: BuildStream-native SBOMs (.spdx.json) compiled and attached using ORAS, keyless signed with Sigstore Cosign.