Release v25.08.13
1. Specifications
- Upstream Junction:
freedesktop-sdk.bstpinned to25.08.13 - Architectures:
linux/amd64,linux/arm64 - Repository:
projectbluefin/fsdk-containers
2. Image Inventory
| Image | Reference Tag | Virtual Size (Uncompressed) | Entrypoint |
|---|---|---|---|
| base | ghcr.io/projectbluefin/base:v25.08.13 |
40 MB | N/A |
| static | ghcr.io/projectbluefin/static:v25.08.13 |
40 MB | N/A |
| skopeo | ghcr.io/projectbluefin/skopeo:v25.08.13 |
95 MB | /usr/bin/skopeo |
| python | ghcr.io/projectbluefin/python:v25.08.13 |
105 MB | /usr/bin/python3 |
| buildah | ghcr.io/projectbluefin/buildah:v25.08.13 |
186 MB | /usr/bin/buildah |
| lab-runner | ghcr.io/projectbluefin/lab-runner:v25.08.13 |
125 MB | /usr/bin/bash |
3. Quality Verification Gates
The following gates have been successfully compiled, validated, and verified:
- Gate 1 (Distroless Assertion): Absence of shells (
/usr/bin/bash,/usr/bin/sh) verified onbase,static,skopeo,python, andbuildah. Exception:lab-runner. - Gate 2 (CA Trust): Trust store bundle at
/etc/pki/tls/certs/ca-bundle.crtverified across all layers. - Gate 3 (Timezone Compliance): Zoneinfo database
usr/share/zoneinfo/UTCpresent. - Gate 4 (Minimalism Audit): Automated removal of
/usr/share/terminfo, GCC sanitizers (libasan,libtsan), and glibc locale archive data.
4. Automation & Security Metadata
- Dependency Tracking: Configured in
renovate.jsonusing custom regex managers matching# renovate:comments. - Supply Chain: BuildStream-native SBOMs (
.spdx.json) compiled and attached using ORAS, keyless signed with Sigstore Cosign.