Releases · thallium-suite/uranium

This repository was archived by the owner on Oct 24, 2026. It is now read-only.

Repository navigation

Release list

stable-20261015: LTS Latest

Latest

github-actions released this 15 Oct 08:45

stable-20261015

b1607eb

Variants promoted

Variant	Tag	Digest
`uranium`	`:stable`	`sha256:526f0b586ceb`
`uranium-nvidia`	`:stable`	`sha256:6b43ea01fe10`

uranium and uranium-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

49 updated, 2 added, 1 removed since the previous release. 1567 packages total.

Package changes

↑ 49 updated packages

Package	From	To
`ffmpeg`	`7.1.5-3.el10`	`7.1.5-4.el10`
`freerdp-libs`	`3.28.0-4.el10`	`3.28.0-6.el10`
`gnome-remote-desktop`	`49.3-13.el10`	`49.3-16.el10`
`gvfs`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-client`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-fuse`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-goa`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-gphoto2`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-mtp`	`1.54.4-5.el10`	`1.54.4-6.el10`
`gvfs-smb`	`1.54.4-5.el10`	`1.54.4-6.el10`
`intel-vsc-firmware`	`20260812-26.el10`	`20260812-27.el10`
`iwlwifi-dvm-firmware`	`20260812-26.el10`	`20260812-27.el10`
`iwlwifi-mvm-firmware`	`20260812-26.el10`	`20260812-27.el10`
`kernel-headers`	`6.12.0-273.el10`	`6.12.0-275.el10`
`kernel-tools`	`6.12.0-273.el10`	`6.12.0-275.el10`
`kernel-tools-libs`	`6.12.0-273.el10`	`6.12.0-275.el10`
`libavcodec`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libavdevice`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libavfilter`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libavformat`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libavutil`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libertas-firmware`	`20260812-26.el10`	`20260812-27.el10`
`libpcap`	`1.10.4-7.el10`	`1.10.4-8.el10`
`libpostproc`	`7.1.5-3.el10`	`7.1.5-4.el10`
`librabbitmq`	`0.14.0-3.el10`	`0.14.0-3.el10.1`
`libsoup3`	`3.6.6-1.el10`	`3.8.0-1.el10`
`libswresample`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libswscale`	`7.1.5-3.el10`	`7.1.5-4.el10`
`libwinpr`	`3.28.0-4.el10`	`3.28.0-6.el10`
`lshw`	`B.02.20-9.el10`	`B.02.20-10.el10`
`netronome-firmware`	`20260812-26.el10`	`20260812-27.el10`
`openblas`	`0.3.33-1.el10`	`0.3.33-2.el10`
`openblas-serial`	`0.3.33-1.el10`	`0.3.33-2.el10`
`openexr-libs`	`3.1.10-13.el10`	`3.1.10-14.el10`
`parted`	`3.6-7.el10`	`3.6-8.el10`
`python3-perf`	`6.12.0-273.el10`	`6.12.0-275.el10`
`python3.14`	`3.14.7-2.el10`	`3.14.8-1.el10`
`python3.14-libs`	`3.14.7-2.el10`	`3.14.8-1.el10`
`qemu-guest-agent`	`10.1.0-28.el10`	`11.1.0-1.el10`
`vim-common`	`9.1.083-23.el10`	`9.1.083-24.el10`
`vim-data`	`9.1.083-23.el10`	`9.1.083-24.el10`
`vim-enhanced`	`9.1.083-23.el10`	`9.1.083-24.el10`
`vim-filesystem`	`9.1.083-23.el10`	`9.1.083-24.el10`
`vim-minimal`	`9.1.083-23.el10`	`9.1.083-24.el10`
`wireplumber`	`0.5.10-1.el10`	`0.5.18-2.el10`
`wireplumber-libs`	`0.5.10-1.el10`	`0.5.18-2.el10`
`xevd-libs`	`0.7.0-2.el10`	`0.8.0-1.el10`
`xeve-libs`	`0.7.0-2.el10`	`0.7.1-1.el10`
`xxd`	`9.1.083-23.el10`	`9.1.083-24.el10`

+ 2 added packages

Package	Version
`ghcr.io/thallium-suite/uranium`	`stable`
`plymouth-plugin-script`	`24.004.60-17.el10`

− 1 removed packages

Package	Last version
`ghcr.io/projectbluefin/bluefin-lts`	`stable`

Merged since last release

Features

feat(factory): build and verify GNOME 51 on CentOS Stream 10 (#709)
feat: add Uranium fastfetch and plymouth theme overrides (#728)

Fixes

fix: updated all three pinned image digests in image-versions.yaml to match the validated combination on the testing branch (#723)
fix: factory publish and malcontent (#727)
fix: plymouth script module (#730)
fix: plymouth script module (#731)
fix: plymouth aarch64 libdir (#732)
fix: plymouth aarch64 libdir v2 (#733)
fix: ModuleName=script in uranium.plymouth, which requires script.so from the plymouth-plugin-script package. That package was never in the install list — only plymouth, plymouth-scripts, and plymouth-system-theme were installed (#734)
fix(factory): chown repodata after createrepo_c before cosign sign-blob (#735)
fix(build): pass certificate-identity-regexp for thallium-suite cosign verify (#736)

Other Changes

refactor: move to thallium-suite/uranium and rebrand to Uranium (#721)
chore: Remove image from README (#722)
docs: add HWE migration entries and note for bluefin-lts-hwe users (#725)
chore: chmod scripts (#729)

Desktop Screenshot

Captured from uranium:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/thallium-suite/uranium@<SBOM_DIGEST>

The SBOM is also attached to this release as
uranium.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
  --source-uri 'github.com/thallium-suite/uranium' \
  --source-versioned-tag 'stable-20261015'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://github.com/thallium-suite/uranium/releases

Full changelog → https://github.com/thallium-suite/uranium/releases

Assets 5

stable-20261012: LTS

github-actions released this 12 Oct 04:17

stable-20261012

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:baee8880758c`
`bluefin-lts-nvidia`	`:stable`	`sha256:3075ef46cffd`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

no package changes since the previous release. 1566 packages total.

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:baee8880758c641ac346a4104a07c604a09c969796ce3c3024f698a31042e022

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:baee8880758c641ac346a4104a07c604a09c969796ce3c3024f698a31042e022

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:baee8880758c641ac346a4104a07c604a09c969796ce3c3024f698a31042e022 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:baee8880758c641ac346a4104a07c604a09c969796ce3c3024f698a31042e022 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261012'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:baee8880758c641ac346a4104a07c604a09c969796ce3c3024f698a31042e022 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261011: LTS

github-actions released this 11 Oct 04:11

stable-20261011

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:1ad18b85cb50`
`bluefin-lts-nvidia`	`:stable`	`sha256:7d118d4c4db6`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

4 updated since the previous release. 1566 packages total.

Package changes

↑ 4 updated packages

Package	From	To
`kdump-utils`	`1.0.61-2.el10`	`1.0.61-1.el10`
`sequoia-sq`	`1.4.0.2-2.el10`	`1.4.0.2-3.el10`
`sos`	`4.11.2-6.el10`	`4.11.2-6.el10.1`
`sudo`	`1.9.17-10.p2.el10`	`1.9.17-13.p2.el10`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1ad18b85cb50b0973d5c16643dcac344cb226beb98e465e154e715f276eb04d3

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1ad18b85cb50b0973d5c16643dcac344cb226beb98e465e154e715f276eb04d3

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1ad18b85cb50b0973d5c16643dcac344cb226beb98e465e154e715f276eb04d3 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1ad18b85cb50b0973d5c16643dcac344cb226beb98e465e154e715f276eb04d3 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261011'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1ad18b85cb50b0973d5c16643dcac344cb226beb98e465e154e715f276eb04d3 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261010: LTS

github-actions released this 10 Oct 04:10

stable-20261010

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:a5a24759d843`
`bluefin-lts-nvidia`	`:stable`	`sha256:60b52d769a34`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

3 updated since the previous release. 1566 packages total.

Package changes

↑ 3 updated packages

Package	From	To
`openssh`	`9.9p1-32.el10`	`9.9p1-33.el10`
`openssh-clients`	`9.9p1-32.el10`	`9.9p1-33.el10`
`openssh-server`	`9.9p1-32.el10`	`9.9p1-33.el10`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a5a24759d84348bc096c666d0c9bdfc49e7a0423db126e25128e0142570818e7

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a5a24759d84348bc096c666d0c9bdfc49e7a0423db126e25128e0142570818e7

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a5a24759d84348bc096c666d0c9bdfc49e7a0423db126e25128e0142570818e7 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a5a24759d84348bc096c666d0c9bdfc49e7a0423db126e25128e0142570818e7 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261010'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:a5a24759d84348bc096c666d0c9bdfc49e7a0423db126e25128e0142570818e7 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261009: LTS

github-actions released this 09 Oct 04:10

stable-20261009

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:006bdf07f94d`
`bluefin-lts-nvidia`	`:stable`	`sha256:1c1520ed729c`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

1 updated since the previous release. 1566 packages total.

Package changes

↑ 1 updated packages

Package	From	To
`sos`	`4.11.2-5.el10`	`4.11.2-6.el10`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:006bdf07f94d264a01655861ef2d3412b4010f0b5125a8496e3243867e87eea4

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:006bdf07f94d264a01655861ef2d3412b4010f0b5125a8496e3243867e87eea4

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:006bdf07f94d264a01655861ef2d3412b4010f0b5125a8496e3243867e87eea4 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:006bdf07f94d264a01655861ef2d3412b4010f0b5125a8496e3243867e87eea4 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261009'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:006bdf07f94d264a01655861ef2d3412b4010f0b5125a8496e3243867e87eea4 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261008: LTS

github-actions released this 08 Oct 04:11

stable-20261008

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:0338d7be5c0f`
`bluefin-lts-nvidia`	`:stable`	`sha256:45456f1c43ca`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

28 updated since the previous release. 1566 packages total.

Package changes

↑ 28 updated packages

Package	From	To
`c-ares`	`1.34.6-4.el10`	`1.34.8-1.el10`
`gnome-remote-desktop`	`49.3-12.el10`	`49.3-13.el10`
`gtk-update-icon-cache`	`3.24.43-5.el10`	`3.24.52-1.el10`
`gtk3`	`3.24.43-5.el10`	`3.24.52-1.el10`
`insights-core`	`3.8.1-1.el10`	`3.8.2-1.el10`
`insights-core-selinux`	`3.8.1-1.el10`	`3.8.2-1.el10`
`kernel-headers`	`6.12.0-271.el10`	`6.12.0-273.el10`
`kernel-tools`	`6.12.0-271.el10`	`6.12.0-273.el10`
`kernel-tools-libs`	`6.12.0-271.el10`	`6.12.0-273.el10`
`libsolv`	`0.7.33-6.el10`	`0.7.33-7.el10`
`mdadm`	`4.4-5.el10.1`	`4.6-1.el10`
`nvme-cli`	`2.16-2.el10`	`2.16-3.el10`
`pcre2`	`10.44-1.el10.3`	`10.44-1.4.el10`
`pcre2-syntax`	`10.44-1.el10.3`	`10.44-1.4.el10`
`pcre2-utf16`	`10.44-1.el10.3`	`10.44-1.4.el10`
`pcre2-utf32`	`10.44-1.el10.3`	`10.44-1.4.el10`
`pipewire`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-alsa`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-gstreamer`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-jack-audio-connection-kit`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-jack-audio-connection-kit-libs`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-libs`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-plugin-libcamera`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-pulseaudio`	`1.6.1-100.el10`	`1.6.9-1.el10`
`pipewire-utils`	`1.6.1-100.el10`	`1.6.9-1.el10`
`python3-perf`	`6.12.0-271.el10`	`6.12.0-273.el10`
`tailscale`	`1.102.5-1`	`1.104.1-1`
`tzdata`	`2026c-1.el10`	`2026e-1.el10`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:0338d7be5c0fcb72072ef3f43666508703307b78005e783cc29e5e9987e4f993

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:0338d7be5c0fcb72072ef3f43666508703307b78005e783cc29e5e9987e4f993

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:0338d7be5c0fcb72072ef3f43666508703307b78005e783cc29e5e9987e4f993 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:0338d7be5c0fcb72072ef3f43666508703307b78005e783cc29e5e9987e4f993 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261008'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:0338d7be5c0fcb72072ef3f43666508703307b78005e783cc29e5e9987e4f993 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261007: LTS

github-actions released this 07 Oct 04:09

stable-20261007

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:72856c32e671`
`bluefin-lts-nvidia`	`:stable`	`sha256:b7c62701087e`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

1 updated since the previous release. 1566 packages total.

Package changes

↑ 1 updated packages

Package	From	To
`tailscale`	`1.102.4-1`	`1.102.5-1`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:72856c32e671e9ec09c5b99bdb0e4fe7dec186bdcae90533108b3b6c04657000

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:72856c32e671e9ec09c5b99bdb0e4fe7dec186bdcae90533108b3b6c04657000

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:72856c32e671e9ec09c5b99bdb0e4fe7dec186bdcae90533108b3b6c04657000 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:72856c32e671e9ec09c5b99bdb0e4fe7dec186bdcae90533108b3b6c04657000 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261007'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:72856c32e671e9ec09c5b99bdb0e4fe7dec186bdcae90533108b3b6c04657000 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261006: LTS

github-actions released this 06 Oct 04:10

stable-20261006

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:de624276a0fd`
`bluefin-lts-nvidia`	`:stable`	`sha256:97be37f12d8a`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

no package changes since the previous release. 1566 packages total.

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:de624276a0fd9b25d43b89fa6e591625ff5a633a61ee30402eb8c3d11ee26ec4

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:de624276a0fd9b25d43b89fa6e591625ff5a633a61ee30402eb8c3d11ee26ec4

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:de624276a0fd9b25d43b89fa6e591625ff5a633a61ee30402eb8c3d11ee26ec4 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:de624276a0fd9b25d43b89fa6e591625ff5a633a61ee30402eb8c3d11ee26ec4 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261006'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:de624276a0fd9b25d43b89fa6e591625ff5a633a61ee30402eb8c3d11ee26ec4 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261005: LTS

github-actions released this 05 Oct 04:14

stable-20261005

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:1502f240cf1a`
`bluefin-lts-nvidia`	`:stable`	`sha256:d7e4fcbad570`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

no package changes since the previous release. 1566 packages total.

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1502f240cf1a366ee9b5289e072bd4c6cc098c9cb6a8395d384d5e14d5802761

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1502f240cf1a366ee9b5289e072bd4c6cc098c9cb6a8395d384d5e14d5802761

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1502f240cf1a366ee9b5289e072bd4c6cc098c9cb6a8395d384d5e14d5802761 \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1502f240cf1a366ee9b5289e072bd4c6cc098c9cb6a8395d384d5e14d5802761 \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261005'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:1502f240cf1a366ee9b5289e072bd4c6cc098c9cb6a8395d384d5e14d5802761 \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

stable-20261004: LTS

github-actions released this 04 Oct 05:23

stable-20261004

2170146

Variants promoted

Variant	Tag	Digest
`bluefin-lts`	`:stable`	`sha256:083e6fb643d8`
`bluefin-lts-nvidia`	`:stable`	`sha256:93c07217a44e`

bluefin-lts and bluefin-lts-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.

Key components

Component	Version	Change
Kernel (LTS)	`7.1.8-200`
GNOME Shell	`50.0-3.el10`
Flatpak	`1.18.0-2.el10`
bootc	`1.16.13-1.el10`

1 updated since the previous release. 1566 packages total.

Package changes

↑ 1 updated packages

Package	From	To
`libaom`	`3.13.1-1.el10_2`	`3.13.3-1.el10_3`

Desktop Screenshot

Captured from bluefin-lts:testing during automated e2e validation — testsuite

Supply chain verification

Supply chain

This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.

Tools required — install via Homebrew or see links in each section:

brew install cosign oras slsa-verifier

1 — Verify the image signature

cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.

cosign verify \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:083e6fb643d8b075e8d6c6580185b5e7a12bff1f642bf6377f2ab14e7be3e38b

A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.

2 — Fetch and inspect the SBOM

The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).

# Discover the attached SBOM referrer
oras discover \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@sha256:083e6fb643d8b075e8d6c6580185b5e7a12bff1f642bf6377f2ab14e7be3e38b

# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
  --artifact-type application/vnd.spdx+json \
  ghcr.io/projectbluefin/bluefin-lts@<SBOM_DIGEST>

The SBOM is also attached to this release as
bluefin-lts.spdx.json.

3 — Verify the SBOM attestation

The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.

cosign verify-attestation \
  --type https://spdx.dev/Document \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:083e6fb643d8b075e8d6c6580185b5e7a12bff1f642bf6377f2ab14e7be3e38b \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

4 — Verify SLSA Build L2 provenance

slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.

slsa-verifier verify-image \
  ghcr.io/projectbluefin/bluefin-lts@sha256:083e6fb643d8b075e8d6c6580185b5e7a12bff1f642bf6377f2ab14e7be3e38b \
  --source-uri 'github.com/projectbluefin/bluefin-lts' \
  --source-versioned-tag 'stable-20261004'

You can also inspect the raw provenance:

cosign verify-attestation \
  --type slsaprovenance1 \
  --certificate-identity-regexp '^https://github\.com/projectbluefin/(bluefin-lts|actions|execute-release)/\.github/workflows/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/projectbluefin/bluefin-lts@sha256:083e6fb643d8b075e8d6c6580185b5e7a12bff1f642bf6377f2ab14e7be3e38b \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Full changelog and verification guide → https://docs.projectbluefin.io/changelogs

Full changelog → https://docs.projectbluefin.io/changelogs

Assets 5

Releases: thallium-suite/uranium

Release list

stable-20261015: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261012: LTS

Variants promoted

Key components

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261011: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261010: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261009: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261008: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261007: LTS

Variants promoted

Key components

Package changes

Desktop Screenshot

Supply chain

1 — Verify the image signature

2 — Fetch and inspect the SBOM

3 — Verify the SBOM attestation

4 — Verify SLSA Build L2 provenance

Uh oh!

stable-20261006: LTS

Variants promoted