This repository was archived by the owner on Oct 24, 2026. It is now read-only.
Repository navigation
·
2 commits
to main
since this release
Variants promoted
| Variant | Tag | Digest |
|---|---|---|
uranium |
:stable |
sha256:526f0b586ceb |
uranium-nvidia |
:stable |
sha256:6b43ea01fe10 |
uranium and uranium-nvidia use the Fedora CoreOS stable kernel. The Kernel (LTS) version above applies to both.
Key components
| Component | Version | Change |
|---|---|---|
| Kernel (LTS) | 7.1.8-200 |
|
| GNOME Shell | 50.0-3.el10 |
|
| Flatpak | 1.18.0-2.el10 |
|
| bootc | 1.16.13-1.el10 |
49 updated, 2 added, 1 removed since the previous release. 1567 packages total.
Package changes
↑ 49 updated packages
| Package | From | To |
|---|---|---|
ffmpeg |
7.1.5-3.el10 |
7.1.5-4.el10 |
freerdp-libs |
3.28.0-4.el10 |
3.28.0-6.el10 |
gnome-remote-desktop |
49.3-13.el10 |
49.3-16.el10 |
gvfs |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-client |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-fuse |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-goa |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-gphoto2 |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-mtp |
1.54.4-5.el10 |
1.54.4-6.el10 |
gvfs-smb |
1.54.4-5.el10 |
1.54.4-6.el10 |
intel-vsc-firmware |
20260812-26.el10 |
20260812-27.el10 |
iwlwifi-dvm-firmware |
20260812-26.el10 |
20260812-27.el10 |
iwlwifi-mvm-firmware |
20260812-26.el10 |
20260812-27.el10 |
kernel-headers |
6.12.0-273.el10 |
6.12.0-275.el10 |
kernel-tools |
6.12.0-273.el10 |
6.12.0-275.el10 |
kernel-tools-libs |
6.12.0-273.el10 |
6.12.0-275.el10 |
libavcodec |
7.1.5-3.el10 |
7.1.5-4.el10 |
libavdevice |
7.1.5-3.el10 |
7.1.5-4.el10 |
libavfilter |
7.1.5-3.el10 |
7.1.5-4.el10 |
libavformat |
7.1.5-3.el10 |
7.1.5-4.el10 |
libavutil |
7.1.5-3.el10 |
7.1.5-4.el10 |
libertas-firmware |
20260812-26.el10 |
20260812-27.el10 |
libpcap |
1.10.4-7.el10 |
1.10.4-8.el10 |
libpostproc |
7.1.5-3.el10 |
7.1.5-4.el10 |
librabbitmq |
0.14.0-3.el10 |
0.14.0-3.el10.1 |
libsoup3 |
3.6.6-1.el10 |
3.8.0-1.el10 |
libswresample |
7.1.5-3.el10 |
7.1.5-4.el10 |
libswscale |
7.1.5-3.el10 |
7.1.5-4.el10 |
libwinpr |
3.28.0-4.el10 |
3.28.0-6.el10 |
lshw |
B.02.20-9.el10 |
B.02.20-10.el10 |
netronome-firmware |
20260812-26.el10 |
20260812-27.el10 |
openblas |
0.3.33-1.el10 |
0.3.33-2.el10 |
openblas-serial |
0.3.33-1.el10 |
0.3.33-2.el10 |
openexr-libs |
3.1.10-13.el10 |
3.1.10-14.el10 |
parted |
3.6-7.el10 |
3.6-8.el10 |
python3-perf |
6.12.0-273.el10 |
6.12.0-275.el10 |
python3.14 |
3.14.7-2.el10 |
3.14.8-1.el10 |
python3.14-libs |
3.14.7-2.el10 |
3.14.8-1.el10 |
qemu-guest-agent |
10.1.0-28.el10 |
11.1.0-1.el10 |
vim-common |
9.1.083-23.el10 |
9.1.083-24.el10 |
vim-data |
9.1.083-23.el10 |
9.1.083-24.el10 |
vim-enhanced |
9.1.083-23.el10 |
9.1.083-24.el10 |
vim-filesystem |
9.1.083-23.el10 |
9.1.083-24.el10 |
vim-minimal |
9.1.083-23.el10 |
9.1.083-24.el10 |
wireplumber |
0.5.10-1.el10 |
0.5.18-2.el10 |
wireplumber-libs |
0.5.10-1.el10 |
0.5.18-2.el10 |
xevd-libs |
0.7.0-2.el10 |
0.8.0-1.el10 |
xeve-libs |
0.7.0-2.el10 |
0.7.1-1.el10 |
xxd |
9.1.083-23.el10 |
9.1.083-24.el10 |
+ 2 added packages
| Package | Version |
|---|---|
ghcr.io/thallium-suite/uranium |
stable |
plymouth-plugin-script |
24.004.60-17.el10 |
− 1 removed packages
| Package | Last version |
|---|---|
ghcr.io/projectbluefin/bluefin-lts |
stable |
Merged since last release
Features
- feat(factory): build and verify GNOME 51 on CentOS Stream 10 (#709)
- feat: add Uranium fastfetch and plymouth theme overrides (#728)
Fixes
- fix: updated all three pinned image digests in image-versions.yaml to match the validated combination on the testing branch (#723)
- fix: factory publish and malcontent (#727)
- fix: plymouth script module (#730)
- fix: plymouth script module (#731)
- fix: plymouth aarch64 libdir (#732)
- fix: plymouth aarch64 libdir v2 (#733)
- fix: ModuleName=script in uranium.plymouth, which requires script.so from the plymouth-plugin-script package. That package was never in the install list — only plymouth, plymouth-scripts, and plymouth-system-theme were installed (#734)
- fix(factory): chown repodata after createrepo_c before cosign sign-blob (#735)
- fix(build): pass certificate-identity-regexp for thallium-suite cosign verify (#736)
Other Changes
Desktop Screenshot
Captured from uranium:testing during automated e2e validation — testsuite
Supply chain verification
Supply chain
This image is signed, attested, and ships a full SPDX-JSON SBOM.
Every artifact below is verifiable without trusting this release page.
Tools required — install via Homebrew or see links in each section:
brew install cosign oras slsa-verifier1 — Verify the image signature
cosign (Sigstore) verifies the keyless
OIDC signature created by GitHub Actions at build time.
cosign verify \
--certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5A valid response lists the certificate subject and OIDC issuer. Any tampered
image will produce a verification error.
2 — Fetch and inspect the SBOM
The SBOM (SPDX 2.3 JSON) is attached to the image as an
OCI referrer using
ORAS (CNCF graduated project).
# Discover the attached SBOM referrer
oras discover \
--artifact-type application/vnd.spdx+json \
ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5
# Pull the SBOM to disk (replace SBOM_DIGEST with the digest from above)
oras pull \
--artifact-type application/vnd.spdx+json \
ghcr.io/thallium-suite/uranium@<SBOM_DIGEST>The SBOM is also attached to this release as
uranium.spdx.json.
3 — Verify the SBOM attestation
The SBOM is also stored as a signed
GitHub SBOM attestation
in the Sigstore transparency log.
cosign verify-attestation \
--type https://spdx.dev/Document \
--certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
| jq -r '.payload | @base64d | fromjson | .predicate.name'4 — Verify SLSA Build L2 provenance
slsa-verifier (OpenSSF)
checks that this image was built by the expected workflow on the expected
source repository — not on a developer's laptop or a forked CI runner.
slsa-verifier verify-image \
ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
--source-uri 'github.com/thallium-suite/uranium' \
--source-versioned-tag 'stable-20261015'You can also inspect the raw provenance:
cosign verify-attestation \
--type slsaprovenance1 \
--certificate-identity-regexp '^https://github\.com/thallium-suite/uranium/\.github/workflows/' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
ghcr.io/thallium-suite/uranium@sha256:526f0b586ceb8eb928db284d332bee72c6323b11086dfdea9f236defbeb37ff5 \
| jq -r '.payload | @base64d | fromjson | .predicate'Full changelog and verification guide → https://github.com/thallium-suite/uranium/releases
Full changelog → https://github.com/thallium-suite/uranium/releases