Skip to content

fix(images): refresh trixie package pins #11634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
prekshivyas merged 7 commits into from
Sep 12, 2026
+274 −58
Merged

fix(images): refresh trixie package pins #11634

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c4823b8
fix(images): refresh trixie curl pin
prekshivyas Sep 12, 2026
4a35608
fix(images): refresh remaining trixie pins
prekshivyas Sep 12, 2026
be41d58
chore(images): refresh Pi qualification receipts
prekshivyas Sep 12, 2026
75a783d
fix(hermes): accept published security package
prekshivyas Sep 12, 2026
76e75f6
test(images): cover refreshed package inputs
prekshivyas Sep 12, 2026
8c582c1
test(images): execute staging dependency overlay
prekshivyas Sep 12, 2026
38f3d2b
test(images): bind package harness path
prekshivyas Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/managed-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@ jobs:
staging_root="$GITHUB_WORKSPACE/staging-qa-base-source"
for relative in \
agents/langchain-deepagents-code/Dockerfile.base \
scripts/security/build-native-security-packages.sh \
agents/langchain-deepagents-code/requirements.lock
do
source_file="$candidate_root/$relative"
Expand Down
6 changes: 3 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,7 +734,7 @@ RUN set -eu; \
apt-get install -y --no-install-recommends procps=2:4.0.4-9; \
fi; \
if [ "$needs_chattr" = "1" ]; then \
apt-get install -y --no-install-recommends e2fsprogs=1.47.2-3+b11; \
apt-get install -y --no-install-recommends e2fsprogs=1.47.2-3+b12; \
fi; \
if [ "$needs_tmux" = "1" ]; then \
apt-get install -y --no-install-recommends tmux=3.5a-3; \
Expand Down Expand Up @@ -2428,7 +2428,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
"libevent-core-2.1-7t64=2.1.13-stable-1" \
Expand All @@ -2441,7 +2441,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' libevent-core-2.1-7t64)" = "2.1.13-stable-1"; \
Expand Down
12 changes: 6 additions & 6 deletions Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ FROM node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada75
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -119,18 +119,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
gnupg=2.4.7-21+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
Comment thread
coderabbitai[bot] marked this conversation as resolved.
"dos2unix=7.5.2-1*" \
libonig5=6.9.9-1+b1 \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -219,7 +219,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' perl)" = "$perl_version_before" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
Expand All @@ -246,7 +246,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
&& chown root:root /usr/local/share/nemoclaw/security-packages.txt \
&& chmod 0644 /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
8 changes: 6 additions & 2 deletions agents/hermes/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1713,6 +1713,11 @@ RUN check_metadata() { \
RUN set -eu; \
security_inventory=/usr/local/share/nemoclaw/security-packages.txt; \
arch="$(dpkg --print-architecture)"; \
python_fix_version="$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)"; \
case "$python_fix_version" in \
3.13.5-2+deb13u4+nemoclaw1|3.13.5-2+deb13u5+nemoclaw1) ;; \
*) echo "ERROR: unexpected patched Python package version: $python_fix_version" >&2; exit 1 ;; \
esac; \
test -f "$security_inventory"; \
test ! -L "$security_inventory"; \
test "$(stat -c '%u:%g:%a' "$security_inventory")" = "0:0:444"; \
Expand All @@ -1726,7 +1731,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=$python_fix_version" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -1738,7 +1743,6 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
14 changes: 7 additions & 7 deletions agents/hermes/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ FROM node:24-trixie-slim@sha256:05c08ce4291e9a58f59456a7985176defb12cdd42271f35f
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -96,20 +96,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
gnupg=2.4.7-21+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
socat=1.8.0.3-1 \
socat=1.8.0.3-1+deb13u1 \
"dos2unix=7.5.2-1*" \
&& arch="$(dpkg --print-architecture)" \
&& case "$arch" in \
Expand Down Expand Up @@ -189,7 +189,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -224,7 +224,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
4 changes: 2 additions & 2 deletions agents/langchain-deepagents-code/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,7 +415,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -427,7 +427,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
12 changes: 6 additions & 6 deletions agents/langchain-deepagents-code/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ ARG NEMOCLAW_CORPORATE_CA_B64
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -87,17 +87,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
python3-pip=25.1.1+dfsg-1 \
python3-venv=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
"dos2unix=7.5.2-1*" \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
ripgrep=14.1.1-1+b4 \
Expand Down Expand Up @@ -191,7 +191,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -226,7 +226,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
4 changes: 2 additions & 2 deletions agents/pi/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ RUN set -eu; \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
| cmp -s - "$security_inventory"; \
Expand All @@ -288,7 +288,7 @@ RUN set -eu; \
test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1"; \
test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2"; \
test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl-base)" = "5.44.0-1nemoclaw1"; \
test "$(dpkg-query -W -f='${Version}' perl)" = "5.44.0-1nemoclaw1"; \
test "$(perl -e 'print $^V')" = "v5.44.0"; \
Expand Down
12 changes: 6 additions & 6 deletions agents/pi/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ ARG NEMOCLAW_CORPORATE_CA_B64
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential=12.12 \
ca-certificates=20250419 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
libssl-dev=3.5.7-1~deb13u2 \
openssh-server=1:10.0p1-7+deb13u4 \
Expand Down Expand Up @@ -91,17 +91,17 @@ ENV DEBIAN_FRONTEND=noninteractive \
# hadolint ignore=DL3001,DL4006
RUN apt-get update && apt-get install -y --no-install-recommends \
python3=3.13.5-1 \
curl=8.14.1-2+deb13u4 \
curl=8.14.1-2+deb13u5 \
git=1:2.47.3-0+deb13u1 \
ca-certificates=20250419 \
iproute2=6.15.0-1 \
iptables=1.8.11-2 \
nftables=1.1.3-1 \
libcap2-bin=1:2.75-10+deb13u1+b1 \
libcap2-bin=1:2.75-10+deb13u1+b3 \
libssl3t64=3.5.7-1~deb13u2 \
util-linux=2.41-5 \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
e2fsprogs=1.47.2-3+b12 \
"dos2unix=7.5.2-1*" \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
ripgrep=14.1.1-1+b4 \
Expand Down Expand Up @@ -195,7 +195,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
&& test "$(dpkg-query -W -f='${Version}' vim-tiny)" = "2:9.2.0858-1" \
&& test "$(dpkg-query -W -f='${Version}' libssh2-1t64)" = "1.11.1-1+deb13u1+nemoclaw2" \
&& test "$(dpkg-query -W -f='${Version}' libssl3t64)" = "3.5.7-1~deb13u2" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u4+nemoclaw1" \
&& test "$(dpkg-query -W -f='${Version}' nemoclaw-python3.13-htmlparser-fix)" = "3.13.5-2+deb13u5+nemoclaw1" \
&& test "$(jq --version)" = "jq-1.8.2" \
&& ldd /usr/bin/jq | grep -Eq 'libonig[.]so[.]5' \
&& printf '%s\n' '{"sandbox":"healthy"}' | jq -e '.sandbox == "healthy"' >/dev/null \
Expand Down Expand Up @@ -230,7 +230,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
"vim-tiny=2:9.2.0858-1" \
"libssh2-1t64=1.11.1-1+deb13u1+nemoclaw2" \
"libssl3t64=3.5.7-1~deb13u2" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u4+nemoclaw1" \
"nemoclaw-python3.13-htmlparser-fix=3.13.5-2+deb13u5+nemoclaw1" \
"perl-base=5.44.0-1nemoclaw1" \
"perl=5.44.0-1nemoclaw1" \
> /usr/local/share/nemoclaw/security-packages.txt \
Expand Down
8 changes: 4 additions & 4 deletions ci/pi-agent-qualification-v1-linux-amd64.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
"agent": "pi",
"platform": "linux/amd64",
"image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
"digest": "sha256:943605332e2f14ae41af8a665eeaebcf281e85a91c41219ef5f9f12294ab5eba",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:943605332e2f14ae41af8a665eeaebcf281e85a91c41219ef5f9f12294ab5eba",
"digest": "sha256:838dcc19764788aa7963183e14a063380fc4f03b9e6813b677473e64768296d0",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:838dcc19764788aa7963183e14a063380fc4f03b9e6813b677473e64768296d0",
"source": {
"repository": "NVIDIA/NemoClaw",
"revision": "322bd36725ed1c6b2d5993fb2e1a727591ccdf90",
"revision": "4a3560862a8262abe087b6e94431b03e825ba965",
"release": "v0.1.0",
"cohort": "ghrun-34634582790-1"
"cohort": "ghrun-34717583242-1"
},
"startupProfileContractVersion": 1,
"capabilityContractVersion": 1
Expand Down
8 changes: 4 additions & 4 deletions ci/pi-agent-qualification-v1-linux-arm64.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
"agent": "pi",
"platform": "linux/arm64",
"image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
"digest": "sha256:5c10876276dd9c4492925a0a68efb0b447a6d390076110cf6bd883ab7d44c5cd",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:5c10876276dd9c4492925a0a68efb0b447a6d390076110cf6bd883ab7d44c5cd",
"digest": "sha256:45ea8e84013f63437e4aff87e6c82818d726eb3401d786fb9ede6c208df868aa",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:45ea8e84013f63437e4aff87e6c82818d726eb3401d786fb9ede6c208df868aa",
"source": {
"repository": "NVIDIA/NemoClaw",
"revision": "322bd36725ed1c6b2d5993fb2e1a727591ccdf90",
"revision": "4a3560862a8262abe087b6e94431b03e825ba965",
"release": "v0.1.0",
"cohort": "ghrun-34634582790-1"
"cohort": "ghrun-34717583242-1"
},
"startupProfileContractVersion": 1,
"capabilityContractVersion": 1
Expand Down
8 changes: 4 additions & 4 deletions scripts/security/build-native-security-packages.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ readonly LIBSSH2_VERSION="1.11.1"
readonly LIBSSH2_DEBIAN_VERSION="1.11.1-1+deb13u1"
readonly LIBSSH2_PACKAGE_VERSION="${LIBSSH2_DEBIAN_VERSION}+nemoclaw2"
readonly LIBSSH2_SOURCE_SHA256="9954cb54c4f548198a7cbebad248bdc87dd64bd26185708a294b2b50771e3769"
readonly PYTHON_DEBIAN_VERSION="3.13.5-2+deb13u4"
readonly PYTHON_DEBIAN_VERSION="3.13.5-2+deb13u5"
readonly PYTHON_FIX_VERSION="${PYTHON_DEBIAN_VERSION}+nemoclaw1"
readonly PYTHON_PARSER_SHA256="f91ec3de6331206bbe2ec3e54a05f646bd23d3c61a18d4a01b25164e070bacc9"
readonly PYTHON_PARSER_FIXED_SHA256="4ff43a8578bda2f14686c67911b64c18e869841973722b1c623b5727491bdaf7"
Expand Down Expand Up @@ -244,10 +244,10 @@ build_python_fix_package() {

case "${architecture}" in
amd64)
original_sha256="0def2d972310b59704ad119abee5a97f95409e14ff1359edd8cc7b8892cfd43f"
original_sha256="db161322a3481d2c0c3b9a3b9a03c3ab0e2b1718f54b88755fb4a3f939165b84"
;;
arm64)
original_sha256="37cce6086b7c1ca93086f83b68761737607689e634693b6972b5dbfd6c080872"
original_sha256="d1178d24e4d143cc6c577d9dc0f26dd982efccc2e600d25ce86361f168a22be0"
;;
*)
printf 'Unsupported architecture: %s\n' "${architecture}" >&2
Expand All @@ -256,7 +256,7 @@ build_python_fix_package() {
esac

download \
"${DEBIAN_SNAPSHOT_URL}/p/python3.13/libpython3.13-stdlib_${PYTHON_DEBIAN_VERSION}_${architecture}.deb" \
"https://snapshot.debian.org/archive/debian/20260906T023042Z/pool/main/p/python3.13/libpython3.13-stdlib_${PYTHON_DEBIAN_VERSION}_${architecture}.deb" \
"${original_deb}"
verify_sha256 "${original_sha256}" "${original_deb}"
dpkg-deb -x "${original_deb}" "${original_root}"
Expand Down
4 changes: 2 additions & 2 deletions src/lib/agent/candidate-authority.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ export const CANDIDATE_QUALIFICATION_RECEIPT_DIGESTS: Readonly<
Record<CandidateManagedImageAgent, readonly string[]>
> = Object.freeze({
pi: Object.freeze([
"f3f3dd129db2cd0902a0072336f871979c72324fcd8296ad9c1e226e27b1c052",
"d9a727ce41822cb95250459f01bcc75b7105bf76d24f259fbbfff5521cda4b94",
"2cf8ffed471002b66923742a887dab3c7a86573f0caf806f827bd202fa671f26",
"c9150fb26ee656d7f5241be22e07de0f09cb1dc028494746f8e7ec3a4a19997b",
]),
});

Expand Down
Loading
Loading