feat: update various extensions

Updated Gvisor, Kata-containers, crun, Glib, Glibc, libseccomp, Open-iSCSI, mdadm, ecr-credential-provider, qemu-guest-agent, tailscale, as well as pkgs and wolfi-base base images Move all hashes to vars for easier updates Use tools instead of base Remove dependency on packages which are in tools Signed-off-by: Dmitrii Sharshakov <[email protected]>
siderolabs · Feb 25, 2025 · 8a5b3b8 · 8a5b3b8
1 parent 8732ec1
commit 8a5b3b8
Show file tree

Hide file tree

Showing 68 changed files with 262 additions and 402 deletions.
diff --git a/.kres.yaml b/.kres.yaml
@@ -62,14 +62,20 @@ spec:
     - TAG
     - PKGS
     - PKGS_PREFIX
+    - TOOLS
+    - TOOLS_PREFIX
   makefile:
     extraVariables:
       - name: EXTENSIONS_IMAGE_REF
         defaultValue: $(REGISTRY_AND_USERNAME)/extensions:$(TAG)
       - name: PKGS
-        defaultValue: v1.10.0-alpha.0-40-ge1f11f0
+        defaultValue: v1.10.0-alpha.0-46-gcc5317a
       - name: PKGS_PREFIX
         defaultValue: ghcr.io/siderolabs
+      - name: TOOLS
+        defaultValue: v1.10.0-alpha.0-17-g6a71711
+      - name: TOOLS_PREFIX
+        defaultValue: ghcr.io/siderolabs
   useBldrPkgTagResolver: true
 ---
 kind: common.Build

diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-02-20T20:33:13Z by kres 8a48729.
+# Generated on 2025-02-25T07:49:52Z by kres 1281806.
 
 # common variables
 
@@ -44,12 +44,16 @@ COMMON_ARGS += --build-arg=SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH)
 COMMON_ARGS += --build-arg=TAG="$(TAG)"
 COMMON_ARGS += --build-arg=PKGS="$(PKGS)"
 COMMON_ARGS += --build-arg=PKGS_PREFIX="$(PKGS_PREFIX)"
+COMMON_ARGS += --build-arg=TOOLS="$(TOOLS)"
+COMMON_ARGS += --build-arg=TOOLS_PREFIX="$(TOOLS_PREFIX)"
 
 # extra variables
 
 EXTENSIONS_IMAGE_REF ?= $(REGISTRY_AND_USERNAME)/extensions:$(TAG)
-PKGS ?= v1.10.0-alpha.0-40-ge1f11f0
+PKGS ?= v1.10.0-alpha.0-44-g7774b08
 PKGS_PREFIX ?= ghcr.io/siderolabs
+TOOLS ?= v1.10.0-alpha.0-17-g6a71711
+TOOLS_PREFIX ?= ghcr.io/siderolabs
 
 # targets defines all the available targets
 

diff --git a/Pkgfile b/Pkgfile
@@ -6,14 +6,24 @@ vars:
   LINUX_FIRMWARE_VERSION: "20250211" # update this when updating PKGS_VERSION in Makefile
   DRBD_DRIVER_VERSION: 9.2.12 # update this when updating PKGS_VERSION in Makefile
   ZFS_DRIVER_VERSION: 2.3.0 # update this when updating PKGS_VERSION in Makefile
+  ZFS_TOOLS_SHA256: 6e8787eab55f24c6b9c317f3fe9b0da9a665eb34c31df88ff368d9a92e9356a6
+  ZFS_TOOLS_SHA512: f0bb1c6e28b325765be809dbc5d38ba294daa38b54eafd7d129cf6081fb209b200580437019faeed3614bbb0687d6583698a9282f3275905a1f5a8314a66cf0b
   UTIL_LINUX_VERSION: 2.40.4 # update this when updating PKGS_VERSION in Makefile
+  UTIL_LINUX_SHA256: 5c1daf733b04e9859afdc3bd87cc481180ee0f88b5c0946b16fdec931975fb79
+  UTIL_LINUX_SHA512: 0024955056ba7b4c54040a917f9919f49692e57ba6d42d17a6c29c1eefe88bf48b1214a545072b71c468829a63a8f15237f49733e9127c134e11126d1e435124
 
   # renovate: datasource=git-tags extractVersion=^libtiprc-(?<version>.*)$ depName=git://linux-nfs.org/~steved/libtirpc
   LIBTIRPC_VERSION: 1-3-3
+  LIBTIRPC_SHA256: 6474e98851d9f6f33871957ddee9714fdcd9d8a5ee9abb5a98d63ea2e60e12f3
+  LIBTIRPC_SHA512: df0781a74ff9ded2d3c4f5eb7e05496b9f58eac8060c02c68331dc14c4a00304dcd19f46836f5756fe0d9d27095fd463d42dd696fcdff891516711b7d63deabe
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=madler/zlib
   ZLIB_VERSION: 1.3.1
+  ZLIB_SHA256: 9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23
+  ZLIB_SHA512: 580677aad97093829090d4b605ac81c50327e74a6c2de0b85dd2e8525553f3ddde17556ea46f8f007f89e435493c9a20bc997d1ef1c1c2c23274528e3c46b94f
   # renovate: datasource=github-tags depName=OpenELEC/dvb-firmware
   LINUX_DVB_FIRMWARE: 0.0.51
+  LINUX_DVB_FIRMWARE_SHA256: cef3ce537d213e020af794cecf9de207e2882c375ceda39102eb6fa2580bad8d
+  LINUX_DVB_FIRMWARE_SHA512: 2372dba98083c76865f5f0f8101b1160888e03cdbe911dd08621e7b6f38e8a25ae5d56eefc21728bf65fd09ea613b53606df4021d3972b0bc9d2bd8b6cbe20a1
 
 labels:
   org.opencontainers.image.source: https://github.com/siderolabs/extensions
diff --git a/container-runtime/crun/pkg.yaml b/container-runtime/crun/pkg.yaml
@@ -8,13 +8,13 @@ steps:
       # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containers/crun/releases/download/{{ .CRUN_VERSION }}/crun-{{ .CRUN_VERSION }}-linux-arm64-disable-systemd
         destination: crun
-        sha256: 19fa0707056b9672c1c8b31049861a97ccf7bb7e85836edcd71c7f9c63656214
-        sha512: dd1012431a74184da6af51f2563662d4e459258330d821a31961d27d728782b4881b90c91401bab541ba69f2b0e2868f5e2d29606a2edc4561615045ae06d700
+        sha256: {{ .CRUN_ARM64_SHA256 }}
+        sha512: {{ .CRUN_ARM64_SHA512 }}
       # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containers/crun/releases/download/{{ .CRUN_VERSION }}/crun-{{ .CRUN_VERSION }}-linux-amd64-disable-systemd
         destination: crun
-        sha256: 17c22b5d941b7072739dd859a69b4038a6cd3c94d30cf093746ba059fcbdbf76
-        sha512: 4a95f0db65f9d8eb05d3959511432c80da77f0f7bf4c52b88f41a28ab86d375a920afaee9cf75718522bf69616ff192371b0b7d71f333b4ca9a7b75d63d49670
+        sha256: {{ .CRUN_AMD64_SHA256 }}
+        sha512: {{ .CRUN_AMD64_SHA512 }}
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
     prepare:
       - |

diff --git a/container-runtime/ecr-credential-provider/pkg.yaml b/container-runtime/ecr-credential-provider/pkg.yaml
@@ -5,10 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/kubernetes/cloud-provider-aws/archive/refs/tags/{{ .VERSION }}.tar.gz
+      - url: https://github.com/kubernetes/cloud-provider-aws/archive/refs/tags/{{ .CLOUD_PROVIDER_AWS_VERSION }}.tar.gz
         destination: cloud-provider-aws.tar.gz
-        sha256: 0bd75a18faab15dae7a603e1d6b57691953f1b6427f6eaa4c14e9fbfc1a75348
-        sha512: e85b0c4a79f6c087147a5868520693f7cb98a471d5497dcda27a6e341e719868f5308ccf8d9781e601ff1b52f332a0447033a096c929e768553e937e154db25e
+        sha256: {{ .CLOUD_PROVIDER_AWS_SHA256 }}
+        sha512: {{ .CLOUD_PROVIDER_AWS_SHA512 }}
     env:
       GOPATH: /tmp/go
     cachePaths:

diff --git a/container-runtime/gvisor/pkg.yaml b/container-runtime/gvisor/pkg.yaml
@@ -5,12 +5,10 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      # gvisor repo 'master' branch is Bazel-bazed, so we need to find matching commit in the "go" branch
-      # find the go-branch specific merge commit ("Merge release-... (automated)") which has the release-tagged commit as a parent
-      - url: https://github.com/google/gvisor/archive/2f1ef2228e0ca861ced3ecc562f2629d6b2aa45a.tar.gz
+      - url: https://github.com/google/gvisor/archive/{{ .GVISOR_REV }}.tar.gz
         destination: gvisor.tar.gz
-        sha256: 63419d6c5744f17f8f8229919ed2399e5e8d567735379b22f34acba2cfc8ab34
-        sha512: 567f72bbf701176e394ca5ad6ba1be8432e56d8f48344dc9561dba668536ca3132c7f9b8a19485b9518d35783b32426318def14e7ca9cc7c682ab26f1db9e293
+        sha256: {{ .GVISOR_SHA256 }}
+        sha512: {{ .GVISOR_SHA512 }}
     env:
       GOPATH: /tmp/go
     cachePaths:

diff --git a/container-runtime/kata-containers/pkg.yaml b/container-runtime/kata-containers/pkg.yaml
@@ -8,18 +8,18 @@ steps:
     # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/kata-containers/kata-containers/releases/download/{{ .KATA_CONTAINERS_VERSION }}/kata-static-{{ .KATA_CONTAINERS_VERSION }}-arm64.tar.xz
         destination: kata-static.tar.xz
-        sha256: 5437f0162e08154260c58642f433d8a9154fb6d443ca2c1ddee675154ec88c9d
-        sha512: 000cf484bd9a9a8500fcbed024b69c4337457bc3e054f6bc2bf6ca6258d8cd78c403d540729a97361ea2f0ca49de13d37078ec0e3ca6c6330003474bf5090e77
+        sha256: {{ .KATA_CONTAINERS_STATIC_ARM64_SHA256 }}
+        sha512: {{ .KATA_CONTAINERS_STATIC_ARM64_SHA512 }}
     # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/kata-containers/kata-containers/releases/download/{{ .KATA_CONTAINERS_VERSION }}/kata-static-{{ .KATA_CONTAINERS_VERSION }}-amd64.tar.xz
         destination: kata-static.tar.xz
-        sha256: 72e29c7b3ee325e0049bf694bbb843ed07c3eb0a05d89c2b3a1635241e4bafe8
-        sha512: b7ff426d4ea44053b7028bae32b3aa2a94d000c5e2bdd361ac0f144988f52e86d61eccc73bf3a6fc888b5d6c6f8db44c9a8ca0fa651bb27a7ab95818144d3b9e
+        sha256: {{ .KATA_CONTAINERS_STATIC_AMD64_SHA256 }}
+        sha512: {{ .KATA_CONTAINERS_STATIC_AMD64_SHA512 }}
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/kata-containers/kata-containers/archive/refs/tags/{{ .KATA_CONTAINERS_VERSION }}.tar.gz
         destination: kata-containers.tar.gz
-        sha256: 6567498577888f29d186d14629e7e987e8afc49ab988c72e0bc80918fe99295a
-        sha512: 54b989b1db27e56266d1e40b18d3c4f353a3f876dad358afecbba7fb7e1238da1f0856c73f627cbb24e36176f784e2a809bb1b7a990ad21644b06e7b43d64a68
+        sha256: {{ .KATA_CONTAINERS_SHA256 }}
+        sha512: {{ .KATA_CONTAINERS_SHA512 }}
     env:
       GOPATH: /tmp/go
     cachePaths:

diff --git a/container-runtime/spin/pkg.yaml b/container-runtime/spin/pkg.yaml
@@ -8,13 +8,13 @@ steps:
     # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/spinkube/containerd-shim-spin/releases/download/{{ .SPIN_VERSION }}/containerd-shim-spin-v2-linux-aarch64.tar.gz
         destination: containerd-shim-spin.tar.gz
-        sha256: bc26d30f08ebed17a9f02059d10d094b3c77a9befb421dc70dfa4ab3840809c7
-        sha512: bcd0804c6d9664110e93f73e1bc82aed5c6aea98f56a4a189201fdcca8a7d5af702b1ad88827894b7cf39ed47a818585f722ff05bc58275da33b94abb6c7b91a
+        sha256: {{ .SPIN_ARM64_SHA256 }}
+        sha512: {{ .SPIN_ARM64_SHA512 }}
     # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/spinkube/containerd-shim-spin/releases/download/{{ .SPIN_VERSION }}/containerd-shim-spin-v2-linux-x86_64.tar.gz
         destination: containerd-shim-spin.tar.gz
-        sha256: af4daf6180d897d583dc2b8e4f032269c9c9e7bc73454442fd1d659147a40f8d
-        sha512: 7665a0fc1a21ccc83f9c1d7e746a170c96ceca19ae35605d5eceae4a789a0919b89b326c94b3c75e3ca5dbb34c3756d17e71e1f5be7d352138fb654630debf33
+        sha256: {{ .SPIN_AMD64_SHA256 }}
+        sha512: {{ .SPIN_AMD64_SHA512 }}
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
     prepare:
       - |

diff --git a/container-runtime/stargz-snapshotter/pkg.yaml b/container-runtime/stargz-snapshotter/pkg.yaml
@@ -7,8 +7,8 @@ steps:
   - sources:
       - url: https://github.com/containerd/stargz-snapshotter/archive/refs/tags/{{ .STARGZ_SNAPSHOTTER_VERSION }}.tar.gz
         destination: stargz-snapshotter.tar.gz
-        sha256: 576f59d4375ac2cab24310d28e3ac98148c05dc6714649e1ec27e8d4fa8a9679
-        sha512: 3a8226e29305f55e9244017cd3063e9ba9b8b4a79a404000677e0e99a84d1337b12a37f6d1b5539c9579f54b1c118fb0ce373eb402296a18d8e55474d549986a
+        sha256: {{ .STARGZ_SNAPSHOTTER_SHA256 }}
+        sha512: {{ .STARGZ_SNAPSHOTTER_SHA512 }}
     env:
       GOPATH: /tmp/go
     cachePaths:

diff --git a/container-runtime/vars.yaml b/container-runtime/vars.yaml
@@ -1,14 +1,41 @@
 # renovate: datasource=github-tags extractVersion=^release-(?<version>.*)$ depName=google/gvisor
-GVISOR_VERSION: 20241118.0
+GVISOR_VERSION: 20250217.0
+# gvisor repo 'master' branch is Bazel-bazed, so we need to find matching commit in the "go" branch
+# find the go-branch specific merge commit ("Merge release-... (automated)") which has the release-tagged commit as a parent
+GVISOR_REV: 313350f3e69787a9930e66186acddc8477c84f03
+GVISOR_SHA256: 0dc2db553a91b519cae1f81bad571738baa48b802f285e9c0889934645aaf2fb
+GVISOR_SHA512: 0c682a014fde6f8c7f88d0640825b73fc2ac422a661d2002ea9b68616a14e969577752054011a9e6a7ccc1547d0d66258706fc8ba14884ebdf4eb6cd6a66a301
 # renovate: datasource=github-releases depName=containerd/stargz-snapshotter
 STARGZ_SNAPSHOTTER_VERSION: v0.16.3
+STARGZ_SNAPSHOTTER_SHA256: 576f59d4375ac2cab24310d28e3ac98148c05dc6714649e1ec27e8d4fa8a9679
+STARGZ_SNAPSHOTTER_SHA512: 3a8226e29305f55e9244017cd3063e9ba9b8b4a79a404000677e0e99a84d1337b12a37f6d1b5539c9579f54b1c118fb0ce373eb402296a18d8e55474d549986a
 # renovate: datasource=github-releases depName=kubernetes/cloud-provider-aws
-CLOUD_PROVIDER_AWS_VERSION: v1.32.0
+CLOUD_PROVIDER_AWS_VERSION: v1.32.1
+CLOUD_PROVIDER_AWS_SHA256: aecdfb69573066ff1fe33609abf9fc6e3d200d60c512356e00a0f4ec5e890843
+CLOUD_PROVIDER_AWS_SHA512: 787d48f4696c358084a0a24cc8b65b1a3ee0dc6dfdd677d8e8fc599312cd44759ebed5ba684ee1f295b3084d8a67b0301e970468ffdae554a1ca6f5dd149fca5
 # renovate: datasource=git-tags extractVersion=^containerd-shim-wasmedge\/(?<version>.*)$ depName=https://github.com/containerd/runwasi.git
 WASMEDGE_VERSION: v0.5.0
+WASMEDGE_ARM64_SHA256: d969b781531571ed7b2c5bc5e9ec22321e942567753892a9e042e6db882df944
+WASMEDGE_ARM64_SHA512: 27a4e2af61f4893de468e38086e3cc3fef9d5b5aae193136e4a443ed1657e21f591455198bd402ca24a079fe92ea4d2c658d4d02093dedff0655ffdcf5484203
+WASMEDGE_AMD64_SHA256: 84388d24c87be93e1e32ef15ff776b9cb17a8bf57374c0faca0a994508347de3
+WASMEDGE_AMD64_SHA512: 144a9d36b55a439700b09b96d25905c1c0ea3ebb4be95bbd71f541e34a07ff2ac4b0d5541e2bd45bb4ccc710f26b2f4b7e56067d9d484fb64986a574cbe21664
 # renovate: datasource=git-tags depName=https://github.com/spinkube/containerd-shim-spin.git
 SPIN_VERSION: v0.18.0
+SPIN_ARM64_SHA256: bc26d30f08ebed17a9f02059d10d094b3c77a9befb421dc70dfa4ab3840809c7
+SPIN_ARM64_SHA512: bcd0804c6d9664110e93f73e1bc82aed5c6aea98f56a4a189201fdcca8a7d5af702b1ad88827894b7cf39ed47a818585f722ff05bc58275da33b94abb6c7b91a
+SPIN_AMD64_SHA256: af4daf6180d897d583dc2b8e4f032269c9c9e7bc73454442fd1d659147a40f8d
+SPIN_AMD64_SHA512: 7665a0fc1a21ccc83f9c1d7e746a170c96ceca19ae35605d5eceae4a789a0919b89b326c94b3c75e3ca5dbb34c3756d17e71e1f5be7d352138fb654630debf33
 # renovate: datasource=github-releases depName=kata-containers/kata-containers
-KATA_CONTAINERS_VERSION: 3.3.0
+KATA_CONTAINERS_VERSION: 3.14.0
+KATA_CONTAINERS_SHA256: e09a5394259a0d81f7571d2ff47221583747d7aa63d1a6e82d4d3d3ae7b58b6b
+KATA_CONTAINERS_SHA512: 3aae1c357cd6bafbdbf28f27d3894214ae032a6cb7fca1ac0cc55d905642eeb51ff8266f831afec21a3ff1945bd905a594edb3e176785173e850dc7fb3a85f3c
+KATA_CONTAINERS_STATIC_ARM64_SHA256: e0a0394a6ff9bc03432a6027ffdce12581875d56d1c70fd1dd9b909da78188af
+KATA_CONTAINERS_STATIC_ARM64_SHA512: c16e3020013dd3c5335055c0f6145aece9e5ef3baf53520b5df1e3b51e71b708ec89b2f38262a3cb8132d9479e448f68a1627d5c5989dc1142a8af4b6f3082ff
+KATA_CONTAINERS_STATIC_AMD64_SHA256: 3ec3a62f29042ac0d72f9f28625e053e6dc9f1fe59e31ff6d9437c579821fd19
+KATA_CONTAINERS_STATIC_AMD64_SHA512: 3ad8021930dc612b8b6a0d13fb0c83be838f4be129f3754a3e5622cd4a219f5991a3f3019a781a07d2d90221bdaa2c56c56f34249e5f4dbbe74a1132818c1ca4
 # renovate: datasource=github-releases depName=containers/crun
-CRUN_VERSION: 1.19.1
+CRUN_VERSION: 1.20
+CRUN_ARM64_SHA256: 1e06f605dd8f07c640c59113ed161143ef7786962b11e44804918070e374d5ea
+CRUN_ARM64_SHA512: 6c630cab9fe45d740aeca577c6039bd1123b8c0e6bd6dbbdb5ded5b8fadc7b7ce325cb8d76716d6f462e59655c968e88393b4208d2e72b7326f9ecfb38ca93bb
+CRUN_AMD64_SHA256: ff8407185ec474d7c60f697032b7b1fc1fb028fbd0bf13c7d5da9a7d9a479e38
+CRUN_AMD64_SHA512: d7d76bfc88192c3c7868f4dba89d2f6a73a8ea5649d1cd605828d674842145acd563cce1111e03a0fc9f4b820f5a6a5047db15ff704c98bf8c0e5bef085efb0b
diff --git a/container-runtime/wasmedge/pkg.yaml b/container-runtime/wasmedge/pkg.yaml
@@ -8,13 +8,13 @@ steps:
     # {{ if eq .ARCH "aarch64" }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmedge/{{ .WASMEDGE_VERSION }}/containerd-shim-wasmedge-aarch64-linux-musl.tar.gz
         destination: containerd-shim-wasmedge.tar.gz
-        sha256: d969b781531571ed7b2c5bc5e9ec22321e942567753892a9e042e6db882df944
-        sha512: 27a4e2af61f4893de468e38086e3cc3fef9d5b5aae193136e4a443ed1657e21f591455198bd402ca24a079fe92ea4d2c658d4d02093dedff0655ffdcf5484203
+        sha256: {{ .WASMEDGE_ARM64_SHA256 }}
+        sha512: {{ .WASMEDGE_ARM64_SHA512 }}
     # {{ else }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
       - url: https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmedge/{{ .WASMEDGE_VERSION }}/containerd-shim-wasmedge-x86_64-linux-musl.tar.gz
         destination: containerd-shim-wasmedge.tar.gz
-        sha256: 84388d24c87be93e1e32ef15ff776b9cb17a8bf57374c0faca0a994508347de3
-        sha512: 144a9d36b55a439700b09b96d25905c1c0ea3ebb4be95bbd71f541e34a07ff2ac4b0d5541e2bd45bb4ccc710f26b2f4b7e56067d9d484fb64986a574cbe21664
+        sha256: {{ .WASMEDGE_AMD64_SHA256 }}
+        sha512: {{ .WASMEDGE_AMD64_SHA512 }}
     # {{ end }} This in fact is YAML comment, but Go templating instruction is evaluated by bldr
     prepare:
       - |

diff --git a/deps.png b/deps.png
diff --git a/dvb/cx23885/pkg.yaml b/dvb/cx23885/pkg.yaml
@@ -11,8 +11,8 @@ steps:
   - sources:
       - url: https://github.com/OpenELEC/dvb-firmware/archive/refs/tags/{{ .LINUX_DVB_FIRMWARE }}.tar.gz
         destination: dvb-firmware.tar.gz
-        sha256: cef3ce537d213e020af794cecf9de207e2882c375ceda39102eb6fa2580bad8d
-        sha512: 2372dba98083c76865f5f0f8101b1160888e03cdbe911dd08621e7b6f38e8a25ae5d56eefc21728bf65fd09ea613b53606df4021d3972b0bc9d2bd8b6cbe20a1
+        sha256: {{ .LINUX_DVB_FIRMWARE_SHA256 }}
+        sha512: {{ .LINUX_DVB_FIRMWARE_SHA512 }}
     prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml

diff --git a/firmware/intel-ucode/pkg.yaml b/firmware/intel-ucode/pkg.yaml
@@ -7,8 +7,8 @@ steps:
   - sources:
       - url: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/archive/refs/tags/microcode-{{ .INTEL_UCODE_VERSION }}.tar.gz
         destination: intel-ucode.tar.gz
-        sha256: 1da88b51953c9da2e20b5c94b3d7270cf87ea5babcaa56e3d6a5c9eaf11694b3
-        sha512: 493216fb14097c7c9bda3117fbcae8ad4300fb8646918338119ef303000aad6f73ca04acc59c9a890b0b2b58e097798f673954f15e3142948267bbeeacc842cf
+        sha256: {{ .INTEL_UCODE_SHA256 }}
+        sha512: {{ .INTEL_UCODE_SHA512 }}
     prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml

diff --git a/firmware/vars.yaml b/firmware/vars.yaml
@@ -1,2 +1,4 @@
 # renovate: datasource=github-releases extractVersion=^microcode-(?<version>.*)$ depName=intel/Intel-Linux-Processor-Microcode-Data-Files
 INTEL_UCODE_VERSION: 20250211
+INTEL_UCODE_SHA256: 1da88b51953c9da2e20b5c94b3d7270cf87ea5babcaa56e3d6a5c9eaf11694b3
+INTEL_UCODE_SHA512: 493216fb14097c7c9bda3117fbcae8ad4300fb8646918338119ef303000aad6f73ca04acc59c9a890b0b2b58e097798f673954f15e3142948267bbeeacc842cf
diff --git a/guest-agents/qemu-guest-agent/glib/pkg.yaml b/guest-agents/qemu-guest-agent/glib/pkg.yaml
@@ -3,14 +3,13 @@ variant: scratch
 shell: /bin/bash
 dependencies:
   - stage: base
-  - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/openssl:{{ .BUILD_ARG_PKGS }}"
   - stage: pcre2
 steps:
   - sources:
       - url: https://download.gnome.org/sources/glib/{{ regexReplaceAll ".\\d+$" .GLIB_VERSION "${1}" }}/glib-{{ .GLIB_VERSION }}.tar.xz
         destination: glib.tar.xz
-        sha256: 8428d672c8485636d940f03ce8dcdc174f9b3892ac8b2eea76dd281af6a6e937
-        sha512: 1686ef719122d2b3e8bcc569ba1e125cde51fbe645811e1eb7ddd49e300ff834eed712bb619bba13629f23ad5f801fdc2d37e3103b5150ad3cb7ff9d1168d902
+        sha256: {{ .GLIB_SHA256 }}
+        sha512: {{ .GLIB_SHA512 }}
     prepare:
       - |
         tar -xf glib.tar.xz --strip-components=1

diff --git a/guest-agents/qemu-guest-agent/pcre2/pkg.yaml b/guest-agents/qemu-guest-agent/pcre2/pkg.yaml
@@ -7,8 +7,8 @@ steps:
   - sources:
       - url: https://github.com/PCRE2Project/pcre2/releases/download/pcre2-{{ .PCRE2_VERSION }}/pcre2-{{ .PCRE2_VERSION }}.tar.bz2
         destination: pcre2.tar.bz2
-        sha256: 8d36cd8cb6ea2a4c2bb358ff6411b0c788633a2a45dabbf1aeb4b701d1b5e840
-        sha512: 72fbde87fecec3aa4b47225dd919ea1d55e97f2cbcf02aba26e5a0d3b1ffb58c25a80a9ef069eb99f9cf4e41ba9604ad06a7ec159870e1e875d86820e12256d3
+        sha256: {{ .PCRE2_SHA256 }}
+        sha512: {{ .PCRE2_SHA512 }}
     prepare:
       - |
         tar -xf pcre2.tar.bz2 --strip-components=1

diff --git a/guest-agents/qemu-guest-agent/pkg.yaml b/guest-agents/qemu-guest-agent/pkg.yaml
@@ -3,15 +3,14 @@ variant: scratch
 shell: /bin/bash
 dependencies:
   - stage: base
-  - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/openssl:{{ .BUILD_ARG_PKGS }}"
   - stage: pcre2
   - stage: glib
 steps:
   - sources:
       - url: https://download.qemu.org/qemu-{{ .QEMU_VERSION }}.tar.xz
         destination: qemu.tar.xz
-        sha256: f859f0bc65e1f533d040bbe8c92bcfecee5af2c921a6687c652fb44d089bd894
-        sha512: f92548623e4e31400c823a2d78417a8a4ecfccb07f3ee4883e2f2ad33054539d2a37d076dbc64df42c6c86c08fa7c2c975cd6e823aa14d5f20cef83348006813
+        sha256: {{ .QEMU_SHA256 }}
+        sha512: {{ .QEMU_SHA512 }}
     prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml