From a51e6c5aa97cfc33e9a8f204400dd8cf6f150325 Mon Sep 17 00:00:00 2001
From: chen21019 <chen21019@gmail.com>
Date: Wed, 26 Aug 2026 19:49:41 +0800
Subject: [PATCH 1/2] fix: consume fixed Linux headers

---
 Dockerfile       | 4 ++--
 scripts/validate | 4 ++--
 ubuntu-apt.lock  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 495d90a..eadeb38 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@ ARG UBUNTU_IMAGE=ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73
 FROM ${UBUNTU_IMAGE} AS snapshot-ca-bootstrap
 
 ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 \
-    https://snapshot.ubuntu.com/ubuntu/20260808T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
+    https://snapshot.ubuntu.com/ubuntu/20260825T000000Z/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb \
     /tmp/ca-certificates.deb
 
 RUN set -eux; \
@@ -18,7 +18,7 @@ RUN set -eux; \
 
 FROM ${UBUNTU_IMAGE} AS build
 
-ARG UBUNTU_APT_SNAPSHOT=20260808T000000Z
+ARG UBUNTU_APT_SNAPSHOT=20260825T000000Z
 
 ENV DEBIAN_FRONTEND=noninteractive
 
diff --git a/scripts/validate b/scripts/validate
index 12cc1e8..b353b84 100644
--- a/scripts/validate
+++ b/scripts/validate
@@ -20,7 +20,7 @@ test -f pause.c
 test -f .github/workflows/security-release-gate.yml
 
 . ./ubuntu-apt.lock
-test "$UBUNTU_APT_LOCKED_SNAPSHOT" = '20260808T000000Z'
+test "$UBUNTU_APT_LOCKED_SNAPSHOT" = '20260825T000000Z'
 test "$UBUNTU_APT_BUILD_ESSENTIAL_VERSION" = '12.12ubuntu2.26.04.2'
 test "$UBUNTU_APT_CA_CERTIFICATES_VERSION" = '20260601~26.04.1'
 test "$UBUNTU_APT_DPKG_DEV_VERSION" = '1.23.7ubuntu1'
@@ -30,7 +30,7 @@ test "$UBUNTU_APT_LIBC6_DEV_VERSION" = '2.43-2ubuntu2.3'
 test "$UBUNTU_APT_MAKE_VERSION" = '4.4.1-3'
 
 grep -F 'ARG UBUNTU_IMAGE=ubuntu:26.04@sha256:' Dockerfile >/dev/null
-grep -F 'https://snapshot.ubuntu.com/ubuntu/20260808T000000Z/' Dockerfile >/dev/null
+grep -F 'https://snapshot.ubuntu.com/ubuntu/20260825T000000Z/' Dockerfile >/dev/null
 grep -F 'https://snapshot.ubuntu.com/ubuntu/%s' Dockerfile >/dev/null
 grep -F 'build-essential="${UBUNTU_APT_BUILD_ESSENTIAL_VERSION}"' Dockerfile >/dev/null
 grep -F 'gcc="${UBUNTU_APT_GCC_VERSION}"' Dockerfile >/dev/null
diff --git a/ubuntu-apt.lock b/ubuntu-apt.lock
index ef0cabb..23e56ef 100644
--- a/ubuntu-apt.lock
+++ b/ubuntu-apt.lock
@@ -3,7 +3,7 @@
 # Source indexes are the official resolute, resolute-updates, and
 # resolute-security Packages files below the dated snapshot URL.
 
-UBUNTU_APT_LOCKED_SNAPSHOT='20260808T000000Z'
+UBUNTU_APT_LOCKED_SNAPSHOT='20260825T000000Z'
 
 UBUNTU_APT_BUILD_ESSENTIAL_VERSION='12.12ubuntu2.26.04.2'
 UBUNTU_APT_CA_CERTIFICATES_VERSION='20260601~26.04.1'

From 29c129b58fcf8402c789b506ea0e83d2b1fa94b0 Mon Sep 17 00:00:00 2001
From: chen21019 <chen21019@gmail.com>
Date: Wed, 26 Aug 2026 20:03:07 +0800
Subject: [PATCH 2/2] ci: align pod pause snapshot gate

---
 .github/workflows/security-release-gate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml
index 23e3f4d..5842625 100644
--- a/.github/workflows/security-release-gate.yml
+++ b/.github/workflows/security-release-gate.yml
@@ -65,7 +65,7 @@ jobs:
           test -s evidence/manifests/builder-ubuntu-packages.tsv
           test -s evidence/manifests/builder-toolchain.tsv
           test -s evidence/manifests/runtime-ubuntu-packages.tsv
-          grep -F $'metadata\tubuntu_snapshot\t-\t20260808T000000Z' \
+          grep -F $'metadata\tubuntu_snapshot\t-\t20260825T000000Z' \
             evidence/manifests/builder-ubuntu-packages.tsv >/dev/null
           grep -F $'gcc\t4:15.2.0-5ubuntu1\t15.2.0' \
             evidence/manifests/builder-toolchain.tsv >/dev/null