Build toolchain digest drift

[github-actions]

Build toolchain digest drift

Upstream registries published new digests for pinned build-toolchain images.
This is a review request, not authorization to update. The scheduled
workflow never edits, commits, or merges a pin.

After reviewing an observed digest, update every listed file to that digest
and set that inventory entry's resolved_at to the review time (UTC RFC3339).
Procedure: docs/ADR060-build-worker-reliability-and-performance.md D7.

cnb-builder

• upstream: docker.io/paketobuildpacks/builder-jammy-base:latest
• committed: sha256:5799343cd316c1a03fa3ff7ab0915d9e6d134e95df4583016d70c6f5330d3898
• observed: sha256:1d9000800a3339a87e1f141468054d6a15bc747c6bff8fb3fdc3d13d2e6a6ca2
• files:
  • lego/operator/cmd/manager/main.go
  • lego/operator/config/manager/manager.yaml
  • deploy/gitops/charts/kpack/platform.yaml

cnb-stack-build

• upstream: docker.io/paketobuildpacks/build-jammy-base:latest
• committed: sha256:28074573683875fcb332cd22c406afd16974f298aafb155d6cb9887642c4abd3
• observed: sha256:f716da238141a907b141a11aa8a3202e7984d5acaf6a94992cb0ed6b84d68861
• files:
  • deploy/gitops/charts/kpack/platform.yaml

cnb-stack-run

• upstream: docker.io/paketobuildpacks/run-jammy-base:latest
• committed: sha256:20cc50011753022514c54388ad9bd5790766d738fc711a6d6a49104a33d45cc3
• observed: sha256:872287752f28ae2d8fc27ccb75c19a6e0c7c6ed4aa08e10794f3cd1b502e1b86
• files:
  • deploy/gitops/charts/kpack/platform.yaml

helper-skopeo

• upstream: quay.io/skopeo/stable:v1.22.2
• committed: sha256:64ac45c5a1c01230896fbae960b2213e32a5040e4009b83b5f5cbf31a35f61c3
• observed: sha256:2b7d76dde38c5924e1945348840c58786fc192201f2fd545832e58b53d26f7b8
• files:
  • lego/operator/internal/build/build.go

native-busybox

• upstream: docker.io/library/busybox:1.37.0
• committed: sha256:9db7b59979c38555a39def84a31fb98b5296952f9e3afd4f6f11f05b07adfab0
• observed: sha256:bdf57e528e45e4433820e045b29b4597825a1c9e38353532d90a01445013f82e
• files:
  • lego/operator/internal/build/native.go

native-elixir

• upstream: docker.io/library/elixir:1.18
• committed: sha256:52e8ea10d10e95d74dde312606637e12bc1b1fdf9cfa37d864eacd85fcc16b3c
• observed: sha256:45cd5b9be69e9bf62920762c732a0b8a09c4efb91ec5c499e9c6e8a3b1de1475
• files:
  • lego/operator/internal/build/native.go

native-node

• upstream: docker.io/library/node:24-bookworm
• committed: sha256:934240a162082fd8b8a2f90cd5114446443f1eba1c5378f6687167ca405e6584
• observed: sha256:64af3819f9275802414d7cdc38c27e9d82bd564dec4d4da87d008255d36c63b4
• files:
  • lego/operator/internal/build/native.go

native-python

• upstream: docker.io/library/python:3.13-bookworm
• committed: sha256:62eafe52c91cad83c2c74e630bfde917da8c253673e695665d454def84fc9a13
• observed: sha256:227b6570d6ee07061ae6ca2eb04dedfb6d2b34045835f343065b9869e4d427ea
• files:
  • lego/operator/internal/build/native.go

native-ruby

• upstream: docker.io/library/ruby:3.4-bookworm
• committed: sha256:56e0c9fdbf64d090e45072d32f0d3be7f2e392e733444f7d176a50881e6c325a
• observed: sha256:246b2dc3f6e40bba3af18503c22997a34dbb27c9f97e198dde6dd727895115c5
• files:
  • lego/operator/internal/build/native.go

native-rust

• upstream: docker.io/library/rust:1-bookworm
• committed: sha256:0e2bcaef56d041a486784e54104a81aebe0da44bd03019bd70bc0401e42e4a97
• observed: sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e
• files:
  • lego/operator/internal/build/native.go

Resolver: python3 scripts/lib/toolchain-freshness.py resolve.

[puncsky]

Review disposition — 2026-09-22 UTC (w1/108)

All nine entries are HELD, pending a healthy dev-1 scheduler and the required
examples/hello-go build smoke test. This keeps #60 open; its remaining scope is
to re-resolve the candidates, validate the build, then accept each pin and update
every listed file plus its resolved_at in one commit. The original issue's
observed digests have all drifted again. No pins or freshness timestamps were
advanced in this review.

The anonymous registry review fetched each current tag, verified the response
body SHA256 equals Docker-Content-Digest, and fetched that digest directly.
These checks establish content integrity/addressability, not publisher signature
verification or absence of vulnerabilities.

Inventory entry	Current observed digest	Platforms	Disposition
cnb-builder	sha256:89ddcb0016c8030efa8c5c32c0d0339d97f2d9d7de7faa76aaeb05f40a996145	amd64	Hold: dev-1 build validation unavailable
cnb-stack-build	sha256:2e345a652462206b9cbdc0753409f84cd0ffda67ae5491fb01d0ed003e366a3d	amd64, arm64	Hold: dev-1 build validation unavailable
cnb-stack-run	sha256:35df3ab97066fce0fda062391bff989e1e80639319bda866175f4a3b8f19df42	amd64, arm64	Hold: dev-1 build validation unavailable
helper-skopeo	sha256:2b7d76dde38c5924e1945348840c58786fc192201f2fd545832e58b53d26f7b8	amd64, arm64, ppc64le, s390x	Hold: dev-1 build validation unavailable
native-elixir	sha256:7633422c7b79f1661c5c368093cf540cc23cc0aad03fa6d3de5f39d1c8d5e1a3	386, amd64, arm, arm64	Hold: dev-1 build validation unavailable; also verify Erlang/OTP compatibility
native-node	sha256:64af3819f9275802414d7cdc38c27e9d82bd564dec4d4da87d008255d36c63b4	amd64, arm64, ppc64le	Hold: dev-1 build validation unavailable
native-python	sha256:227b6570d6ee07061ae6ca2eb04dedfb6d2b34045835f343065b9869e4d427ea	386, amd64, arm, arm64, ppc64le	Hold: dev-1 build validation unavailable
native-ruby	sha256:cc183c94af21fe763dcf1a89f731da75797b80b399e1c4d0a9408bcd3f87c63c	386, amd64, arm, arm64, ppc64le	Hold: dev-1 build validation unavailable
native-rust	sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e	386, amd64, arm, arm64, ppc64le	Hold: dev-1 build validation unavailable; compiler minor may advance

Both the committed and observed CNB builder are single-platform Linux/amd64
Docker manifests with stack ID io.buildpacks.stacks.jammy. The existing
inventory source's “multi-arch index” description is inaccurate for this builder;
correct it when accepting its pin. The other eight are OCI indexes; native-image
unknown/unknown descriptors are excluded from the runtime platform list.
The Skopeo OCI index is directly addressable, avoiding the converted-manifest
digest problem documented by w7/m85.

Upstream maintenance/provenance and compatibility review:

• Paketo documents Ubuntu 22.04 and compatibility within a stack major line:
  stack/security policy.
  Builder v0.4.644
  lists lifecycle 0.21.20 and Platform APIs 0.7–0.15; verify the selected builder's
  metadata against local kpack before acceptance.
• Skopeo v1.22.2
  addresses proxy verification of per-platform signatures. This is not a
  digest-specific CVE clearance.
• Docker Official Images definitions trace the five native tags to source
  commits/Dockerfiles:
  Elixir,
  Node,
  Python,
  Ruby,
  Rust.
  Elixir's unqualified 1.18 tag currently names an OTP-28 variant and can change
  Erlang/base dependencies; Rust's 1-bookworm can advance compiler minor versions.
  Keep the four explicitly Bookworm variants within their selected lines.
• Digest-specific vulnerability scans and OCI signature verification were not
  performed. Fresh or official images are not a claim of vulnerability freedom;
  see Docker's CVE guidance.

Validation: bash scripts/build-toolchain-freshness.test.sh passed, including
inventory and issue-only workflow guards. The full operator suite passed for
m164 during this drain; this review changes no executable code.
Local API /readyz responds, but kube-scheduler is CrashLoopBackOff (31 restarts)
with lease-renewal timeouts/connection loss, and all newly created dev-1-auth
database-init and Mailpit pods remain Pending. The dev-1 bring-up failed with a timed-out Mailpit rollout. Earlier standard mock-cluster recovery also stalled fetching
the kubelet CSR approver chart from GHCR. Other workstreams share this cluster;
no cluster deletion or production build was attempted.