From 0fe9733d39d01ed43724c21a3f02bca1063166e0 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Fri, 21 Nov 2025 13:35:19 +0000
Subject: [PATCH 001/127] Prepare 1877

---
 .github/workflows/dev.yml                    |  2 +-
 .github/workflows/nightly.yaml               |  4 ++--
 .github/workflows/upload_oci.yml             |  2 +-
 features/_usi/initrd.include/usr/bin/persist |  2 +-
 features/sci/exec.config                     | 13 +++++++++++++
 features/sci/pkg.include                     |  5 ++---
 gardenlinux                                  |  2 +-
 7 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 6dc97a4b..2cc7fcb5 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -35,7 +35,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 546d6f74..6cfff988 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -36,7 +36,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 896e2495..22482452 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -87,7 +87,7 @@ jobs:
           DASHED_VERSION=${DASHED_VERSION//./-}
 
           echo "Adding additional tag: ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}"
-          oras tag ghcr.io/${{ github.repository }}:${{ inputs.version }}-${CNAME}-${{ matrix.arch }} ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}
+          oras tag ghcr.io/${{ github.repository }}:${{ inputs.version }}-${CNAME}-${{ matrix.arch }} ${{ inputs.upload_version || inputs.version }}.0-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}
       - uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # pin@v4.2.3
         with:
           path: oci_manifest_entry_${{ env.CNAME }}.json
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index ad950446..f193c291 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -74,7 +74,7 @@ OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/
 
 DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 # setup OCI_TAG, UKI_SHA and fetch UKI
-OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
+OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION.0-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
 OCI_TAG=${OCI_TAG//_/-} # replace underscores with dashes
 UKI_SHA=$(oras manifest fetch "$OCI_REPO:${OCI_TAG}" | jq -r '.layers[] | select(.mediaType=="application/io.gardenlinux.uki") | .digest')
 oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/uki.efi"
diff --git a/features/sci/exec.config b/features/sci/exec.config
index 3817f6d7..69033075 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -4,6 +4,19 @@ set -Eeuo pipefail
 # Undo the gardener feature disablement
 systemctl enable ssh
 
+# install custom packages
+# TODO : these all should go in the repo
+
+mkdir /tmp/custompackages
+for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/20250503-5gl0%2Bbp1877/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/11.3.0-27gl0%2Bbp1877/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/48.0-3gl0%2Bbp1877/build.tar.xz.0000; do
+	wget -q "$p" -O - | xz -d | tar xf - -C /tmp/custompackages
+done
+
+pushd /tmp/custompackages > /dev/null
+dpkg -i cloud-hypervisor-gl*_amd64.deb edk2-cloud-hypervisor-gl*_amd64.deb libvirt-clients_*_amd64.deb libvirt-common_*_amd64.deb libvirt-daemon_*_amd64.deb libvirt-daemon-common_*_amd64.deb libvirt-daemon-config-network_*_all.deb libvirt-daemon-config-nwfilter_*_all.deb libvirt-daemon-driver-ch-gl_*_amd64.deb libvirt-daemon-driver-network_*_amd64.deb libvirt-daemon-driver-nodedev_*_amd64.deb libvirt-daemon-driver-nwfilter_*_amd64.deb libvirt-daemon-driver-qemu_*_amd64.deb libvirt-daemon-driver-secret_*_amd64.deb libvirt-daemon-driver-storage_*_amd64.deb libvirt-daemon-log_*_amd64.deb libvirt-daemon-system_*_amd64.deb libvirt0_*_amd64.deb
+popd > /dev/null
+rm -rf /tmp/custompackages
+
 # UID taken from sles 15, looks like it runs as root in debian/gardenlinux
 adduser --uid 476 openvswitch \
   --system --group --no-create-home --disabled-password --disabled-login
diff --git a/features/sci/pkg.include b/features/sci/pkg.include
index 71c8ba35..e05599e8 100644
--- a/features/sci/pkg.include
+++ b/features/sci/pkg.include
@@ -1,6 +1,5 @@
-cloud-hypervisor-gl
-edk2-cloud-hypervisor-gl
-libvirt-daemon-driver-ch-gl
 multipath-tools
 open-iscsi
 openvswitch-switch
+wget
+xz-utils
diff --git a/gardenlinux b/gardenlinux
index 40e7dfa8..5282bd31 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 40e7dfa820cb8bd5e0317779f818d31464c18c63
+Subproject commit 5282bd31155e6ce2dc6c1b62b72caf662e198f74

From 50f9d49e3fff7e0dcde313a9c66e76197b6c6fb3 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Fri, 21 Nov 2025 14:46:45 +0100
Subject: [PATCH 002/127] Add rel-1877-dev branch to workflow triggers

---
 .github/workflows/dev.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 2cc7fcb5..cbdd1518 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - rel-1877-dev
     paths-ignore:
       - "**/README.md"
       - "docs/**"

From 87e65502b1147564d0e628ff74b029804e0cfd15 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 21 Nov 2025 14:53:16 +0100
Subject: [PATCH 003/127] fixup: build workflow is now from 1877

---
 .github/workflows/dev.yml      | 1 -
 .github/workflows/nightly.yaml | 2 +-
 bin/flavors_parse.py           | 1 +
 3 files changed, 2 insertions(+), 2 deletions(-)
 create mode 120000 bin/flavors_parse.py

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index cbdd1518..76be3fa6 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -43,7 +43,6 @@ jobs:
       # have a look at gardenlinux/.github/workflows/github.mjs
       target: dev
       fail_fast: true
-      platform_test_build: false
     # secrets:
       # aws_region: ${{ secrets.AWS_REGION }}
       # aws_kms_role: ${{ secrets.KMS_SIGNING_IAM_ROLE }}
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 6cfff988..e1e477cc 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -26,7 +26,7 @@ jobs:
       # have a look at gardenlinux/.github/workflows/github.mjs 
       target: dev
       fail_fast: true
-      platform_test_build: false
+      #platform_test_build: false
     # secrets:
       # aws_region: ${{ secrets.AWS_REGION }}
       # aws_kms_role: ${{ secrets.KMS_SIGNING_IAM_ROLE }}
diff --git a/bin/flavors_parse.py b/bin/flavors_parse.py
new file mode 120000
index 00000000..8c2e0e41
--- /dev/null
+++ b/bin/flavors_parse.py
@@ -0,0 +1 @@
+../gardenlinux/bin/flavors_parse.py
\ No newline at end of file

From b5a82ed0e7e43158930da3355ae004b19553cb1e Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Fri, 21 Nov 2025 14:09:35 +0100
Subject: [PATCH 004/127] ci: avoid using potentially missing xargs during
 emergency debugprinting

---
 .../systemd/system/emergency.service.d/debugprint.conf   | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/features/_rescue/file.include/etc/systemd/system/emergency.service.d/debugprint.conf b/features/_rescue/file.include/etc/systemd/system/emergency.service.d/debugprint.conf
index fd70fadb..2b7feac7 100644
--- a/features/_rescue/file.include/etc/systemd/system/emergency.service.d/debugprint.conf
+++ b/features/_rescue/file.include/etc/systemd/system/emergency.service.d/debugprint.conf
@@ -2,9 +2,8 @@
 StandardOutput=journal+console
 StandardError=journal+console
 ExecStartPre=/bin/sh -c ' \
-  systemctl --failed --no-legend --no-pager | awk "{print \$2}" | \
-  xargs -r -I{} sh -c " \
-    echo \"\\n=== FAILED UNIT: {} ===\\n\"; \
-    journalctl -b -u {} --no-pager || true; \
-  "'
+  for unit in $(systemctl --failed --no-legend --no-pager | awk "{print \$2}"); do \
+    echo "\n=== FAILED UNIT: $unit ===\n"; \
+    journalctl -b -u "$unit" --no-pager || true; \
+  done'
 TimeoutStartSec=20s

From d8391a3e7619c7f304d1ec0f16f4fd0907b6bc68 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Tue, 25 Nov 2025 10:02:39 +0000
Subject: [PATCH 005/127] Add demo iso

---
 features/_iso                                 |  1 -
 features/_iso/README.md                       | 21 +++++
 features/_iso/exec.config                     |  1 +
 .../etc/kernel/cmdline.d/99-serial.cfg        |  1 +
 .../_iso/file.include/opt/install/install.sh  | 59 +++++++++++++
 .../opt/install/repart/00-efi.conf            |  8 ++
 .../opt/install/repart/10-root.conf           |  9 ++
 features/_iso/image.iso                       | 85 +++++++++++++++++++
 features/_iso/info.yaml                       |  6 ++
 features/_iso/pkg.include                     |  8 ++
 features/_iso/test/autologin.disable          |  0
 features/_iso/test/test_capabilities.py       |  1 +
 features/_iso/test/test_packages_musthave.py  |  1 +
 flavors.yaml                                  |  8 ++
 14 files changed, 208 insertions(+), 1 deletion(-)
 delete mode 120000 features/_iso
 create mode 100644 features/_iso/README.md
 create mode 100755 features/_iso/exec.config
 create mode 100644 features/_iso/file.include/etc/kernel/cmdline.d/99-serial.cfg
 create mode 100755 features/_iso/file.include/opt/install/install.sh
 create mode 100644 features/_iso/file.include/opt/install/repart/00-efi.conf
 create mode 100644 features/_iso/file.include/opt/install/repart/10-root.conf
 create mode 100755 features/_iso/image.iso
 create mode 100644 features/_iso/info.yaml
 create mode 100644 features/_iso/pkg.include
 create mode 100644 features/_iso/test/autologin.disable
 create mode 100644 features/_iso/test/test_capabilities.py
 create mode 100644 features/_iso/test/test_packages_musthave.py

diff --git a/features/_iso b/features/_iso
deleted file mode 120000
index d7ebec9b..00000000
--- a/features/_iso
+++ /dev/null
@@ -1 +0,0 @@
-../gardenlinux/features/_iso
\ No newline at end of file
diff --git a/features/_iso/README.md b/features/_iso/README.md
new file mode 100644
index 00000000..41b572d0
--- /dev/null
+++ b/features/_iso/README.md
@@ -0,0 +1,21 @@
+## Feature: _iso
+
+## !! USE THIS FOR DEMO PURPOSES ONLY !!
+
+### Description
+<website-feature>
+
+This feature flag creates an `.iso` artifact of Garden Linux.
+The root user has a hardcoded password _gardenlinux_
+</website-feature>
+
+### Features
+This feature simply creates a bootable `.iso` image as an additional artifact.
+
+### Meta
+|||
+|---|---|
+|type|flag|
+|artifact|None|
+|included_features|None|
+|excluded_features|None|
diff --git a/features/_iso/exec.config b/features/_iso/exec.config
new file mode 100755
index 00000000..c8536047
--- /dev/null
+++ b/features/_iso/exec.config
@@ -0,0 +1 @@
+echo "root:gardenlinux" | chpasswd -c YESCRYPT
diff --git a/features/_iso/file.include/etc/kernel/cmdline.d/99-serial.cfg b/features/_iso/file.include/etc/kernel/cmdline.d/99-serial.cfg
new file mode 100644
index 00000000..e438d02d
--- /dev/null
+++ b/features/_iso/file.include/etc/kernel/cmdline.d/99-serial.cfg
@@ -0,0 +1 @@
+CMDLINE_LINUX="$CMDLINE_LINUX console=ttyS0,115200"
diff --git a/features/_iso/file.include/opt/install/install.sh b/features/_iso/file.include/opt/install/install.sh
new file mode 100755
index 00000000..906f4831
--- /dev/null
+++ b/features/_iso/file.include/opt/install/install.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -ue
+
+thisDir=$(readlink -f $(dirname "${BASH_SOURCE[0]}"))
+
+targetDisk="$1"
+
+pushd "$thisDir"
+
+# remove all HD related boot entries
+for e in $(efibootmgr | awk '$NF ~ /^HD/ { print $1 }' | sed "s/Boot\([0-9A-F]*\)./\1/"); do
+  echo "Removing entry $e"
+  efibootmgr -B -b "$e" > /dev/null
+done
+
+# prepare disk for repart
+sgdisk -Z "$targetDisk"
+sgdisk -o "$targetDisk"
+
+# actually partition and populate with data
+mkdir -p /run/source
+mount --bind / /run/source
+systemd-repart --definitions repart/ --json=pretty --dry-run=off --copy-source=/run/source/ "$targetDisk"
+
+sleep 5
+
+# prepare mounts for chroot env
+target="/run/chroot"
+mkdir "$target" 
+mount /dev/disk/by-label/ROOT "$target" 
+mount /dev/disk/by-label/ESP "$target/efi"
+
+# prepare extra mounts
+pushd "$target" > /dev/null
+mount -t proc proc proc
+mount -t sysfs sys sys
+mount --bind /dev dev
+
+# regenerate initrd and generate loader entries
+chroot "$target" dracut -f /boot/initrd.img-"$(uname -r)"
+
+if mount --bind /sys/firmware/efi/efivars "$target/sys/firmware/efi/efivars"; then
+	# efi
+	chroot "$target" bootctl install
+	chroot "$target" kernel-install add "$(uname -r)" "/boot/vmlinuz-$(uname -r)" "/boot/initrd.img-$(uname -r)"
+else
+	# legacy
+	chroot "${target}" sfdisk --part-attrs "${targetDisk}" 1 LegacyBIOSBootable
+	chroot "${target}" dd if="/usr/lib/SYSLINUX/gptmbr.bin" of="${targetDisk}" bs=440 count=1 conv=notrunc
+	chroot "${target}" mkdir -p /efi/syslinux
+	chroot "${target}" cp /usr/lib/syslinux/modules/bios/menu.c32 /efi/syslinux/
+	chroot "${target}" cp /usr/lib/syslinux/modules/bios/libutil.c32 /efi/syslinux/
+	chroot "${target}" syslinux --directory syslinux --install /dev/disk/by-label/ESP
+	mkdir /run/chroot/efi/Default
+	chroot "$target" kernel-install add "$(uname -r)" "/boot/vmlinuz-$(uname -r)" "/boot/initrd.img-$(uname -r)"
+	chroot "${target}" update-syslinux
+fi
+
+echo "Safe to reboot"
diff --git a/features/_iso/file.include/opt/install/repart/00-efi.conf b/features/_iso/file.include/opt/install/repart/00-efi.conf
new file mode 100644
index 00000000..d71d8caa
--- /dev/null
+++ b/features/_iso/file.include/opt/install/repart/00-efi.conf
@@ -0,0 +1,8 @@
+# modify only the size to fit your needs
+[Partition]
+Type=esp
+Format=vfat
+SizeMinBytes=1024M
+SizeMaxBytes=1024M
+Label=ESP
+MountPoint=/efi
diff --git a/features/_iso/file.include/opt/install/repart/10-root.conf b/features/_iso/file.include/opt/install/repart/10-root.conf
new file mode 100644
index 00000000..617337f0
--- /dev/null
+++ b/features/_iso/file.include/opt/install/repart/10-root.conf
@@ -0,0 +1,9 @@
+# modify only the size to fit your needs, do not specify the size to use whatever space is left on disk
+[Partition]
+Type=root
+#SizeMinBytes=2G
+#SizeMaxBytes=2G
+CopyFiles=/
+CopyFiles=/boot
+Label=ROOT
+MountPoint=/
diff --git a/features/_iso/image.iso b/features/_iso/image.iso
new file mode 100755
index 00000000..2c875f5a
--- /dev/null
+++ b/features/_iso/image.iso
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input="$(realpath -- "$1")"
+output="$(realpath -- "$2")"
+
+dir="$(mktemp -d)"
+pushd "$dir" > /dev/null
+
+export PATH="/builder/image.d:$PATH"
+
+chroot_dir="$(mktemp -d)"
+mount -t tmpfs tmpfs "$chroot_dir"
+tar --extract --xattrs --xattrs-include '*' --directory "$chroot_dir" < "$input"
+
+mount --rbind --make-rprivate /proc "$chroot_dir/proc"
+mount --rbind --make-rprivate /sys "$chroot_dir/sys"
+mount --rbind --make-rprivate /dev "$chroot_dir/dev"
+mount --bind /usr/bin/false "${chroot_dir}/usr/bin/systemd-detect-virt"
+
+kernel=$(echo "${chroot_dir}"/boot/vmlinuz-* | tr " " '\n' | cut -d- -f 2- | sort -V | tail -1)
+chroot "$chroot_dir" dracut -f /tmp/initrd "${kernel}" -m "bash systemd systemd-initrd kernel-modules kernel-modules-extra terminfo dracut-systemd shutdown dmsquash-live" --reproducible
+
+# we use ukify because dracut 059 and systemd 254 don't mix, dracut generate a broken uki
+# https://github.com/dracutdevs/dracut/issues/2431
+# TODO: fix when dracut is fixed
+#chroot "${chroot_dir}" dracut -f /tmp/unified ${kernel} --uefi --kernel-cmdline "console=tty0 console=ttyS0,115200 rd.live.squashimg=squashfs.img root=live:CDLABEL=GardenlinuxISO rd.live.overlay.overlayfs rd.live.dir=live rd.live.ram"  -m "bash systemd systemd-initrd kernel-modules kernel-modules-extra terminfo dracut-systemd shutdown dmsquash-live" --reproducible
+chroot "${chroot_dir}" /lib/systemd/ukify build --output=/tmp/unified --linux=/boot/vmlinuz-"${kernel}" --initrd=/tmp/initrd --cmdline="console=tty0 console=ttyS0,115200 rd.live.squashimg=squashfs.img root=live:CDLABEL=GardenlinuxISO rd.live.overlay.overlayfs rd.live.dir=live rd.live.ram"
+
+umount -l "$chroot_dir/proc"
+umount -l "$chroot_dir/sys"
+umount -l "$chroot_dir/dev"
+umount "${chroot_dir}/usr/bin/systemd-detect-virt"
+
+mkdir CD_root
+mkdir CD_root/{isolinux,images,kernel,boot,boot/images,boot/syslinux,live}
+
+mksquashfs "$chroot_dir" "CD_root/live/squashfs.img" -comp lzo
+cp "${chroot_dir}/boot/"vmlinuz* "CD_root/boot/images/vmlinuz"
+mv "${chroot_dir}/tmp/"initrd* "CD_root/boot/images/initrd"
+mv "${chroot_dir}/tmp/unified" bootx64.efi
+
+#TODO: determine proper size
+dd if=/dev/zero of=efiboot.img bs=512 count=131072
+mkfs.msdos -F 16 -n 'EFIBOOTISO' efiboot.img
+mmd -i efiboot.img ::EFI
+mmd -i efiboot.img ::EFI/BOOT
+mcopy -i efiboot.img bootx64.efi ::EFI/BOOT/BOOTX64.EFI
+
+mv efiboot.img CD_root/isolinux/
+cp "${chroot_dir}/usr/lib/ISOLINUX/isolinux.bin" CD_root/isolinux/
+cp "${chroot_dir}/usr/lib/ISOLINUX/isohdpfx.bin" CD_root/isolinux/
+cp "${chroot_dir}/usr/lib/syslinux/modules/bios/ldlinux.c32" CD_root/isolinux
+
+cat << EOF > CD_root/isolinux/isolinux.cfg
+PATH /boot/syslinux
+DEFAULT loadconfig
+
+LABEL loadconfig
+  CONFIG /boot/syslinux/syslinux.cfg
+EOF
+
+cat << EOF > CD_root/boot/syslinux/syslinux.cfg
+MENU TITLE gardenlinux
+DEFAULT GardenlinuxRam
+
+LABEL GardenlinuxRam
+MENU LABEL Gardenlinux Live in RAM
+LINUX /boot/images/vmlinuz console=tty0 console=ttyS0,115200 rd.live.squashimg=squashfs.img root=live:CDLABEL=GardenlinuxISO rd.live.overlay.overlayfs rd.live.dir=live rd.live.ram
+INITRD /boot/images/initrd
+EOF
+
+# TODO: make this reproducible
+xorriso -as mkisofs \
+ -volid "GardenlinuxISO" \
+ -o "${output}" \
+ -isohybrid-mbr "${chroot_dir}/usr/lib/ISOLINUX/isohdpfx.bin" \
+ -c isolinux/boot.cat \
+ -b isolinux/isolinux.bin \
+ -no-emul-boot -boot-load-size 4 -boot-info-table \
+ -eltorito-alt-boot \
+ -e isolinux/efiboot.img \
+ -no-emul-boot \
+ -isohybrid-gpt-basdat \
+ CD_root
diff --git a/features/_iso/info.yaml b/features/_iso/info.yaml
new file mode 100644
index 00000000..302d84a9
--- /dev/null
+++ b/features/_iso/info.yaml
@@ -0,0 +1,6 @@
+description: "iso"
+type: flag
+features:
+  exclude:
+    - _selinux
+    - sap
diff --git a/features/_iso/pkg.include b/features/_iso/pkg.include
new file mode 100644
index 00000000..b70528d8
--- /dev/null
+++ b/features/_iso/pkg.include
@@ -0,0 +1,8 @@
+dracut
+dracut-core
+dracut-live
+binutils
+isolinux
+python3-pefile
+systemd-ukify
+gdisk
diff --git a/features/_iso/test/autologin.disable b/features/_iso/test/autologin.disable
new file mode 100644
index 00000000..e69de29b
diff --git a/features/_iso/test/test_capabilities.py b/features/_iso/test/test_capabilities.py
new file mode 100644
index 00000000..c0048aee
--- /dev/null
+++ b/features/_iso/test/test_capabilities.py
@@ -0,0 +1 @@
+from helper.tests.capabilities import capabilities as test_capabilities
diff --git a/features/_iso/test/test_packages_musthave.py b/features/_iso/test/test_packages_musthave.py
new file mode 100644
index 00000000..4b2783d2
--- /dev/null
+++ b/features/_iso/test/test_packages_musthave.py
@@ -0,0 +1 @@
+from helper.tests.packages_musthave import packages_musthave as test_packages_musthave
diff --git a/flavors.yaml b/flavors.yaml
index 5dd93a8a..a99b5107 100644
--- a/flavors.yaml
+++ b/flavors.yaml
@@ -41,6 +41,14 @@ targets:
         test: true
         test-platform: false
         publish: false
+      - features:
+          - sci
+          - _iso 
+        arch: amd64
+        build: true
+        test: true
+        test-platform: false
+        publish: false
   # this is needed as bare_flavors step in build.yml is currently hard wired
   - name: bare
     category: container

From e6170f15767b93c101a922cc3dd71f43f78627e2 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 28 Nov 2025 17:22:57 +0100
Subject: [PATCH 006/127] update package version of libvirtd and cloud
 hypervisor

---
 features/sci/exec.config | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 69033075..3135b21e 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -7,8 +7,13 @@ systemctl enable ssh
 # install custom packages
 # TODO : these all should go in the repo
 
+# all versions URL encoded
+EDK2_VERSION="20250503-5gl0%2Bbp1877"
+LIBVIRT_VERSION="11.3.0-28gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="48.0-4gl0%2Bbp1877"
+
 mkdir /tmp/custompackages
-for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/20250503-5gl0%2Bbp1877/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/11.3.0-27gl0%2Bbp1877/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/48.0-3gl0%2Bbp1877/build.tar.xz.0000; do
+for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do
 	wget -q "$p" -O - | xz -d | tar xf - -C /tmp/custompackages
 done
 

From 83876ef54a6ae21e5f88e8c658249886cec17b48 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 5 Dec 2025 10:05:45 +0100
Subject: [PATCH 007/127] bump to 1877.8

---
 gardenlinux | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gardenlinux b/gardenlinux
index 5282bd31..df93847a 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 5282bd31155e6ce2dc6c1b62b72caf662e198f74
+Subproject commit df93847afbba358513b15eb95b45ef7b5c719229

From 6662893f4de26a30b1eed2851c0c4692c1bf7651 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 5 Dec 2025 10:46:24 +0100
Subject: [PATCH 008/127] update libvirt and cloud hypervisor packages

---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 3135b21e..2c20313f 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-5gl0%2Bbp1877"
-LIBVIRT_VERSION="11.3.0-28gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-4gl0%2Bbp1877"
+LIBVIRT_VERSION="11.3.0-29gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="48.0-5gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 3cfe3dff2d8973b47e0c94b5f18002475884297f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 10 Dec 2025 16:57:10 +0100
Subject: [PATCH 009/127] Update libvirt and cloud hypervisor packages

```diff
-LIBVIRT_VERSION="11.3.0-29gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-5gl0%2Bbp1877"
+LIBVIRT_VERSION="11.3.0-31gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="48.0-6gl0%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 2c20313f..31f90bfb 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-5gl0%2Bbp1877"
-LIBVIRT_VERSION="11.3.0-29gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-5gl0%2Bbp1877"
+LIBVIRT_VERSION="11.3.0-31gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="48.0-6gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 4952d647e5e114f22d8d7f076e06d80c7d51379b Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Thu, 11 Dec 2025 15:04:16 +0000
Subject: [PATCH 010/127] Preload debug container

---
 .../etc/systemd/system/dbgimport.service           | 12 ++++++++++++
 features/_usi/initrd.include/usr/bin/persist       | 14 ++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 features/_usi/file.include/etc/systemd/system/dbgimport.service

diff --git a/features/_usi/file.include/etc/systemd/system/dbgimport.service b/features/_usi/file.include/etc/systemd/system/dbgimport.service
new file mode 100644
index 00000000..cdf06b46
--- /dev/null
+++ b/features/_usi/file.include/etc/systemd/system/dbgimport.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Import debug container image
+ConditionPathExists=|/opt/dbgimage/debug.tar
+ConditionFirstBoot=yes
+After=containerd.service
+
+[Service]
+ExecStart=/bin/sh -c 'ctr image import --base-name "$(cat /opt/dbgimage/debug.tar.name)" /opt/dbgimage/debug.tar && rm -f /opt/dbgimage/debug.tar && rm -f /opt/dbgimage/debug.tar.name && rm -f /opt/dbgimage/image'
+Type=oneshot
+
+[Install]
+WantedBy=multi-user.target
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index f193c291..534001dd 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -94,6 +94,20 @@ if [ "$ENABLE_HUGEPAGE_SETUP" = "true" ]; then
   objcopy --add-section .cmdline=/tmp/cmdlinef --change-section-vma .cmdline=$(printf 0x%x $offs) $addon "$addon_dir/hugepages.addon.efi"
 fi
 
+# debug container
+DBG_CONTAINER_IMPORT="/sysroot/opt/dbgimage"
+DBG_CONTAINER_IMAGE_DUMP="debug.tar"
+DBG_CONTAINER_FILE="/sysroot/opt/dbgimage/image"
+
+mkdir -p "$DBG_CONTAINER_IMPORT"
+if [ -f "$DBG_CONTAINER_FILE" ]; then
+	oras backup --output "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP" "$(cat "$DBG_CONTAINER_FILE")"
+	cat "$DBG_CONTAINER_FILE" | cut -d: -f 1 > "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP.name"
+else
+	echo "no container image file providing, skipping..."
+fi
+
+
 # Network config generation
 if [[ -x /sysroot/opt/persist/network_up.sh ]]; then
 	chroot /sysroot /opt/persist/network_up.sh

From 81bc868c4981030e42448a0b70b4acdeaa0cf3ac Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Fri, 12 Dec 2025 14:41:03 +0100
Subject: [PATCH 011/127] Update features/_usi/initrd.include/usr/bin/persist

Co-authored-by: Fabian Koller <10155170+anokfireball@users.noreply.github.com>
---
 features/_usi/initrd.include/usr/bin/persist | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 534001dd..60978a17 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -104,7 +104,7 @@ if [ -f "$DBG_CONTAINER_FILE" ]; then
 	oras backup --output "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP" "$(cat "$DBG_CONTAINER_FILE")"
 	cat "$DBG_CONTAINER_FILE" | cut -d: -f 1 > "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP.name"
 else
-	echo "no container image file providing, skipping..."
+	echo "no container image file provided, skipping..."
 fi
 
 

From 7c1db2ae0199bb7eabfe9f63997b36937e2894d3 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Fri, 12 Dec 2025 14:41:47 +0100
Subject: [PATCH 012/127] Update
 features/_usi/file.include/etc/systemd/system/dbgimport.service

Co-authored-by: Fabian Koller <10155170+anokfireball@users.noreply.github.com>
---
 features/_usi/file.include/etc/systemd/system/dbgimport.service | 1 +
 1 file changed, 1 insertion(+)

diff --git a/features/_usi/file.include/etc/systemd/system/dbgimport.service b/features/_usi/file.include/etc/systemd/system/dbgimport.service
index cdf06b46..2b84b937 100644
--- a/features/_usi/file.include/etc/systemd/system/dbgimport.service
+++ b/features/_usi/file.include/etc/systemd/system/dbgimport.service
@@ -3,6 +3,7 @@ Description=Import debug container image
 ConditionPathExists=|/opt/dbgimage/debug.tar
 ConditionFirstBoot=yes
 After=containerd.service
+Requires=containerd.service
 
 [Service]
 ExecStart=/bin/sh -c 'ctr image import --base-name "$(cat /opt/dbgimage/debug.tar.name)" /opt/dbgimage/debug.tar && rm -f /opt/dbgimage/debug.tar && rm -f /opt/dbgimage/debug.tar.name && rm -f /opt/dbgimage/image'

From 38b73e46b94fe13d2b93a702a9217330af8c93a0 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Tue, 16 Dec 2025 16:25:04 +0000
Subject: [PATCH 013/127] Pull in oras from a more recent version of GL

---
 features/_usi/exec.config | 7 +++++++
 features/_usi/pkg.include | 1 -
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/features/_usi/exec.config b/features/_usi/exec.config
index 13871d48..60b8d26b 100755
--- a/features/_usi/exec.config
+++ b/features/_usi/exec.config
@@ -2,6 +2,13 @@
 
 set -eufo pipefail
 
+#TODO: oras should be pulled in via pkg.include, but we don't have it for 1877, will be in the next release
+pushd /tmp
+wget https://packages.gardenlinux.io/gardenlinux/pool/f87336e4082eae86cf54b69082b68f5a2af218be30957448d0401dd559f6f8a2/oras_1.3.0-1gl0_amd64.deb
+dpkg -i oras_1.3.0-1gl0_amd64.deb
+rm oras_1.3.0-1gl0_amd64.deb
+popd
+
 systemctl enable systemd-bless-boot.service
 
 update-kernel-cmdline
diff --git a/features/_usi/pkg.include b/features/_usi/pkg.include
index 7ee423c5..8f20b728 100644
--- a/features/_usi/pkg.include
+++ b/features/_usi/pkg.include
@@ -9,6 +9,5 @@ tpm2-tools
 yq
 gdisk
 binutils
-oras
 efibootmgr
 systemd-ukify

From a0e94ba03827a71d8e84a4268613839447d1f9f5 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 16 Dec 2025 18:03:34 +0100
Subject: [PATCH 014/127] Cloud Hypervisor: Update version from 48.0-6 to
 48.0-7

---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 31f90bfb..1743f7ed 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,7 +10,7 @@ systemctl enable ssh
 # all versions URL encoded
 EDK2_VERSION="20250503-5gl0%2Bbp1877"
 LIBVIRT_VERSION="11.3.0-31gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-6gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="48.0-7gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 3ee6e43738308d6d2556fcb5a92d4dbd4db377de Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 17 Dec 2025 08:56:36 +0100
Subject: [PATCH 015/127] Add presets and improve build output

* Disable virtchd* sockets and service
* List downloaded packages during sci feature `exec.config`
---
 features/sci/exec.config                                     | 3 ++-
 .../etc/systemd/system-preset/00-sci-libvirt.preset          | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 features/sci/file.include/etc/systemd/system-preset/00-sci-libvirt.preset

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 1743f7ed..3c046bde 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -14,7 +14,8 @@ CLOUD_HYPERVISOR_VERSION="48.0-7gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do
-	wget -q "$p" -O - | xz -d | tar xf - -C /tmp/custompackages
+  echo "Downloading and extracting package from $p"
+  wget -q "$p" -O - | xz -d | tar xf - -C /tmp/custompackages
 done
 
 pushd /tmp/custompackages > /dev/null
diff --git a/features/sci/file.include/etc/systemd/system-preset/00-sci-libvirt.preset b/features/sci/file.include/etc/systemd/system-preset/00-sci-libvirt.preset
new file mode 100644
index 00000000..a45ccf70
--- /dev/null
+++ b/features/sci/file.include/etc/systemd/system-preset/00-sci-libvirt.preset
@@ -0,0 +1,5 @@
+# default presets for sci image
+disable virtchd-admin.socket
+disable virtchd-ro.socket
+disable virtchd.service
+disable virtchd.socket

From b23d127d78b8c65819b608566b0b29ed37f53d90 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 17 Dec 2025 17:26:46 +0100
Subject: [PATCH 016/127] 1877 does not have cut available using awk

---
 features/_usi/initrd.include/usr/bin/persist | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 60978a17..072b00c5 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -102,7 +102,7 @@ DBG_CONTAINER_FILE="/sysroot/opt/dbgimage/image"
 mkdir -p "$DBG_CONTAINER_IMPORT"
 if [ -f "$DBG_CONTAINER_FILE" ]; then
 	oras backup --output "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP" "$(cat "$DBG_CONTAINER_FILE")"
-	cat "$DBG_CONTAINER_FILE" | cut -d: -f 1 > "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP.name"
+	cat "$DBG_CONTAINER_FILE" | awk -F':' '{print $1}' > "$DBG_CONTAINER_IMPORT/$DBG_CONTAINER_IMAGE_DUMP.name"
 else
 	echo "no container image file provided, skipping..."
 fi

From 215271d2bb3c796910e1ff469b9e5ed4ffd8aa79 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 17 Dec 2025 20:46:00 +0100
Subject: [PATCH 017/127] bump libvirtd to libvirt_11.3.0-32gl0+bp1877

---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 3c046bde..5811bfd1 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,7 +9,7 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-5gl0%2Bbp1877"
-LIBVIRT_VERSION="11.3.0-31gl0%2Bbp1877"
+LIBVIRT_VERSION="11.3.0-32gl0%2Bbp1877"
 CLOUD_HYPERVISOR_VERSION="48.0-7gl0%2Bbp1877"
 
 mkdir /tmp/custompackages

From 4535bb5b0d344a47856d4f6e641d3200c245ec44 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 5 Jan 2026 10:55:38 +0100
Subject: [PATCH 018/127] Update to Garden Linux 1877.9

---
 gardenlinux | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gardenlinux b/gardenlinux
index df93847a..171a5397 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit df93847afbba358513b15eb95b45ef7b5c719229
+Subproject commit 171a5397058b93b419f5127d6247b0bdb7b1844d

From 250ff56bb6e0040e346ec39924a964d7c152234e Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Thu, 8 Jan 2026 10:45:02 +0000
Subject: [PATCH 019/127] Use custom 1877.9.x version

---
 Containerfile      |   3 +
 VERSION            |   2 +-
 bin/garden-version | 156 ++++++++++++++++++++++++++++++++++++++++++++-
 build              | 129 ++++++++++++++++++++++++++++++++++++-
 4 files changed, 287 insertions(+), 3 deletions(-)
 create mode 100644 Containerfile
 mode change 120000 => 100644 VERSION
 mode change 120000 => 100755 bin/garden-version
 mode change 120000 => 100755 build

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 00000000..c4ae04f0
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,3 @@
+FROM ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd
+
+RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2)/' -i /builder/bootstrap
diff --git a/VERSION b/VERSION
deleted file mode 120000
index e96da460..00000000
--- a/VERSION
+++ /dev/null
@@ -1 +0,0 @@
-gardenlinux/VERSION
\ No newline at end of file
diff --git a/VERSION b/VERSION
new file mode 100644
index 00000000..e6e7decd
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+1877.9.1
diff --git a/bin/garden-version b/bin/garden-version
deleted file mode 120000
index d88969eb..00000000
--- a/bin/garden-version
+++ /dev/null
@@ -1 +0,0 @@
-../gardenlinux/bin/garden-version
\ No newline at end of file
diff --git a/bin/garden-version b/bin/garden-version
new file mode 100755
index 00000000..48c2b777
--- /dev/null
+++ b/bin/garden-version
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+
+# Contains sources from https://github.com/debuerreotype/debuerreotype
+
+set -Eeuo pipefail
+# shellcheck disable=2128
+thisDir="$(dirname "$(readlink -f "${BASH_SOURCE}")")"
+versionfile="$(readlink -f "${thisDir}/../VERSION")"
+startdate="Mar 31 00:00:00 UTC 2020"
+build_os="$(uname -s)"
+
+function check_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Error: The binary '$1' could not be found. Please make sure to install it." >&2
+    exit 1
+  fi
+}
+
+# Use "gdate" & sed (GNU) which must be installed by "Homebrew"
+# on macOS systems to have a normalized date interface
+if [ "Darwin" == "$build_os" ]; then
+        date_gnu="gdate"
+        sed_gnu="gsed"
+else
+        date_gnu="date"
+        sed_gnu="sed"
+fi
+check_command "$date_gnu"
+check_command "$sed_gnu"
+
+# shellcheck disable=1091
+source "${thisDir}/.constants.sh" \
+	--flags 'major,minor,patch,date,datefull,epoch,git' \
+	--usage '[ --major | --minor | --patch | --date | --datefull | --epoch | --git ] [<garden-version>|<timestamp>]' \
+	--sample '20200427' \
+	--sample '--date 27.1' \
+	--help   "Generates version dependent values according to the file $versionfile or to the parameter handed over. Versions can be converted adequately
+
+--major 	prints only the major version
+--minor		prints only the minor version
+--patch		prints only the patch/patch version
+--date 		prints the date according to the version e.g. 20200427 if garden-version=27
+--datefull	prints a full date deteministically usable by debootstrap
+--epoch		prints the seconds sinc 19700101 till garden-version
+--git		prints the version plus the last git-hash
+
+If no parameter is specified the full version <major>.<minor> e.g. 27.5 is printed. The version is taken from $versionfile. On HEAD this should always evaluate to 'today', on branch versions this always should resolve to the next version that will be build e.g. 27.1. This implies there is no branch with a .0 in the $versionfile file.
+The version calculated expresses the days since $startdate. Calculation is always UTC based."
+
+# shellcheck disable=2154
+eval "${dgetopt}"
+typeout="default"
+while true; do
+	flag="$1"; shift
+	dgetopt-case "${flag}"
+	case "${flag}" in
+		--major|--minor|--patch|--date|--datefull|--epoch|--git)
+			typeout="${flag}"   ;;
+		--)	break ;;
+		*) 	eusage "unknown flag '${flag}'" ;;
+	esac
+done
+
+# Checks repo.gardenlinux.io for the highest available suite minor for the given major
+function get_minor_from_repo {
+  minor=0   # running index
+  limit=100 # hard limit the search in case of unexpected curl results
+  major=$1  # major to check the latest minor for
+  repo_url="https://packages.gardenlinux.io/gardenlinux/dists/$major.__MINOR__/InRelease"
+  while [ $minor -le $limit ]
+  do
+    check_url=${repo_url//__MINOR__/$minor}
+    if curl -s "$check_url" | grep -q "Error"; then
+      ((minor--))
+      echo $minor
+      return
+    fi
+    ((minor++))
+  done
+}
+
+function get_patch_from_repo {
+	# TODO: implement if we really expect that we'll ever have a nonzero micro/patch version
+	local major=$1
+	local minor=$2
+	if [ "$minor" -eq -1 ]; then
+		echo -1
+		return
+	fi
+	echo 0
+	return
+}
+
+function trim_when_old_version {
+	if [ "$1" == "today" ] || [ "$1" == "experimental" ]; then
+		echo "$1"
+		return
+	fi
+	# HACK just for 1877 for SCI
+	# shellcheck disable=2046
+	if [ $(echo "$1" | cut -d. -f1) -lt 1876 ]; then
+		echo "$1" | cut -d. -f1-2
+	else
+		echo "$1"
+	fi
+}
+
+input="${1:-$($sed_gnu -e "s/#.*\$//" -e "/^$/d" "${versionfile}")}";  shift || true
+input=$($sed_gnu "s/^[[:space:]]*//;s/[[:space:]]*\$//" <<< "${input}")
+
+# no version / timestamp on versionfile
+[ -z "${input}" ] && input="today"
+
+minor=0
+patch=0
+# shellcheck disable=2046
+if [[ "${input}" =~ ^[0-9\.]*$ && $(cut -d. -f1 <<< "${input}") -lt 10000000 ]];
+then	[ $(cut -d. -sf4 <<< "${input}") ] && eusage "invalid version format ${input}. should be <major>[.<minor>.<patch>]"
+
+	major="$(cut -d. -f1 <<< "${input}")"
+	# shellcheck disable=2046
+	if [ $(cut -d. -sf2 <<< "${input}") ]; then
+		minor="$(cut -d. -f2 <<< "${input}")"
+	else
+		minor=$(get_minor_from_repo "$major")
+	fi
+	# shellcheck disable=2046
+	if [ $(cut -d. -sf3 <<< "${input}") ]; then
+		patch="$(cut -d. -f3 <<< "${input}")"
+	else
+		patch=$(get_patch_from_repo "$major" "$minor")
+	fi
+	version="${major}.${minor}.${patch}"
+else
+  if	[[ ${input} = today ]] || [[ ${input} = experimental ]];
+	then	indate=$($date_gnu --date "today" +%s 2>/dev/null)
+		major="$(( ("${indate}" - $($date_gnu --date "${startdate}" +%s)) / (60*60*24) ))"
+		version=${input}
+	else	indate=$($date_gnu --date "${input}" +%s 2>/dev/null) || eusage "invalid date ${input}"
+		major="$(( ("${indate}" - $($date_gnu --date "${startdate}" +%s)) / (60*60*24) ))"
+		version="${major}.${minor}.${patch}"
+	fi
+fi
+
+# shellcheck disable=2154
+case "${typeout}" in
+	--major)	echo "${major}" ;;
+	--minor)	echo "${minor}" ;;
+	--patch)	echo "${patch}" ;;
+	--date)		$date_gnu --date "${startdate} + ${major} days" +%Y%m%d ;;
+	--datefull)	$date_gnu --date "${startdate} + ${major} days" +%Y%m%dT%H%M%SZ ;;
+	--epoch)	$date_gnu --date "${startdate} + ${major} days" +%s ;;
+	--git)		echo "$(trim_when_old_version "${version}")-$(git -C "${scriptsDir}" rev-parse --short 'HEAD^{commit}')" ;;
+        *)		trim_when_old_version "${version}" ;;
+esac
diff --git a/build b/build
deleted file mode 120000
index 9a5480ab..00000000
--- a/build
+++ /dev/null
@@ -1 +0,0 @@
-gardenlinux/build
\ No newline at end of file
diff --git a/build b/build
new file mode 100755
index 00000000..cc890cd0
--- /dev/null
+++ b/build
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+exec 3>&1
+exec 1>&2
+
+#container_image=ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd
+container_image=localhost/builder
+container_engine=podman
+target_dir=.build
+
+container_run_opts=(
+	--memory 4G
+	--security-opt seccomp=unconfined
+	--security-opt apparmor=unconfined
+	--security-opt label=disable
+	--read-only
+)
+
+container_cmd=()
+
+use_kms=0
+resolve_cname=0
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--container-image)
+			container_image="$2"
+			shift 2
+			;;
+		--container-engine)
+			container_engine="$2"
+			shift 2
+			;;
+		--container-run-opts)
+			declare -a "container_run_opts=($2)"
+			shift 2
+			;;
+		--privileged)
+			container_run_opts+=(--privileged)
+			container_cmd=(--second-stage)
+			shift
+			;;
+		--kms)
+			use_kms=1
+			shift
+			;;
+		--print-container-image)
+			printf '%s\n' "$container_image" >&3
+			exit 0
+			;;
+		--resolve-cname)
+			resolve_cname=1
+			shift
+			;;
+		--target)
+			target_dir="$2"
+			shift 2
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+[ -d "$target_dir" ] || mkdir "$target_dir"
+
+container_mount_opts=(
+	-v "$PWD/keyring.gpg:/builder/keyring.gpg:ro"
+	-v "$(realpath "$target_dir"):/builder/.build"
+)
+
+for feature in features/*; do
+	if [ -d "$feature" ]; then
+		container_mount_opts+=(-v "$(realpath -- "$feature"):/builder/$feature:ro")
+	fi
+done
+
+if [ "$container_image" = localhost/builder ]; then
+	dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
+	"$container_engine" build -t "$container_image" "$dir"
+fi
+
+repo="$(./get_repo)"
+commit="$(./get_commit)"
+timestamp="$(./get_timestamp)"
+default_version="$(./get_version)"
+
+
+if [ "$resolve_cname" = 1 ]; then
+	arch="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" dpkg --print-architecture)"
+	cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")"
+	short_commit="$(head -c 8 <<< "$commit")"
+	echo "$cname-$short_commit" >&3
+	exit 0
+fi
+
+make_opts=(
+	REPO="$repo"
+	COMMIT="$commit"
+	TIMESTAMP="$timestamp"
+	DEFAULT_VERSION="$default_version"
+)
+
+if [ "$use_kms" = 1 ]; then
+	for e in AWS_DEFAULT_REGION AWS_REGION AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do
+		if [ -n "${!e-}" ]; then
+			make_opts+=("$e=${!e}")
+		fi
+	done
+fi
+
+# Default values which can be overriden via 'build.config' file
+tempfs_size=2G
+
+if [[ -f "$PWD"/build.config ]]; then
+	. "$PWD"/build.config
+fi
+
+make_opts+=("TEMPFS_SIZE=$tempfs_size")
+
+if [ -d cert ]; then
+	container_mount_opts+=(-v "$PWD/cert:/builder/cert:ro")
+fi
+
+"$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" ${container_cmd[@]+"${container_cmd[@]}"} fake_xattr make --no-print-directory -C /builder "${make_opts[@]}" "$@" >&3

From 3d3cdb073f5da590eaef1c54ca7a550a49466b16 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Mon, 5 Jan 2026 15:15:13 +0000
Subject: [PATCH 020/127] disable efi pstore

---
 .../etc/modprobe.d/disabled_efipstore.conf      |  2 ++
 .../etc/systemd/system/systemd-pstore.service   | 17 +++++++++++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 features/_scicommon/file.include/etc/modprobe.d/disabled_efipstore.conf
 create mode 100644 features/_scicommon/file.include/etc/systemd/system/systemd-pstore.service

diff --git a/features/_scicommon/file.include/etc/modprobe.d/disabled_efipstore.conf b/features/_scicommon/file.include/etc/modprobe.d/disabled_efipstore.conf
new file mode 100644
index 00000000..1e92dd6c
--- /dev/null
+++ b/features/_scicommon/file.include/etc/modprobe.d/disabled_efipstore.conf
@@ -0,0 +1,2 @@
+blacklist efi_pstore
+install efi_pstore /bin/true
diff --git a/features/_scicommon/file.include/etc/systemd/system/systemd-pstore.service b/features/_scicommon/file.include/etc/systemd/system/systemd-pstore.service
new file mode 100644
index 00000000..08f6956a
--- /dev/null
+++ b/features/_scicommon/file.include/etc/systemd/system/systemd-pstore.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Platform Persistent Storage Archival
+Documentation=man:systemd-pstore(8)
+ConditionDirectoryNotEmpty=/sys/fs/pstore
+ConditionVirtualization=!container
+DefaultDependencies=no
+Conflicts=shutdown.target
+Before=sysinit.target shutdown.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/systemd/systemd-pstore
+RemainAfterExit=yes
+StateDirectory=systemd/pstore
+
+[Install]
+WantedBy=sysinit.target

From f3add879777739acd023bf49cb47cf29f95d3be9 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 12 Jan 2026 10:30:17 +0100
Subject: [PATCH 021/127] bump libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="11.3.0-32gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-7gl0%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl0%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 5811bfd1..688b7f4b 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-5gl0%2Bbp1877"
-LIBVIRT_VERSION="11.3.0-32gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="48.0-7gl0%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 6bb2b442e01371f497268771afcd8f962d2e50b2 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 12 Jan 2026 10:33:29 +0100
Subject: [PATCH 022/127] Bump Version to 1877.9.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index e6e7decd..1e0198f6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.1
+1877.9.2

From b9618d774e52f8b625dc038469a777d7792f5534 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 12 Jan 2026 11:23:52 +0100
Subject: [PATCH 023/127] Fix versioning

---
 .github/workflows/upload_oci.yml             | 2 +-
 features/_usi/initrd.include/usr/bin/persist | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 22482452..896e2495 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -87,7 +87,7 @@ jobs:
           DASHED_VERSION=${DASHED_VERSION//./-}
 
           echo "Adding additional tag: ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}"
-          oras tag ghcr.io/${{ github.repository }}:${{ inputs.version }}-${CNAME}-${{ matrix.arch }} ${{ inputs.upload_version || inputs.version }}.0-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}
+          oras tag ghcr.io/${{ github.repository }}:${{ inputs.version }}-${CNAME}-${{ matrix.arch }} ${{ inputs.upload_version || inputs.version }}-${CNAME2}-${DASHED_VERSION}-${COMMIT_SHA_SHORT}
       - uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # pin@v4.2.3
         with:
           path: oci_manifest_entry_${{ env.CNAME }}.json
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 072b00c5..018dffcd 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -74,7 +74,7 @@ OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/
 
 DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 # setup OCI_TAG, UKI_SHA and fetch UKI
-OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION.0-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
+OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
 OCI_TAG=${OCI_TAG//_/-} # replace underscores with dashes
 UKI_SHA=$(oras manifest fetch "$OCI_REPO:${OCI_TAG}" | jq -r '.layers[] | select(.mediaType=="application/io.gardenlinux.uki") | .digest')
 oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/uki.efi"

From e9e2a20788b934e6fd2923577643c160ab2da83a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 13 Jan 2026 10:36:47 +0100
Subject: [PATCH 024/127] Update edk2 version

```diff
-EDK2_VERSION="20250503-5gl0%2Bbp1877"
+EDK2_VERSION="20250503-6gl0%2Bbp1877"
```
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 688b7f4b..bb43fac0 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -8,7 +8,7 @@ systemctl enable ssh
 # TODO : these all should go in the repo
 
 # all versions URL encoded
-EDK2_VERSION="20250503-5gl0%2Bbp1877"
+EDK2_VERSION="20250503-6gl0%2Bbp1877"
 LIBVIRT_VERSION="11.10.0-2gl0%2Bbp1877"
 CLOUD_HYPERVISOR_VERSION="50.0-1gl0%2Bbp1877"
 

From d0f0ee1492d5eaf1fb19fbb241c580ec39cfc388 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 14 Jan 2026 13:12:46 +0100
Subject: [PATCH 025/127] Bump Version to 1877.9.3

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 1e0198f6..1c96b9d3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.2
+1877.9.3

From 346fe027fdb63f95856304d2de66e026fe214fa1 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 16 Jan 2026 15:47:58 +0100
Subject: [PATCH 026/127] Update packges

```diff
-EDK2_VERSION="20250503-6gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl0%2Bbp1877"
+EDK2_VERSION="20250503-7gl0%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl1%2Bbp1877"
```
---
 features/sci/exec.config | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index bb43fac0..89a7819a 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -8,9 +8,9 @@ systemctl enable ssh
 # TODO : these all should go in the repo
 
 # all versions URL encoded
-EDK2_VERSION="20250503-6gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl0%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl0%2Bbp1877"
+EDK2_VERSION="20250503-7gl0%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl1%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 5766488df5c49f38bfbd64d5fa0c8510093890d8 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 16 Jan 2026 15:48:38 +0100
Subject: [PATCH 027/127] Bump Version to 1877.9.4

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 1c96b9d3..dbf20292 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.3
+1877.9.4

From 092e6ecac92132f2ed80893f9de6bcaec918159a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 26 Jan 2026 13:28:09 +0100
Subject: [PATCH 028/127] Bump libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="11.10.0-2gl2%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl1%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl2%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 89a7819a..dbaa2d09 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl2%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl1%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl2%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 63fc1876ed4474ed5f7b135248a7c462c1accd1f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 26 Jan 2026 13:28:47 +0100
Subject: [PATCH 029/127] Bump version to 1877.9.5

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index dbf20292..db3cd180 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.4
+1877.9.5

From a96c16766aa3631b175f11d56698340297518636 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 27 Jan 2026 13:33:40 +0100
Subject: [PATCH 030/127] Bump libvirt and cloud hypvervior

```diff
-LIBVIRT_VERSION="11.10.0-2gl3%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl2%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl3%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index dbaa2d09..59f2396e 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl3%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl2%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl3%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From d55a5e65b22067c0bc4d97106cb3778e4f0eafb3 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 27 Jan 2026 17:10:08 +0100
Subject: [PATCH 031/127] Bump version to 1877.9.6

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index db3cd180..96761cc5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.5
+1877.9.6

From dddc800051122dc7677c9ce931c1d73c6e8f2c64 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 30 Jan 2026 09:00:03 +0100
Subject: [PATCH 032/127] Upgrade to 1877.10

---
 .github/workflows/dev.yml      | 2 +-
 .github/workflows/nightly.yaml | 4 ++--
 VERSION                        | 2 +-
 gardenlinux                    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 76be3fa6..dbf3b281 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -36,7 +36,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index e1e477cc..781fd9bb 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -36,7 +36,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5282bd31155e6ce2dc6c1b62b72caf662e198f74
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/VERSION b/VERSION
index 96761cc5..089ca983 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.9.6
+1877.10.1
diff --git a/gardenlinux b/gardenlinux
index 171a5397..3d56ba62 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 171a5397058b93b419f5127d6247b0bdb7b1844d
+Subproject commit 3d56ba627f7f471e64f36608ffbc84a441d309d9

From b3e6649831bce2109ecb49cda327506a66256009 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 30 Jan 2026 09:23:03 +0100
Subject: [PATCH 033/127] Test dev build in 1877 branch

---
 .github/workflows/dev.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index dbf3b281..08e38cd9 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,11 +27,7 @@ jobs:
       - name: use VERSION file to support dev build on rel-branch
         id: version
         run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "VERSION=today" >> $GITHUB_OUTPUT
-          else
-            echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
-          fi
+          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
 
   build:
     needs: [set_version]

From 74b516086050df16c8e325235d9d3f378facbcc2 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 2 Feb 2026 14:00:48 +0100
Subject: [PATCH 034/127] Update libvirt

```diff
-LIBVIRT_VERSION="11.10.0-2gl4%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl5%2Bbp1877"
`
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 59f2396e..989ba1f1 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,7 +9,7 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl4%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl5%2Bbp1877"
 CLOUD_HYPERVISOR_VERSION="50.0-1gl3%2Bbp1877"
 
 mkdir /tmp/custompackages

From f7272af5696ad2b2d1f67a8b10a03e5e7ddc4873 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 3 Feb 2026 10:38:31 +0100
Subject: [PATCH 035/127] Update khost feature for CAPI image

1.30 is outdated
---
 features/khost                                |  1 -
 features/khost/README.md                      | 19 ++++++++++++
 features/khost/exec.late                      | 11 +++++++
 features/khost/file.exclude                   |  1 +
 .../etc/modules-load.d/br-nf.conf             |  1 +
 .../file.include/etc/sysctl.d/20-br-nf.conf   |  2 ++
 .../file.include/etc/sysctl.d/20-inotify.conf |  2 ++
 .../etc/sysctl.d/20-ip-forward.conf           |  3 ++
 features/khost/fstab.mod                      |  6 ++++
 features/khost/info.yaml                      |  5 ++++
 features/khost/pkg.include                    |  6 ++++
 features/khost/release.key                    | 30 +++++++++++++++++++
 features/khost/test/test_packages_musthave.py |  1 +
 features/khost/test/test_systemd_unit.py      | 16 ++++++++++
 14 files changed, 103 insertions(+), 1 deletion(-)
 delete mode 120000 features/khost
 create mode 100644 features/khost/README.md
 create mode 100755 features/khost/exec.late
 create mode 100644 features/khost/file.exclude
 create mode 100644 features/khost/file.include/etc/modules-load.d/br-nf.conf
 create mode 100644 features/khost/file.include/etc/sysctl.d/20-br-nf.conf
 create mode 100644 features/khost/file.include/etc/sysctl.d/20-inotify.conf
 create mode 100644 features/khost/file.include/etc/sysctl.d/20-ip-forward.conf
 create mode 100755 features/khost/fstab.mod
 create mode 100644 features/khost/info.yaml
 create mode 100644 features/khost/pkg.include
 create mode 100644 features/khost/release.key
 create mode 100644 features/khost/test/test_packages_musthave.py
 create mode 100644 features/khost/test/test_systemd_unit.py

diff --git a/features/khost b/features/khost
deleted file mode 120000
index 0b36d54a..00000000
--- a/features/khost
+++ /dev/null
@@ -1 +0,0 @@
-../gardenlinux/features/khost
\ No newline at end of file
diff --git a/features/khost/README.md b/features/khost/README.md
new file mode 100644
index 00000000..7d71961c
--- /dev/null
+++ b/features/khost/README.md
@@ -0,0 +1,19 @@
+## Feature: khost
+### Description
+<website-feature>
+The khost feature adjusts Garden Linux to support running Kubernetes (vanilla) workloads.
+</website-feature>
+
+### Features
+The `khost` feature adjusts Garden Linux to support running Kubernetes (vanilla) workloads and installs and configures all related packages (regarding the used hardware architecture) and tools. It adjusts the `kublets`, `sysctl` and removes any swap partition.
+
+### Unit testing
+Unit tests will ensure that the needed packages are present as well as the `kublet` is enabled within `systemd`.
+
+### Meta
+|||
+|---|---|
+|type|element|
+|artifact|None|
+|included_features|`chost`|
+|excluded_features|None|
diff --git a/features/khost/exec.late b/features/khost/exec.late
new file mode 100755
index 00000000..69bcfa62
--- /dev/null
+++ b/features/khost/exec.late
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+K8S_VERSION=v1.34.3
+K8S_VERSION_REPO="${K8S_VERSION%.*}"
+
+gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg < /builder/features/khost/release.key
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
+apt update -y
+apt install -y --no-install-recommends "kubelet=${K8S_VERSION#v}*" "kubectl=${K8S_VERSION#v}*" "kubeadm=${K8S_VERSION#v}*" "cri-tools=${K8S_VERSION_REPO#v}*"
+
diff --git a/features/khost/file.exclude b/features/khost/file.exclude
new file mode 100644
index 00000000..82b5c657
--- /dev/null
+++ b/features/khost/file.exclude
@@ -0,0 +1 @@
+/etc/init.d/apparmor
diff --git a/features/khost/file.include/etc/modules-load.d/br-nf.conf b/features/khost/file.include/etc/modules-load.d/br-nf.conf
new file mode 100644
index 00000000..a13fc179
--- /dev/null
+++ b/features/khost/file.include/etc/modules-load.d/br-nf.conf
@@ -0,0 +1 @@
+br_netfilter
diff --git a/features/khost/file.include/etc/sysctl.d/20-br-nf.conf b/features/khost/file.include/etc/sysctl.d/20-br-nf.conf
new file mode 100644
index 00000000..0454e18a
--- /dev/null
+++ b/features/khost/file.include/etc/sysctl.d/20-br-nf.conf
@@ -0,0 +1,2 @@
+net.bridge.bridge-nf-call-iptables=1
+net.bridge.bridge-nf-call-ip6tables=1
diff --git a/features/khost/file.include/etc/sysctl.d/20-inotify.conf b/features/khost/file.include/etc/sysctl.d/20-inotify.conf
new file mode 100644
index 00000000..8f7c9d98
--- /dev/null
+++ b/features/khost/file.include/etc/sysctl.d/20-inotify.conf
@@ -0,0 +1,2 @@
+fs.inotify.max_user_instances = 8192
+fs.inotify.max_user_watches = 65536
diff --git a/features/khost/file.include/etc/sysctl.d/20-ip-forward.conf b/features/khost/file.include/etc/sysctl.d/20-ip-forward.conf
new file mode 100644
index 00000000..5f01c9cd
--- /dev/null
+++ b/features/khost/file.include/etc/sysctl.d/20-ip-forward.conf
@@ -0,0 +1,3 @@
+net.ipv4.ip_forward=1
+net.ipv6.conf.all.forwarding=1
+
diff --git a/features/khost/fstab.mod b/features/khost/fstab.mod
new file mode 100755
index 00000000..de880d56
--- /dev/null
+++ b/features/khost/fstab.mod
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# remove any swap partition
+sed '/^[^[:space:]]\+[[:space:]]\+[^[:space:]]\+[[:space:]]\+swap[[:space:]]\+/d'
+
diff --git a/features/khost/info.yaml b/features/khost/info.yaml
new file mode 100644
index 00000000..1d9d389e
--- /dev/null
+++ b/features/khost/info.yaml
@@ -0,0 +1,5 @@
+description: 'host for kubernetes workloads (vanilla)'
+type: element
+features:
+  include:
+    - chost
diff --git a/features/khost/pkg.include b/features/khost/pkg.include
new file mode 100644
index 00000000..487a9abe
--- /dev/null
+++ b/features/khost/pkg.include
@@ -0,0 +1,6 @@
+apparmor
+conntrack
+ethtool
+ipvsadm
+socat
+gnupg
diff --git a/features/khost/release.key b/features/khost/release.key
new file mode 100644
index 00000000..64f4d8f8
--- /dev/null
+++ b/features/khost/release.key
@@ -0,0 +1,30 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.5 (GNU/Linux)
+
+mQENBGMHoXcBCADukGOEQyleViOgtkMVa7hKifP6POCTh+98xNW4TfHK/nBJN2sm
+u4XaiUmtB9UuGt9jl8VxQg4hOMRf40coIwHsNwtSrc2R9v5Kgpvcv537QVIigVHH
+WMNvXeoZkkoDIUljvbCEDWaEhS9R5OMYKd4AaJ+f1c8OELhEcV2dAQLLyjtnEaF/
+qmREN+3Y9+5VcRZvQHeyBxCG+hdUGE740ixgnY2gSqZ/J4YeQntQ6pMUEhT6pbaE
+10q2HUierj/im0V+ZUdCh46Lk/Rdfa5ZKlqYOiA2iN1coDPIdyqKavcdfPqSraKF
+Lan2KLcZcgTxP+0+HfzKefvGEnZa11civbe9ABEBAAG0PmlzdjprdWJlcm5ldGVz
+IE9CUyBQcm9qZWN0IDxpc3Y6a3ViZXJuZXRlc0BidWlsZC5vcGVuc3VzZS5vcmc+
+iQE+BBMBCAAoBQJnFF34AhsDBQkIK2yBBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIX
+gAAKCRAjRlTamilkNtOACACDK9dQ8CH2Ji9C3Q926nVMUiXdyJK1onCBrQSEBqdR
+LJaT6hGx5pzxkQGgUDpS9p7LA0u920HKLwGb7yIAWtyE5TAj2CYprGgpq98sfsGC
++U5T9IrAdya/BaTAkkP6gNhfMjNaK3bOWsvuLRlluKMNch4ify+IwLqc1JLG40bj
+2HnKBGYkC3m0VtQfUuPQMImSLta/NwRHJMPo8jfGyManqMMxp35/ecP2rXMfb/l1
+WjFDY7h+6nqXay20ljMXkN23W8wFTdvC6lq45wwM5IBnKNR/TjNNYAIizZoHFWz1
+c/ecMWWWCB2S7WbY4xI3JSCOD4XIff3ie7pc68/kgPytiQIcBBMBAgAGBQJjB6F3
+AAoJEM8Lkoze1k873TQP/0t2F/jltLRQMG7VCLw7+ps5JCW5FIqu/S2i9gSdNA0E
+42u+LyxjG3YxmVoVRMsxeu4kErxr8bLcA4p71W/nKeqwF9VLuXKirsBC7z2syFiL
+Ndl0ARnC3ENwuMVlSCwJO0MM5NiJuLOqOGYyD1XzSfnCzkXN0JGA/bfPRS5mPfoW
+0OHIRZFhqE7ED6wyWpHIKT8rXkESFwszUwW/D7o1HagX7+duLt8WkrohGbxTJ215
+YanOKSqyKd+6YGzDNUoGuMNPZJ5wTrThOkTzEFZ4HjmQ16w5xmcUISnCZd4nhsbS
+qN/UyV9Vu3lnkautS15E4CcjP1RRzSkT0jka62vPtAzw+PiGryM1F7svuRaEnJD5
+GXzj9RCUaR6vtFVvqqo4fvbA99k4XXj+dFAXW0TRZ/g2QMePW9cdWielcr+vHF4Z
+2EnsAmdvF7r5e2JCOU3N8OUodebU6ws4VgRVG9gptQgfMR0vciBbNDG2Xuk1WDk1
+qtscbfm5FVL36o7dkjA0x+TYCtqZIr4x3mmfAYFUqzxpfyXbSHqUJR2CoWxlyz72
+XnJ7UEo/0UbgzGzscxLPDyJHMM5Dn/Ni9FVTVKlALHnFOYYSTluoYACF1DMt7NJ3
+oyA0MELL0JQzEinixqxpZ1taOmVR/8pQVrqstqwqsp3RABaeZ80JbigUC29zJUVf
+=Eplj
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/features/khost/test/test_packages_musthave.py b/features/khost/test/test_packages_musthave.py
new file mode 100644
index 00000000..4b2783d2
--- /dev/null
+++ b/features/khost/test/test_packages_musthave.py
@@ -0,0 +1 @@
+from helper.tests.packages_musthave import packages_musthave as test_packages_musthave
diff --git a/features/khost/test/test_systemd_unit.py b/features/khost/test/test_systemd_unit.py
new file mode 100644
index 00000000..0bc474ab
--- /dev/null
+++ b/features/khost/test/test_systemd_unit.py
@@ -0,0 +1,16 @@
+import pytest
+from helper.utils import execute_remote_command
+from helper.utils import validate_systemd_unit
+
+
+@pytest.mark.parametrize(
+    "systemd_unit",
+    [
+        "kubelet"
+    ]
+)
+
+
+def test_systemd_unit(client, systemd_unit, non_provisioner_chroot):
+    execute_remote_command(client, f"systemctl start {systemd_unit}")
+    validate_systemd_unit(client, f"{systemd_unit}")

From 1ea135279fd636953bda482cbd2a38f7894a458b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 3 Feb 2026 11:18:29 +0100
Subject: [PATCH 036/127] 1877.10.1


From ff5406e3a9fead0e775cdcbf18ce3bac6760091b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 4 Feb 2026 15:52:56 +0100
Subject: [PATCH 037/127] Update cloud hypervisor

```diff
-CLOUD_HYPERVISOR_VERSION="50.0-1gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl4%2Bbp1877"
```
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 989ba1f1..cfc351cc 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,7 +10,7 @@ systemctl enable ssh
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
 LIBVIRT_VERSION="11.10.0-2gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl4%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 1f1b4226660ab622a276412a2861fce84b30c9f0 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 4 Feb 2026 15:56:45 +0100
Subject: [PATCH 038/127] Update version to 1877.10.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 089ca983..cf0ab4f5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.10.1
+1877.10.2

From fed15f3fefafab56486b15bab82a6b1ebcc7a46a Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Wed, 4 Feb 2026 14:32:19 +0100
Subject: [PATCH 039/127] ci: directly trigger test from nightly, drop ORAS
 image tag parsing

---
 .github/workflows/nightly.yaml | 27 ++++++++++++++++++++++++-
 .github/workflows/test.yml     | 37 ++++++++++++++++++----------------
 2 files changed, 46 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 781fd9bb..6db62613 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -23,7 +23,7 @@ jobs:
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
-      # have a look at gardenlinux/.github/workflows/github.mjs 
+      # have a look at gardenlinux/.github/workflows/github.mjs
       target: dev
       fail_fast: true
       #platform_test_build: false
@@ -32,6 +32,25 @@ jobs:
       # aws_kms_role: ${{ secrets.KMS_SIGNING_IAM_ROLE }}
       # aws_oidc_session: ${{ secrets.AWS_OIDC_SESSION }}
       # secureboot_db_kms_arn: ${{ secrets.SECUREBOOT_DB_KMS_ARN }}
+  meta:
+    name: Compute image metadata
+    needs: [build]
+    runs-on: ubuntu-latest
+    outputs:
+      VERSION: ${{ needs.build.outputs.version }}
+      DASHED_VERSION: ${{ steps.meta.outputs.dashed_version }}
+      COMMIT_SHA: ${{ steps.meta.outputs.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Derive image metadata
+        id: meta
+        run: |
+          SHA="${GITHUB_SHA::8}"
+          echo "sha=${SHA}" >> $GITHUB_OUTPUT
+          VERSION="${{ needs.build.outputs.version }}"
+          DASHED_VERSION=${VERSION//./-}
+          echo "dashed_version=${DASHED_VERSION}" >> $GITHUB_OUTPUT
   upload_oci:
     name: Run glcli to publish to OCI
     needs: [build]
@@ -40,3 +59,9 @@ jobs:
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
+  test:
+    name: Test nightly image
+    needs: [meta, upload_oci]
+    uses: ./.github/workflows/test.yml
+    with:
+      image_tag: "${{ needs.meta.outputs.VERSION }}-metal-sci-usi-amd64-${{ needs.meta.outputs.DASHED_VERSION }}-${{ needs.meta.outputs.COMMIT_SHA }}"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ea9abc1f..729fffd8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,19 +1,11 @@
 name: test hypervisor capabilities
 on:
-  push:
-    branches:
-      - feat/ci-test-cloud-hypervisor
-  workflow_run:
-    workflows:
-      - nightly
-    types:
-      - completed
   workflow_dispatch:
     inputs:
       image_tag:
         description: "Image tag to test (must be usi-sci)"
         type: string
-        default: ""
+        required: true
   workflow_call:
     inputs:
       image_tag:
@@ -27,19 +19,30 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Install oras
+        uses: oras-project/setup-oras@v1
+        with:
+          version: 1.2.2
+      - name: Validate image tag
+        run: |
+          if [ -z "${{ inputs.image_tag }}" ]; then
+            echo "Error: image_tag is required"
+            exit 1
+          fi
+
+          echo "Verifying image ${{ inputs.image_tag }} exists in GHCR..."
+          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-ccloud:${{ inputs.image_tag }} 2>&1); then
+            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-ccloud"
+            echo "Resolve output: $digest"
+            exit 1
+          fi
+          echo "Image tag present in GHCR (digest: ${digest:0:12}...)"
       - name: Install Dependencies
         uses: ./.github/actions/test/integration/dependencies
-      - name: Obtain newest Tag from GHCR
-        id: fetch_tag
-        if: ${{ inputs.image_tag == '' || github.event_name == 'workflow_run' || github.event_name == 'push' }}
-        run: |
-          latest_tag=$(oras repo tags ghcr.io/gardenlinux/gardenlinux-ccloud | grep -E '^[0-9]+\.[0-9]+\.[0-9]+-metal-sci-usi-amd64-[0-9]+-[0-9]+-[0-9]-[0-9a-f]{8}$' | sort -r | head -n 1)
-          echo $latest_tag
-          echo "latest_tag=$latest_tag" >> $GITHUB_ENV
       - name: Build
         uses: ./.github/actions/test/integration/build
         with:
-          image_tag: ${{ env.latest_tag || inputs.image_tag }}
+          image_tag: ${{ inputs.image_tag }}
       - name: Setup
         uses: ./.github/actions/test/integration/setup
       - name: Test QEMU

From bb5096bfabe02897f989aa53eadd650de4e29889 Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Wed, 4 Feb 2026 14:48:54 +0100
Subject: [PATCH 040/127] ci: centralize image tag computation in reusable
 script

---
 .github/scripts/compute-image-tag.sh | 45 ++++++++++++++++++++++++++++
 .github/workflows/dev.yml            | 12 ++++----
 .github/workflows/nightly.yaml       | 15 ++++------
 3 files changed, 57 insertions(+), 15 deletions(-)
 create mode 100755 .github/scripts/compute-image-tag.sh

diff --git a/.github/scripts/compute-image-tag.sh b/.github/scripts/compute-image-tag.sh
new file mode 100755
index 00000000..d0c9c389
--- /dev/null
+++ b/.github/scripts/compute-image-tag.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Computes the OCI image tag for Garden Linux ccloud images
+#
+# This script centralizes the image tag format computation to ensure consistency
+# across all workflows (nightly, dev, upload_oci).
+#
+# Usage:
+#   ./compute-image-tag.sh <version> [flavor]
+#
+# Arguments:
+#   version - The version for the tag (e.g., "1877.10.1", "pr-123")
+#   flavor  - The image flavor (e.g., "metal-sci-usi-amd64"). Defaults to "metal-sci-usi-amd64".
+#
+# Environment:
+#   GITHUB_SHA - Git commit SHA (required, set automatically by GitHub Actions)
+#
+# Output:
+#   Prints the computed image tag to stdout
+#
+# Tag format:
+#   {version}-{flavor}-{dashed_version}-{commit_sha_short}
+#
+# Examples:
+#   ./compute-image-tag.sh "1877.10.1"
+#   # Output: 1877.10.1-metal-sci-usi-amd64-1877-10-1-abcd1234
+#
+#   ./compute-image-tag.sh "pr-123" "metal-capi-amd64"
+#   # Output: pr-123-metal-capi-amd64-pr-123-abcd1234
+
+set -euo pipefail
+
+VERSION="${1:?Error: VERSION argument required}"
+FLAVOR="${2:-metal-sci-usi-amd64}"
+
+if [ -z "${GITHUB_SHA:-}" ]; then
+    echo "Error: GITHUB_SHA environment variable is required" >&2
+    exit 1
+fi
+
+COMMIT_SHA="${GITHUB_SHA::8}"
+DASHED_VERSION="${VERSION//./-}"
+
+IMAGE_TAG="${VERSION}-${FLAVOR}-${DASHED_VERSION}-${COMMIT_SHA}"
+
+echo "$IMAGE_TAG"
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 08e38cd9..ccb0cc65 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -51,16 +51,18 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       UPLOAD_VERSION: ${{ steps.meta.outputs.upload_version }}
-      COMMIT_SHA: ${{ steps.meta.outputs.sha }}
+      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
-      - name: Derive image version
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Compute image metadata
         id: meta
         run: |
           PR_NUMBER=${{ github.event.pull_request.number }}
           UPLOAD_VERSION="pr-${PR_NUMBER}"
           echo "upload_version=${UPLOAD_VERSION}" >> $GITHUB_OUTPUT
-          SHA="${GITHUB_SHA::8}"
-          echo "sha=${SHA}" >> $GITHUB_OUTPUT
+          IMAGE_TAG=$(.github/scripts/compute-image-tag.sh "${UPLOAD_VERSION}")
+          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
 
   upload:
     name: Upload PR image to OCI
@@ -79,7 +81,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.action != 'closed' }}
     uses: ./.github/workflows/test.yml
     with:
-      image_tag: "${{ needs.meta.outputs.UPLOAD_VERSION }}-metal-sci-usi-amd64-${{ needs.meta.outputs.UPLOAD_VERSION }}-${{ needs.meta.outputs.COMMIT_SHA }}"
+      image_tag: ${{ needs.meta.outputs.image_tag }}
 
   cleanup_images:
     name: Cleanup PR images
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 6db62613..327f3d78 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -37,20 +37,15 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     outputs:
-      VERSION: ${{ needs.build.outputs.version }}
-      DASHED_VERSION: ${{ steps.meta.outputs.dashed_version }}
-      COMMIT_SHA: ${{ steps.meta.outputs.sha }}
+      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - name: Derive image metadata
+      - name: Compute image tag
         id: meta
         run: |
-          SHA="${GITHUB_SHA::8}"
-          echo "sha=${SHA}" >> $GITHUB_OUTPUT
-          VERSION="${{ needs.build.outputs.version }}"
-          DASHED_VERSION=${VERSION//./-}
-          echo "dashed_version=${DASHED_VERSION}" >> $GITHUB_OUTPUT
+          IMAGE_TAG=$(.github/scripts/compute-image-tag.sh "${{ needs.build.outputs.version }}")
+          echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
   upload_oci:
     name: Run glcli to publish to OCI
     needs: [build]
@@ -64,4 +59,4 @@ jobs:
     needs: [meta, upload_oci]
     uses: ./.github/workflows/test.yml
     with:
-      image_tag: "${{ needs.meta.outputs.VERSION }}-metal-sci-usi-amd64-${{ needs.meta.outputs.DASHED_VERSION }}-${{ needs.meta.outputs.COMMIT_SHA }}"
+      image_tag: ${{ needs.meta.outputs.image_tag }}

From 1645aeab85f9f17a3100c1273c58b411e7f4592b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 12 Feb 2026 17:04:45 +0100
Subject: [PATCH 041/127] update libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="11.10.0-2gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl4%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl6%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl5%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index cfc351cc..897494f9 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl4%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl6%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl5%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 4ac59946bd9c2c1215891043745e8365cd94f3ed Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 12 Feb 2026 17:13:09 +0100
Subject: [PATCH 042/127] Update to 1877.10.3

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index cf0ab4f5..783093aa 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.10.2
+1877.10.3

From 0adbdd926f1b8464dfb99b8461f2f2b4793b8c05 Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Tue, 27 Jan 2026 15:14:54 +0100
Subject: [PATCH 043/127] ci: disable libvirt TLS/TCP sockets for CI tests

Mask libvirtd-tls.socket and libvirtd-tcp.socket via Ignition. CI tests
only need local Unix socket access, not remote TLS connections. This
avoids missing CA cert errors.
---
 .../actions/test/integration/build/dev-user-butane.yaml    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index b8486454..f7a331f1 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -85,3 +85,10 @@ storage:
         kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h
         kernel.core_pipe_limit=16
         fs.suid_dumpable=2
+# Disable libvirt sockets not required for CI tests
+systemd:
+  units:
+    - name: libvirtd-tls.socket
+      mask: true
+    - name: libvirtd-tcp.socket
+      mask: true

From b163611af28c4e88bc78dda638cea1f47d99ffbd Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 19 Feb 2026 18:53:16 +0100
Subject: [PATCH 044/127] Bump libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="11.10.0-2gl6%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl5%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl7%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl7%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 897494f9..f755033e 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl6%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl5%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl7%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl7%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 2ec3151f4c63a9d1a62ea3f60c91b4d3a456564f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 19 Feb 2026 19:34:21 +0100
Subject: [PATCH 045/127] Update to 1877.10.4

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 783093aa..a1150058 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.10.3
+1877.10.4

From 2cdc2acc8bdc06388374f70c1ba8b70dc1e8da3b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 23 Feb 2026 13:42:44 +0100
Subject: [PATCH 046/127] [usi] add further presets

disable update services in addition to their timers
---
 .../etc/systemd/system-preset/00-systemd-usi.preset             | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/features/_usi/file.include/etc/systemd/system-preset/00-systemd-usi.preset b/features/_usi/file.include/etc/systemd/system-preset/00-systemd-usi.preset
index 56084989..55578a5e 100644
--- a/features/_usi/file.include/etc/systemd/system-preset/00-systemd-usi.preset
+++ b/features/_usi/file.include/etc/systemd/system-preset/00-systemd-usi.preset
@@ -2,4 +2,6 @@
 disable apt-daily.timer
 disable dpkg-db-backup.timer
 disable systemd-sysupdate-reboot.timer
+disable systemd-sysupdate-reboot.service
 disable systemd-sysupdate.timer
+disable systemd-sysupdate.service

From dea4c8cfa157317f0c20d4f5e8f68dd7e318dda4 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 23 Feb 2026 13:48:43 +0100
Subject: [PATCH 047/127] Update to 1877.13

---
 .github/workflows/dev.yml      | 2 +-
 .github/workflows/nightly.yaml | 4 ++--
 gardenlinux                    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index ccb0cc65..90149f24 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -32,7 +32,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@81e502e76193219aa54365ff23e3de619902a39b
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 327f3d78..642a3ee7 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@81e502e76193219aa54365ff23e3de619902a39b
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@3d56ba627f7f471e64f36608ffbc84a441d309d9
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@81e502e76193219aa54365ff23e3de619902a39b
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/gardenlinux b/gardenlinux
index 3d56ba62..81e502e7 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 3d56ba627f7f471e64f36608ffbc84a441d309d9
+Subproject commit 81e502e76193219aa54365ff23e3de619902a39b

From a2203017f5b0e5658dedce665551c854b82376bf Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Fri, 13 Feb 2026 14:21:14 +0100
Subject: [PATCH 048/127] ci: cancel dev workflow before cleanup

---
 .github/workflows/dev.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 90149f24..f9eda1dc 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -12,6 +12,13 @@ on:
     paths-ignore:
       - "**/README.md"
       - "docs/**"
+
+# Cancel any in-progress PR workflow runs when PR is closed
+# Used to ensure cleanup runs after any PR build are uploaded (or aborts before the upload)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event.action == 'closed' }}
+
 jobs:
   set_version:
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}

From ff0b137e0d3a1eda16e643efd4876e2028113611 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 23 Feb 2026 16:29:53 +0100
Subject: [PATCH 049/127] Update to 1877.13.1

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index a1150058..8fcb3b87 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.10.4
+1877.13.1

From 1acf531abd39968951d7ae0324185c9d7c86e5f3 Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Thu, 26 Feb 2026 16:46:49 +0100
Subject: [PATCH 050/127] fix: replace gpg --dearmor with direct .asc file
 usage for apt keys

Replace gpg --dearmor operations with direct cp to .asc files for APT
repository key handling. APT natively supports ASCII-armored .asc files,
eliminating the need for GPG conversion and avoiding MD5 digest issues.

This change applies the solution from upstream PR gardenlinux/gardenlinux#4388
to the gardenlinux-ccloud repository files.

Changes:
- features/_scicommon/exec.config: Use cp to .asc for Kubernetes keyring
- features/metal3/exec.config: Use cp to .asc with generic filename
- features/khost/exec.late: Use cp to .asc for Kubernetes keyring

Note: Changes to gardenlinux submodule features will be handled independently.
---
 features/_scicommon/exec.config | 4 ++--
 features/khost/exec.late        | 4 ++--
 features/metal3/exec.config     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/features/_scicommon/exec.config b/features/_scicommon/exec.config
index c67667e1..5efda446 100755
--- a/features/_scicommon/exec.config
+++ b/features/_scicommon/exec.config
@@ -17,14 +17,14 @@ K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
 # curl -fsSL https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/Release.key > pkgs-k8s-io_${K8S_VERSION_REPO}_release.key
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" <"/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key"
+cp "/builder/features/_scicommon/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
 
 cat <<EOF | tee /etc/apt/sources.list.d/kubernetes-"${K8S_VERSION_REPO}".sources
 Types: deb
 Architectures: amd64
 URIs: https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/
 Suites: /
-Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg
+Signed-By: /etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc
 EOF
 
 DEBIAN_FRONTEND=noninteractive apt update -y
diff --git a/features/khost/exec.late b/features/khost/exec.late
index 69bcfa62..f0ea8caf 100755
--- a/features/khost/exec.late
+++ b/features/khost/exec.late
@@ -4,8 +4,8 @@ set -Eeuo pipefail
 K8S_VERSION=v1.34.3
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg < /builder/features/khost/release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
+cp /builder/features/khost/release.key /etc/apt/keyrings/kubernetes-apt-keyring.asc
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list
 apt update -y
 apt install -y --no-install-recommends "kubelet=${K8S_VERSION#v}*" "kubectl=${K8S_VERSION#v}*" "kubeadm=${K8S_VERSION#v}*" "cri-tools=${K8S_VERSION_REPO#v}*"
 
diff --git a/features/metal3/exec.config b/features/metal3/exec.config
index b15043a1..4fdb8e0f 100755
--- a/features/metal3/exec.config
+++ b/features/metal3/exec.config
@@ -26,7 +26,7 @@ apt-mark hold ${package_name}
 K8S_VERSION=v1.30.7
 K8S_VERSION_REPO="${K8S_VERSION%.*}"
 
-gpg --dearmor -o "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg" </builder/features/metal3/pkgs-k8s-io_1.30_release.key
-echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
+cp "/builder/features/metal3/pkgs-k8s-io_${K8S_VERSION_REPO}_release.key" "/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc"
+echo "deb [signed-by=/etc/apt/keyrings/kubernetes-${K8S_VERSION_REPO}-apt-keyring.asc] https://pkgs.k8s.io/core:/stable:/${K8S_VERSION_REPO}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes-${K8S_VERSION_REPO}.list
 apt update -y
 apt install -y --no-install-recommends "cri-tools=${K8S_VERSION_REPO#v}*"

From 22834d451a6c833f918ba48caec921f94e563d0b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 26 Feb 2026 10:08:33 +0100
Subject: [PATCH 051/127] root-hints: improve installation to disk

In case no root-hints.yaml is provided we fall back to select the first
available smallest device.

We check in addition if there is already an ESP disk.

* Best case there is none and we can use the smallest one.
* If there is an ESP disk we
** check if ESP disk is on the smallest found disk and if so use it
** we fail if ESP disk is not the same as the smallest disk
---
 .../actions/test/integration/build/action.yml | 17 +++-
 .../integration/build/dev-user-butane.yaml    |  6 --
 .../test/integration/build/root-hints.yaml    |  6 ++
 .../actions/test/integration/setup/action.yml |  3 +-
 .github/actions/test/integration/setup/hv.xml |  2 +-
 .../_usi/initrd.include/usr/bin/detect_disk   |  4 -
 features/_usi/initrd.include/usr/bin/persist  |  5 +
 .../_usi/initrd.include/usr/bin/root-hints    | 92 +++++++++++++++++--
 8 files changed, 110 insertions(+), 25 deletions(-)
 create mode 100644 .github/actions/test/integration/build/root-hints.yaml

diff --git a/.github/actions/test/integration/build/action.yml b/.github/actions/test/integration/build/action.yml
index adcf018c..eca53a32 100644
--- a/.github/actions/test/integration/build/action.yml
+++ b/.github/actions/test/integration/build/action.yml
@@ -99,12 +99,21 @@ runs:
         chmod 600 /opt/ssh_host_ed25519_key
         SSH_KEY=$(cat /opt/ssh_host_ed25519_key.pub)
         echo "SSH_KEY=$SSH_KEY" >> $GITHUB_ENV
-        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
+        cp ./.github/actions/test/integration/build/dev-user-butane.yaml ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        yq '.storage.files += load("./.github/actions/test/integration/build/root-hints.yaml")' ./.github/actions/test/integration/build/dev-user-butane.yaml > ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
+        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|SSH_KEY_GOES_HERE|$SSH_KEY|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
         PASSWORD=$(openssl passwd "password")
         echo "PASSWORD=$PASSWORD" >> $GITHUB_ENV
-        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
-        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane.yaml
-        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane.yaml > "/opt/${TAG}.ign"
+        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|PASSWORD_GOES_HERE|$PASSWORD|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml
+        sed -i "s|TAG_GOES_HERE|${{ inputs.image_tag }}|g" ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml
+
+        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane-hv1.yaml > "/opt/${TAG}-hv1.ign"
+        butane --pretty --strict ./.github/actions/test/integration/build/dev-user-butane-hv2.yaml > "/opt/${TAG}-hv2.ign"
 
     - name: Download ubuntu cloud image
       shell: bash
diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index f7a331f1..9eb08a14 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -37,12 +37,6 @@ storage:
         # custom
         192.168.122.2 hv1
         192.168.122.3 hv2
-  - path: /opt/persist/root-hints.yaml
-    mode: 0644
-    contents:
-      inline: |
-        hints:
-          - size: lt 500G
   # turn off hugepages, not required for this test
   # also SIGNIFICANTLY reduces test runtime
   - path: /opt/persist/hugepages.env
diff --git a/.github/actions/test/integration/build/root-hints.yaml b/.github/actions/test/integration/build/root-hints.yaml
new file mode 100644
index 00000000..59159664
--- /dev/null
+++ b/.github/actions/test/integration/build/root-hints.yaml
@@ -0,0 +1,6 @@
+- path: /opt/persist/root-hints.yaml
+  mode: 0644
+  contents:
+    inline: |
+      hints:
+        - size: lt 500G
diff --git a/.github/actions/test/integration/setup/action.yml b/.github/actions/test/integration/setup/action.yml
index 915b282b..1b8b1bea 100644
--- a/.github/actions/test/integration/setup/action.yml
+++ b/.github/actions/test/integration/setup/action.yml
@@ -15,7 +15,8 @@ runs:
     - name: Copy ignition file
       shell: bash
       run: |
-        sudo cp "/opt/${TAG}.ign" /var/lib/libvirt/images/hv.ign
+        sudo cp "/opt/${TAG}-hv1.ign" /var/lib/libvirt/images/HV1.ign
+        sudo cp "/opt/${TAG}-hv2.ign" /var/lib/libvirt/images/HV2.ign
 
     - name: Create HyperVisor 1
       shell: bash
diff --git a/.github/actions/test/integration/setup/hv.xml b/.github/actions/test/integration/setup/hv.xml
index 90ab559f..63341fbf 100644
--- a/.github/actions/test/integration/setup/hv.xml
+++ b/.github/actions/test/integration/setup/hv.xml
@@ -32,6 +32,6 @@
     </devices>
     <qemu:commandline>
         <qemu:arg value='-fw_cfg' />
-        <qemu:arg value='name=opt/com.coreos/config,file=/var/lib/libvirt/images/hv.ign' />
+        <qemu:arg value='name=opt/com.coreos/config,file=/var/lib/libvirt/images/HV_NAME_GOES_HERE.ign' />
     </qemu:commandline>
 </domain>
diff --git a/features/_usi/initrd.include/usr/bin/detect_disk b/features/_usi/initrd.include/usr/bin/detect_disk
index 0a8fb937..d061a300 100755
--- a/features/_usi/initrd.include/usr/bin/detect_disk
+++ b/features/_usi/initrd.include/usr/bin/detect_disk
@@ -4,10 +4,6 @@ set -Eeuo pipefail
 
 ROOT_HINTS_FILE="/sysroot/opt/persist/root-hints.yaml"
 
-if ! [[ -f $ROOT_HINTS_FILE ]]; then
-	echo "no root-hints.yaml provided, error"
-	exit 1
-fi
 if kname=$(/usr/bin/root-hints $ROOT_HINTS_FILE); then
 	echo "/dev/${kname}"
 else
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 018dffcd..7a6ad93f 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -6,6 +6,11 @@ if ! disk_dev=$(/usr/bin/detect_disk); then
 	exit 1
 fi
 
+if [[ ! -b "$disk_dev" ]]; then
+  echo "Device $disk_dev not found, exiting"
+  exit 1
+fi
+
 # clean up the disk
 sgdisk -Z "$disk_dev"
 sgdisk -o "$disk_dev"
diff --git a/features/_usi/initrd.include/usr/bin/root-hints b/features/_usi/initrd.include/usr/bin/root-hints
index 5186752f..360bac06 100755
--- a/features/_usi/initrd.include/usr/bin/root-hints
+++ b/features/_usi/initrd.include/usr/bin/root-hints
@@ -2,12 +2,17 @@
 
 set -Eeuo pipefail
 
+# setup error trap
+trap 'err "Error occurred at line $LINENO while executing: $BASH_COMMAND"' ERR
+
 function yqroot() {
 	cat "$1" | chroot /sysroot /usr/bin/yq -c '.hints | .[]'
 }
 
 function err() {
 	echo "$@" 1>&2
+
+  lsblk -bOJ | jq
 }
 
 function filter() {
@@ -27,25 +32,94 @@ function filter() {
 	fi
 	if [[ $val =~ ^[0-9]+[KMGT]+$ ]]; then
 		val=$(echo "$val" | numfmt --from=iec)
-		echo "and ${col^^} $op ${val}"
+		echo "${col^^} $op ${val}"
 	else
-		echo "and ${col^^} $op \"${val}\""
+		echo "${col^^} $op \"${val}\""
 	fi
+}
 
+function blockdevicesize() {
+  local kname="$1"
+  lsblk -bOJ | jq --arg kname "$kname" -r '.blockdevices.[] | select(.kname == $kname).size'
 }
 
+udevadm settle
+
 yamlFile="$1"
 
+esp_disk=""
+if [ -e "/dev/disk/by-label/ESP" ]; then
+	esp_partition=$(basename "$(readlink -f /dev/disk/by-label/ESP)")
+  esp_disk=$(basename "$(readlink -f "/sys/class/block/$esp_partition/..")")
+fi
+
+# TODO: likely go rather with device uuid or alike
 #if dev=$(yq -e .dev "$yamlFile" 2> /dev/null); then
 #	echo "$dev"
 #	exit 0
 #fi
 
-flsblk="TYPE eq \"disk\""
-while IFS= read -r r; do
-	f=$(filter "$r")
-	flsblk="$flsblk $f"
-done < <(yqroot "$yamlFile" )
+declare -a flsblk=()
+# check if yaml file exists and is valid, if so, use it to build the filter for lsblk
+if [ -f "$yamlFile" ] && yq -e . "$yamlFile" >/dev/null 2>&1; then
+	while IFS= read -r r; do
+		flsblk+=("$(filter "$r")")
+	done < <(yqroot "$yamlFile")
+fi
+
+LSBLK_JSON=""
+
+function join {
+	local SEPARATOR="$1"
+	shift
+	printf "%s${SEPARATOR}" "$@" | sed --unbuffered "s/${SEPARATOR}$//"
+}
+
+# if flsblk contains elements, we join them by 'and' and use the filter with lsblk
+if [ ${#flsblk[@]} -gt 0 ]; then
+	flsfilter=$(join " and " "${flsblk[@]}")
+	echo "Using filter: $flsfilter" 1>&2
+	LSBLK_JSON=$(lsblk --sort size --exclude 1,2,3,4,7,11 --filter "$flsfilter" -OJ)
+else
+	# no hints, hence we choose the smallest disk we find. we exclude ram disk,
+	# floppy, ide, dynamically allocated, loopback and scsi cd-rom devices
+	LSBLK_JSON=$(lsblk --sort size --exclude 1,2,3,4,7,11 -OJ)
+fi
 
-#echo "$flsblk"
-lsblk --filter "$flsblk" --noheadings -o kname
+# from the resulting list of disks we pick the first disk that are writeable
+kname=$(echo "$LSBLK_JSON" | jq -r '[.blockdevices.[]|select(.type? == "disk" and .ro? == false)][0].kname // ""')
+
+# check which disk to use.
+# 1. if kname is empty:
+#    * we check if we have an esp_disk, if so we use it
+#    * otherwise we fail
+# 2. if kname is not empty:
+#    * we check if we have an esp_disk, if not we use
+#    * kname, otherwise we check if they are the same, if not we fail, otherwise we use kname/esp_disk
+if [ -z "$kname" ]; then
+	if [ -z "$esp_disk" ]; then
+		err "No suitable disk found"
+		exit 1
+	fi
+	echo "Warning: No suitable disk found, falling back to ESP disk ${esp_disk}" 1>&2
+	echo "$esp_disk"
+else
+	if [ -z "$esp_disk" ]; then
+		# no esp_disk using kname
+		echo "$kname"
+    exit 0
+	fi
+
+	if [ "$kname" != "$esp_disk" ]; then
+    # check if desvice size are the same
+    err "Error: Found disk ${kname} does not match ESP disk ${esp_disk}." 1>&2
+    kname_size=$(blockdevicesize "$kname")
+    esp_disk_size=$(blockdevicesize "$esp_disk")
+    if [ "$kname_size" != "$esp_disk_size" ]; then
+      err "Error: Found disk ${kname} size ${kname_size} does not match ESP disk ${esp_disk} size ${esp_disk_size}." 1>&2
+      exit 1
+    fi
+	fi
+	# kname == esp_disk or esp_disk has similar size to kname
+	echo "$esp_disk"
+fi

From 527f7f43233b6b0358f74527e9d1e34e0bf734a3 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 26 Feb 2026 18:26:08 +0100
Subject: [PATCH 052/127] bump libvirt and cloud hypervisor packages

```diff
-LIBVIRT_VERSION="11.10.0-2gl7%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl7%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl8%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl8%2Bbp1877"
```
---
 features/sci/exec.config | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index f755033e..641496e1 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,9 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl7%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl7%2Bbp1877"
+LIBVIRT_VERSION="11.10.0-2gl8%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl8%2Bbp1877"
+
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From f116c03f2e65fcba8f1f265ad305705a2b937a8d Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 26 Feb 2026 20:20:43 +0100
Subject: [PATCH 053/127] Update to 1877.13.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 8fcb3b87..4aca127b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.1
+1877.13.2

From 2e15fd34eaacd2ecc6a8bcc3aa49de36a102dad7 Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Wed, 4 Mar 2026 15:36:41 +0100
Subject: [PATCH 054/127] sci: load kvm modules via modules-load.d to fix
 libvirtd boot race

libvirtd's Cloud Hypervisor driver does a one-time /dev/kvm existence
check at init (ch_conf.c). If /dev/kvm doesn't exist at that moment
the driver is permanently skipped with no retry.

kvm_amd/kvm_intel are loaded by udev (non-deterministic), not by
systemd-modules-load.service (which runs Before=sysinit.target).
This creates a race: libvirtd can start before /dev/kvm is created.

Adding kvm.conf to modules-load.d moves loading to
systemd-modules-load.service, which is guaranteed to complete before
libvirtd starts (via the sysinit.target -> multi-user.target chain).
The arch-mismatched module fails harmlessly with -EOPNOTSUPP.

Fixes intermittent CI failures in Test CloudHypervisor jobs.
---
 features/sci/file.include/etc/modules-load.d/kvm.conf | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 features/sci/file.include/etc/modules-load.d/kvm.conf

diff --git a/features/sci/file.include/etc/modules-load.d/kvm.conf b/features/sci/file.include/etc/modules-load.d/kvm.conf
new file mode 100644
index 00000000..01884b87
--- /dev/null
+++ b/features/sci/file.include/etc/modules-load.d/kvm.conf
@@ -0,0 +1,3 @@
+kvm
+kvm_amd
+kvm_intel

From 9db096ea008f3accb7d1a38f65bd6e92e94b22e1 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 00:33:50 +0100
Subject: [PATCH 055/127] Update packages

```diff
-EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl8%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl8%2Bbp1877"
-
+EDK2_VERSION="20260221-0gl1%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl9%2Bbp1877"
```
---
 features/sci/exec.config | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 641496e1..14ea9d6b 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -8,10 +8,9 @@ systemctl enable ssh
 # TODO : these all should go in the repo
 
 # all versions URL encoded
-EDK2_VERSION="20250503-7gl0%2Bbp1877"
-LIBVIRT_VERSION="11.10.0-2gl8%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl8%2Bbp1877"
-
+EDK2_VERSION="20260221-0gl1%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl0%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="50.0-1gl9%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From feb5ebbaad96b58fa53a4f999addc3f9156e3f4c Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 00:34:29 +0100
Subject: [PATCH 056/127] Update to 1877.13.3

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 4aca127b..6089346b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.2
+1877.13.3

From ea6903f0d6a0ffc35fa08100e3e71056627eba46 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 09:02:00 +0100
Subject: [PATCH 057/127] CI: create folder for
 virt-secret-init-encryption.service

---
 .../actions/test/integration/build/dev-user-butane.yaml    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index 9eb08a14..e37bceb2 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -86,3 +86,10 @@ systemd:
       mask: true
     - name: libvirtd-tcp.socket
       mask: true
+
+    - name: virt-secret-init-encryption.service
+      dropins:
+        - name: create-dir.conf
+          contents: |
+            [Service]
+            ExecStartPre=/usr/bin/mkdir -p /var/lib/libvirt/secrets

From 480c8201dc3197fdf085447c737404bf732d71dc Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 11:36:04 +0100
Subject: [PATCH 058/127] Revert "CI: create folder for
 virt-secret-init-encryption.service"

This reverts commit ea6903f0d6a0ffc35fa08100e3e71056627eba46.
---
 .../actions/test/integration/build/dev-user-butane.yaml    | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index e37bceb2..9eb08a14 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -86,10 +86,3 @@ systemd:
       mask: true
     - name: libvirtd-tcp.socket
       mask: true
-
-    - name: virt-secret-init-encryption.service
-      dropins:
-        - name: create-dir.conf
-          contents: |
-            [Service]
-            ExecStartPre=/usr/bin/mkdir -p /var/lib/libvirt/secrets

From ded4a060f2b254485a9ee27bb8cce2763c38e8bb Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 11:37:02 +0100
Subject: [PATCH 059/127] bump libvirtd packge

---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 14ea9d6b..f24b9b99 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,7 +9,7 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl0%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl1%2Bbp1877"
 CLOUD_HYPERVISOR_VERSION="50.0-1gl9%2Bbp1877"
 
 mkdir /tmp/custompackages

From 971c3972449f1599329e6e79b15e75374685c960 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 6 Mar 2026 11:37:54 +0100
Subject: [PATCH 060/127] Update to 1877.13.4

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 6089346b..6d52c527 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.3
+1877.13.4

From f73a9ab299ac70194232fc63728e91484d4ae3d6 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 13 Mar 2026 10:17:40 +0100
Subject: [PATCH 061/127] Update libvirt and cloud hypervisor packages

```diff
-LIBVIRT_VERSION="12.1.0-1gl1%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl9%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl0%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index f24b9b99..8e5d2cb5 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl1%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="50.0-1gl9%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl0%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From c4e65fc7ff7806191d3625929de3b7af3b68de53 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 13 Mar 2026 11:36:32 +0100
Subject: [PATCH 062/127] Update to 1877.13.5

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 6d52c527..da3ed394 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.4
+1877.13.5

From 7c0d1166bef32e9e64fe94448bcc6e0457482686 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 18 Mar 2026 12:10:23 +0100
Subject: [PATCH 063/127] Update libvirt and cloud hypervior

```diff
-LIBVIRT_VERSION="12.1.0-1gl2%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl0%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl1%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 8e5d2cb5..5ed014a0 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl2%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl0%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl1%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From a0b7389ca841121be2d69ea6e1bb80a5b66a6fdb Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 18 Mar 2026 12:49:26 +0100
Subject: [PATCH 064/127] Update to 1877.13.6

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index da3ed394..049a4556 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.5
+1877.13.6

From 48338c23436ad7b2ec616be682ee7ac70126cd98 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 19 Mar 2026 15:22:49 +0100
Subject: [PATCH 065/127] Update packages libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="12.1.0-1gl3%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl1%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl2%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 5ed014a0..a9694d5f 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl3%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl1%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl2%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 6d5b90a5428f8d92670e4bf337da54b1e9f2bce0 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 19 Mar 2026 16:36:32 +0100
Subject: [PATCH 066/127] Update to 1877.13.7

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 049a4556..c06ed8cc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.6
+1877.13.7

From ff0fba41313828daa79d5d9c4784dc3fea844aa0 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Tue, 24 Mar 2026 15:19:41 +0100
Subject: [PATCH 067/127] Update upload_oci.yml

---
 .github/workflows/upload_oci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 896e2495..3d189869 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -40,7 +40,7 @@ jobs:
       - uses: oras-project/setup-oras@v1
       - run: oras version
       - name: Install python-gardenlinux-lib
-        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@hotfix-disabled-python-cache-in-setup-action
+        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Install cosign
         uses: sigstore/cosign-installer@v3.9.1
         with:
@@ -118,7 +118,7 @@ jobs:
         with:
           submodules: true
       - name: Install python-gardenlinux-lib
-        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@hotfix-disabled-python-cache-in-setup-action
+        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Set flavor version reference
         run: |
           git rev-parse HEAD | cut -c1-8 | tee COMMIT

From 0a55f588b6464bd7ba2d65056fa5abe8e77bcc13 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 23 Mar 2026 21:01:43 +0100
Subject: [PATCH 068/127] Update cloud hypervisor package

```diff
-CLOUD_HYPERVISOR_VERSION="51.1-1gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl3%2Bbp1877"
```
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index a9694d5f..b03a8973 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,7 +10,7 @@ systemctl enable ssh
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
 LIBVIRT_VERSION="12.1.0-1gl4%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl3%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From e5bbbdb03841e615df55190994b49465cd466d02 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 24 Mar 2026 18:14:46 +0100
Subject: [PATCH 069/127] bump build_flavors_matrix.yml ref and update gl-oci
 tool usage

---
 .github/workflows/upload_oci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 3d189869..a91f906b 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@40e7dfa820cb8bd5e0317779f818d31464c18c63
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@81e502e76193219aa54365ff23e3de619902a39b # pin@1877.13
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
@@ -138,7 +138,7 @@ jobs:
           mkdir manifests
           mv oci_manifest_entry_${CNAME}.json manifests/
 
-          gl-oci update-index \
-            --container "ghcr.io/${{ github.repository }}" \
-            --version ${{ inputs.upload_version || inputs.version }} \
+          gl-oci push-index-from-directory \
+            --index "ghcr.io/${{ github.repository }}" \
+            --index-tag ${{ inputs.upload_version || inputs.version }} \
             --manifest_folder manifests

From 5917a4bf38c173a39410f3295df27134999a90d6 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 24 Mar 2026 21:09:42 +0100
Subject: [PATCH 070/127] Update to 1877.13.8

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index c06ed8cc..3c51a91a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.7
+1877.13.8

From c8047d831018a2bc301d871fe98d313c5bfcea7e Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Wed, 25 Mar 2026 15:55:35 +0100
Subject: [PATCH 071/127] Load kvm_* only when the proper cpu is present

---
 features/sci/file.include/etc/modprobe.d/kvm-amd.conf   | 1 +
 features/sci/file.include/etc/modprobe.d/kvm-intel.conf | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 features/sci/file.include/etc/modprobe.d/kvm-amd.conf
 create mode 100644 features/sci/file.include/etc/modprobe.d/kvm-intel.conf

diff --git a/features/sci/file.include/etc/modprobe.d/kvm-amd.conf b/features/sci/file.include/etc/modprobe.d/kvm-amd.conf
new file mode 100644
index 00000000..79910fc2
--- /dev/null
+++ b/features/sci/file.include/etc/modprobe.d/kvm-amd.conf
@@ -0,0 +1 @@
+install kvm_amd if grep -q AuthenticAMD /proc/cpuinfo; then modprobe --ignore-install kvm_amd; else echo "WARNING kvm_amd: no AMD cpu found, skipping"; exit 0; fi 
diff --git a/features/sci/file.include/etc/modprobe.d/kvm-intel.conf b/features/sci/file.include/etc/modprobe.d/kvm-intel.conf
new file mode 100644
index 00000000..67abf1e0
--- /dev/null
+++ b/features/sci/file.include/etc/modprobe.d/kvm-intel.conf
@@ -0,0 +1 @@
+install kvm_intel if grep -q GenuineIntel /proc/cpuinfo; then modprobe --ignore-install kvm_intel; else echo "WARNING kvm_intel: no Intel cpu found, skipping"; exit 0; fi 

From 2f983fbf2f34d3fcf87bd47ded44d948de591ed2 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Wed, 25 Mar 2026 16:11:19 +0100
Subject: [PATCH 072/127] Remove cronjobs

Do not include

* update-pciids/usbids
* dpgk
* apt-compat
* quota

as cronjobs
---
 features/_usi/file.exclude | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/features/_usi/file.exclude b/features/_usi/file.exclude
index 9c50a71c..86e0873c 100644
--- a/features/_usi/file.exclude
+++ b/features/_usi/file.exclude
@@ -6,3 +6,8 @@
 #/opt/{,.}*
 #/home/{,.}*
 /root/{,.}*
+/etc/cron.daily/apt-compat
+/etc/cron.daily/dpkg
+/etc/cron.daily/quota
+/etc/cron.monthly/update-pciids
+/etc/cron.monthly/update-usbids

From ac625a559592cbb4ccf2747e7f0fdcf165b8a22b Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Thu, 26 Mar 2026 16:35:54 +0100
Subject: [PATCH 073/127] Add preset to disable ipmievd

---
 .../sci/file.include/etc/systemd/system-preset/10-ipmiev.preset | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset

diff --git a/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset b/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset
new file mode 100644
index 00000000..a4793fd0
--- /dev/null
+++ b/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset
@@ -0,0 +1,2 @@
+# default presets for sci image
+disable ipmievd

From 663c3ce86f3ea3428ad91619aedb99692dda18c7 Mon Sep 17 00:00:00 2001
From: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
Date: Thu, 26 Mar 2026 16:53:32 +0100
Subject: [PATCH 074/127] mask systemd-repart for _usi

---
 .../_usi/file.include/etc/systemd/system/systemd-repart.service  | 1 +
 .../initrd.include/etc/systemd/system/systemd-repart.service     | 1 +
 2 files changed, 2 insertions(+)
 create mode 120000 features/_usi/file.include/etc/systemd/system/systemd-repart.service
 create mode 120000 features/_usi/initrd.include/etc/systemd/system/systemd-repart.service

diff --git a/features/_usi/file.include/etc/systemd/system/systemd-repart.service b/features/_usi/file.include/etc/systemd/system/systemd-repart.service
new file mode 120000
index 00000000..dc1dc0cd
--- /dev/null
+++ b/features/_usi/file.include/etc/systemd/system/systemd-repart.service
@@ -0,0 +1 @@
+/dev/null
\ No newline at end of file
diff --git a/features/_usi/initrd.include/etc/systemd/system/systemd-repart.service b/features/_usi/initrd.include/etc/systemd/system/systemd-repart.service
new file mode 120000
index 00000000..dc1dc0cd
--- /dev/null
+++ b/features/_usi/initrd.include/etc/systemd/system/systemd-repart.service
@@ -0,0 +1 @@
+/dev/null
\ No newline at end of file

From 62bb1b15d57895f5979939548f114a57adf1733a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 26 Mar 2026 17:33:18 +0100
Subject: [PATCH 075/127] Update libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="12.1.0-1gl4%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl3%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl4%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index b03a8973..47b072c3 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl4%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl3%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl4%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 947cb29f2cd74bf94122e79f74187cc9f855e975 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 26 Mar 2026 18:04:30 +0100
Subject: [PATCH 076/127] Update to 1877.13.9

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 3c51a91a..819de120 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.8
+1877.13.9

From ced49677a614aedb8fe337624e220f73a3803162 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Fri, 27 Mar 2026 13:59:11 +0100
Subject: [PATCH 077/127] fix ipmievd preset (#211)

Co-authored-by: Stefan Catargiu <13122921+5kt@users.noreply.github.com>
---
 .../sci/file.include/etc/systemd/system-preset/10-ipmiev.preset | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset b/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset
index a4793fd0..17ed7623 100644
--- a/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset
+++ b/features/sci/file.include/etc/systemd/system-preset/10-ipmiev.preset
@@ -1,2 +1,2 @@
 # default presets for sci image
-disable ipmievd
+disable ipmievd.service

From 790e26da81ba84e462b131352ac280762e80bb0e Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 27 Mar 2026 15:27:05 +0100
Subject: [PATCH 078/127] Bump cloud hypervisor package

```diff
-CLOUD_HYPERVISOR_VERSION="51.1-1gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl5%2Bbp1877"
```
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 47b072c3..b47060b4 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,7 +10,7 @@ systemctl enable ssh
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
 LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl5%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 66ee02edcdc3fb7997a1d4b0a984f2140e326d1b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:10:22 +0100
Subject: [PATCH 079/127] Update to 1877.13.10

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 819de120..798a8267 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.9
+1877.13.10

From a9af970401466a9dadaf343d15fa3db52b5e94fa Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 30 Mar 2026 12:26:09 +0200
Subject: [PATCH 080/127] Update cloud hypervisor

```diff
-CLOUD_HYPERVISOR_VERSION="51.1-1gl5%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl6%2Bbp1877"
```
---
 features/sci/exec.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index b47060b4..7e0d33a3 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,7 +10,7 @@ systemctl enable ssh
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
 LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl5%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl6%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 1af563313d6a53e8658b15bad2338e5c23ce814f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 30 Mar 2026 13:31:54 +0200
Subject: [PATCH 081/127] Update to 1877.13.11

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 798a8267..2bb17315 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.10
+1877.13.11

From 57eb01538aea1ae7fd16eae1f722719f7295001c Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 31 Mar 2026 15:46:41 +0200
Subject: [PATCH 082/127] Bump packages libvirt and cloud hypervisor

```diff
-LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl6%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl6%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl7%2Bbp1877"
```
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 7e0d33a3..f5a1ed29 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl5%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl6%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl6%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl7%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 4624643bac5cf4a1245bb6265fdf37f358912231 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 31 Mar 2026 16:30:36 +0200
Subject: [PATCH 083/127] Update to 1877.13.12

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 2bb17315..f1fbea14 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.11
+1877.13.12

From f8e4f50e9b473b8f484955cd4640211a102c15be Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 14 Apr 2026 15:01:03 +0200
Subject: [PATCH 084/127] Update refs to 1877.14

---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 features/pythonDev               | 1 +
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)
 create mode 120000 features/pythonDev

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index f9eda1dc..f2bb9e69 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@81e502e76193219aa54365ff23e3de619902a39b
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 642a3ee7..7cd58d05 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@81e502e76193219aa54365ff23e3de619902a39b
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@81e502e76193219aa54365ff23e3de619902a39b
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index a91f906b..819cf3a2 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@81e502e76193219aa54365ff23e3de619902a39b # pin@1877.13
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b # pin@1877.14
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/features/pythonDev b/features/pythonDev
new file mode 120000
index 00000000..2bbcd948
--- /dev/null
+++ b/features/pythonDev
@@ -0,0 +1 @@
+../gardenlinux/features/pythonDev
\ No newline at end of file
diff --git a/gardenlinux b/gardenlinux
index 81e502e7..30044208 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 81e502e76193219aa54365ff23e3de619902a39b
+Subproject commit 30044208a44ce0ca73013b5cb18a7f15153ee18b

From 85db5328f6c797b3c7801294ee97833438f798d3 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 16 Apr 2026 08:59:57 +0200
Subject: [PATCH 085/127] remove whitespace from flavors

---
 flavors.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flavors.yaml b/flavors.yaml
index a99b5107..c7fda618 100644
--- a/flavors.yaml
+++ b/flavors.yaml
@@ -1,5 +1,5 @@
 targets:
-  - name: metal 
+  - name: metal
     category: baremetal
     flavors:
       - features:
@@ -43,7 +43,7 @@ targets:
         publish: false
       - features:
           - sci
-          - _iso 
+          - _iso
         arch: amd64
         build: true
         test: true

From 166c392e3f054088b305a7936ed524288d1da221 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 15 Apr 2026 11:21:08 +0200
Subject: [PATCH 086/127] Add ignition from package repo

Until the upstream repo is updated we add the latest ignition package
from the github releases.

Update butane config version to 1.7.0 to generate 3.6.0 ignition.
---
 .../test/integration/build/dev-user-butane.yaml  |  2 +-
 .../test/integration/dependencies/action.yml     |  2 +-
 features/_usi/exec.config                        | 16 +++++++++++++++-
 features/_usi/pkg.exclude                        |  1 +
 4 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 features/_usi/pkg.exclude

diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index 9eb08a14..581c32d8 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.3.0
+version: 1.7.0
 passwd:
   users:
     - name: root
diff --git a/.github/actions/test/integration/dependencies/action.yml b/.github/actions/test/integration/dependencies/action.yml
index e1923df9..65fb700c 100644
--- a/.github/actions/test/integration/dependencies/action.yml
+++ b/.github/actions/test/integration/dependencies/action.yml
@@ -34,7 +34,7 @@ runs:
     - name: butane
       shell: bash
       run: |
-        BUTANE_VERSION="0.24.0"
+        BUTANE_VERSION="0.27.0"
         curl -LO "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu"
         chmod +x "butane-x86_64-unknown-linux-gnu"
         sudo mv "butane-x86_64-unknown-linux-gnu" /usr/local/bin/butane
diff --git a/features/_usi/exec.config b/features/_usi/exec.config
index 60b8d26b..7d98e508 100755
--- a/features/_usi/exec.config
+++ b/features/_usi/exec.config
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -eufo pipefail
+set -euo pipefail
 
 #TODO: oras should be pulled in via pkg.include, but we don't have it for 1877, will be in the next release
 pushd /tmp
@@ -19,3 +19,17 @@ mkdir -p /efi
 [ -e /usr/lib/systemd/systemd-pcrphase ] || ln -s systemd-pcrextend /usr/lib/systemd/systemd-pcrphase
 
 mkdir -p /var/etc.overlay /var/etc.overlay.workdir
+
+# temporary adding latest ignition until it is in the repo
+IGNITION_VERSION="2.26.0-0gl0%2Bbp1877"
+TEMP_DIR=$(mktemp -d)
+for p in "https://github.com/gardenlinux/package-ignition/releases/download/$IGNITION_VERSION/build.tar.xz.0000"; do
+  echo "Downloading and extracting package from $p"
+  wget -q "$p" -O - | xz -d | tar xf - -C "$TEMP_DIR"
+  ls "$TEMP_DIR"
+done
+
+pushd "$TEMP_DIR" > /dev/null
+dpkg -i ignition_*_amd64.deb
+popd > /dev/null
+rm -rf "$TEMP_DIR"
diff --git a/features/_usi/pkg.exclude b/features/_usi/pkg.exclude
new file mode 100644
index 00000000..df284caa
--- /dev/null
+++ b/features/_usi/pkg.exclude
@@ -0,0 +1 @@
+ignition

From cf86244fc87fac118d6b6049ff337026aa73352f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 23 Apr 2026 15:41:15 +0200
Subject: [PATCH 087/127] Update libvirt and cloud hypervisor packages

---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index f5a1ed29..7a513c4d 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl6%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl7%2Bbp1877"
+LIBVIRT_VERSION="12.1.0-1gl7%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl8%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From b06f541811b5f8925d38c6795aa7975b889d1362 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 24 Apr 2026 13:42:14 +0200
Subject: [PATCH 088/127] Update to 1877.14.1

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index f1fbea14..0d18e649 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.13.12
+1877.14.1

From 0daaefdfc0f5be16f27eb9d884e366f8c4a6eb3f Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 30 Apr 2026 17:13:06 +0200
Subject: [PATCH 089/127] Update to 1877.16.1

---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index f2bb9e69..a8be6552 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 7cd58d05..d8b81158 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 819cf3a2..a39ccb54 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@30044208a44ce0ca73013b5cb18a7f15153ee18b # pin@1877.14
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028 # pin@1877.14
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 0d18e649..002992e0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.14.1
+1877.16.1
diff --git a/gardenlinux b/gardenlinux
index 30044208..49b4a937 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 30044208a44ce0ca73013b5cb18a7f15153ee18b
+Subproject commit 49b4a9375d8c119b297e424c1e575eb5ad5fc028

From b8bb1badb67294419848ee8e8a8a4e7fad374eb6 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Sat, 9 May 2026 13:41:04 +0200
Subject: [PATCH 090/127] Update to 1877.17.1

---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index a8be6552..112dbe2e 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@db2199be4559d92013eccd6c9362acb6e2651f84
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d8b81158..8af02e5c 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@db2199be4559d92013eccd6c9362acb6e2651f84
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@db2199be4559d92013eccd6c9362acb6e2651f84
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index a39ccb54..4a789bef 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@49b4a9375d8c119b297e424c1e575eb5ad5fc028 # pin@1877.14
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@db2199be4559d92013eccd6c9362acb6e2651f84
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 002992e0..58c4c241 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.16.1
+1877.17.1
diff --git a/gardenlinux b/gardenlinux
index 49b4a937..db2199be 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 49b4a9375d8c119b297e424c1e575eb5ad5fc028
+Subproject commit db2199be4559d92013eccd6c9362acb6e2651f84

From 7559857964f2ec220af082ae998e37cf049d3a08 Mon Sep 17 00:00:00 2001
From: Fabian Wiesel <fabian.wiesel@sap.com>
Date: Thu, 5 Mar 2026 09:46:33 +0100
Subject: [PATCH 091/127] sci: Set nfs max_session_slots=512

Netapp recommends nconnect=8 and setting the value
to 64 times nconnect, so we end up with 512.
---
 features/sci/file.include/etc/modprobe.d/nfsclient.conf | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 features/sci/file.include/etc/modprobe.d/nfsclient.conf

diff --git a/features/sci/file.include/etc/modprobe.d/nfsclient.conf b/features/sci/file.include/etc/modprobe.d/nfsclient.conf
new file mode 100644
index 00000000..d1587635
--- /dev/null
+++ b/features/sci/file.include/etc/modprobe.d/nfsclient.conf
@@ -0,0 +1,3 @@
+# According to Netapp KVM Best Practices mount options this value should be nconnect*64 (nconnect=8)
+options nfs max_session_slots=512
+

From 40dde771ec9354539b0406e2a08f67f32c7ba2b9 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 19 May 2026 13:24:36 +0200
Subject: [PATCH 092/127] Add EU funding logo to README

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 5d4d29bc..77b14dc7 100644
--- a/README.md
+++ b/README.md
@@ -17,3 +17,7 @@ The following make targets are available:
 - `prepare`: Initialize and update submodules, required for first-time setup
 - `update [COMMIT=<hash>]`: Update Garden Linux submodule to latest (or specific) commit and sync workflow references
 - `clean`: Remove Garden Linux submodule and reset the environment
+
+<p align="center">
+  <img alt="Bundesministerium für Wirtschaft und Energie (BMWE)-EU funding logo" src="https://apeirora.eu/assets/img/BMWK-EU.png" width="400"/>
+</p>

From 03f7e9135b8c22bdc41cf4bd30d33cc8dc102d5d Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 19 May 2026 17:18:38 +0200
Subject: [PATCH 093/127] Upgrade packages cloud hypervisor and libvirt

* [libvirtd](https://github.com/gardenlinux/package-libvirt/pull/80)
* [cloud-hypervisor](https://github.com/gardenlinux/package-cloud-hypervisor-gl/pull/49)
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 7a513c4d..fe358e01 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.1.0-1gl7%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl8%2Bbp1877"
+LIBVIRT_VERSION="12.2.0-1gl1%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl9%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 35d56479944318352db75c5343c5330d6d820eee Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 19 May 2026 17:59:07 +0200
Subject: [PATCH 094/127] Update to 1877.17.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 58c4c241..d67f890d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.17.1
+1877.17.2

From ed40b18b895fd84bfbdc7255952029b1666fa76a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 08:46:48 +0200
Subject: [PATCH 095/127] Update to 1877.19

---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 112dbe2e..5151e2ce 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@db2199be4559d92013eccd6c9362acb6e2651f84
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 8af02e5c..709994ca 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@db2199be4559d92013eccd6c9362acb6e2651f84
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@db2199be4559d92013eccd6c9362acb6e2651f84
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 4a789bef..35969cc8 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@db2199be4559d92013eccd6c9362acb6e2651f84
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index d67f890d..9734acca 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.17.2
+1877.19.1
diff --git a/gardenlinux b/gardenlinux
index db2199be..fb18553b 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit db2199be4559d92013eccd6c9362acb6e2651f84
+Subproject commit fb18553b6374966548cdcbcd50cf8ef7f36c29d9

From 504f702982166136510160b6cb3b6e2514558b2e Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 13:17:34 +0200
Subject: [PATCH 096/127] add chost _pxe flavor

Additional flavor for metal probes
---
 flavors.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/flavors.yaml b/flavors.yaml
index c7fda618..8ed403a1 100644
--- a/flavors.yaml
+++ b/flavors.yaml
@@ -2,6 +2,14 @@ targets:
   - name: metal
     category: baremetal
     flavors:
+      - features:
+          - chost
+          - _pxe
+        arch: amd64
+        build: true
+        test: true
+        test-platform: false
+        publish: false
       - features:
           - sci
           - _pxe

From 96c3b937f03f2ac3df5be14087b8a0ab11657f24 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 14:27:06 +0200
Subject: [PATCH 097/127] Update to 1877.19.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 9734acca..1199a456 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.1
+1877.19.2

From bb9a0e615b29c65f2d48e71edd66879a9ea0d632 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 2 Jun 2026 17:36:50 +0200
Subject: [PATCH 098/127] fix(pxe): use - for stdin for sha256 check

Related: https://github.com/gardenlinux/gardenlinux/pull/4383
---
 .../dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh b/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
index 818d0f38..bc30d2c7 100755
--- a/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
+++ b/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
@@ -27,7 +27,7 @@ if [ ! -f "${shaFile}" ]; then
 	exit 1
 fi
 
-if ! echo "$(grep . ${shaFile}) ${squashFile}" | sha256sum --status --check; then
+if ! echo "$(grep . ${shaFile})  ${squashFile}" | sha256sum --status --check -; then
 	warn "the hash verification of the squashfs has failed - exiting"
 	exit 1
 fi

From 28cb69335aadbfd9fa4e97a28c69332960a4ee65 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 3 Jun 2026 09:57:36 +0200
Subject: [PATCH 099/127] Update to 1877.19.3

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 1199a456..2e2d13d6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.2
+1877.19.3

From b21411a5e588f57c00e3b186af57fd74b7d801d6 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 11 Jun 2026 09:14:33 +0200
Subject: [PATCH 100/127] Renaming of the repository

changed all related artifacts to gardenlinux-sci
---
 .github/actions/test/integration/build/action.yml           | 4 ++--
 .github/actions/test/integration/build/dev-user-butane.yaml | 2 +-
 .github/workflows/dev.yml                                   | 4 ++--
 .github/workflows/test.yml                                  | 4 ++--
 features/_usi/initrd.include/usr/bin/persist                | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/actions/test/integration/build/action.yml b/.github/actions/test/integration/build/action.yml
index eca53a32..447de18c 100644
--- a/.github/actions/test/integration/build/action.yml
+++ b/.github/actions/test/integration/build/action.yml
@@ -11,7 +11,7 @@ runs:
     - name: Set ENV
       shell: bash
       env:
-        REPO: ghcr.io/gardenlinux/gardenlinux-ccloud
+        REPO: ghcr.io/gardenlinux/gardenlinux-sci
         TAG: ${{ inputs.image_tag }}
         ESP_SIZE: 2  # GiB
         DISK_SIZE: 8  # GiB
@@ -135,7 +135,7 @@ runs:
     # - name: Upload artifacts
     #   uses: actions/upload-artifact@v4
     #   with:
-    #     name: gardenlinux-ccloud-${{ inputs.image_tag }}
+    #     name: gardenlinux-sci-${{ inputs.image_tag }}
     #     path: /opt/${{ inputs.image_tag }}.*
     #     retention-days: 1
     #     overwrite: true
diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index 581c32d8..ac08d4a1 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -49,7 +49,7 @@ storage:
     contents:
       inline: |
         # pull the image from GHCR instead of keppel
-        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-ccloud
+        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-sci
         # point to a custom tag to download for the persist step
         OCI_TAG=TAG_GOES_HERE
   # Enable unlimited core dumps for all systemd services
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 5151e2ce..6bfa6087 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -109,7 +109,7 @@ jobs:
             response=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions?per_page=$page_size&page=$page")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions?per_page=$page_size&page=$page")
 
             page_ids=$(echo "$response" | jq -r --arg prefix "${UPLOAD_VERSION}" '
               .[] | select(.metadata.container.tags[]? | test("^" + $prefix + "(-.*)?$")) | .id
@@ -138,7 +138,7 @@ jobs:
               -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions/$version_id")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions/$version_id")
             if [ "$http_code" != "204" ]; then
               echo "Failed to delete version $version_id (HTTP $http_code)"
             fi
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 729fffd8..92c5d4eb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,8 +31,8 @@ jobs:
           fi
 
           echo "Verifying image ${{ inputs.image_tag }} exists in GHCR..."
-          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-ccloud:${{ inputs.image_tag }} 2>&1); then
-            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-ccloud"
+          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-sci:${{ inputs.image_tag }} 2>&1); then
+            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-sci"
             echo "Resolve output: $digest"
             exit 1
           fi
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 7a6ad93f..0c93a99b 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -75,7 +75,7 @@ export HOME=/root
 
 # source optional config file
 [ -f /sysroot/opt/persist/gl-oci.conf ] && . /sysroot/opt/persist/gl-oci.conf
-OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/gardenlinux-ccloud}"
+OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/gardenlinux-sci}"
 
 DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 # setup OCI_TAG, UKI_SHA and fetch UKI

From 4af4d5f384e15437fd9f7dfe410412cf034b7f4f Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Thu, 11 Jun 2026 14:51:39 +0200
Subject: [PATCH 101/127] chore: add renovate.json for base branch config merge

---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..7190a60b
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

From b8cdccf49b1d3def816cbeec9671901bd9bff771 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 15 Jun 2026 14:59:58 +0200
Subject: [PATCH 102/127] Pin dependencies (#249)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 4 ++--
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/test.yml       | 4 ++--
 .github/workflows/upload_oci.yml | 4 ++--
 Containerfile                    | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 6bfa6087..dc17ae7c 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 709994ca..5a3ab187 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
   build:
@@ -40,7 +40,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 92c5d4eb..b2d37fcb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install oras
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 35969cc8..f83dc1cf 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,12 +37,12 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@v1
+      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.9.1
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
         with:
           cosign-release: 'v2.4.1'
       - name: Set flavor version reference
diff --git a/Containerfile b/Containerfile
index c4ae04f0..edd1ecce 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,3 +1,3 @@
-FROM ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd
+FROM ghcr.io/gardenlinux/builder:d6d24ba1aec66889a2acab83aedcb00e869abfcd@sha256:3dc78daebb56605baf105d2f20a6e8b94137237c1c2587b80d571fbb5c9f49ab
 
 RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2)/' -i /builder/bootstrap

From 1961e0e92a3f4ba4eb32f10e6df5d81b406201b5 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:15:19 +0200
Subject: [PATCH 103/127] Update sigstore/cosign-installer action to v4 (#254)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/upload_oci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index f83dc1cf..b8978617 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Install cosign
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: 'v2.4.1'
       - name: Set flavor version reference

From 35f1bb0ce04fb4bf14e67fdc0e73089ab29af407 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:15:37 +0200
Subject: [PATCH 104/127] Update actions/checkout action to v6 (#252)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml      | 4 ++--
 .github/workflows/nightly.yaml | 4 ++--
 .github/workflows/test.yml     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index dc17ae7c..9e631384 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 5a3ab187..3cd17a8b 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
   build:
@@ -40,7 +40,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b2d37fcb..435833cc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Install oras
         uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
         with:

From 428e89a400cb2eac154f963e504fe59e3de0697b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:50:55 +0200
Subject: [PATCH 105/127] Update oras-project/setup-oras action to v2 (#253)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 435833cc..06d0c08c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Install oras
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index b8978617..f037fefe 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
+      - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a

From 1f14f13e1823ed8a723ba575898543fa9a890f29 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:20:48 +0200
Subject: [PATCH 106/127] Update cri-tools version to 1.35 (#250) (#261)

update tools from 1.33 to 1.35
---
 features/_scicommon/exec.config                                 | 2 +-
 ...s-k8s-io_v1.33_release.key => pkgs-k8s-io_v1.35_release.key} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename features/_scicommon/{pkgs-k8s-io_v1.33_release.key => pkgs-k8s-io_v1.35_release.key} (100%)

diff --git a/features/_scicommon/exec.config b/features/_scicommon/exec.config
index 5efda446..d18e272c 100755
--- a/features/_scicommon/exec.config
+++ b/features/_scicommon/exec.config
@@ -12,7 +12,7 @@ for feature in "${FEATURES[@]}"; do
 done
 
 # capi versions: https://github.com/kubernetes-sigs/cri-tools/releases
-CAPI_VERSION=v1.33.0
+CAPI_VERSION=v1.35.0
 K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
diff --git a/features/_scicommon/pkgs-k8s-io_v1.33_release.key b/features/_scicommon/pkgs-k8s-io_v1.35_release.key
similarity index 100%
rename from features/_scicommon/pkgs-k8s-io_v1.33_release.key
rename to features/_scicommon/pkgs-k8s-io_v1.35_release.key

From 1b8a4b2c8c17f3357ef5f14dfbda15bd334bcfb2 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:28:59 +0200
Subject: [PATCH 107/127] Update to 1877.19.4

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 2e2d13d6..cd39e864 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.3
+1877.19.4

From 5d53f184cd7a197e47f1ed0aba07ba3eda1e0592 Mon Sep 17 00:00:00 2001
From: Fabian Koller <10155170+anokfireball@users.noreply.github.com>
Date: Thu, 18 Jun 2026 13:46:19 +0200
Subject: [PATCH 108/127] renovate: automate SCI package updates for
 rel-1877-dev (#264)

Add custom regex managers for libvirt, cloud-hypervisor-gl, and
edk2-cloud-hypervisor-gl packages. These packages are hosted in
gardenlinux org repos and use branch-specific release tags with a
'+bp1877' suffix.

The managers:
- Extract the version prefix (before the %2B-encoded '+') as the
  current value for comparison against GitHub release tags
- Filter datasource releases to only those ending in '+bp1877' via
  extractVersionTemplate, excluding staging (+sta) and cross-branch
  (+bp2150) releases
- Write back with the correct URL-encoded suffix via
  autoReplaceStringTemplate
---
 renovate.json | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 7190a60b..67a1ea91 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,3 +1,54 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update libvirt package version for rel-1877-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "LIBVIRT_VERSION=\"(?<currentValue>[^%]+)%2Bbp1877\""
+      ],
+      "depNameTemplate": "gardenlinux/package-libvirt",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp1877$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "LIBVIRT_VERSION=\"{{{newValue}}}%2Bbp1877\""
+    },
+    {
+      "customType": "regex",
+      "description": "Update cloud-hypervisor-gl package version for rel-1877-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "CLOUD_HYPERVISOR_VERSION=\"(?<currentValue>[^%]+)%2Bbp1877\""
+      ],
+      "depNameTemplate": "gardenlinux/package-cloud-hypervisor-gl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp1877$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "CLOUD_HYPERVISOR_VERSION=\"{{{newValue}}}%2Bbp1877\""
+    },
+    {
+      "customType": "regex",
+      "description": "Update edk2-cloud-hypervisor-gl package version for rel-1877-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "EDK2_VERSION=\"(?<currentValue>[^%]+)%2Bbp1877\""
+      ],
+      "depNameTemplate": "gardenlinux/package-edk2-cloud-hypervisor-gl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp1877$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}%2Bbp1877\""
+    }
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": [
+        "gardenlinux/package-libvirt",
+        "gardenlinux/package-cloud-hypervisor-gl",
+        "gardenlinux/package-edk2-cloud-hypervisor-gl"
+      ],
+      "groupName": "SCI custom packages"
+    }
+  ]
 }

From 046987c3cad41421f20b225ab7329c1667f2b7c8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:43:24 +0200
Subject: [PATCH 109/127] Update actions/checkout action to v7 (#268)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml      | 4 ++--
 .github/workflows/nightly.yaml | 4 ++--
 .github/workflows/test.yml     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 9e631384..e6721ee5 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 3cd17a8b..b1a7e448 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           submodules: recursive
   build:
@@ -40,7 +40,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 06d0c08c..a880bd4c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install oras
         uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
         with:

From afdd9c956adbc9340051a9b1a7f81b8146588115 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Mon, 22 Jun 2026 14:40:56 +0200
Subject: [PATCH 110/127] Remove packageRules from renovate.json (#275)

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 renovate.json | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/renovate.json b/renovate.json
index 67a1ea91..1ba6e4a3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -40,15 +40,5 @@
       "versioningTemplate": "loose",
       "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}%2Bbp1877\""
     }
-  ],
-  "packageRules": [
-    {
-      "matchPackageNames": [
-        "gardenlinux/package-libvirt",
-        "gardenlinux/package-cloud-hypervisor-gl",
-        "gardenlinux/package-edk2-cloud-hypervisor-gl"
-      ],
-      "groupName": "SCI custom packages"
-    }
   ]
 }

From 9f148aa6b694b202fdf20278d285716b83f79bd4 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 15:13:24 +0200
Subject: [PATCH 111/127] Update SCI custom packages (#272)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index fe358e01..e71ff5e1 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.2.0-1gl1%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl9%2Bbp1877"
+LIBVIRT_VERSION="12.2.0-1gl2%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl1%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 55baf7b0843531038072c006f1d287d8c4e17cdd Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 22 Jun 2026 17:34:02 +0200
Subject: [PATCH 112/127] Update to 1877.19.5

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index cd39e864..c773b2d8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.4
+1877.19.5

From 9626c9cb44a229455632c8a45b1d24c49ff2ba67 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:15:53 +0200
Subject: [PATCH 113/127] Update SCI custom packages (#287)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index e71ff5e1..b053068b 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.2.0-1gl2%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl1%2Bbp1877"
+LIBVIRT_VERSION="12.2.0-1gl3%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl2%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 3587572e5d110e0b3d876c5ce509dffb3161b0f2 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:16:50 +0200
Subject: [PATCH 114/127] Update to 1877.19.6

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index c773b2d8..cb724818 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.5
+1877.19.6

From 8a34aaeccda7b7f023423ef5d4b339f1a44e830c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 12:23:32 +0200
Subject: [PATCH 115/127] Update SCI custom packages (#289)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index b053068b..c94f70e6 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.2.0-1gl3%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl2%2Bbp1877"
+LIBVIRT_VERSION="12.2.0-1gl4%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl3%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 926147af717cab44ff38d7072e155facf6f97ad8 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 7 Jul 2026 09:00:20 +0200
Subject: [PATCH 116/127] Prepare 1877.20 (#293)

make update COMMIT=624399f5f8f575252961644f5b2cdcce8bab84cc

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 gardenlinux                      | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index e6721ee5..c34c4eb1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index b1a7e448..d481bca5 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index f037fefe..e4b4a2f4 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@fb18553b6374966548cdcbcd50cf8ef7f36c29d9
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/gardenlinux b/gardenlinux
index fb18553b..624399f5 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit fb18553b6374966548cdcbcd50cf8ef7f36c29d9
+Subproject commit 624399f5f8f575252961644f5b2cdcce8bab84cc

From 2c008b80cf6f90fd1ee4e3e2dcf261e999937452 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 7 Jul 2026 09:29:11 +0200
Subject: [PATCH 117/127] Update to 1877.20.0

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index cb724818..e70b5a3b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.19.6
+1877.20.0

From 030ca71edc7f4519ea31f9c986333b46f07eaecc Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:20:42 +0200
Subject: [PATCH 118/127] Improve sci exec.config (#297)

* cloud hypervisor had debug symbols, hence generally remove them from
  the package list to avoid installing them
* improve quoting in create function

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 features/sci/exec.config | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index c94f70e6..a038a089 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+
 set -Eeuo pipefail
 
 # Undo the gardener feature disablement
@@ -19,6 +20,8 @@ for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/release
 done
 
 pushd /tmp/custompackages > /dev/null
+rm -f -- *dbgsym* *arm64* || true
+ls -1
 dpkg -i cloud-hypervisor-gl*_amd64.deb edk2-cloud-hypervisor-gl*_amd64.deb libvirt-clients_*_amd64.deb libvirt-common_*_amd64.deb libvirt-daemon_*_amd64.deb libvirt-daemon-common_*_amd64.deb libvirt-daemon-config-network_*_all.deb libvirt-daemon-config-nwfilter_*_all.deb libvirt-daemon-driver-ch-gl_*_amd64.deb libvirt-daemon-driver-network_*_amd64.deb libvirt-daemon-driver-nodedev_*_amd64.deb libvirt-daemon-driver-nwfilter_*_amd64.deb libvirt-daemon-driver-qemu_*_amd64.deb libvirt-daemon-driver-secret_*_amd64.deb libvirt-daemon-driver-storage_*_amd64.deb libvirt-daemon-log_*_amd64.deb libvirt-daemon-system_*_amd64.deb libvirt0_*_amd64.deb
 popd > /dev/null
 rm -rf /tmp/custompackages
@@ -34,11 +37,11 @@ function create() {
   shift
   ID=$1
   shift
-  adduser --uid $ID --home /var/lib/$NAME $NAME \
+  adduser --uid "$ID" --home "/var/lib/$NAME" "$NAME" \
     --system --group --disabled-password --disabled-login
   echo "$@"
   for group in "$@"; do
-    adduser $NAME $group
+    adduser "$NAME" "$group"
   done
 }
 

From 6d4723f5f4fcc06024b3ce6bb3ee01d4539507ab Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:44:56 +0200
Subject: [PATCH 119/127] Update oras-project/setup-oras digest to 1d808f7
 (#295)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a880bd4c..645025a3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install oras
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index e4b4a2f4..5ba06168 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
+      - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a

From 3538866af1447e430a77061da8afe68cf2c8ee0c Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 20:53:58 +0200
Subject: [PATCH 120/127] Update SCI custom packages (#300)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index a038a089..2e06335e 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,8 +10,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp1877"
-LIBVIRT_VERSION="12.2.0-1gl4%2Bbp1877"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl3%2Bbp1877"
+LIBVIRT_VERSION="12.2.0-1gl5%2Bbp1877"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl4%2Bbp1877"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From a8ab0b597614e807508dde67054f8a36cfcd7438 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Wed, 15 Jul 2026 09:35:28 +0200
Subject: [PATCH 121/127] Apply systemd presets (#299) (#303)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Евгени Димитров <evgeni.dimitrov@gmail.com>
---
 features/sci/exec.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 2e06335e..54eddf47 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -2,6 +2,9 @@
 
 set -Eeuo pipefail
 
+# Apply systemd presets
+systemctl preset-all
+
 # Undo the gardener feature disablement
 systemctl enable ssh
 

From 5bad46ce1e849296d67d9559dfbeb46aa82cbf23 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Wed, 15 Jul 2026 14:35:12 +0200
Subject: [PATCH 122/127] Update version to 1877.20.1 (#304)

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index e70b5a3b..0526a3ab 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.20.0
+1877.20.1

From fc81a7d5d2d63483762cf5144093d0a8b11c2ee3 Mon Sep 17 00:00:00 2001
From: Fabian Koller <fabian.koller@sap.com>
Date: Thu, 16 Jul 2026 16:43:07 +0200
Subject: [PATCH 123/127] fix(ci): try to improve performance

we are seeing a lot of `workqueue: ata_sff_pio_task hogged CPU for
>10000us 4 times` which comes from the IDE Driver. Try if switching to
virtio-blk speeds things up.
---
 .github/actions/test/integration/setup/hv.xml     | 2 +-
 .github/actions/test/integration/test/qemu/vm.xml | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/test/integration/setup/hv.xml b/.github/actions/test/integration/setup/hv.xml
index 63341fbf..c8f6f0d8 100644
--- a/.github/actions/test/integration/setup/hv.xml
+++ b/.github/actions/test/integration/setup/hv.xml
@@ -15,7 +15,7 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/HV_NAME_GOES_HERE.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
         <interface type='network'>
             <mac address='MAC_GOES_HERE' />
diff --git a/.github/actions/test/integration/test/qemu/vm.xml b/.github/actions/test/integration/test/qemu/vm.xml
index 3626dc12..1fe453b8 100644
--- a/.github/actions/test/integration/test/qemu/vm.xml
+++ b/.github/actions/test/integration/test/qemu/vm.xml
@@ -15,12 +15,12 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/ubuntu.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
-        <disk type='file' device='cdrom'>
+        <disk type='file' device='disk'>
             <driver name='qemu' type='raw' />
             <source file='/var/lib/libvirt/images/ubuntu-cloud-init-ds.iso' />
-            <target dev='hdb' bus='ide' />
+            <target dev='vdb' bus='virtio' />
             <readonly />
         </disk>
         <interface type='network'>

From 3f57b126a25faa403cb3f2d6c508010620df745e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 13:44:43 +0200
Subject: [PATCH 124/127] Update Group GitHub Actions (#310)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 4 ++--
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index c34c4eb1..cba6e725 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d481bca5..ae943702 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
   build:
@@ -40,7 +40,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 645025a3..87ecf16f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install oras
         uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
         with:
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 5ba06168..864565b5 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: 'v2.4.1'
+          cosign-release: 'v3.1.3'
       - name: Set flavor version reference
         run: |
           git rev-parse HEAD | cut -c1-8 | tee COMMIT

From cba5e75909d7784a4c0872862c1e0f6e2181a204 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 11 Aug 2026 14:20:24 +0200
Subject: [PATCH 125/127] Bump to 1877.21.0 (#314)

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 features/sslfips                 | 1 +
 gardenlinux                      | 2 +-
 6 files changed, 7 insertions(+), 6 deletions(-)
 create mode 120000 features/sslfips

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index cba6e725..9fff5f5b 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@409e9b640087ade203321a8d63bd1651f4677205
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index ae943702..c6480aa6 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@409e9b640087ade203321a8d63bd1651f4677205
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -50,7 +50,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@409e9b640087ade203321a8d63bd1651f4677205
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 864565b5..e32154f1 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@624399f5f8f575252961644f5b2cdcce8bab84cc
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@409e9b640087ade203321a8d63bd1651f4677205
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 0526a3ab..161eda4d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1877.20.1
+1877.21.0
diff --git a/features/sslfips b/features/sslfips
new file mode 120000
index 00000000..94a753fc
--- /dev/null
+++ b/features/sslfips
@@ -0,0 +1 @@
+../gardenlinux/features/sslfips
\ No newline at end of file
diff --git a/gardenlinux b/gardenlinux
index 624399f5..409e9b64 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 624399f5f8f575252961644f5b2cdcce8bab84cc
+Subproject commit 409e9b640087ade203321a8d63bd1651f4677205

From 54f8e89288a099eba4711b3262fca7f80aed1363 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Wed, 12 Aug 2026 12:00:26 +0200
Subject: [PATCH 126/127] Add modified gardenlinux-update tool for in-place
 update testing (#315)

The modified tool is currently build in
https://github.com/toanju/package-gardenlinux-update and disables OCI
image verification by default. This is required to speed up testing the
Gardener in-place update before implementing all details. Hence this
only goes to the dev image.

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 features/_usidev/exec.config | 16 +++++++++++++++-
 features/_usidev/pkg.exclude |  1 +
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 features/_usidev/pkg.exclude

diff --git a/features/_usidev/exec.config b/features/_usidev/exec.config
index 402f6dbf..8eee4e1c 100755
--- a/features/_usidev/exec.config
+++ b/features/_usidev/exec.config
@@ -1,5 +1,19 @@
 #!/usr/bin/env bash
 
-set -eufo pipefail
+set -euo pipefail
 
 mkdir -p /var/usr.overlay /var/usr.overlay.workdir
+
+# install
+mkdir /tmp/custompackages
+package="https://github.com/toanju/package-gardenlinux-update/releases/download/0.9gl4%2Bbp1877/build.tar.xz.0000"
+
+echo "Downloading and extracting package from $package"
+wget -q "$package" -O - | xz -d | tar xf - -C /tmp/custompackages
+
+pushd /tmp/custompackages > /dev/null
+rm -f -- *dbgsym* *arm64* || true
+ls -1
+dpkg -i gardenlinux-update_*_amd64.deb
+popd > /dev/null
+rm -rf /tmp/custompackages
diff --git a/features/_usidev/pkg.exclude b/features/_usidev/pkg.exclude
new file mode 100644
index 00000000..562044e0
--- /dev/null
+++ b/features/_usidev/pkg.exclude
@@ -0,0 +1 @@
+gardenlinux-update

From 00b27b09bc10c845440b77fbf51a4380b9a5e6ad Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Thu, 20 Aug 2026 10:55:40 +0200
Subject: [PATCH 127/127] Rename UKI in persist script (#316)

This renames the UKI file to use GARDENLINUX_CNAME instead of a static
name. This supports transitioning to in-place updates.

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>

Backport of 4538861e2185716f8e4868908f6fbc9eae107804
---
 features/_usi/initrd.include/usr/bin/persist | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 0c93a99b..26fcaca0 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -82,7 +82,7 @@ DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
 OCI_TAG=${OCI_TAG//_/-} # replace underscores with dashes
 UKI_SHA=$(oras manifest fetch "$OCI_REPO:${OCI_TAG}" | jq -r '.layers[] | select(.mediaType=="application/io.gardenlinux.uki") | .digest')
-oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/uki.efi"
+oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/${GARDENLINUX_CNAME}.efi"
 
 if [ "$ENABLE_HUGEPAGE_SETUP" = "true" ]; then
   echo "hugepagesz=2MB hugepages=$hugepages" > /tmp/cmdlinef