From 2efb223bc0af5bec7297c6b46e20d96b79a392c2 Mon Sep 17 00:00:00 2001
From: Nemo <328747105+Nemo-010@users.noreply.github.com>
Date: Mon, 21 Sep 2026 14:07:36 +0000
Subject: [PATCH] Bump the loong64 keyring pin and the pinned archlinux base
 image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The loong64 mirror removed archlinux-lcpu-keyring-20241126-1 on 2026-09-06, so
every build since then failed at install-port-keyring with a 404. A port removes
a superseded keyring package rather than keeping it, so the pin falls behind the
moment the port rebuilds its keyring. The mirror now serves
archlinux-lcpu-keyring-20260906-1 and the pin follows it. Only the package name
and the sha256 move: scripts/check-keyring-pin reports no fingerprint added or
removed, so the trusted set is the same ten keys and every one keeps its expiry.

  mirror  https://loongarchlinux.lcpu.dev/loongarch/archlinux/core/os/loong64
  package archlinux-lcpu-keyring-20260906-1-any.pkg.tar.zst (17953 bytes)
  sha256  09ab1bfa4e4e5c06863f3ce21e5bc8a734c05f88eacbb58ee7de13603cddf42f

docker.io/library/archlinux:latest also moved on from the digest the Dockerfile
pinned, which freshness-image-pins has been reporting since 2026-09-08. Bumped
to what the tag resolves to now, read through the same registry flow the check
uses.

  before sha256:b860afd5823683f7ea389ba5f00d812f4fe55f6f286dea329d2abeefa535e309
  after  sha256:63c7b061c0c001cb7ce4f8d11b63d351c23e7f97121bc5c8bd5d9f431e615d7d

tests/run.sh static leaves both the Dockerfile digest assertion and the keyring
pin derivation passing. ⚠ This does not on its own make build-deploy green:
since 2026-09-18 the Resolve inputs job cannot read the ArchPOWER databases from
a GitHub runner, because the origin and the api.rv.pkgforge.dev fall-through both
answer 403 with a Cloudflare challenge. That is a network path, not a pin.
---
 Dockerfile                            |  2 +-
 bootstrap/keyrings/archlinux-lcpu.pin | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7575f97..48d4c43 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@
 # against what that tag resolves to now. A Dockerfile instruction takes no
 # trailing comment, so the marker sits on its own line directly above.
 # tag: latest
-FROM --platform=$BUILDPLATFORM docker.io/library/archlinux@sha256:b860afd5823683f7ea389ba5f00d812f4fe55f6f286dea329d2abeefa535e309 AS bootstrap
+FROM --platform=$BUILDPLATFORM docker.io/library/archlinux@sha256:63c7b061c0c001cb7ce4f8d11b63d351c23e7f97121bc5c8bd5d9f431e615d7d AS bootstrap
 
 ARG TARGETARCH
 ARG TARGETVARIANT
diff --git a/bootstrap/keyrings/archlinux-lcpu.pin b/bootstrap/keyrings/archlinux-lcpu.pin
index f79e6ea..a355393 100644
--- a/bootstrap/keyrings/archlinux-lcpu.pin
+++ b/bootstrap/keyrings/archlinux-lcpu.pin
@@ -38,12 +38,19 @@
 # package when it lists.
 #
 # Adopted 2026-08-28. Verified on that date against the mirror below.
+#
+# ⚠ Re-measured 2026-09-21. The mirror removed archlinux-lcpu-keyring-20241126-1
+# on 2026-09-06 and every loong64 build since then failed at install-port-keyring
+# with a 404, because a port removes a superseded keyring package rather than
+# keeping it. The mirror now serves archlinux-lcpu-keyring-20260906-1, so the pin
+# follows it. scripts/check-keyring-pin reports no fingerprint added or removed:
+# the trusted set is the same ten keys and every one keeps its expiry.
 
 keyring = archlinux-lcpu
 arch    = loong64
 mirror  = https://loongarchlinux.lcpu.dev/loongarch/archlinux/core/os/loong64
-package = archlinux-lcpu-keyring-20241126-1-any.pkg.tar.zst
-sha256  = cfdd65dceddbc5824df091787bd8546143beae9adb12f8ecccc25fbb67baa303
+package = archlinux-lcpu-keyring-20260906-1-any.pkg.tar.zst
+sha256  = 09ab1bfa4e4e5c06863f3ce21e5bc8a734c05f88eacbb58ee7de13603cddf42f
 trusted = 49E74F2DF61CFF4217AB8EB737EFC8DBFB4CC627 2029-02-24
 trusted = 5CDE9ADCBD04454BAF547A1C40D0304E1192746B 2026-04-24
 trusted = 60922C5D40F6297BC1616C270A8F993ECADF8CE7 2026-07-14