recipe-maintainers/custom-html
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: re-pin openssh-server latest digest to 161e0b6 #11

Open
autonomic-bot wants to merge 1 commits from upgrade-9a91f23 into main
pull from: upgrade-9a91f23
merge into: :main
Conversation 4 Commits 1 Files Changed 1
+2 -2
autonomic-bot commented 2026-10-30 02:28:50 +00:00
Owner
Copy Link
Copy Source

What / why

Re-pin the stale digest for lscr.io/linuxserver/openssh-server:latest in the optional SFTP overlay
(compose.sftp.yml, both the ssh and sshstart services). latest is a moving tag and was rebuilt
upstream on 2026-11-08, so its multi-arch index digest changed while the tag stayed the same. abra cannot
see this: abra recipe upgrade FATAs on image:tag@sha256:… refs (Docker references with both a tag and digest are currently not supported), so the digest was resolved directly from the registry.

This extends/replaces the older open upgrade PR #11 (branch upgrade-9a91f23) rather than opening a
parallel PR. It is one commit on current upstream main (5cc1b61).

Image table

service file tag old digest new digest
ssh compose.sftp.yml linuxserver/openssh-server:latest sha256:aa4e1b39… sha256:161e0b67…
sshstart compose.sftp.yml linuxserver/openssh-server:latest sha256:aa4e1b39… sha256:161e0b67…

Full new index digest:
sha256:161e0b670b31d9539ca1718bc5943e981779331b4e1c9d32e8929d7652a1f22f
(amd64 child 7bd52bcb…, arm64 child 699500b1…; verified with
docker buildx imagetools inspect lscr.io/linuxserver/openssh-server:latest on cc-ci).

No tag changes. nginx:1.31.8 and alpine/git:v2.54.0 are unchanged by this PR.

Operator action required

None. Digest-only re-pin of the same latest tag; no compose/env/volume/config/migration changes. The
image runs as before (LinuxServer build 10.3_p1-r2-ls243, build date 2026-11-08).

Recommended publish step (not run here — no version label is bumped in this PR):
abra recipe release custom-html -z

Live verification (step 2b, on cc-ci)

Deployed this WIP head via abra app deploy … --chaos with both compose.yml and compose.sftp.yml
enabled, on a throwaway dev-custom-html domain:

  • app (nginx 1.31.8@sha256:165ddde…) and ssh (openssh latest@sha256:161e0b67…) both 1/1;
    sshstart completed (Complete).
  • docker service ps --no-trunc confirms the running image is the new digest for both ssh and sshstart.
  • SSH login over the published port succeeded (ssh -p 2220 sftp@… 'ls /content'), HTTPS served 200.
  • Torn down (abra app undeploy + abra app rm); leak check: 0 stacks, 0 volumes, 0 apps.

Upstream release notes

Upstream release notes: linuxserver/openssh-server latest (tag unchanged, digest re-pin):
https://github.com/linuxserver/docker-openssh-server/releases

Advisory scan

Same-tag (latest → latest) digest-only window: 0 CVEs fixed by this upgrade identified by the
deterministic scan (9 sources checked: 6 registry URLs + advisory APIs; no failed sources).

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

## What / why Re-pin the stale digest for `lscr.io/linuxserver/openssh-server:latest` in the optional SFTP overlay (`compose.sftp.yml`, both the `ssh` and `sshstart` services). `latest` is a moving tag and was rebuilt upstream on 2026-11-08, so its multi-arch index digest changed while the tag stayed the same. `abra` cannot see this: `abra recipe upgrade` FATAs on `image:tag@sha256:…` refs (`Docker references with both a tag and digest are currently not supported`), so the digest was resolved directly from the registry. This extends/replaces the older open upgrade PR #11 (branch `upgrade-9a91f23`) rather than opening a parallel PR. It is one commit on current upstream `main` (`5cc1b61`). ## Image table | service | file | tag | old digest | new digest | |---------|------|-----|------------|------------| | ssh | compose.sftp.yml | `linuxserver/openssh-server:latest` | `sha256:aa4e1b39…` | `sha256:161e0b67…` | | sshstart | compose.sftp.yml | `linuxserver/openssh-server:latest` | `sha256:aa4e1b39…` | `sha256:161e0b67…` | Full new index digest: `sha256:161e0b670b31d9539ca1718bc5943e981779331b4e1c9d32e8929d7652a1f22f` (amd64 child `7bd52bcb…`, arm64 child `699500b1…`; verified with `docker buildx imagetools inspect lscr.io/linuxserver/openssh-server:latest` on cc-ci). No tag changes. `nginx:1.31.8` and `alpine/git:v2.54.0` are unchanged by this PR. ## Operator action required None. Digest-only re-pin of the same `latest` tag; no compose/env/volume/config/migration changes. The image runs as before (LinuxServer build `10.3_p1-r2-ls243`, build date 2026-11-08). Recommended publish step (not run here — no version label is bumped in this PR): `abra recipe release custom-html -z` ## Live verification (step 2b, on cc-ci) Deployed this WIP head via `abra app deploy … --chaos` with both `compose.yml` and `compose.sftp.yml` enabled, on a throwaway `dev-custom-html` domain: - `app` (nginx `1.31.8@sha256:165ddde…`) and `ssh` (openssh `latest@sha256:161e0b67…`) both `1/1`; `sshstart` completed (`Complete`). - `docker service ps --no-trunc` confirms the running image is the new digest for both `ssh` and `sshstart`. - SSH login over the published port succeeded (`ssh -p 2220 sftp@… 'ls /content'`), HTTPS served `200`. - Torn down (`abra app undeploy` + `abra app rm`); leak check: 0 stacks, 0 volumes, 0 apps. ## Upstream release notes **Upstream release notes:** linuxserver/openssh-server `latest` (tag unchanged, digest re-pin): https://github.com/linuxserver/docker-openssh-server/releases ## Advisory scan Same-tag (`latest` → `latest`) digest-only window: **0 CVEs fixed by this upgrade** identified by the deterministic scan (9 sources checked: 6 registry URLs + advisory APIs; no failed sources). CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants
autonomic-bot requested review from trav 2026-10-30 02:28:50 +00:00
autonomic-bot requested review from notplants 2026-10-30 02:28:51 +00:00
autonomic-bot commented 2026-10-30 02:29:01 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-30 02:29:32 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — custom-html @ 9a91f23b ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `9a91f23b` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/101/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/101) [![level](https://ci.autonomic.zone/runs/101/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/101) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/101) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot changed title from chore: re-pin stale image digests (nginx 1.31.8, alpine/git v2.54.0, openssh-server latest) to chore: re-pin openssh-server latest digest to 161e0b6 2026-11-13 03:35:15 +00:00
autonomic-bot added 1 commit 2026-11-13 03:35:16 +00:00
chore: re-pin openssh-server latest digest to 161e0b6
cc-ci/testme cc-ci: success
Details
e61c321029
autonomic-bot force-pushed upgrade-9a91f23 from 9a91f23b93 to e61c321029 2026-11-13 03:35:16 +00:00 Compare
autonomic-bot commented 2026-11-13 03:35:25 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-13 03:35:49 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — custom-html @ e61c3210 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `e61c3210` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/144/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/144) [![level](https://ci.autonomic.zone/runs/144/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/144) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/144) · [dashboard](https://ci.autonomic.zone/)
All checks were successful
cc-ci/testme cc-ci: success
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin upgrade-9a91f23:upgrade-9a91f23
git checkout upgrade-9a91f23
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/custom-html#11