-
Say what the fontconfig measurement did not cover
-
Ship the USB keyboard gate, so deny-unknown has a release valve
-
Put usbguard in both profiles, and assert that it stays disarmed
-
Ship the firewall: firewalld, a zone per profile, tailscale exempt
-
Take the secureblue review's adopted set, nine files and a SUID strip
-
Gate the SHOP_REV bump on a build that actually happened
-
Move both base pins; the pinned digests were gone from quay
-
Correct the js arm's weight to what a mint actually costs
-
Add a js arm to LANGS, so the image can supply node and npm
-
Ship rsync and minisign in the base image
-
Correct two stale Containerfile comments: the seed-name derivation gap and the font-guard claim
-
Stop the server profile carrying fonts, and let a build seed its font bases
-
Turn weak deps off in the client package block
-
Record the two hotfix-channel rulings where the code makes the claim
-
Filter translations and documentation at install time
-
Pick Firefox as the browser, drop Helium
-
Drop Go from the default LANGS set
-
Say so when there is no browser, instead of failing to stderr
-
Cut 370 MB by cleaning caches in the layer that fills them
-
Keep copied passwords out of the clipboard history
-
Move gopass to the client block, where the person it is for sits
-
Default the toolchains to what compiles the shipped stack
-
Refuse recommends in the base package block, and name the one that was load-bearing
-
Move QUASI_TYPE_REV to e403306
-
Move SHOP_REV to shop@af8c79c, so both fetches retry
-
Move QUASI_TYPE_REV to the revision that retries a fetch
-
Move SHOP_REV to shop@21aa2f7
-
Retire IosevkaTerm: the image cuts its own faces now
-
Move both base pins; the old digests are gone from quay
-
Give the image a real version: product, build stamp and Fedora base