From 06c6e019b972a644f4f80a0b5a325649eced87a5 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 21:57:11 +0200
Subject: [PATCH 01/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 320e525 (#2628)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 71997fdba..d424c1e8b 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:a89ec8048e37424da098c564bad6c02243e9e3d41d6f5c536a0cb698fcd25f27
+    digest: sha256:320e525651c13fd5282e717fcfa6e06aca3353bee4d4c333f80d6c03c5197da1
 
   # https://github.com/ublue-os/brew
   - name: brew

From 11a6dcae3b63d98bb5cea872fbb19d31a114bd4d Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 03:44:50 +0000
Subject: [PATCH 02/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 3f54111 (#2631)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index d424c1e8b..e58b2b6b6 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:4825b41ccb3a6cde16ae21ef7107977bd071892a959c591ccf3ca917c3011b73
+    digest: sha256:3f541117ed4080f616874dc6cfe41fab96959f526b62952940d3ebd397999e96
 
   # https://github.com/get-aurora-dev/common
   - name: common

From f3c3da478eed350734707bec70de646eaa4d2083 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Mon, 27 Jul 2026 19:46:08 +0200
Subject: [PATCH 03/25] feat: implement retries for cosign verify step (#2634)

xref: https://github.com/ublue-os/aurora/issues/2337
---
 Justfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Justfile b/Justfile
index 90ea36d3b..6159245fb 100644
--- a/Justfile
+++ b/Justfile
@@ -202,14 +202,16 @@ build $image=default_image $tag=default_tag $flavor=default_flavor $rechunk="fal
         ALL_IMAGES+=("${AKMODS_NVIDIA_OPEN}")
     fi
 
-    cosign verify \
+    {{ retry_function }}
+
+    retry 5 60 cosign verify \
       --certificate-oidc-issuer https://token.actions.githubusercontent.com \
       --certificate-identity-regexp="github.com/get-aurora-dev/common/.github/workflows/*" \
       "{{ common }}"
 
     ALL_IMAGES+=("{{ common }}")
 
-    cosign verify \
+    retry 5 60 cosign verify \
       --certificate-oidc-issuer https://token.actions.githubusercontent.com \
       --certificate-identity-regexp="github.com/coreos/chunkah/.github/workflows/*" \
       "{{ chunkah }}"
@@ -218,8 +220,6 @@ build $image=default_image $tag=default_tag $flavor=default_flavor $rechunk="fal
 
     ALL_IMAGES+=("{{ brew }}")
 
-    {{ retry_function }}
-
     # I hate this immensely, podman build/pull with --retry does not work for
     # transient network issues
     if [[ "${retry_pull}" == "true" ]]; then

From 9b48b07d94f80dac5983bcff53ee61495996f9c8 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 04:33:00 +0000
Subject: [PATCH 04/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 852b666 (#2635)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index e58b2b6b6..576d815b2 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:3f541117ed4080f616874dc6cfe41fab96959f526b62952940d3ebd397999e96
+    digest: sha256:852b6668673eb2ae2f2377f256dfd032bc1c7121ae13c9b4170c7a65169096f9
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 13b3096e24cfc7d30cb2fe48a2ac6fd94ba203e9 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Tue, 28 Jul 2026 20:21:35 +0200
Subject: [PATCH 05/25] docs: remove star history (#2638)

---
 README.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/README.md b/README.md
index 928fa5384..84e0edf95 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,3 @@ sudo mokutil --import public_key.der
 ## Repobeats
 
 ![Alt](https://repobeats.axiom.co/api/embed/c86e98a6654e55f789375ff210dd4eb95f757906.svg "Repobeats analytics image")
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=ublue-os/aurora&type=Date)](https://www.star-history.com/#ublue-os/aurora&Date)

From 21d2f381c3d0a041064c25447ae77d2d17d48d2a Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 19:07:50 +0000
Subject: [PATCH 06/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to e451e62 (#2639)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 576d815b2..b3df51412 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:320e525651c13fd5282e717fcfa6e06aca3353bee4d4c333f80d6c03c5197da1
+    digest: sha256:e451e626565228cbb6ed2bb0ab74f17cbcfbedb28ff628af40027516402cd8a1
 
   # https://github.com/ublue-os/brew
   - name: brew

From e6a718f2e1e13223baf9c50509c345e88ac98625 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Tue, 28 Jul 2026 21:34:58 +0200
Subject: [PATCH 07/25] chore(ci): pin cosign (#2640)

This is a ticking time bomb, so we don't accidentally use cosign v4 when
it comes out and so on, renovate should pick this up.
---
 .github/workflows/reusable-build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 438f8930a..ec874dca0 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -97,6 +97,9 @@ jobs:
       # FIXME: Implement retries for stuff like this
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        # be careful when upgrading major versions
+        with:
+          cosign-release: 'v3.1.2'
 
       - name: Install ORAS
         uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1

From 962429a809eedf3c5ab935f32a9a668dfc9ee8c8 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 20:06:01 +0000
Subject: [PATCH 08/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 32cad51 (#2641)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index b3df51412..896b8462a 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:e451e626565228cbb6ed2bb0ab74f17cbcfbedb28ff628af40027516402cd8a1
+    digest: sha256:32cad518e0d76e5723cf94d8d7c3125ccd63610e88dce05de7371a5bcf1a74e4
 
   # https://github.com/ublue-os/brew
   - name: brew

From 2687e2485cd3f2e14cb54316116e80f6c3b6f57e Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 21:03:16 +0000
Subject: [PATCH 09/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 99c85fe (#2642)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 896b8462a..796ea9866 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:32cad518e0d76e5723cf94d8d7c3125ccd63610e88dce05de7371a5bcf1a74e4
+    digest: sha256:99c85fe7ec0b5dc8ee47c34d5d2d10498fb28027c4bb9ac0fa104d57bc791a8a
 
   # https://github.com/ublue-os/brew
   - name: brew

From 456d86b3d2fa29494c3fcc843b7192da9a2d3494 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 22:56:02 +0000
Subject: [PATCH 10/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 52d2bb5 (#2643)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 796ea9866..f4e3479c2 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:99c85fe7ec0b5dc8ee47c34d5d2d10498fb28027c4bb9ac0fa104d57bc791a8a
+    digest: sha256:52d2bb52a92d58fec1c5130e2d2b687ff2acbfb02f97a7814e7c99cf1b4534bd
 
   # https://github.com/ublue-os/brew
   - name: brew

From 39ec627e48f82ed4ced0287ad8afbd03b9f51ed0 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 06:43:22 +0300
Subject: [PATCH 11/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to dd10f3b (#2644)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index f4e3479c2..c49cb3867 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:852b6668673eb2ae2f2377f256dfd032bc1c7121ae13c9b4170c7a65169096f9
+    digest: sha256:dd10f3bfa619ef27d01f1e55af7c40bd6c27bbc28d1a040af63d61de0db30479
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 13fa39879f2c41558059889cd876cbd9cd123454 Mon Sep 17 00:00:00 2001
From: inffy <10782843+inffy@users.noreply.github.com>
Date: Wed, 29 Jul 2026 20:34:13 +0300
Subject: [PATCH 12/25] chore: update renovate for github-action to weekly
 (#2633)

* chore: update renovate for github-action to weekly

* add anchore/sbom-action to ignore list
---
 .github/renovate.json5 | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index ed9085640..a1294a53a 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -63,10 +63,13 @@
       "enabled": false
     },
     {
+      "matchManagers": ["github-actions"],
       "matchDepNames": [
-        "github/codeql-action/upload-sarif"
+        "!oras-project/setup-oras",
+        "!sigstore/cosign-installer",
+        "!anchore/sbom-action"
       ],
-      "extends": ["schedule:weekly"]
+      "schedule": ["on sunday"]
     }
   ]
 }

From 68cdcaa90c852ca53e237d25974f579846ce9ff3 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 07:23:05 +0300
Subject: [PATCH 13/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to a3ba37b (#2646)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index c49cb3867..8fb90e638 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:dd10f3bfa619ef27d01f1e55af7c40bd6c27bbc28d1a040af63d61de0db30479
+    digest: sha256:a3ba37bf37a89aa848643b29060d11df4f37574abe75d8a1638535813c064ea6
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 5cd42a896db82923a76d6033e4805928d0cd3976 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 03:43:28 +0000
Subject: [PATCH 14/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to d047ca1 (#2649)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 8fb90e638..b02da00ec 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:a3ba37bf37a89aa848643b29060d11df4f37574abe75d8a1638535813c064ea6
+    digest: sha256:d047ca15fcc45565810e827466617233d701c124698adccb0fff972e7b22cec8
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 7c3d4b62b0b73bd1ed5fac1271cb83b2914bb14f Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Fri, 31 Jul 2026 08:36:09 +0200
Subject: [PATCH 15/25] feat: set SOURCE_DATE_EPOCH on chunkah (#2651)

Should help with reproducibility and might make updates smaller for
unpackaged contents like wallpapers, homebrew.

Only downside so far that I see is that `podman images` and the like
will show up at the bottom with 56 years ago and so on. Labels like
`org.opencontainers.image.created` are of course not affected by this.

xref: https://github.com/ublue-os/aurora/issues/2350 and
https://github.com/ublue-os/aurora/issues/2579
---
 Justfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Justfile b/Justfile
index 6159245fb..b45fccda8 100644
--- a/Justfile
+++ b/Justfile
@@ -341,6 +341,7 @@ rechunk $image=default_image $tag=default_tag $flavor=default_flavor:
     ${PODMAN} run --rm --mount=type=image,src="${image_name}:${tag}",target=/chunkah \
     -v "${CHUNKAH_CONFIG_FILE}:/chunkah-config.json:ro,Z" \
     -v "${CHUNKAH_OUTPUT_DIR}:/run/out:Z" \
+    -e SOURCE_DATE_EPOCH=0 \
     "{{ chunkah }}" \
     build \
     --verbose \

From 5c379087b2cad46d37e4affc1f79d13e058eb2f1 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 04:18:48 +0000
Subject: [PATCH 16/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to f427cd5 (#2654)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index b02da00ec..20e168d17 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:d047ca15fcc45565810e827466617233d701c124698adccb0fff972e7b22cec8
+    digest: sha256:f427cd5156436a454a16821c3982c997375cf5c290a79f23bc47aff8802fcf2a
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 01dec4f2c86071701fa01d9dce1a39917920ff77 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 05:16:29 +0000
Subject: [PATCH 17/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 224c894 (#2656)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 20e168d17..0b0ec1542 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:52d2bb52a92d58fec1c5130e2d2b687ff2acbfb02f97a7814e7c99cf1b4534bd
+    digest: sha256:224c8947f012957b087c23b3fc639ab4ce770b985afa0308f401d31cc6386146
 
   # https://github.com/ublue-os/brew
   - name: brew

From 1c8263eebec1d59357a4f447b700f86d128987d9 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 02:17:07 +0000
Subject: [PATCH 18/25] chore(deps): update ghcr.io/ublue-os/brew:latest docker
 digest to bcd5391 (#2659)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 0b0ec1542..8c26692d8 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -15,7 +15,7 @@ images:
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:ff3a0f6d6d9ff372fbc22e0131800a1755fd5031903ba1d7630050f45f8a476e
+    digest: sha256:bcd5391e8e2b925e6ad02b8a5b7cfac039a18c419b891d2b244e2758ebe2b9d1
 
   # https://github.com/coreos/chunkah
   - name: chunkah

From 96a4598ff83accc4a1d2d3b36956a5eb3a8c2aa8 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 03:43:08 +0000
Subject: [PATCH 19/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 5b42fc4 (#2661)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 8c26692d8..44617d194 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:f427cd5156436a454a16821c3982c997375cf5c290a79f23bc47aff8802fcf2a
+    digest: sha256:5b42fc466e7a0fcf13d4211108db4daa6cd7baab1f551eac78e68bbf77c82766
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 50d424512e1288fc69bc8f3eeedaa00bb5ced4c1 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 21:26:54 +0300
Subject: [PATCH 20/25] chore(deps): update actions/attest action to v4.2.1
 (#2660)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 .github/workflows/reusable-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index ec874dca0..0480fceaf 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -447,7 +447,7 @@ jobs:
 
       - name: Attestation
         if: inputs.publish
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.pre-push.outputs.digest }}

From 9845d8f404741656b89b777570dabaa99bcc0639 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 18:46:20 +0000
Subject: [PATCH 21/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to d396a8b (#2666)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index 44617d194..af33918d5 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:224c8947f012957b087c23b3fc639ab4ce770b985afa0308f401d31cc6386146
+    digest: sha256:d396a8b1a6e64f9233aa43d4480e4178fe21fa5a9e89273ccf6b2939ca733481
 
   # https://github.com/ublue-os/brew
   - name: brew

From 0574a4b6c04c15e8ef264c73a60c23f6dbe66d61 Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:59:53 +0000
Subject: [PATCH 22/25] chore(deps): update
 ghcr.io/get-aurora-dev/common:latest docker digest to 9c3378b (#2667)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index af33918d5..efcda12dd 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -9,7 +9,7 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:d396a8b1a6e64f9233aa43d4480e4178fe21fa5a9e89273ccf6b2939ca733481
+    digest: sha256:9c3378b7c3612b3b08b9c79bd0e6fdfa7eaeef31fdbbb9e6ff491b3326d85338
 
   # https://github.com/ublue-os/brew
   - name: brew

From ae04f0c96c941e81459d5646e091bd9b6e700a3e Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 03:42:07 +0000
Subject: [PATCH 23/25] chore(deps): update
 quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 706d256 (#2668)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
---
 image-versions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/image-versions.yml b/image-versions.yml
index efcda12dd..9ec51588a 100644
--- a/image-versions.yml
+++ b/image-versions.yml
@@ -3,7 +3,7 @@ images:
   - name: kinoite
     image: quay.io/fedora-ostree-desktops/kinoite
     tag: 44
-    digest: sha256:5b42fc466e7a0fcf13d4211108db4daa6cd7baab1f551eac78e68bbf77c82766
+    digest: sha256:706d2566228e53e05f125e9893e5dcd187d54d8386ddada647ddeeaf9442917c
 
   # https://github.com/get-aurora-dev/common
   - name: common

From 8fd730e0b61e358c8000b0c155717e2b7a4d149d Mon Sep 17 00:00:00 2001
From: "ubot-7274[bot]" <217212047+ubot-7274[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:35:18 +0300
Subject: [PATCH 24/25] chore(deps): update github/codeql-action action to
 v4.37.4 (main) (#2662)

---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 25499dba6..fe2329d72 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -71,6 +71,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

From 24c1b9828174ce4fad86ca17e9befee79440d22c Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:54:05 +0200
Subject: [PATCH 25/25] Revert "feat: set SOURCE_DATE_EPOCH on chunkah (#2651)"
 (#2670)

This reverts commit 7c3d4b62b0b73bd1ed5fac1271cb83b2914bb14f.

See: https://github.com/coreos/chunkah/issues/160
---
 Justfile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Justfile b/Justfile
index b45fccda8..6159245fb 100644
--- a/Justfile
+++ b/Justfile
@@ -341,7 +341,6 @@ rechunk $image=default_image $tag=default_tag $flavor=default_flavor:
     ${PODMAN} run --rm --mount=type=image,src="${image_name}:${tag}",target=/chunkah \
     -v "${CHUNKAH_CONFIG_FILE}:/chunkah-config.json:ro,Z" \
     -v "${CHUNKAH_OUTPUT_DIR}:/run/out:Z" \
-    -e SOURCE_DATE_EPOCH=0 \
     "{{ chunkah }}" \
     build \
     --verbose \