Upstream linux-hardened tag v7.2.5-hardened1 available #54

New issue

Open

opened 2026-09-11 21:00:28 +00:00 by unredacted_bot · 0 comments

unredacted_bot commented

2026-09-11 21:00:28 +00:00

Owner

Upstream tag: v7.2.5-hardened1
Local newest PUBLISHED: v7.1.13-hardened1

Stuck release: tag v7.2.3-hardened1 exists but releases/v7.2.3-hardened1/manifest.json does not — its build failed, or publish.yml was never dispatched for it. Resolve that before cutting a new tag.

7.2.5 is on a different stable series than 7.1.13; cross-series CVE enumeration is not automated — see the kernel CVE list: https://git.kernel.org/pub/scm/linux/security/vulns.git.

Action: review the upstream signature, then tag from an up-to-date
main and push — the tag push triggers build-kernel.yml.

git switch main && git pull --ff-only   # do NOT skip
git tag v7.2.5-hardened1
git push origin v7.2.5-hardened1

The pull is load-bearing. Seed-bump merges and publish: commits
land on main continuously between builds, so a tag cut from a
stale checkout builds an old seed pin and silently ships that config.
If you already pushed a stale tag, drop it on both sides
(git push origin :refs/tags/v7.2.5-hardened1 then
git tag -d v7.2.5-hardened1), pull, and re-tag.

See docs/users/cve-policy.md for the SLA.

Upstream tag: v7.2.5-hardened1 Local newest PUBLISHED: v7.1.13-hardened1 **Stuck release:** tag `v7.2.3-hardened1` exists but `releases/v7.2.3-hardened1/manifest.json` does not — its build failed, or `publish.yml` was never dispatched for it. Resolve that before cutting a new tag. _`7.2.5` is on a different stable series than `7.1.13`; cross-series CVE enumeration is not automated — see the kernel CVE list: <https://git.kernel.org/pub/scm/linux/security/vulns.git>._ Action: review the upstream signature, then tag from an up-to-date `main` and push — the tag push triggers build-kernel.yml. ``` git switch main && git pull --ff-only # do NOT skip git tag v7.2.5-hardened1 git push origin v7.2.5-hardened1 ``` The pull is load-bearing. Seed-bump merges and `publish:` commits land on `main` continuously between builds, so a tag cut from a stale checkout builds an old seed pin and silently ships that config. If you already pushed a stale tag, drop it on both sides (`git push origin :refs/tags/v7.2.5-hardened1` then `git tag -d v7.2.5-hardened1`), pull, and re-tag. See docs/users/cve-policy.md for the SLA.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted#54

No description provided.

Rows
Columns