Hadron v0.5.2

Released 2026-09-09 · 86 commits since v0.5.1 (2026-07-09) · full compare

Highlights

• Firmware landing site fixed. Image blobs now ship at /usr/lib/firmware (a real directory), and /usr/lib/firmware/updates → /usr/local/lib/firmware gives operators the override slot without needing anything on the kernel cmdline. The kernel's own fw_path[] searches updates/ first, so overrides always win over baked-in blobs. Nodes that used to boot with an empty firmware tree because COS_PERSISTENT shadowed the shipped blobs no longer do. (#581, fixes kairos-io/kairos#4290)
• Real less replaces the busybox applet. Hadron images now ship upstream less-704 linked against a narrow ncurses runtime (libtinfo + 13 terminfo entries). The busybox LESS applet is disabled so there is one pager on the system. Net cost is around ~180 KB per image variant after trimming man pages and headers. (#587, #590)
• Kernel BTF is on. CONFIG_DEBUG_INFO_BTF is enabled everywhere (including riscv64, where DEBUG_KERNEL had to be forced so olddefconfig couldn't silently strip BTF back off), and the build image carries dwarves/pahole as required. bpftrace, bpftool and CO-RE-based observability tools now work out of the box. (#512, #530)
• shim no longer races itself. The GNU EFI build had two Makefile targets sharing a recipe under make -j, occasionally producing the "ar: file format not recognized" flake in CI. Grouped-target syntax (&:, GNU make ≥4.3) closes the race. (#592)
• getent and nslookup are in the base image. Two small but frequently-missed tools for anyone debugging DNS or NSS on a running node. (#523)
• CI source-fetch stops depending on ttl.sh and bare kernel.org. The build now pulls the kernel and libcap tarballs from cdn.kernel.org, and every package downloader stage is backed by a per-package source cache on ghcr populated from a matrix over sources.yaml. Fork PRs also fetch sources directly instead of through the cache path they can't write to. Fewer flaky mirror timeouts, faster warm builds, and the arm64/amd64 image handoff between jobs is now a tarball artifact instead of a ttl.sh push. (#566, #567, #580, plus the source-cache series 3fed87f..dc4d3ef)

Changes

Base image / userland

• less-704 replaces the busybox applet, with a narrow ncurses runtime for terminfo (#587).
• Busybox CONFIG_LESS (and every CONFIG_FEATURE_LESS_*) disabled so there is exactly one less on the system (#590).
• Firmware layout fixed: /usr/lib/firmware real dir + /usr/lib/firmware/updates → /usr/local/lib/firmware for overrides (#581).
• getent and nslookup added to the base image (#523).
• Removed the redundant system-openssh install that was segfaulting on MLDSA44 keys under FIPS OpenSSL (#511).
• sshd drop-in precedence fixed so hadron's sshd_config.d/ overrides win where the upstream defaults are stricter (#571).

Kernel

• BTF support enabled across every variant, with the toolchain (dwarves/pahole) added to the update-kernel-configs stage (#512, #527).
• DEBUG_KERNEL=y on cloud-riscv64 so olddefconfig doesn't silently drop BTF back off (#530).
• Regular kernel bumps via the autobumper.

Build system

• Shim's gnu-efi build converted to grouped-target Makefile syntax, killing the intermittent ar: file format not recognized under make -j (#592).
• make split into a local base build tag and a separate published PULL_IMAGE_NAME, so a local make build-hadron no longer collides with the published ghcr.io/kairos-io/hadron:main tag (#589).
• stage0 pre-stages musl for mussel; the toolchain build no longer hits musl.libc.org on every run (#578).
• nfs-utils linkage fixed by patching the exportfs header rather than enabling nfsdctl (9c4ade8); lvm2's parallel-install race on dmstats symlinks fixed (d348d7e); autobumper matrix jobs no longer race each other on the fork (#591).

Dependency bumps

• shadow → 4.20.2 (upstreamed musl patch dropped) (#584).
• busybox → 1.38.0 (minimal.config regenerated) (#586).
• nfs-utils → 2.9.2, plus a shadow-for-musl patch (1be9ac3).
• Regular autobump traffic for gawk, pkgconfig, cmake, libffi, openssh, findutils, perl, tpm2_tss, libucontext, open_iscsi, cryptsetup, systemd, sqlite3, binutils, multipath, dracut, pax_utils, python, libkcapi, lvm2, pkgconfig.

CI / infrastructure

• Fork PRs now fetch sources directly instead of through the cache write path they can't reach (#580).
• amd64 and trusted build chains moved off ttl.sh; arm64 image handoff between jobs is now a tarball artifact (#566, #567).
• hadron's riscv64 pipeline unified and moved off the native runner (#572).
• Kernel and libcap tarballs fetched from cdn.kernel.org instead of the bare cgit snapshot (3fed87f, 1b6ff27).
• Per-package source cache on ghcr, populated from a matrix over sources.yaml, with sha-verified fallback URLs and pre-filtering to skip the matrix on a warm cache (57e57dd..dc4d3ef).
• gen-components auto-renders the Dockerfile from the template when it's absent (f008b67).

Tests

• Extension install coverage added for the non-UKI recovery boot path (#565).
• Component versions report renders the rendered Dockerfile on the amd64 job (fb5b34b).

Documentation

• Issue reporting pointed at kairos-io/kairos so the tracker doesn't split (#575).
• riscv64: recorded that preset-all no longer crashes under QEMU (#564).
• Docs page rebuilds every two hours so external firmware/layers data stays fresh (#524).
• Layer sysext artifacts now render on the components page (#568).
• LICENSE added (7b242bb).

Contributors

Thanks to @Itxaka, @jimmykarily, @mudler, @mauromorales, and the automation cohort: @ci-robbot, @mudler-agent, @mauro-agent, @itxaka-agent, @Copilot, and Renovate.