Hadron v0.6.0 is mostly about hardening: proper password quality checks in PAM, sshd hardening moved over to kairos-init where it belongs, and GRUB fonts in the image. On top of that there's a kernel build fix for an intermittent FIPS boot panic and the usual round of component bumps, with systemd 262 and Linux 7.2.10 being the big ones.
Highlights
Password quality in PAM (#653, #690)
cracklib 2.10.3 and libpwquality 1.4.5 are now built into the base image. pam_pwquality.so is wired into /etc/pam.d/system-auth as requisite before pam_unix, with retry=3 try_first_pass, and the pam_unix password line now has use_authtok.
This covers the CIS Distribution Independent Linux L1 password quality checks (5.4.1 / 5.3.1). Lockout via pam_faillock was already in place. The actual tunables still come from kairos-init under /etc/security/. Part of kairos-io/kairos#4626.
sshd hardening now comes from kairos-init (#654)
Hadron no longer ships 01-hadron-stig.conf, 02-hadron-crypto.conf or the generated 03-hadron.conf. The same baseline now lives in kairos-init as /etc/ssh/sshd_config.d/05-kairos-hardening.conf, same values. On FIPS images Hadron keeps 02-hadron-fips.conf only, so the FIPS crypto list sorts before kairos-init's post-quantum one.
Heads-up: if you use Hadron on its own without kairos-init, you no longer get hardened sshd drop-ins from Hadron. You'll need to bring your own.
GRUB fonts (#681)
The image now ships ascii.pf2, euro.pf2 and unicode.pf2 under /usr/share/grub/, built from unifont 16.0.04 and freetype 2.14.3. Both are build-time only, they don't end up in the final image.
Fixes
- Kernel (#677):
vmlinuz and the modules are now built on a single stage chain. Before, /boot and /lib/modules could come from different cached builds signed with different throwaway keys, which gave the intermittent FIPS panic Module crc32c_cryptoapi signature verification failed in FIPS mode (kairos-io/kairos#5298)
- Kernel (#678): the build now fails when a kernel patch doesn't apply, instead of silently carrying on
- Container image (#686):
/usr/bin/ldd in hadron-container on arm64 pointed at the x86_64 musl loader. It now points at the right loader for each arch (kairos-io/kairos#5415)
- gzip on arm64 (#636): gzip 1.15 builds again, its
head macro was colliding with musl's signal.h
- NVIDIA example (#668, #669):
examples/add-packages/Dockerfile.nvidia builds on current Hadron again. Kernel source URL is derived from the major version, default driver is newer and the default target is fixed (kairos-io/kairos#5154, kairos-io/kairos#5155)
- README (#688): the quickstart pointed at an ISO target that doesn't exist
Component bumps
| Component
| v0.5.3
| v0.6.0
|
| linux
| 7.2.6
| 7.2.10
|
| systemd
| 261.3
| 262
|
| openssh
| 10.5p1
| 10.6p1
|
| openssl
| 3.6.4
| 3.6.5
|
| python
| 3.14.7
| 3.15.0
|
| nfs-utils
| 2.9.2
| 3.1.1
|
| gdb
| 17.2
| 18.1
|
| sqlite3
| 3.53.4
| 3.54.0
|
| util-linux
| 2.42.3
| 2.42.4
|
| shadow
| 4.20.2
| 4.20.3
|
| lvm2
| 2.03.42
| 2.03.43
|
| parted
| 3.7
| 3.8
|
| expat
| 2.8.4
| 2.9.0
|
| pcre2
| 10.48
| 10.49
|
| gzip
| 1.14
| 1.15
|
| rsync
| 3.5.0
| 3.5.1
|
| xxhash
| 0.8.3
| 0.8.4
|
| libnftnl
| 1.3.1
| 1.3.2
|
| cmake
| 4.4.3
| 4.4.4
|
| pkgconf
| 3.0.7
| 3.0.8
|
New: cracklib 2.10.3, libpwquality 1.4.5, freetype 2.14.3 (build-time), unifont 16.0.04 (build-time).
Known issue
The GRUB fonts are in the image, but kairos-agent v2.31.4 still doesn't copy them over on install. Its copyGrubFonts only matches paths that contain the arch string, so it skips /usr/share/grub/. You'll keep seeing the did not find grub font warnings until that's fixed on the kairos-agent side, tracked in kairos-io/kairos#5334.
CI and infra
arm64 ISO pipeline and artifact naming fixes, the autobumper now opens PRs from an in-repo branch and reads its matrix from updatecli.d, KVM tests moved off the self-hosted pool, e2e/acceptance test hardening, and docs site dependency bumps.
Full Changelog: v0.5.3...v0.6.0
📦 Shipped components
Hadron components — v0.6.0
Commit: da24f82
Build Tools
| Component
| Version
|
| autoconf
| 2.73
|
| automake
| 1.18.1
|
| binutils
| 2.47
|
| bison
| 3.8.2
|
| cmake
| 4.4.4
|
| flex
| 2.6.4
|
| gawk
| 5.4.1
|
| libtool
| 2.5.4
|
| m4
| 1.4.21
|
| make
| 4.4.1
|
| pkgconf
| 3.0.8
|
Compiler Tools
| Component
| Version
|
| gcc
| 15.3.0
|
| gmp
| 6.3.0
|
| mpc
| 1.4.1
|
| mpfr
| 4.2.2
|
| perl
| 5.44.0
|
Compression Tools
| Component
| Version
|
| curl
| 8.22.0
|
| gzip
| 1.15
|
| lz4
| 1.10.0
|
| rsync
| 3.5.1
|
| xxhash
| 0.8.4
|
| xz
| 5.8.3
|
| zlib
| 1.3.2
|
| zstd
| 1.5.7
|
Core System
| Component
| Version
|
| bash
| 5.3
|
| busybox
| 1.38.0
|
| coreutils
| 9.12
|
| diffutils
| 3.12
|
| findutils
| 4.11.0
|
| gperf
| 3.3
|
| grep
| 3.12
|
| musl
| 1.2.6
|
| readline
| 8.3
|
| systemd
| 262
|
| util-linux
| 2.42.4
|
Kernel And Boot
| Component
| Version
|
| dracut
| 112
|
| dwarves
| 1.32
|
| grub
| 2.14
|
| kbd
| 2.10.0
|
| kmod
| 34.2
|
| linux
| 7.2.10
|
Misc Tools
| Component
| Version
|
| aports
| 3.24.1
|
| bc
| 7.1.0
|
| ca-certificates
| 20260611
|
| gdb
| 18.1
|
| libucontext
| 1.5.2
|
| patch
| 2.8
|
| pax-utils
| 1.3.11
|
| python
| 3.15.0
|
| sqlite3
| 3.54.0
|
| tpm2-tss
| 4.2.0
|
Network Tools
| Component
| Version
|
| iptables
| 1.8.13
|
| keyutils
| 1.6.3
|
| libevent
| 2.1.13
|
| libnl
| 3.12.0
|
| openscsi
| 2.1.13
|
| strace
| 7.2
|
Other
| Component
| Version
|
| argp-standalone
| 1.4.1
|
| audit
| 4.2.1
|
| conntrack-tools
| 1.4.9
|
| cracklib
| 2.10.3
|
| elfutils
| 0.195
|
| freetype
| 2.14.3
|
| less
| 704
|
| libbpf
| 1.5.0
|
| libnetfilter_conntrack
| 1.1.1
|
| libnetfilter_cthelper
| 1.0.1
|
| libnetfilter_cttimeout
| 1.0.1
|
| libnetfilter_queue
| 1.0.5
|
| libnfnetlink
| 1.0.2
|
| libpwquality
| 1.4.5
|
| musl-obstack
| 1.2.3
|
| musl-toolchain
| 1.2.5
|
| mussel
| 687d2f5e4d679487209cd9b4bd75091a20cae357
|
| ncurses
| 6.5
|
| openssl-fips
| 3.1.2
|
| procps-ng
| 4.0.6
|
| sbat-distro
| 1
|
| shim
| 16.1
|
| unifont
| 16.0.04
|
Security Tools
| Component
| Version
|
| cryptsetup
| 2.8.8
|
| openssh
| 10.6p1
|
| openssl
| 3.6.5
|
| pam
| 1.7.2
|
| shadow
| 4.20.3
|
| sudo
| 1.9.17p2
|
Storage Tools
| Component
| Version
|
| dosfstools
| 4.2
|
| e2fsprogs
| 1.47.4
|
| libtirpc
| 1.3.8
|
| lvm2
| 2.03.43
|
| multipath-tools
| 0.15.1
|
| nfs-utils
| 3.1.1
|
| parted
| 3.8
|
| urcu
| 0.15.7
|
System Libraries
| Component
| Version
|
| acl
| 2.4.0
|
| attr
| 2.6.0
|
| dbus
| 1.16.2
|
| expat
| 2.9.0
|
| json-c
| 0.19
|
| libaio
| 0.3.113
|
| libcap
| 2.78
|
| libelf
| 0.196
|
| libffi
| 3.8.0
|
| libiconv
| 1.19
|
| libkcapi
| 1.5.1
|
| libmnl
| 1.0.5
|
| libnftnl
| 1.3.2
|
| libseccomp
| 2.6.1
|
| libxml2
| 2.15.4
|
| musl-fts
| 1.2.7
|
| pcre2
| 10.49
|
| popt
| 1.19
|
Vm Tools
| Component
| Version
|
| glib
| 2.86.2
|
| mspack
| 1.11
|
| open-vm-tools
| 13.1.0
|
| qemu
| 10.1.5
|
