Copacetic v0.15.0 expands support for minimal and application-centric workloads, led by Ubuntu Chiseled image patching and experimental Helm chart-aware patching. This release also adds SLES 16 support and includes substantial correctness, reproducibility, and performance improvements.
✨ Highlights
Ubuntu Chiseled image patching
Copa can now patch both common Ubuntu Chiseled image layouts:
- Apt-less images that retain a full
/var/lib/dpkg/statussupport targeted updates from scanner reports and comprehensive updates without a report. Copa applies updates through external Ubuntu tooling while preserving the full-status representation; the final image does not gain/var/lib/dpkg/status.d, apt, dpkg, BusyBox, or a shell. - Native images containing
/var/lib/chisel/manifest.wallsupport comprehensive re-cuts of their selected Chisel slices. Copa validates the manifest and resulting filesystem, preserves paths not owned by the original manifest and unaffected platform descriptors, rejects downgrades, and records the resolved Chisel release as OCI provenance.
Native Chisel release selection can be inferred from /etc/os-release or overridden with --chisel-release. The CLI and bulk mode accept a named release, local release directory, or pinned HTTPS Git source; the BuildKit frontend accepts a named release or a supplied local build context and rejects Git URLs.
See the Ubuntu Chiseled image documentation and #1667.
Experimental Helm chart-aware patching
The experimental chart mode renders a Helm chart with its default values, discovers images from supported Kubernetes workload locations, patches those images, and publishes a self-contained wrapper chart containing the patched image overrides. Patched images remain in their original repositories in single-chart mode; bulk PatchConfig supports a separate image target registry and explicit value-path overrides where automatic resolution is ambiguous.
Chart mode requires the Helm CLI, COPA_EXPERIMENTAL=1, --push, and credentials that can push both the patched images and wrapper chart.
See the bulk and Helm chart patching documentation and #1547.
SLES 16 support
Copa now supports SLES 16 BCI images and recognizes the SQLite RPM database used by SLES 16 alongside the existing NDB and Berkeley DB formats. Multi-platform fixtures and package-manager coverage were added for the new release.
See #1621.
🐛 Patching correctness and reliability
- Local image resolution — Docker and Podman inspection is preferred before registry fallback, improving support for local-only images and avoiding unnecessary remote lookups. (#1614)
- Reliable RPM repatching — successive updates now compute changes from the current patched state, preventing stale files from being reintroduced. (#1589)
- Bounded image inspection — media-type discovery now honors patch cancellation and timeout contexts instead of allowing daemon or registry calls to block indefinitely. (#1587)
- Platform and VEX correctness — platform discovery no longer panics on descriptors without platform metadata, and generated OpenVEX documents now include the required vulnerability name field for schema compliance. (#1672)
🧪 Application-level Go patching
Experimental Go patching is more reliable and reproducible:
go mod tidy -eallows CVE-relevant updates to proceed when an upstream project has unrelated module-graph problems. (#1602)- Pre-modules major-version dependencies such as
github.com/docker/dockerreceive the required+incompatiblesuffix. (#1682) - Copa skips stale scanner fixes that would downgrade or reinstall an equal Go dependency and avoids claiming those skipped findings as remediated in VEX output. (#1683)
- Go update lists, generated
go.modrequirements, and rebuild steps are emitted deterministically. (#1680)
⚡ Performance and maintenance
VEX generation, VEX file output, tar hardlink rewriting, BuildKit progress forwarding, and terminal progress bookkeeping now use substantially fewer allocations and less CPU in large workloads. (#1639)
The release also updates BuildKit to 0.31.1 (#1675), containerd to 2.2.5 (#1631), Go to 1.25.13 (#1673), and gRPC to 1.83.1 (#1694), while expanding unit, integration, and end-to-end coverage across patching paths.
⚠️ Important usage notes
- Native
manifest.wallChiseled images currently support comprehensive patching only; do not pass a vulnerability report. Trivy does not yet inventory packages frommanifest.wall. - Updating an apt-less full-status Chiseled image installs content from complete
.debarchives and can add dependency packages or package-owned files that were not present in the original image. Maintainer scripts and dpkg triggers are disabled, lifecycle-package updates such asdpkg,apt, orbashare rejected, and the resulting filesystem and application should be validated before deployment. - Initial native Chisel support resolves public Ubuntu archives only. Ubuntu Pro, ESM, FIPS, private mirrors, and authenticated archives are not forwarded.
- Native Chisel patching does not support
linux/arm/v6. - Helm chart-aware patching remains experimental. Single-chart mode has no custom values-file input, so it discovers only images visible in the default render and supported workload shapes. Digest-pinned images and ambiguous value paths are rejected rather than silently publishing unsafe overrides.
📦 Install or upgrade
See the installation guide. Release assets include Linux and macOS archives for amd64 and arm64, checksums, and SBOMs.
🙌 Contributors
Thank you to @AruneshDwivedi, @SAY-5, @ashnamehrotra, @cwayne18, @jpinz, @omercnet, @robert-cronin, @sozercan, @y4ney, and everyone who tested, reviewed, documented, and reported issues for this release.
📋 Full changelog
All changes since v0.14.0: v0.14.0...v0.15.0
The v0.14.1 and v0.14.2 patch fixes are also included in v0.15.0; see the v0.14.1 and v0.14.2 release notes.