From 6b04121cae1eacd95f15fc32eb9453ae8e2278fb Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 18 May 2026 09:51:05 +0200
Subject: [PATCH 01/38] Initial work on 2150

---
 .../integration/build/dev-user-butane.yaml    |  2 +-
 .../test/integration/dependencies/action.yml  |  2 +-
 .github/workflows/dev.yml                     |  9 +++------
 .github/workflows/nightly.yaml                |  4 ++--
 .github/workflows/upload_oci.yml              |  2 +-
 VERSION                                       |  2 +-
 features/sci/exec.config                      | 19 +++++++++++++++++++
 features/sci/pkg.include                      |  5 ++---
 gardenlinux                                   |  2 +-
 9 files changed, 31 insertions(+), 16 deletions(-)
 mode change 120000 => 100644 VERSION

diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index 9eb08a1..581c32d 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.3.0
+version: 1.7.0
 passwd:
   users:
     - name: root
diff --git a/.github/actions/test/integration/dependencies/action.yml b/.github/actions/test/integration/dependencies/action.yml
index e1923df..65fb700 100644
--- a/.github/actions/test/integration/dependencies/action.yml
+++ b/.github/actions/test/integration/dependencies/action.yml
@@ -34,7 +34,7 @@ runs:
     - name: butane
       shell: bash
       run: |
-        BUTANE_VERSION="0.24.0"
+        BUTANE_VERSION="0.27.0"
         curl -LO "https://github.com/coreos/butane/releases/download/v${BUTANE_VERSION}/butane-x86_64-unknown-linux-gnu"
         chmod +x "butane-x86_64-unknown-linux-gnu"
         sudo mv "butane-x86_64-unknown-linux-gnu" /usr/local/bin/butane
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index af0d441..b28f465 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - rel-2150-dev
     paths-ignore:
       - "**/README.md"
       - "docs/**"
@@ -33,16 +34,12 @@ jobs:
       - name: use VERSION file to support dev build on rel-branch
         id: version
         run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo "VERSION=today" >> $GITHUB_OUTPUT
-          else
-            echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
-          fi
+          echo "VERSION=$(cat VERSION)" >> $GITHUB_OUTPUT
 
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 3157546..06378d4 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@36078a576d0767433423289f2fa217b96cd951c9
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 4574361..5ebbed5 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@36078a576d0767433423289f2fa217b96cd951c9
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
deleted file mode 120000
index e96da46..0000000
--- a/VERSION
+++ /dev/null
@@ -1 +0,0 @@
-gardenlinux/VERSION
\ No newline at end of file
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..94f6510
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+2150.3.0
diff --git a/features/sci/exec.config b/features/sci/exec.config
index 3817f6d..402c560 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -4,6 +4,25 @@ set -Eeuo pipefail
 # Undo the gardener feature disablement
 systemctl enable ssh
 
+# install custom packages
+# TODO : these all should go in the repo
+
+# all versions URL encoded
+EDK2_VERSION="20260221-0gl1%2Bbp2150"
+LIBVIRT_VERSION="12.1.0-1gl7%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl8%2Bbp2150"
+
+mkdir /tmp/custompackages
+for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do
+  echo "Downloading and extracting package from $p"
+  wget -q "$p" -O - | xz -d | tar xf - -C /tmp/custompackages
+done
+
+pushd /tmp/custompackages > /dev/null
+dpkg -i cloud-hypervisor-gl*_amd64.deb edk2-cloud-hypervisor-gl*_amd64.deb libvirt-clients_*_amd64.deb libvirt-common_*_amd64.deb libvirt-daemon_*_amd64.deb libvirt-daemon-common_*_amd64.deb libvirt-daemon-config-network_*_all.deb libvirt-daemon-config-nwfilter_*_all.deb libvirt-daemon-driver-ch-gl_*_amd64.deb libvirt-daemon-driver-network_*_amd64.deb libvirt-daemon-driver-nodedev_*_amd64.deb libvirt-daemon-driver-nwfilter_*_amd64.deb libvirt-daemon-driver-qemu_*_amd64.deb libvirt-daemon-driver-secret_*_amd64.deb libvirt-daemon-driver-storage_*_amd64.deb libvirt-daemon-log_*_amd64.deb libvirt-daemon-system_*_amd64.deb libvirt0_*_amd64.deb
+popd > /dev/null
+rm -rf /tmp/custompackages
+
 # UID taken from sles 15, looks like it runs as root in debian/gardenlinux
 adduser --uid 476 openvswitch \
   --system --group --no-create-home --disabled-password --disabled-login
diff --git a/features/sci/pkg.include b/features/sci/pkg.include
index 71c8ba3..e05599e 100644
--- a/features/sci/pkg.include
+++ b/features/sci/pkg.include
@@ -1,6 +1,5 @@
-cloud-hypervisor-gl
-edk2-cloud-hypervisor-gl
-libvirt-daemon-driver-ch-gl
 multipath-tools
 open-iscsi
 openvswitch-switch
+wget
+xz-utils
diff --git a/gardenlinux b/gardenlinux
index 36078a5..ddf3b2d 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 36078a576d0767433423289f2fa217b96cd951c9
+Subproject commit ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a

From 000a64def936fb048034c348878d63f98ee1dd34 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 18 May 2026 11:14:12 +0200
Subject: [PATCH 02/38] Fixup release build

* use correct libvirt version
* add libxml2 to pkg.include to fix build failure of libvirt
---
 features/sci/pkg.exclude | 4 +++-
 features/sci/pkg.include | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/features/sci/pkg.exclude b/features/sci/pkg.exclude
index 1794447..5c0fd1a 100644
--- a/features/sci/pkg.exclude
+++ b/features/sci/pkg.exclude
@@ -1,2 +1,4 @@
 frr
-
+libvirt-daemon-system
+libvirt-clients
+libvirt0
diff --git a/features/sci/pkg.include b/features/sci/pkg.include
index e05599e..c7711e0 100644
--- a/features/sci/pkg.include
+++ b/features/sci/pkg.include
@@ -1,5 +1,10 @@
+gettext-base
+libpciaccess0
+libxml2-utils
+mdevctl
 multipath-tools
 open-iscsi
 openvswitch-switch
+systemd-container
 wget
 xz-utils

From ca45bcbbf8e85690eb4e8db82bbc36a57ef224f1 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 08:54:35 +0200
Subject: [PATCH 03/38] Update to 2150.4.0

---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index b28f465..cec2289 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 06378d4..14bf750 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 5ebbed5..22e7619 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 94f6510..14d5c32 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.3.0
+2150.4.0
diff --git a/gardenlinux b/gardenlinux
index ddf3b2d..2a04811 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit ddf3b2d84d972b6b6c7195d2ab726cdb84806e3a
+Subproject commit 2a0481143efc26c2acc2c29be0e1379b23842bcb

From 9483984d8b9327f01b0f5f830f3cca4747946116 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 13:17:34 +0200
Subject: [PATCH 04/38] add chost _pxe flavor

Additional flavor for metal probes
---
 flavors.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/flavors.yaml b/flavors.yaml
index 6edc213..10617ee 100644
--- a/flavors.yaml
+++ b/flavors.yaml
@@ -2,6 +2,14 @@ targets:
   - name: baremetal
     category: baremetal
     flavors:
+      - features:
+          - chost
+          - _pxe
+        arch: amd64
+        build: true
+        test: true
+        test-platform: false
+        publish: false
       - features:
           - sci
           - _pxe

From 4a909d7d074a46e90802ef26917ba71853f3c5a8 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Fri, 29 May 2026 14:05:01 +0200
Subject: [PATCH 05/38] Update to 2150.4.1

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 14d5c32..df8020c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.4.0
+2150.4.1

From 256547f8e42d50e3469d93bcbc0523417be1825a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 2 Jun 2026 17:36:50 +0200
Subject: [PATCH 06/38] fix(pxe): use - for stdin for sha256 check

Related: https://github.com/gardenlinux/gardenlinux/pull/4383
---
 .../dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh b/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
index 818d0f3..bc30d2c 100755
--- a/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
+++ b/features/_pxe/file.include/usr/lib/dracut/modules.d/98gardenlinux-live/live-get-squashfs.sh
@@ -27,7 +27,7 @@ if [ ! -f "${shaFile}" ]; then
 	exit 1
 fi
 
-if ! echo "$(grep . ${shaFile}) ${squashFile}" | sha256sum --status --check; then
+if ! echo "$(grep . ${shaFile})  ${squashFile}" | sha256sum --status --check -; then
 	warn "the hash verification of the squashfs has failed - exiting"
 	exit 1
 fi

From b52e6056e4dadc2a6fb3401b2d6ec52d21c98d1c Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 4 Jun 2026 13:49:53 +0200
Subject: [PATCH 07/38] fixup build to use the correct versioning

As with 1877 we need the local `garden-version` script to determine the
correct version. For the build this needs to be adjusted since upstream
Garden Linux only builds versions with patch == 0.
---
 Containerfile      |   3 +
 bin/garden-version | 155 +++++++++++++++++++++++++++++++++++++-
 build              | 183 ++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 339 insertions(+), 2 deletions(-)
 create mode 100644 Containerfile
 mode change 120000 => 100755 bin/garden-version
 mode change 120000 => 100755 build

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000..5a26f5d
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,3 @@
+FROM ghcr.io/gardenlinux/builder:98ee0d480844b2d041524841bfdbbb4007d32248
+
+RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2).0/' -i /builder/bootstrap
diff --git a/bin/garden-version b/bin/garden-version
deleted file mode 120000
index d88969e..0000000
--- a/bin/garden-version
+++ /dev/null
@@ -1 +0,0 @@
-../gardenlinux/bin/garden-version
\ No newline at end of file
diff --git a/bin/garden-version b/bin/garden-version
new file mode 100755
index 0000000..c2212f8
--- /dev/null
+++ b/bin/garden-version
@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+
+# Contains sources from https://github.com/debuerreotype/debuerreotype
+
+set -Eeuo pipefail
+# shellcheck disable=2128
+thisDir="$(dirname "$(readlink -f "${BASH_SOURCE}")")"
+versionfile="$(readlink -f "${thisDir}/../VERSION")"
+startdate="Mar 31 00:00:00 UTC 2020"
+build_os="$(uname -s)"
+
+function check_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Error: The binary '$1' could not be found. Please make sure to install it." >&2
+    exit 1
+  fi
+}
+
+# Use "gdate" & sed (GNU) which must be installed by "Homebrew"
+# on macOS systems to have a normalized date interface
+if [ "Darwin" == "$build_os" ]; then
+        date_gnu="gdate"
+        sed_gnu="gsed"
+else
+        date_gnu="date"
+        sed_gnu="sed"
+fi
+check_command "$date_gnu"
+check_command "$sed_gnu"
+
+# shellcheck disable=1091
+source "${thisDir}/.constants.sh" \
+	--flags 'major,minor,patch,date,datefull,epoch,git' \
+	--usage '[ --major | --minor | --patch | --date | --datefull | --epoch | --git ] [<garden-version>|<timestamp>]' \
+	--sample '20200427' \
+	--sample '--date 27.1' \
+	--help   "Generates version dependent values according to the file $versionfile or to the parameter handed over. Versions can be converted adequately
+
+--major 	prints only the major version
+--minor		prints only the minor version
+--patch		prints only the patch/patch version
+--date 		prints the date according to the version e.g. 20200427 if garden-version=27
+--datefull	prints a full date deteministically usable by debootstrap
+--epoch		prints the seconds sinc 19700101 till garden-version
+--git		prints the version plus the last git-hash
+
+If no parameter is specified the full version <major>.<minor> e.g. 27.5 is printed. The version is taken from $versionfile. On HEAD this should always evaluate to 'today', on branch versions this always should resolve to the next version that will be build e.g. 27.1. This implies there is no branch with a .0 in the $versionfile file.
+The version calculated expresses the days since $startdate. Calculation is always UTC based."
+
+# shellcheck disable=2154
+eval "${dgetopt}"
+typeout="default"
+while true; do
+	flag="$1"; shift
+	dgetopt-case "${flag}"
+	case "${flag}" in
+		--major|--minor|--patch|--date|--datefull|--epoch|--git)
+			typeout="${flag}"   ;;
+		--)	break ;;
+		*) 	eusage "unknown flag '${flag}'" ;;
+	esac
+done
+
+# Checks repo.gardenlinux.io for the highest available suite minor for the given major
+function get_minor_from_repo {
+  minor=0   # running index
+  limit=100 # hard limit the search in case of unexpected curl results
+  major=$1  # major to check the latest minor for
+  repo_url="https://packages.gardenlinux.io/gardenlinux/dists/$major.__MINOR__/InRelease"
+  while [ $minor -le $limit ]
+  do
+    check_url=${repo_url//__MINOR__/$minor}
+    if curl -s "$check_url" | grep -q "Error"; then
+      ((minor--))
+      echo $minor
+      return
+    fi
+    ((minor++))
+  done
+}
+
+function get_patch_from_repo {
+	# TODO: implement if we really expect that we'll ever have a nonzero micro/patch version
+	local major=$1
+	local minor=$2
+	if [ "$minor" -eq -1 ]; then
+		echo -1
+		return
+	fi
+	echo 0
+	return
+}
+
+function trim_when_old_version {
+	if [ "$1" == "today" ] || [ "$1" == "experimental" ]; then
+		echo "$1"
+		return
+	fi
+	# shellcheck disable=2046
+	if [ $(echo "$1" | cut -d. -f1) -lt 2015 ]; then
+		echo "$1" | cut -d. -f1-2
+	else
+		echo "$1"
+	fi
+}
+
+input="${1:-$($sed_gnu -e "s/#.*\$//" -e "/^$/d" "${versionfile}")}";  shift || true
+input=$($sed_gnu "s/^[[:space:]]*//;s/[[:space:]]*\$//" <<< "${input}")
+
+# no version / timestamp on versionfile
+[ -z "${input}" ] && input="today"
+
+minor=0
+patch=0
+# shellcheck disable=2046
+if [[ "${input}" =~ ^[0-9\.]*$ && $(cut -d. -f1 <<< "${input}") -lt 10000000 ]];
+then	[ $(cut -d. -sf4 <<< "${input}") ] && eusage "invalid version format ${input}. should be <major>[.<minor>.<patch>]"
+
+	major="$(cut -d. -f1 <<< "${input}")"
+	# shellcheck disable=2046
+	if [ $(cut -d. -sf2 <<< "${input}") ]; then
+		minor="$(cut -d. -f2 <<< "${input}")"
+	else
+		minor=$(get_minor_from_repo "$major")
+	fi
+	# shellcheck disable=2046
+	if [ $(cut -d. -sf3 <<< "${input}") ]; then
+		patch="$(cut -d. -f3 <<< "${input}")"
+	else
+		patch=$(get_patch_from_repo "$major" "$minor")
+	fi
+	version="${major}.${minor}.${patch}"
+else
+  if	[[ ${input} = today ]] || [[ ${input} = experimental ]];
+	then	indate=$($date_gnu --date "today" +%s 2>/dev/null)
+		major="$(( ("${indate}" - $($date_gnu --date "${startdate}" +%s)) / (60*60*24) ))"
+		version=${input}
+	else	indate=$($date_gnu --date "${input}" +%s 2>/dev/null) || eusage "invalid date ${input}"
+		major="$(( ("${indate}" - $($date_gnu --date "${startdate}" +%s)) / (60*60*24) ))"
+		version="${major}.${minor}.${patch}"
+	fi
+fi
+
+# shellcheck disable=2154
+case "${typeout}" in
+	--major)	echo "${major}" ;;
+	--minor)	echo "${minor}" ;;
+	--patch)	echo "${patch}" ;;
+	--date)		$date_gnu --date "${startdate} + ${major} days" +%Y%m%d ;;
+	--datefull)	$date_gnu --date "${startdate} + ${major} days" +%Y%m%dT%H%M%SZ ;;
+	--epoch)	$date_gnu --date "${startdate} + ${major} days" +%s ;;
+	--git)		echo "$(trim_when_old_version "${version}")-$(git -C "${scriptsDir}" rev-parse --short 'HEAD^{commit}')" ;;
+        *)		trim_when_old_version "${version}" ;;
+esac
diff --git a/build b/build
deleted file mode 120000
index 9a5480a..0000000
--- a/build
+++ /dev/null
@@ -1 +0,0 @@
-gardenlinux/build
\ No newline at end of file
diff --git a/build b/build
new file mode 100755
index 0000000..ded1dcd
--- /dev/null
+++ b/build
@@ -0,0 +1,182 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+exec 3>&1
+exec 1>&2
+
+#container_image=ghcr.io/gardenlinux/builder:98ee0d480844b2d041524841bfdbbb4007d32248
+container_image=localhost/builder
+container_engine=podman
+target_dir=.build
+
+container_run_opts=(
+	--memory 4G
+	--security-opt seccomp=unconfined
+	--security-opt apparmor=unconfined
+	--security-opt label=disable
+	--read-only
+)
+
+container_cmd=()
+
+use_kms=0
+resolve_cname=0
+allow_frankenstein=0
+apparmor_profile=
+
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--allow-frankenstein) # https://xkcd.com/1589/
+			allow_frankenstein=1
+			shift
+			;;
+		--container-image)
+			container_image="$2"
+			shift 2
+			;;
+		--container-engine)
+			container_engine="$2"
+			shift 2
+			;;
+		--container-run-opts)
+			declare -a "container_run_opts=($2)"
+			shift 2
+			;;
+		--privileged)
+			container_run_opts+=(--privileged)
+			container_cmd=(--second-stage)
+			shift
+			;;
+		--kms)
+			use_kms=1
+			shift
+			;;
+		--print-container-image)
+			printf '%s\n' "$container_image" >&3
+			exit 0
+			;;
+		--resolve-cname)
+			resolve_cname=1
+			shift
+			;;
+		--target)
+			target_dir="$2"
+			shift 2
+			;;
+		--apparmor-profile)
+			apparmor_profile="$2"
+			shift 2
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+[ -d "$target_dir" ] || mkdir "$target_dir"
+
+container_mount_opts=(
+	-v "$PWD/keyring.gpg:/builder/keyring.gpg:ro"
+	-v "$(realpath "$target_dir"):/builder/.build"
+)
+
+for feature in features/*; do
+	if [ -d "$feature" ]; then
+		container_mount_opts+=(-v "$(realpath -- "$feature"):/builder/$feature:ro")
+	fi
+done
+
+if [ "$container_image" = localhost/builder ]; then
+	dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
+	"$container_engine" build -t "$container_image" "$dir"
+fi
+
+repo="$(./get_repo)"
+commit="$(./get_commit)"
+timestamp="$(./get_timestamp)"
+default_version="$(./get_version)"
+
+
+if [ "$resolve_cname" = 1 ]; then
+	arch="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" dpkg --print-architecture)"
+	cname="$("$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" /builder/parse_features --feature-dir /builder/features --default-arch "$arch" --default-version "$default_version" --cname "$1")"
+	short_commit="$(head -c 8 <<< "$commit")"
+	echo "$cname-$short_commit" >&3
+	exit 0
+fi
+
+make_opts=(
+	REPO="$repo"
+	COMMIT="$commit"
+	TIMESTAMP="$timestamp"
+	DEFAULT_VERSION="$default_version"
+	LOG_WITH_TIMESTAMP="${LOG_WITH_TIMESTAMP:-true}"
+)
+
+if [ "$allow_frankenstein" = 1 ]; then
+	make_opts+=("ALLOW_FRANKENSTEIN=1")
+fi
+
+if [ "$use_kms" = 1 ]; then
+	for e in AWS_DEFAULT_REGION AWS_REGION AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; do
+		if [ -n "${!e-}" ]; then
+			make_opts+=("$e=${!e}")
+		fi
+	done
+fi
+
+# Default values which can be overriden via 'build.config' file
+tempfs_size=2G
+
+if [[ -f "$PWD"/build.config ]]; then
+	. "$PWD"/build.config
+fi
+
+make_opts+=("TEMPFS_SIZE=$tempfs_size")
+
+if [ -d cert ]; then
+	container_mount_opts+=(-v "$PWD/cert:/builder/cert:ro")
+fi
+
+# Check if builder apparmor profile has to be created or selected
+if [ "$container_engine" = "docker" ] \
+	&& [ ! "$apparmor_profile" ] \
+	&& out=$(sysctl kernel.apparmor_restrict_unprivileged_userns 2> /dev/null) \
+	&& [[ $out = "kernel.apparmor_restrict_unprivileged_userns = 1" ]]; then
+	if [ ! -f /etc/apparmor.d/builder ]; then
+		echo "You are using Docker on a system restricting unprivileged user namespaces with apparmor, which prevents a successful build. For more information please refer to the #Usage section in the README."
+		read -r -p "Do you want to permanently create a new apparmor profile at /etc/apparmor.d/builder to solve the issue? [Y/n] " response
+		response=${response,,}
+		if [[ "$response" =~ ^(yes|y)$ ]]; then
+			if [ ! -f /etc/apparmor.d/builder ]; then
+				profile="abi <abi/4.0>, include <tunables/global> profile builder flags=(unconfined) {userns, }"
+				echo "$profile" | sudo tee /etc/apparmor.d/builder > /dev/null
+				sudo apparmor_parser -r -W /etc/apparmor.d/builder
+			fi
+			echo "Created profile builder at /etc/apparmor.d/builder"
+		else
+			echo Abort.
+			exit 1
+		fi
+	fi
+	apparmor_profile=builder
+fi
+
+# Apply apparmor profile if seleceted
+if [ "$apparmor_profile" ]; then
+	replaced=false
+	for i in "${!container_run_opts[@]}"; do
+			if [ "${container_run_opts[$i]}" = "apparmor=unconfined" ]; then
+					container_run_opts["$i"]="apparmor=$apparmor_profile"
+					replaced=true
+			fi
+	done
+
+	if ! $replaced; then
+			container_run_opts+=(--security-opt "apparmor=$apparmor_profile")
+	fi
+fi
+
+"$container_engine" run --rm "${container_run_opts[@]}" "${container_mount_opts[@]}" "$container_image" ${container_cmd[@]+"${container_cmd[@]}"} fake_xattr make --no-print-directory -C /builder "${make_opts[@]}" "$@" >&3

From 93f31392e2eea10afda300f8fbe6f5784d3b1bfe Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Thu, 11 Jun 2026 09:14:33 +0200
Subject: [PATCH 08/38] Renaming of the repository

changed all related artifacts to gardenlinux-sci
---
 .github/actions/test/integration/build/action.yml           | 4 ++--
 .github/actions/test/integration/build/dev-user-butane.yaml | 2 +-
 .github/workflows/dev.yml                                   | 4 ++--
 .github/workflows/test.yml                                  | 4 ++--
 features/_usi/initrd.include/usr/bin/persist                | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/actions/test/integration/build/action.yml b/.github/actions/test/integration/build/action.yml
index eca53a3..447de18 100644
--- a/.github/actions/test/integration/build/action.yml
+++ b/.github/actions/test/integration/build/action.yml
@@ -11,7 +11,7 @@ runs:
     - name: Set ENV
       shell: bash
       env:
-        REPO: ghcr.io/gardenlinux/gardenlinux-ccloud
+        REPO: ghcr.io/gardenlinux/gardenlinux-sci
         TAG: ${{ inputs.image_tag }}
         ESP_SIZE: 2  # GiB
         DISK_SIZE: 8  # GiB
@@ -135,7 +135,7 @@ runs:
     # - name: Upload artifacts
     #   uses: actions/upload-artifact@v4
     #   with:
-    #     name: gardenlinux-ccloud-${{ inputs.image_tag }}
+    #     name: gardenlinux-sci-${{ inputs.image_tag }}
     #     path: /opt/${{ inputs.image_tag }}.*
     #     retention-days: 1
     #     overwrite: true
diff --git a/.github/actions/test/integration/build/dev-user-butane.yaml b/.github/actions/test/integration/build/dev-user-butane.yaml
index 581c32d..ac08d4a 100644
--- a/.github/actions/test/integration/build/dev-user-butane.yaml
+++ b/.github/actions/test/integration/build/dev-user-butane.yaml
@@ -49,7 +49,7 @@ storage:
     contents:
       inline: |
         # pull the image from GHCR instead of keppel
-        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-ccloud
+        OCI_REPO=ghcr.io/gardenlinux/gardenlinux-sci
         # point to a custom tag to download for the persist step
         OCI_TAG=TAG_GOES_HERE
   # Enable unlimited core dumps for all systemd services
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index cec2289..42877e2 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -109,7 +109,7 @@ jobs:
             response=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions?per_page=$page_size&page=$page")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions?per_page=$page_size&page=$page")
 
             page_ids=$(echo "$response" | jq -r --arg prefix "${UPLOAD_VERSION}" '
               .[] | select(.metadata.container.tags[]? | test("^" + $prefix + "(-.*)?$")) | .id
@@ -138,7 +138,7 @@ jobs:
               -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
               -H "Accept: application/vnd.github+json" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-ccloud/versions/$version_id")
+              "https://api.github.com/orgs/gardenlinux/packages/container/gardenlinux-sci/versions/$version_id")
             if [ "$http_code" != "204" ]; then
               echo "Failed to delete version $version_id (HTTP $http_code)"
             fi
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 729fffd..92c5d4e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,8 +31,8 @@ jobs:
           fi
 
           echo "Verifying image ${{ inputs.image_tag }} exists in GHCR..."
-          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-ccloud:${{ inputs.image_tag }} 2>&1); then
-            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-ccloud"
+          if ! digest=$(oras resolve ghcr.io/gardenlinux/gardenlinux-sci:${{ inputs.image_tag }} 2>&1); then
+            echo "Error: Image tag '${{ inputs.image_tag }}' not found in ghcr.io/gardenlinux/gardenlinux-sci"
             echo "Resolve output: $digest"
             exit 1
           fi
diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 7a6ad93..0c93a99 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -75,7 +75,7 @@ export HOME=/root
 
 # source optional config file
 [ -f /sysroot/opt/persist/gl-oci.conf ] && . /sysroot/opt/persist/gl-oci.conf
-OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/gardenlinux-ccloud}"
+OCI_REPO="${OCI_REPO:-keppel.global.cloud.sap/ccloud-ghcr-io-mirror/gardenlinux/gardenlinux-sci}"
 
 DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 # setup OCI_TAG, UKI_SHA and fetch UKI

From 908c4be8ed87003724f704a71940450e27c4cabf Mon Sep 17 00:00:00 2001
From: Fabian Koller <github@kthxbye.cyou>
Date: Thu, 11 Jun 2026 14:51:45 +0200
Subject: [PATCH 09/38] chore: add renovate.json for base branch config merge

---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 renovate.json

diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..7190a60
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

From 74501059864706da662058a3e6c2925ad596724b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 15 Jun 2026 15:00:03 +0200
Subject: [PATCH 10/38] Pin dependencies (#255)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 4 ++--
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/test.yml       | 4 ++--
 .github/workflows/upload_oci.yml | 4 ++--
 Containerfile                    | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 42877e2..b3ac80d 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 14bf750..157f8ac 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           submodules: recursive
   build:
@@ -39,7 +39,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 92c5d4e..b2d37fc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install oras
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 22e7619..aed95b5 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,12 +37,12 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@v1
+      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.9.1
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
         with:
           cosign-release: 'v2.4.1'
       - name: Set flavor version reference
diff --git a/Containerfile b/Containerfile
index 5a26f5d..9893378 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,3 +1,3 @@
-FROM ghcr.io/gardenlinux/builder:98ee0d480844b2d041524841bfdbbb4007d32248
+FROM ghcr.io/gardenlinux/builder:98ee0d480844b2d041524841bfdbbb4007d32248@sha256:d7063f72c0db3e7cdd618136efb292379794a0c4d4b5ddfc3759795c17d963ab
 
 RUN sed 's/version="$2"/version=\$(echo \$2 | cut -d. -f 1-2).0/' -i /builder/bootstrap

From 84c79a7af6a7c6e09dfd9da48df9bed29135c0b8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:14:25 +0200
Subject: [PATCH 11/38] Update sigstore/cosign-installer action to v4 (#259)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/upload_oci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index aed95b5..a6ddda8 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
       - name: Install cosign
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: 'v2.4.1'
       - name: Set flavor version reference

From bc9363ebe90d12f455d4ac108fbc92aefc1b1e82 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:14:47 +0200
Subject: [PATCH 12/38] Update oras-project/setup-oras action to v2 (#258)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b2d37fc..6facd0a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Install oras
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index a6ddda8..01074c6 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
+      - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a

From 2b6d121f08d7a84923a18968d2cda18f296abfe9 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:50:33 +0200
Subject: [PATCH 13/38] Update actions/checkout action to v6 (#257)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml      | 4 ++--
 .github/workflows/nightly.yaml | 4 ++--
 .github/workflows/test.yml     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index b3ac80d..d2bda75 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 157f8ac..efa4484 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
   build:
@@ -39,7 +39,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6facd0a..06d0c08 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Install oras
         uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
         with:

From bd0cf428ba96f013652438fb590d1be5d897d526 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:20:41 +0200
Subject: [PATCH 14/38] Update cri-tools version to 1.35 (#250) (#260)

update tools from 1.33 to 1.35

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 features/_scicommon/exec.config                                 | 2 +-
 ...s-k8s-io_v1.33_release.key => pkgs-k8s-io_v1.35_release.key} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename features/_scicommon/{pkgs-k8s-io_v1.33_release.key => pkgs-k8s-io_v1.35_release.key} (100%)

diff --git a/features/_scicommon/exec.config b/features/_scicommon/exec.config
index 5efda44..d18e272 100755
--- a/features/_scicommon/exec.config
+++ b/features/_scicommon/exec.config
@@ -12,7 +12,7 @@ for feature in "${FEATURES[@]}"; do
 done
 
 # capi versions: https://github.com/kubernetes-sigs/cri-tools/releases
-CAPI_VERSION=v1.33.0
+CAPI_VERSION=v1.35.0
 K8S_VERSION_REPO="${CAPI_VERSION%.*}"
 
 # key can be downloaded liek e.g.
diff --git a/features/_scicommon/pkgs-k8s-io_v1.33_release.key b/features/_scicommon/pkgs-k8s-io_v1.35_release.key
similarity index 100%
rename from features/_scicommon/pkgs-k8s-io_v1.33_release.key
rename to features/_scicommon/pkgs-k8s-io_v1.35_release.key

From 55909ef598020bdbba7b75e5555e6a9d261b146e Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:29:51 +0200
Subject: [PATCH 15/38] Update to 2150.4.2

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index df8020c..1facf7b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.4.1
+2150.4.2

From a0c67037a9ff18aea23dcedfa230ab357b3e958f Mon Sep 17 00:00:00 2001
From: Fabian Koller <10155170+anokfireball@users.noreply.github.com>
Date: Thu, 18 Jun 2026 13:46:03 +0200
Subject: [PATCH 16/38] renovate: automate SCI package updates for rel-2150-dev
 (#265)

Add custom regex managers for libvirt, cloud-hypervisor-gl, and
edk2-cloud-hypervisor-gl packages. These packages are hosted in
gardenlinux org repos and use branch-specific release tags with a
'+bp2150' suffix.

The managers:
- Extract the version prefix (before the %2B-encoded '+') as the
  current value for comparison against GitHub release tags
- Filter datasource releases to only those ending in '+bp2150' via
  extractVersionTemplate, excluding staging (+sta) and cross-branch
  (+bp1877) releases
- Write back with the correct URL-encoded suffix via
  autoReplaceStringTemplate
---
 renovate.json | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/renovate.json b/renovate.json
index 7190a60..67b763c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,3 +1,54 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Update libvirt package version for rel-2150-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "LIBVIRT_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+      ],
+      "depNameTemplate": "gardenlinux/package-libvirt",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "LIBVIRT_VERSION=\"{{{newValue}}}%2Bbp2150\""
+    },
+    {
+      "customType": "regex",
+      "description": "Update cloud-hypervisor-gl package version for rel-2150-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "CLOUD_HYPERVISOR_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+      ],
+      "depNameTemplate": "gardenlinux/package-cloud-hypervisor-gl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "CLOUD_HYPERVISOR_VERSION=\"{{{newValue}}}%2Bbp2150\""
+    },
+    {
+      "customType": "regex",
+      "description": "Update edk2-cloud-hypervisor-gl package version for rel-2150-dev",
+      "managerFilePatterns": ["/features/sci/exec\\.config$/"],
+      "matchStrings": [
+        "EDK2_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+      ],
+      "depNameTemplate": "gardenlinux/package-edk2-cloud-hypervisor-gl",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
+      "versioningTemplate": "loose",
+      "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}%2Bbp2150\""
+    }
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": [
+        "gardenlinux/package-libvirt",
+        "gardenlinux/package-cloud-hypervisor-gl",
+        "gardenlinux/package-edk2-cloud-hypervisor-gl"
+      ],
+      "groupName": "SCI custom packages"
+    }
+  ]
 }

From edc5d9be8aebed7baa9c34475dc5356b71b0b49b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 10:05:41 +0200
Subject: [PATCH 17/38] Update SCI custom packages (#266)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 402c560..650fb31 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.1.0-1gl7%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl8%2Bbp2150"
+LIBVIRT_VERSION="12.2.0-1gl1%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="51.1-1gl9%2Bbp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 7d2d97e43156a693afd9006b7ad919807958386d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 13:43:53 +0200
Subject: [PATCH 18/38] Update actions/checkout action to v7 (#269)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml      | 4 ++--
 .github/workflows/nightly.yaml | 4 ++--
 .github/workflows/test.yml     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index d2bda75..268bb68 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index efa4484..51048b9 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           submodules: recursive
   build:
@@ -39,7 +39,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 06d0c08..a880bd4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install oras
         uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
         with:

From 2b90efa458be0907712fd08634688f9bdd70fdc6 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 16:45:00 +0200
Subject: [PATCH 19/38] Update SCI custom packages (#273)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 650fb31..35e691f 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.2.0-1gl1%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="51.1-1gl9%2Bbp2150"
+LIBVIRT_VERSION="12.2.0-1gl2%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl1%2Bbp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 2d181bbf006c18c93d59c362f84073aea50b275a Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Wed, 24 Jun 2026 08:34:49 +0200
Subject: [PATCH 20/38] Remove packageRules from renovate.json (#277)

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 renovate.json | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/renovate.json b/renovate.json
index 67b763c..c756739 100644
--- a/renovate.json
+++ b/renovate.json
@@ -40,15 +40,5 @@
       "versioningTemplate": "loose",
       "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}%2Bbp2150\""
     }
-  ],
-  "packageRules": [
-    {
-      "matchPackageNames": [
-        "gardenlinux/package-libvirt",
-        "gardenlinux/package-cloud-hypervisor-gl",
-        "gardenlinux/package-edk2-cloud-hypervisor-gl"
-      ],
-      "groupName": "SCI custom packages"
-    }
   ]
 }

From 662bab99c51bb20cb94e0170d34b0dd602e9fd44 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Fri, 26 Jun 2026 10:02:46 +0200
Subject: [PATCH 21/38] Update to 2150.5.0 (#278)

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 268bb68..5329c35 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 51048b9..ac34614 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 01074c6..3510d7c 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@2a0481143efc26c2acc2c29be0e1379b23842bcb
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 1facf7b..a3b40ea 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.4.2
+2150.5.0
diff --git a/gardenlinux b/gardenlinux
index 2a04811..6f17d0c 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 2a0481143efc26c2acc2c29be0e1379b23842bcb
+Subproject commit 6f17d0c28bddd056b7c747cf9b67904bc53939f1

From 13224ebcaf303b73bb31a971632b859f2f860fae Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:27:17 +0200
Subject: [PATCH 22/38] Update SCI custom packages (#288)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 35e691f..d8d6c68 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.2.0-1gl2%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl1%2Bbp2150"
+LIBVIRT_VERSION="12.2.0-1gl3%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl2%2Bbp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 4ac9474171fde7d45dbb281230b2a8ed5327cdf8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:42:44 +0200
Subject: [PATCH 23/38] Update SCI custom packages (#290)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index d8d6c68..a0cbf43 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -9,8 +9,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.2.0-1gl3%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl2%2Bbp2150"
+LIBVIRT_VERSION="12.2.0-1gl4%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl3%2Bbp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 97ef38d053df1d03552f95f5cbf59dc78f3be92b Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:43:34 +0200
Subject: [PATCH 24/38] Update references for upgrade to 2150.6.0 (#292)

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 4 ++--
 gardenlinux                      | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 5329c35..901b387 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index ac34614..c90de87 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 3510d7c..05f69a0 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@6f17d0c28bddd056b7c747cf9b67904bc53939f1
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
@@ -40,7 +40,7 @@ jobs:
       - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
-        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@19c1b24c01faab81a7fe24713748dd172d00904a
+        uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@efdffb9a6b279cd7aada23b02baf4ec2534dc6d2
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
diff --git a/gardenlinux b/gardenlinux
index 6f17d0c..7b7c0db 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 6f17d0c28bddd056b7c747cf9b67904bc53939f1
+Subproject commit 7b7c0db856bfe4b7e976215c03d87652c277bf0e

From 297ce257954b76a3c5a23c35bfd537cb20215fd1 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Mon, 6 Jul 2026 17:03:33 +0200
Subject: [PATCH 25/38] Update to 2150.6.0

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index a3b40ea..11e46b5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.5.0
+2150.6.0

From ae9f4cf40797c9341cbac4ab0d59a827e75b2a56 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:40:36 +0200
Subject: [PATCH 26/38] Improve sci exec.config (#298)

* cloud hypervisor had debug symbols, hence generally remove them from
  the package list to avoid installing them
* improve quoting in create function

Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 features/sci/exec.config | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index a0cbf43..c5bae1f 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+
 set -Eeuo pipefail
 
 # Undo the gardener feature disablement
@@ -19,6 +20,8 @@ for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/release
 done
 
 pushd /tmp/custompackages > /dev/null
+rm -f -- *dbgsym* *arm64* || true
+ls -1
 dpkg -i cloud-hypervisor-gl*_amd64.deb edk2-cloud-hypervisor-gl*_amd64.deb libvirt-clients_*_amd64.deb libvirt-common_*_amd64.deb libvirt-daemon_*_amd64.deb libvirt-daemon-common_*_amd64.deb libvirt-daemon-config-network_*_all.deb libvirt-daemon-config-nwfilter_*_all.deb libvirt-daemon-driver-ch-gl_*_amd64.deb libvirt-daemon-driver-network_*_amd64.deb libvirt-daemon-driver-nodedev_*_amd64.deb libvirt-daemon-driver-nwfilter_*_amd64.deb libvirt-daemon-driver-qemu_*_amd64.deb libvirt-daemon-driver-secret_*_amd64.deb libvirt-daemon-driver-storage_*_amd64.deb libvirt-daemon-log_*_amd64.deb libvirt-daemon-system_*_amd64.deb libvirt0_*_amd64.deb
 popd > /dev/null
 rm -rf /tmp/custompackages
@@ -34,11 +37,11 @@ function create() {
   shift
   ID=$1
   shift
-  adduser --uid $ID --home /var/lib/$NAME $NAME \
+  adduser --uid "$ID" --home "/var/lib/$NAME" "$NAME" \
     --system --group --disabled-password --disabled-login
   echo "$@"
   for group in "$@"; do
-    adduser $NAME $group
+    adduser "$NAME" "$group"
   done
 }
 

From 01f9bc3f5b76980406a97042fec9f9a095ec7396 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:45:15 +0200
Subject: [PATCH 27/38] Update oras-project/setup-oras digest to 1d808f7 (#296)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a880bd4..645025a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Install oras
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
         with:
           version: 1.2.2
       - name: Validate image tag
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 05f69a0..542b73d 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin@v4.1.1
         with:
           submodules: true
-      - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2
+      - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
       - run: oras version
       - name: Install python-gardenlinux-lib
         uses: gardenlinux/python-gardenlinux-lib/.github/actions/setup@efdffb9a6b279cd7aada23b02baf4ec2534dc6d2

From c7c3d9a4f2ab2c4acadcb2aaf9225714ebfa2b72 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 20:53:53 +0200
Subject: [PATCH 28/38] Update SCI custom packages (#301)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index c5bae1f..4131bd2 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -10,8 +10,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.2.0-1gl4%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl3%2Bbp2150"
+LIBVIRT_VERSION="12.2.0-1gl5%2Bbp2150"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl4%2Bbp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 3bf4e5de2d6a95425588fe40760e4cb9c2b77eb7 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Wed, 15 Jul 2026 09:35:31 +0200
Subject: [PATCH 29/38] Apply systemd presets (#299) (#302)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Евгени Димитров <evgeni.dimitrov@gmail.com>
---
 features/sci/exec.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 4131bd2..3a234c1 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -2,6 +2,9 @@
 
 set -Eeuo pipefail
 
+# Apply systemd presets
+systemctl preset-all
+
 # Undo the gardener feature disablement
 systemctl enable ssh
 

From 2037ceee83b484799b558018f7a63418def043fd Mon Sep 17 00:00:00 2001
From: Fabian Koller <fabian.koller@sap.com>
Date: Thu, 16 Jul 2026 16:43:07 +0200
Subject: [PATCH 30/38] fix(ci): try to improve performance

we are seeing a lot of `workqueue: ata_sff_pio_task hogged CPU for
>10000us 4 times` which comes from the IDE Driver. Try if switching to
virtio-blk speeds things up.
---
 .github/actions/test/integration/setup/hv.xml     | 2 +-
 .github/actions/test/integration/test/qemu/vm.xml | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/test/integration/setup/hv.xml b/.github/actions/test/integration/setup/hv.xml
index 63341fb..c8f6f0d 100644
--- a/.github/actions/test/integration/setup/hv.xml
+++ b/.github/actions/test/integration/setup/hv.xml
@@ -15,7 +15,7 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/HV_NAME_GOES_HERE.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
         <interface type='network'>
             <mac address='MAC_GOES_HERE' />
diff --git a/.github/actions/test/integration/test/qemu/vm.xml b/.github/actions/test/integration/test/qemu/vm.xml
index 3626dc1..1fe453b 100644
--- a/.github/actions/test/integration/test/qemu/vm.xml
+++ b/.github/actions/test/integration/test/qemu/vm.xml
@@ -15,12 +15,12 @@
         <disk type='file' device='disk'>
             <driver name='qemu' type='qcow2' />
             <source file='/var/lib/libvirt/images/ubuntu.qcow2' />
-            <target dev='hda' bus='ide' />
+            <target dev='vda' bus='virtio' />
         </disk>
-        <disk type='file' device='cdrom'>
+        <disk type='file' device='disk'>
             <driver name='qemu' type='raw' />
             <source file='/var/lib/libvirt/images/ubuntu-cloud-init-ds.iso' />
-            <target dev='hdb' bus='ide' />
+            <target dev='vdb' bus='virtio' />
             <readonly />
         </disk>
         <interface type='network'>

From 90b3171ac2f80c417e7e379228ba3c478e6754a9 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 11 Aug 2026 13:36:44 +0200
Subject: [PATCH 31/38] Update to upstream 2150.7.0 (#305)

* Update to upstream 2150.7.0

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>

* add diagnostics

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>

* add ssh client

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>

---------

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .../test/integration/collect-logs/action.yml  | 38 +++++++++++++++++++
 .../test/cloudhypervisor/action.yml           | 31 ++++++++++++++-
 .../test/integration/test/qemu/action.yml     | 27 +++++++++++++
 .github/workflows/dev.yml                     |  2 +-
 .github/workflows/nightly.yaml                |  4 +-
 .github/workflows/upload_oci.yml              |  2 +-
 VERSION                                       |  2 +-
 features/_scicommon/pkg.include               |  1 +
 gardenlinux                                   |  2 +-
 9 files changed, 101 insertions(+), 8 deletions(-)

diff --git a/.github/actions/test/integration/collect-logs/action.yml b/.github/actions/test/integration/collect-logs/action.yml
index 0974c81..51df119 100644
--- a/.github/actions/test/integration/collect-logs/action.yml
+++ b/.github/actions/test/integration/collect-logs/action.yml
@@ -34,6 +34,44 @@ runs:
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/QEMU.log "serial-VM-QEMU-HV2.log" || true
         scp $SSH_OPTS $USER@$HV2_IP:/var/log/CHV.log "serial-VM-CHV-HV2.log" || true
 
+    - name: Obtain network diagnostics from hypervisors
+      shell: bash
+      run: |
+        KEY=/opt/ssh_host_ed25519_key
+        SSH_OPTS="-i $KEY -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
+        USER="root"
+
+        for HV_NAME in HV1 HV2; do
+          IP="192.168.122.$([[ $HV_NAME == HV1 ]] && echo 2 || echo 3)"
+
+          ssh $SSH_OPTS $USER@$IP "
+            echo '=== ip addr ==='
+            ip addr
+            echo '=== ip route ==='
+            ip route
+            echo '=== bridge link ==='
+            bridge link 2>/dev/null || true
+            echo '=== arp -n ==='
+            arp -n 2>/dev/null || ip neigh || true
+            echo '=== iptables -L -n ==='
+            iptables -L -n 2>/dev/null || true
+            echo '=== iptables -t nat -L -n ==='
+            iptables -t nat -L -n 2>/dev/null || true
+            echo '=== virsh net-list ==='
+            virsh net-list --all 2>/dev/null || true
+            echo '=== virsh net-dumpxml default ==='
+            virsh net-dumpxml default 2>/dev/null || true
+            echo '=== dnsmasq leases ==='
+            cat /var/lib/libvirt/dnsmasq/*.leases 2>/dev/null || true
+            echo '=== systemctl status systemd-networkd ==='
+            systemctl status systemd-networkd --no-pager 2>/dev/null || true
+            echo '=== networkctl status ==='
+            networkctl status --no-pager 2>/dev/null || true
+            echo '=== ssh -V ==='
+            ssh -V 2>&1 || true
+          " > "network-diag-${HV_NAME}.log" 2>&1 || true
+        done
+
     - name: Set permissions
       shell: bash
       run: |
diff --git a/.github/actions/test/integration/test/cloudhypervisor/action.yml b/.github/actions/test/integration/test/cloudhypervisor/action.yml
index f3eeabc..078de40 100644
--- a/.github/actions/test/integration/test/cloudhypervisor/action.yml
+++ b/.github/actions/test/integration/test/cloudhypervisor/action.yml
@@ -52,7 +52,14 @@ runs:
             IP=\$(virsh -c ch:///session domifaddr VM-CHV | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
-            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
+            elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
               ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
@@ -60,6 +67,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh -c ch:///session domifaddr VM-CHV ---"
+              virsh -c ch:///session domifaddr VM-CHV || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -111,7 +130,7 @@ runs:
 
           MAX_ITER=15
           for ((i=1; i<=MAX_ITER; i++)); do
-            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' ; then
+            if ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # verify the migration by checking the dummy file
               if ssh \$SSH_OPTS "\$USER@\$IP" 'test -f /opt/hello.txt'; then
@@ -124,6 +143,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/actions/test/integration/test/qemu/action.yml b/.github/actions/test/integration/test/qemu/action.yml
index 0dab034..e6887e5 100644
--- a/.github/actions/test/integration/test/qemu/action.yml
+++ b/.github/actions/test/integration/test/qemu/action.yml
@@ -50,6 +50,13 @@ runs:
             IP=\$(virsh domifaddr VM-QEMU | awk '/ipv4/ {print \$4}' | cut -d'/' -f1)
             if [ -z "\$IP" ]; then
               echo "No IP address found for VM. Retrying..."
+            elif (( i >= MAX_ITER - 2 )); then
+              # Show SSH errors on last 3 attempts for debugging
+              if ssh \$SSH_OPTS "\$USER@\$IP" 'exit'; then
+                echo "VM is up at IP: \$IP"
+                ssh \$SSH_OPTS "\$USER@\$IP" 'echo "Hello, World!" > /opt/hello.txt'
+                break
+              fi
             elif ssh \$SSH_OPTS "\$USER@\$IP" 'exit' 2>/dev/null; then
               echo "VM is up at IP: \$IP"
               # create a dummy file for verification later
@@ -58,6 +65,18 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- virsh domifaddr VM-QEMU ---"
+              virsh domifaddr VM-QEMU || true
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- arp -n ---"
+              arp -n 2>/dev/null || ip neigh || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
@@ -122,6 +141,14 @@ runs:
             fi
             if (( i == MAX_ITER )); then
               echo "Timeout waiting for VM to respond to SSH."
+              echo "=== DIAGNOSTICS ==="
+              echo "--- ip addr show virbr0 ---"
+              ip addr show virbr0 || true
+              echo "--- ip route ---"
+              ip route || true
+              echo "--- ssh -v attempt ---"
+              ssh -v \$SSH_OPTS "\$USER@\$IP" 'exit' 2>&1 || true
+              echo "=== END DIAGNOSTICS ==="
               exit 1
             fi
             echo "Waiting for VM to respond to SSH... (\$i/\$MAX_ITER)"
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 901b387..cf4bfe1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index c90de87..c7b5ae6 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 542b73d..73d2e37 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@7b7c0db856bfe4b7e976215c03d87652c277bf0e
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index 11e46b5..e9406d3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.6.0
+2150.7.0
diff --git a/features/_scicommon/pkg.include b/features/_scicommon/pkg.include
index a8ef404..af58852 100644
--- a/features/_scicommon/pkg.include
+++ b/features/_scicommon/pkg.include
@@ -1 +1,2 @@
 gnupg
+openssh-client
diff --git a/gardenlinux b/gardenlinux
index 7b7c0db..5e66e8d 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 7b7c0db856bfe4b7e976215c03d87652c277bf0e
+Subproject commit 5e66e8da34e90e9c257662f4a80142ebe11ca346

From b33d0e2771d7af773c3f313a8fe2c1689dfff46e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 11 Aug 2026 13:44:32 +0200
Subject: [PATCH 32/38] Update Group GitHub Actions (#311)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 4 ++--
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/test.yml       | 2 +-
 .github/workflows/upload_oci.yml | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index cf4bfe1..fbc8558 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -27,7 +27,7 @@ jobs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
@@ -61,7 +61,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image metadata
         id: meta
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index c7b5ae6..5fc7e4d 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
   build:
@@ -39,7 +39,7 @@ jobs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Compute image tag
         id: meta
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 645025a..87ecf16 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install oras
         uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2
         with:
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 73d2e37..520afed 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: 'v2.4.1'
+          cosign-release: 'v3.1.3'
       - name: Set flavor version reference
         run: |
           git rev-parse HEAD | cut -c1-8 | tee COMMIT

From 56aae50bd22e158209f864c326107383da88e7c4 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Tue, 11 Aug 2026 14:20:17 +0200
Subject: [PATCH 33/38] Bump to 2150.8.0 (#313)

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 gardenlinux                      | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index fbc8558..d742b1e 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40f62d581bbdc272e4261108f29494a37b9cae53
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 5fc7e4d..b67feeb 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40f62d581bbdc272e4261108f29494a37b9cae53
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@40f62d581bbdc272e4261108f29494a37b9cae53
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 520afed..70d79cd 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@5e66e8da34e90e9c257662f4a80142ebe11ca346
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@40f62d581bbdc272e4261108f29494a37b9cae53
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index e9406d3..db90320 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.7.0
+2150.8.0
diff --git a/gardenlinux b/gardenlinux
index 5e66e8d..40f62d5 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 5e66e8da34e90e9c257662f4a80142ebe11ca346
+Subproject commit 40f62d581bbdc272e4261108f29494a37b9cae53

From 14deec821046399f14f8113763f7e60739fc1591 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:51:15 +0200
Subject: [PATCH 34/38] Rename UKI in persist script (#316) (#318)

This renames the UKI file to use GARDENLINUX_CNAME instead of a static
name. This supports transitioning to in-place updates.

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>

Backport of 4538861e2185716f8e4868908f6fbc9eae107804
---
 features/_usi/initrd.include/usr/bin/persist | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/_usi/initrd.include/usr/bin/persist b/features/_usi/initrd.include/usr/bin/persist
index 0c93a99..26fcaca 100755
--- a/features/_usi/initrd.include/usr/bin/persist
+++ b/features/_usi/initrd.include/usr/bin/persist
@@ -82,7 +82,7 @@ DASHED_GARDENLINUX_VERSION=${GARDENLINUX_VERSION//./-}
 OCI_TAG=${OCI_TAG:-"$GARDENLINUX_VERSION-$VARIANT_ID-${DASHED_GARDENLINUX_VERSION}-$GARDENLINUX_COMMIT_ID"}
 OCI_TAG=${OCI_TAG//_/-} # replace underscores with dashes
 UKI_SHA=$(oras manifest fetch "$OCI_REPO:${OCI_TAG}" | jq -r '.layers[] | select(.mediaType=="application/io.gardenlinux.uki") | .digest')
-oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/uki.efi"
+oras blob fetch "$OCI_REPO@$UKI_SHA" -o "$esp_dir/EFI/Linux/${GARDENLINUX_CNAME}.efi"
 
 if [ "$ENABLE_HUGEPAGE_SETUP" = "true" ]; then
   echo "hugepagesz=2MB hugepages=$hugepages" > /tmp/cmdlinef

From 9bb5f7c7e52cb7eb9eaefa4aa6c9016028fdab54 Mon Sep 17 00:00:00 2001
From: Tobias Jungel <toanju@users.noreply.github.com>
Date: Mon, 24 Aug 2026 11:01:20 +0200
Subject: [PATCH 35/38] Use not encoded version strings (#323)

Use not encoded values for better readability and improve update
handling. In addition, future tags will included 2 + signs which now is
handled.

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Co-authored-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 features/sci/exec.config |  6 +++---
 renovate.json            | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 3a234c1..d1b9319 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -12,9 +12,9 @@ systemctl enable ssh
 # TODO : these all should go in the repo
 
 # all versions URL encoded
-EDK2_VERSION="20260221-0gl1%2Bbp2150"
-LIBVIRT_VERSION="12.2.0-1gl5%2Bbp2150"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl4%2Bbp2150"
+EDK2_VERSION="20260221-0gl1+bp2150"
+LIBVIRT_VERSION="12.2.0-1gl5+bp2150"
+CLOUD_HYPERVISOR_VERSION="52.1-1gl4+bp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do
diff --git a/renovate.json b/renovate.json
index c756739..43d8e2a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -6,39 +6,39 @@
       "description": "Update libvirt package version for rel-2150-dev",
       "managerFilePatterns": ["/features/sci/exec\\.config$/"],
       "matchStrings": [
-        "LIBVIRT_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+        "LIBVIRT_VERSION=\"(?<currentValue>.+)\\+bp2150\""
       ],
       "depNameTemplate": "gardenlinux/package-libvirt",
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
       "versioningTemplate": "loose",
-      "autoReplaceStringTemplate": "LIBVIRT_VERSION=\"{{{newValue}}}%2Bbp2150\""
+      "autoReplaceStringTemplate": "LIBVIRT_VERSION=\"{{{newValue}}}+bp2150\""
     },
     {
       "customType": "regex",
       "description": "Update cloud-hypervisor-gl package version for rel-2150-dev",
       "managerFilePatterns": ["/features/sci/exec\\.config$/"],
       "matchStrings": [
-        "CLOUD_HYPERVISOR_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+        "CLOUD_HYPERVISOR_VERSION=\"(?<currentValue>.+)\\+bp2150\""
       ],
       "depNameTemplate": "gardenlinux/package-cloud-hypervisor-gl",
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
       "versioningTemplate": "loose",
-      "autoReplaceStringTemplate": "CLOUD_HYPERVISOR_VERSION=\"{{{newValue}}}%2Bbp2150\""
+      "autoReplaceStringTemplate": "CLOUD_HYPERVISOR_VERSION=\"{{{newValue}}}+bp2150\""
     },
     {
       "customType": "regex",
       "description": "Update edk2-cloud-hypervisor-gl package version for rel-2150-dev",
       "managerFilePatterns": ["/features/sci/exec\\.config$/"],
       "matchStrings": [
-        "EDK2_VERSION=\"(?<currentValue>[^%]+)%2Bbp2150\""
+        "EDK2_VERSION=\"(?<currentValue>.+)\\+bp2150\""
       ],
       "depNameTemplate": "gardenlinux/package-edk2-cloud-hypervisor-gl",
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^(?<version>.+)\\+bp2150$",
       "versioningTemplate": "loose",
-      "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}%2Bbp2150\""
+      "autoReplaceStringTemplate": "EDK2_VERSION=\"{{{newValue}}}+bp2150\""
     }
   ]
 }

From 4e95e52b703d6dfa9a25ed1ce180ef4759d02c33 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:15:12 +0200
Subject: [PATCH 36/38] Update SCI custom packages (#322)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index d1b9319..42fe2b9 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -13,8 +13,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1+bp2150"
-LIBVIRT_VERSION="12.2.0-1gl5+bp2150"
-CLOUD_HYPERVISOR_VERSION="52.1-1gl4+bp2150"
+LIBVIRT_VERSION="12.2.0+260714-1gl0+bp2150"
+CLOUD_HYPERVISOR_VERSION="52.1+260714-1gl0+bp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From 4734fd6960eb1e87c16e563aca7d9d6a1fd2ff2d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:46:13 +0200
Subject: [PATCH 37/38] Update SCI custom packages (#327)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 features/sci/exec.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/features/sci/exec.config b/features/sci/exec.config
index 42fe2b9..5115bba 100755
--- a/features/sci/exec.config
+++ b/features/sci/exec.config
@@ -13,8 +13,8 @@ systemctl enable ssh
 
 # all versions URL encoded
 EDK2_VERSION="20260221-0gl1+bp2150"
-LIBVIRT_VERSION="12.2.0+260714-1gl0+bp2150"
-CLOUD_HYPERVISOR_VERSION="52.1+260714-1gl0+bp2150"
+LIBVIRT_VERSION="12.2.0+260825-1gl0+bp2150"
+CLOUD_HYPERVISOR_VERSION="52.1+260825-1gl0+bp2150"
 
 mkdir /tmp/custompackages
 for p in https://github.com/gardenlinux/package-edk2-cloud-hypervisor-gl/releases/download/$EDK2_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-libvirt/releases/download/$LIBVIRT_VERSION/build.tar.xz.0000 https://github.com/gardenlinux/package-cloud-hypervisor-gl/releases/download/$CLOUD_HYPERVISOR_VERSION/build.tar.xz.0000; do

From ef9500efc08eb5cb3856023394dfbdc4d2a53dab Mon Sep 17 00:00:00 2001
From: Tobias Jungel <1773291+toanju@users.noreply.github.com>
Date: Wed, 2 Sep 2026 21:47:35 +0200
Subject: [PATCH 38/38] Update to 2150.9.0

Signed-off-by: Tobias Jungel <1773291+toanju@users.noreply.github.com>
---
 .github/workflows/dev.yml        | 2 +-
 .github/workflows/nightly.yaml   | 4 ++--
 .github/workflows/upload_oci.yml | 2 +-
 VERSION                          | 2 +-
 features/_archgrouped            | 1 +
 gardenlinux                      | 2 +-
 6 files changed, 7 insertions(+), 6 deletions(-)
 create mode 120000 features/_archgrouped

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index d742b1e..351fed3 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -39,7 +39,7 @@ jobs:
   build:
     needs: [set_version]
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40f62d581bbdc272e4261108f29494a37b9cae53
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       version: ${{ needs.set_version.outputs.VERSION }}
       # to set target to "release" or "nightly" we need proper KMS secrets
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index b67feeb..e358b1f 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -19,7 +19,7 @@ jobs:
           submodules: recursive
   build:
     needs: [checkout]
-    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@40f62d581bbdc272e4261108f29494a37b9cae53
+    uses: gardenlinux/gardenlinux/.github/workflows/build.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       version: ${{ inputs.version || 'now' }}
       # to set target to "release" or "nightly" we need proper KMS secrets
@@ -49,7 +49,7 @@ jobs:
     name: Run glcli to publish to OCI
     needs: [build]
     # use custom upload_oci.yml as we do not sign the images
-    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@40f62d581bbdc272e4261108f29494a37b9cae53
+    # uses: gardenlinux/gardenlinux/.github/workflows/upload_oci.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     uses: ./.github/workflows/upload_oci.yml
     with:
       version: ${{ needs.build.outputs.version }}
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index 70d79cd..c46c226 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   generate_matrix_publish:
     name: Generate flavors matrix to publish
-    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@40f62d581bbdc272e4261108f29494a37b9cae53
+    uses: gardenlinux/gardenlinux/.github/workflows/build_flavors_matrix.yml@a6e35cf0c955dde584c67163a3a8dff6d60e9d56
     with:
       flags: '${{ inputs.flavor_filter }} --no-arch --json-by-arch --build --test'
   upload_gl_artifacts:
diff --git a/VERSION b/VERSION
index db90320..52dfea6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2150.8.0
+2150.9.0
diff --git a/features/_archgrouped b/features/_archgrouped
new file mode 120000
index 0000000..fdd2adc
--- /dev/null
+++ b/features/_archgrouped
@@ -0,0 +1 @@
+../gardenlinux/features/_archgrouped
\ No newline at end of file
diff --git a/gardenlinux b/gardenlinux
index 40f62d5..a6e35cf 160000
--- a/gardenlinux
+++ b/gardenlinux
@@ -1 +1 @@
-Subproject commit 40f62d581bbdc272e4261108f29494a37b9cae53
+Subproject commit a6e35cf0c955dde584c67163a3a8dff6d60e9d56