Merge pull request #3679 from rn/kern-up

Update kernels to 5.11.22/5.10.39/5.4.121

examples/aws.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/azure.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/cadvisor.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/dm-crypt-loop.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/dm-crypt.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/docker-for-mac.yml

@@ -1,6 +1,6 @@
 # This is an example for building the open source components of Docker for Mac
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/vpnkit-expose-port:b0a5ede4c53aa718b48fb9a86e4725ab6ae7f96e # install vpnkit-expose-port and vpnkit-iptables-wrapper on host

examples/docker.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/gcp.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/getty.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/hetzner.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: console=ttyS1
   ucode: intel-ucode.cpio
 init:

examples/hostmount-writeable-overlay.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/influxdb-os.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/logging.yml

@@ -1,6 +1,6 @@
 # Simple example of using an external logging service
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/minimal.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/node_exporter.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/openstack.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/packet.arm64.yml

@@ -5,7 +5,7 @@
 # for arm64 then the 'ucode' line in the kernel section can be left
 # out.
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyAMA0"
   ucode: ""
 onboot:

examples/packet.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: console=ttyS1
   ucode: intel-ucode.cpio
 init:

examples/redis-os.yml

@@ -1,7 +1,7 @@
 # Minimal YAML to run a redis server (used at DockerCon'17)
 # connect: nc localhost 6379
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/scaleway.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0 root=/dev/vda"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/sshd.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/static-ip.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/swap.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/tpm.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/vmware.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/vpnkit-forwarder.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/vsudd-containerd.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/vultr.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

examples/wireguard.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

kernel/Dockerfile

@@ -40,15 +40,13 @@ ARG KERNEL_SERIES
 ARG EXTRA
 ARG DEBUG
 
-ENV WIREGUARD_VERSION=v1.0.20210219
-ENV WIREGUARD_SHA256="11a75cf2387b6bb227c96241c911b5f48475def1ac84d0e758793cf9e677a6f0"
-ENV WIREGUARD_URL=https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${WIREGUARD_VERSION}.tar.xz
-
 # We copy the entire directory. This copies some unneeded files, but
 # allows us to check for the existence /patches-${KERNEL_SERIES} to
 # build kernels without patches.
 COPY / /
 
+RUN mkdir -p /out/src
+
 # Download and verify kernel
 # PGP keys: 589DA6B1 (greg@kroah.com) & 6092693E (autosigner@kernel.org) & 00411886 (torvalds@linux-foundation.org)
 RUN KERNEL_MAJOR=$(echo ${KERNEL_VERSION} | cut -d . -f 1) && \
@@ -65,10 +63,8 @@ RUN KERNEL_MAJOR=$(echo ${KERNEL_VERSION} | cut -d . -f 1) && \
     xz -d linux-${KERNEL_VERSION}.tar.xz && \
     curl -fsSLO ${KERNEL_PGP2_SIGN} && \
     gpg2 --verify linux-${KERNEL_VERSION}.tar.sign linux-${KERNEL_VERSION}.tar && \
-    cat linux-${KERNEL_VERSION}.tar | tar --absolute-names -x && mv /linux-${KERNEL_VERSION} /linux
+    cat linux-${KERNEL_VERSION}.tar | tar --absolute-names -x && mv /linux-${KERNEL_VERSION} /linux && \
-
+    printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info
-
-RUN mkdir -p /out/src
 
 WORKDIR /tmp
 # Download Intel ucode, create a CPIO archive for it, and keep it in the build context
@@ -107,8 +103,6 @@ RUN set -e && \
         done; \
     fi
 
-
-
 # Save kernel source
 RUN tar cJf /out/src/linux.tar.xz /linux
 
@@ -167,18 +161,8 @@ RUN case $(uname -m) in \
     cp System.map /out && \
     ([ -n "${DEBUG}" ] && cp vmlinux /out || true)
 
-# WireGuard (skip kernels which have it in tree)
-RUN if [  ! -d /linux/drivers/net/wireguard ]; then \
-        curl -fsSL -o /wireguard.tar.xz "${WIREGUARD_URL}" && \
-        echo "${WIREGUARD_SHA256}  /wireguard.tar.xz" | sha256sum -c - && \
-        cp /wireguard.tar.xz /out/src/ && \
-        tar -C / --one-top-level=wireguard --strip-components=2 -xJf /wireguard.tar.xz "wireguard-linux-compat-${WIREGUARD_VERSION}/src" && \
-        make -j "$(getconf _NPROCESSORS_ONLN)" M="/wireguard" modules; \
-     fi
-
 # Modules and Device Tree binaries
 RUN make INSTALL_MOD_PATH=/tmp/kernel-modules modules_install && \
-    make INSTALL_MOD_PATH=/tmp/kernel-modules M="/wireguard" modules_install && \
     ( DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \
       cd /tmp/kernel-modules/lib/modules/$DVER && \
       rm build source && \
@@ -210,9 +194,7 @@ RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdept
          tar cf - -T - | (cd $dir; tar xf -) && \
     ( cd /tmp && tar cf /out/kernel-dev.tar usr/src )
 
-RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info
 RUN printf "${BUILD_IMAGE}" > /out/kernel-builder
-LABEL org.mobyproject.linuxkit.kernel.buildimage ${BUILD_IMAGE}
 
 FROM scratch
 ENTRYPOINT []

kernel/Dockerfile.bcc

@@ -1,7 +1,8 @@
 ARG IMAGE
+ARG BUILD_IMAGE
+
 FROM ${IMAGE} as ksrc
 
-ARG BUILD_IMAGE
 FROM ${BUILD_IMAGE} AS build
 RUN apk update && apk upgrade -a && \
   apk add --no-cache \

kernel/Dockerfile.kconfig

@@ -1,4 +1,6 @@
 ARG BUILD_IMAGE
+ARG KERNEL_VERSIONS
+
 FROM ${BUILD_IMAGE} AS kernel-build
 RUN apk add \
     argp-standalone \
@@ -15,8 +17,6 @@ RUN apk add \
     patch \
     xz
 
-ARG KERNEL_VERSIONS
-
 COPY / /
 
 # Unpack kernels (download if not present)

kernel/Dockerfile.perf

@@ -1,9 +1,10 @@
 # This Dockerfile extracts the source code and headers from a kernel package,
 # builds the perf utility, and places it into a scratch image
 ARG IMAGE
+ARG BUILD_IMAGE
+
 FROM ${IMAGE} AS ksrc
 
-ARG BUILD_IMAGE
 FROM ${BUILD_IMAGE} AS build
 RUN apk add \
     argp-standalone \

kernel/Dockerfile.zfs

@@ -1,7 +1,8 @@
 ARG IMAGE
+ARG BUILD_IMAGE
+
 FROM ${IMAGE} AS ksrc
 
-ARG BUILD_IMAGE
 FROM ${BUILD_IMAGE} AS build
 RUN apk add \
     attr-dev \

kernel/Makefile

@@ -55,6 +55,8 @@ endif
 
 TAG=$(HASH)$(DIRTY)
 
+BUILD_LABEL=--label org.mobyproject.linuxkit.kernel.buildimage=$(IMAGE_BUILDER)
+
 REPO?=https://github.com/linuxkit/linuxkit
 ifneq ($(REPO),)
 REPO_LABEL=--label org.opencontainers.image.source=$(REPO)
@@ -63,7 +65,8 @@ ifeq ($(DIRTY),)
 REPO_COMMIT=$(shell git rev-parse HEAD)
 COMMIT_LABEL=--label org.opencontainers.image.revision=$(REPO_COMMIT)
 endif
-LABELS=$(REPO_LABEL) $(COMMIT_LABEL)
+
+LABELS=$(REPO_LABEL) $(COMMIT_LABEL) $(BUILD_LABEL)
 
 KERNEL_VERSIONS=
 
@@ -125,21 +128,21 @@ push_$(2)$(3)$(4): notdirty build_$(2)$(3)$(4)
 		(docker push $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 		 docker tag $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE):$(1)$(3)$(4)$(SUFFIX) && \
 		 docker push $(ORG)/$(IMAGE):$(1)$(3)$(4)$(SUFFIX) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST))
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4))
 
 forcepush_$(2)$(3)$(4): notdirty forcebuild_$(2)$(3)$(4)
 	docker push $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 	 docker tag $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE):$(1)$(3)$(4)$(SUFFIX) && \
 	 docker push $(ORG)/$(IMAGE):$(1)$(3)$(4)$(SUFFIX) && \
-	 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+	 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG) && \
-	 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST)
+	 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)
 
 # tag the builder and create the manifest
 tagbuilder_$(2)$(3)$(4): notdirty
 	docker tag $(IMAGE_BUILDER) $(ORG)/$(IMAGE):$(1)$(3)$(4)-builder$(SUFFIX) && \
 	docker push $(ORG)/$(IMAGE):$(1)$(3)$(4)-builder$(SUFFIX) && \
-	$(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-builder $(DOCKER_CONTENT_TRUST)
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)$(4)-builder
 
 
 show-tag_$(2)$(3)$(4):
@@ -154,26 +157,18 @@ forcepush_image: forcepush_$(2)$(3)$(4)
 tagbuilder: tagbuilder_$(2)$(3)$(4)
 show-tags: show-tag_$(2)$(3)$(4)
 
-# FIXME: We no longer use DOCKER_CONENT_TRUST=1
-#
-# 'docker build' with the FROM image supplied as --build-arg
-# *and* with DOCKER_CONTENT_TRUST=1 currently does not work
-# (https://github.com/moby/moby/issues/34199). So, we pull the image
-# with DCT as part of the dependency on build_$(2)$(3)$(4) and then build
-# with DOCKER_CONTENT_TRUST explicitly set to 0
-
 # Only build perf only on x86 and recent LTS and latest stable kernels
 ifeq ($(ARCH),x86_64)
 ifeq ($(2), $(filter $(2),5.11.x 5.10.x 5.4.x))
 build_perf_$(2)$(3)$(4): build_$(2)$(3)$(4)
 	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) || \
-		 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.perf \
+		 docker build -f Dockerfile.perf \
 			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) \
 			--build-arg BUILD_IMAGE=$(IMAGE_BUILDER) \
 			--no-cache --network=none $(LABEL) -t $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) .
 
 forcebuild_perf_$(2)$(3)$(4): build_$(2)$(3)$(4)
-	 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.perf \
+	docker build -f Dockerfile.perf \
 		--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) \
 		--build-arg BUILD_IMAGE=$(IMAGE_BUILDER) \
 		--no-cache --network=none $(LABEL) -t $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) .
@@ -183,15 +178,15 @@ push_perf_$(2)$(3)$(4): notdirty build_perf_$(2)$(3)$(4)
 		(docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)$(SUFFIX) && \
 		 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)$(SUFFIX) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST))
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4))
 
 forcepush_perf_$(2)$(3)$(4): notdirty forcebuild_perf_$(2)$(3)$(4)
 	docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 	docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)$(SUFFIX) && \
 	docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)$(SUFFIX) && \
-	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG) && \
-	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST)
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)
 
 build: build_perf_$(2)$(3)$(4)
 forcebuild: forcebuild_perf_$(2)$(3)$(4)
@@ -205,13 +200,13 @@ ifeq ($(ARCH),x86_64)
 ifeq ($(2), $(filter $(2),5.11.x 5.10.x 5.4.x))
 build_bcc_$(2)$(3)$(4): build_$(2)$(3)$(4)
 	docker pull $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) || \
-		 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.bcc \
+		docker build -f Dockerfile.bcc \
 			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) \
 			--build-arg BUILD_IMAGE=$(IMAGE_BUILDER) \
 			--no-cache $(LABEL) -t $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) .
 
 forcebuild_bcc_$(2)$(3)$(4): build_$(2)$(3)$(4)
-	 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.bcc \
+	 docker build -f Dockerfile.bcc \
 		--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)$(4)-$(TAG)$(SUFFIX) \
 		--build-arg BUILD_IMAGE=$(IMAGE_BUILDER) \
 		--no-cache $(LABEL) -t $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) .
@@ -221,15 +216,15 @@ push_bcc_$(2)$(3)$(4): notdirty build_bcc_$(2)$(3)$(4)
 		(docker push $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 		 docker tag $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)$(SUFFIX) && \
 		 docker push $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)$(SUFFIX) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST))
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4))
 
 forcepush_bcc_$(2)$(3)$(4): notdirty forcebuild_bcc_$(2)$(3)$(4)
 	docker push $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) && \
 	docker tag $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)$(SUFFIX) && \
 	docker push $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)$(SUFFIX) && \
-	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)-$(TAG) && \
-	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4) $(DOCKER_CONTENT_TRUST)
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE_BCC):$(1)$(3)$(4)
 
 # Disable bcc build as it is failing: https://github.com/linuxkit/linuxkit/issues/3652
 # build: build_bcc_$(2)$(3)$(4)
@@ -244,7 +239,7 @@ ifeq ($(4),)
 # is incompatible with CDDL, apparently (this is ./configure check)
 build_zfs_$(2)$(3): build_$(2)$(3)
 	docker pull $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG)$(SUFFIX) || \
-		 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.zfs \
+		docker build -f Dockerfile.zfs \
 			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) \
 			--build-arg BUILD_IMAGE=$(IMAGE_BUILDER) \
 			--no-cache $(LABEL) -t $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG)$(SUFFIX) .
@@ -254,8 +249,8 @@ push_zfs_$(2)$(3): notdirty build_zfs_$(2)$(3)
 		(docker push $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG)$(SUFFIX) && \
 		 docker tag $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_ZFS):$(1)$(3)$(SUFFIX) && \
 		 docker push $(ORG)/$(IMAGE_ZFS):$(1)$(3)$(SUFFIX) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG) $(DOCKER_CONTENT_TRUST) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_ZFS):$(1)$(3)-$(TAG) && \
-		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_ZFS):$(1)$(3) $(DOCKER_CONTENT_TRUST))
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_ZFS):$(1)$(3))
 endif
 
 endef
@@ -265,20 +260,20 @@ endef
 # Debug targets only for latest stable and LTS stable
 #
 ifeq ($(ARCH),x86_64)
-$(eval $(call kernel,5.11.18,5.11.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.11.22,5.11.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,5.10.34,5.10.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.10.39,5.10.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,5.10.34,5.10.x,,-dbg))
+$(eval $(call kernel,5.10.39,5.10.x,,-dbg))
-$(eval $(call kernel,5.4.116,5.4.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.4.121,5.4.x,$(EXTRA),$(DEBUG)))
 #$(eval $(call kernel,5.4.28,5.4.x,-rt,))
 
 else ifeq ($(ARCH),$(filter $(ARCH),aarch64 arm64))
-$(eval $(call kernel,5.11.18,5.11.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.11.22,5.11.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,5.10.34,5.10.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.10.39,5.10.x,$(EXTRA),$(DEBUG)))
 #$(eval $(call kernel,5.4.28,5.4.x,-rt,))
 
 else ifeq ($(ARCH),s390x)
-$(eval $(call kernel,5.11.18,5.11.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.11.22,5.11.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,5.10.34,5.10.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,5.10.39,5.10.x,$(EXTRA),$(DEBUG)))
 endif
 
 # Target for kernel config

kernel/config-5.10.x-aarch64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 5.10.34 Kernel Configuration
+# Linux/arm64 5.10.39 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.10.x-s390x

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/s390 5.10.34 Kernel Configuration
+# Linux/s390 5.10.39 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.10.x-x86_64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.10.34 Kernel Configuration
+# Linux/x86 5.10.39 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.11.x-aarch64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 5.11.18 Kernel Configuration
+# Linux/arm64 5.11.22 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.11.x-s390x

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/s390 5.11.18 Kernel Configuration
+# Linux/s390 5.11.22 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.11.x-x86_64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.11.18 Kernel Configuration
+# Linux/x86 5.11.22 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (Alpine 10.2.1_pre1) 10.2.1 20201203"
 CONFIG_CC_IS_GCC=y

kernel/config-5.4.x-x86_64

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.4.116 Kernel Configuration
+# Linux/x86 5.4.121 Kernel Configuration
 #
 
 #

kernel/patches-4.19.x/0001-perf-symbols-Add-fallback-definitions-for-GELF_ST_VI.patch

@@ -1,53 +0,0 @@
-From 1732ff11640d5fefb35083ad0d6bc016f2fd407c Mon Sep 17 00:00:00 2001
-From: Arnaldo Carvalho de Melo <acme@redhat.com>
-Date: Mon, 4 Feb 2019 15:48:03 -0300
-Subject: [PATCH 1/2] perf symbols: Add fallback definitions for
- GELF_ST_VISIBILITY()
-
-Those aren't present in Alpine Linux 3.4 to edge, so provide fallback
-defines to get the next patch building there keeping the build
-bisectable.
-
-Cc: Adrian Hunter <adrian.hunter@intel.com>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Jiri Olsa <jolsa@kernel.org>
-Cc: Masami Hiramatsu <mhiramat@kernel.org>
-Cc: Michael Petlan <mpetlan@redhat.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Nick Clifton <nickc@redhat.com>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Link: https://lkml.kernel.org/n/tip-03cg3gya2ju4ba2x6ibb9fuz@git.kernel.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-(cherry picked from commit 843cf70ed29a7fb51f1e796c1d6e1ba3620250ac)
----
- tools/perf/util/symbol-elf.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
-index a701a8a48f00..dc3fbcbb0e79 100644
---- a/tools/perf/util/symbol-elf.c
-+++ b/tools/perf/util/symbol-elf.c
-@@ -19,6 +19,20 @@
- #define EM_AARCH64	183  /* ARM 64 bit */
- #endif
- 
-+#ifndef ELF32_ST_VISIBILITY
-+#define ELF32_ST_VISIBILITY(o)	((o) & 0x03)
-+#endif
-+
-+/* For ELF64 the definitions are the same.  */
-+#ifndef ELF64_ST_VISIBILITY
-+#define ELF64_ST_VISIBILITY(o)	ELF32_ST_VISIBILITY (o)
-+#endif
-+
-+/* How to extract information held in the st_other field.  */
-+#ifndef GELF_ST_VISIBILITY
-+#define GELF_ST_VISIBILITY(val)	ELF64_ST_VISIBILITY (val)
-+#endif
-+
- typedef Elf64_Nhdr GElf_Nhdr;
- 
- #ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
--- 
-2.26.2
-

kernel/patches-4.19.x/0002-include-uapi-linux-swab-Fix-potentially-missing-__al.patch

@@ -1,55 +0,0 @@
-From d5f2496c154d54f8760aa273384f49c4adfd8704 Mon Sep 17 00:00:00 2001
-From: Matt Redfearn <matt.redfearn@mips.com>
-Date: Wed, 3 Jan 2018 09:57:30 +0000
-Subject: [PATCH 2/2] include/uapi/linux/swab: Fix potentially missing
- __always_inline
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Commit bc27fb68aaad ("include/uapi/linux/byteorder, swab: force inlining
-of some byteswap operations") added __always_inline to swab functions
-and commit 283d75737837 ("uapi/linux/stddef.h: Provide __always_inline to
-userspace headers") added a definition of __always_inline for use in
-exported headers when the kernel's compiler.h is not available.
-
-However, since swab.h does not include stddef.h, if the header soup does
-not indirectly include it, the definition of __always_inline is missing,
-resulting in a compilation failure, which was observed compiling the
-perf tool using exported headers containing this commit:
-
-In file included from /usr/include/linux/byteorder/little_endian.h:12:0,
-                 from /usr/include/asm/byteorder.h:14,
-                 from tools/include/uapi/linux/perf_event.h:20,
-                 from perf.h:8,
-                 from builtin-bench.c:18:
-/usr/include/linux/swab.h:160:8: error: unknown type name ‘__always_inline’
- static __always_inline __u16 __swab16p(const __u16 *p)
-
-Fix this by replacing the inclusion of linux/compiler.h with
-linux/stddef.h to ensure that we pick up that definition if required,
-without relying on it's indirect inclusion. compiler.h is then included
-indirectly, via stddef.h.
-
-Fixes: 283d75737837 ("uapi/linux/stddef.h: Provide __always_inline to userspace headers")
-Signed-off-by: Matt Redfearn <matt.redfearn@mips.com>
----
- include/uapi/linux/swab.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h
-index 7272f85d6d6a..3736f2fe1541 100644
---- a/include/uapi/linux/swab.h
-+++ b/include/uapi/linux/swab.h
-@@ -3,7 +3,7 @@
- #define _UAPI_LINUX_SWAB_H
- 
- #include <linux/types.h>
--#include <linux/compiler.h>
-+#include <linux/stddef.h>
- #include <asm/bitsperlong.h>
- #include <asm/swab.h>
- 
--- 
-2.26.2
-

linuxkit.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

projects/compose/compose-dynamic.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

projects/compose/compose-static.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

projects/miragesdk/examples/mirage-dhcp.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/000_build/000_formats/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/000_build/010_reproducible/test.yml

@@ -1,6 +1,6 @@
 # NOTE: Images build from this file likely do not run
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/000_run_kernel+initrd/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/005_run_kernel+squashfs/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/010_run_iso/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/020_run_efi/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/030_run_qcow_bios/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/040_run_raw_bios/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/050_run_aws/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/000_qemu/100_container/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/010_hyperkit/000_run_kernel+initrd/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/010_hyperkit/005_run_kernel+squashfs/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/010_hyperkit/010_acpi/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/010_platforms/110_gcp/000_run/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/011_config_5.4.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.4.116
+  image: linuxkit/kernel:5.4.121
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/013_config_5.10.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/014_config_5.11.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.11.18
+  image: linuxkit/kernel:5.11.22
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/111_kmod_5.4.x/Dockerfile

@@ -3,10 +3,10 @@
 # In the last stage, it creates a package, which can be used for
 # testing.
 
-FROM linuxkit/kernel:5.4.116 AS ksrc
+FROM linuxkit/kernel:5.4.121 AS ksrc
 
 # Extract headers and compile module
-FROM linuxkit/kernel:5.4.116-builder AS build
+FROM linuxkit/kernel:5.4.121-builder AS build
 RUN apk add build-base elfutils-dev
 
 COPY --from=ksrc /kernel-dev.tar /

test/cases/020_kernel/111_kmod_5.4.x/test.sh

@@ -19,7 +19,7 @@ clean_up() {
 trap clean_up EXIT
 
 # Make sure we have the latest kernel image
-docker pull linuxkit/kernel:5.4.116
+docker pull linuxkit/kernel:5.4.121
 # Build a package
 docker build -t ${IMAGE_NAME} .
 

test/cases/020_kernel/111_kmod_5.4.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.4.116
+  image: linuxkit/kernel:5.4.121
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/113_kmod_5.10.x/Dockerfile

@@ -3,10 +3,10 @@
 # In the last stage, it creates a package, which can be used for
 # testing.
 
-FROM linuxkit/kernel:5.10.34 AS ksrc
+FROM linuxkit/kernel:5.10.39 AS ksrc
 
 # Extract headers and compile module
-FROM linuxkit/kernel:5.10.34-builder AS build
+FROM linuxkit/kernel:5.10.39-builder AS build
 RUN apk add build-base elfutils-dev
 
 COPY --from=ksrc /kernel-dev.tar /

test/cases/020_kernel/113_kmod_5.10.x/test.sh

@@ -19,7 +19,7 @@ clean_up() {
 trap clean_up EXIT
 
 # Make sure we have the latest kernel image
-docker pull linuxkit/kernel:5.10.34
+docker pull linuxkit/kernel:5.10.39
 # Build a package
 docker build -t ${IMAGE_NAME} .
 

test/cases/020_kernel/113_kmod_5.10.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/114_kmod_5.11.x/Dockerfile

@@ -3,10 +3,10 @@
 # In the last stage, it creates a package, which can be used for
 # testing.
 
-FROM linuxkit/kernel:5.11.18 AS ksrc
+FROM linuxkit/kernel:5.11.22 AS ksrc
 
 # Extract headers and compile module
-FROM linuxkit/kernel:5.11.18-builder AS build
+FROM linuxkit/kernel:5.11.22-builder AS build
 RUN apk add build-base elfutils-dev
 
 COPY --from=ksrc /kernel-dev.tar /

test/cases/020_kernel/114_kmod_5.11.x/test.sh

@@ -19,7 +19,7 @@ clean_up() {
 trap clean_up EXIT
 
 # Make sure we have the latest kernel image
-docker pull linuxkit/kernel:5.11.18
+docker pull linuxkit/kernel:5.11.22
 # Build a package
 docker build -t ${IMAGE_NAME} .
 

test/cases/020_kernel/114_kmod_5.11.x/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.11.18
+  image: linuxkit/kernel:5.11.22
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/200_namespace/common.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/020_kernel/211_tags_5.4.x/test.sh

@@ -5,7 +5,7 @@
 
 set -e
 
-KERNEL=linuxkit/kernel:5.4.116
+KERNEL=linuxkit/kernel:5.4.121
 
 # just include the common test
 . ../tags.sh

test/cases/020_kernel/213_tags_5.10.x/test.sh

@@ -5,7 +5,7 @@
 
 set -e
 
-KERNEL=linuxkit/kernel:5.10.34
+KERNEL=linuxkit/kernel:5.10.39
 
 # just include the common test
 . ../tags.sh

test/cases/020_kernel/214_tags_5.11.x/test.sh

@@ -5,7 +5,7 @@
 
 set -e
 
-KERNEL=linuxkit/kernel:5.11.18
+KERNEL=linuxkit/kernel:5.11.22
 
 # just include the common test
 . ../tags.sh

test/cases/020_kernel/tags.sh

@@ -36,31 +36,50 @@ BUILDERLABEL=$(docker inspect -f '{{index .Config.Labels "org.mobyproject.linuxk
 # create the container; /bin/sh does not exist, but that does not prevent us from indicating what the command
 #   *would* be. Indeed, you *must* have a command for `docker create` to work
 ctrid=$(docker create $KERNEL /bin/sh)
-docker cp ${ctrid}:/etc/kernel-builder ${BUILDERFILE}
+docker cp ${ctrid}:/kernel-builder ${BUILDERFILE}
 FILECONTENTS=$(cat ${BUILDERFILE})
 
-# get the manifests for the referenced tag and for the referenced builder.
+# Get a list of architectures for which we have this kernel
-# these are not guaranated to be identical, since the orders can change. So we need to account for that.
+KERNEL_ARCHES=$(docker manifest inspect ${KERNEL} | jq  -r -c '.manifests[].platform.architecture')
-sumtag=$(docker manifest inspect ${BUILDER} | jq  -c '.manifests | sort_by(.digest)' | sha256sum | awk '{print $1}')
+
-sumlabel=$(docker manifest inspect ${BUILDERLABEL} | jq  -c '.manifests | sort_by(.digest)' | sha256sum | awk '{print $1}')
+# Get builder manifest
+BUILDER_MANIFEST=$(docker manifest inspect ${BUILDER} | jq  -c '.manifests')
+
+# Get the manifest of the builder pointed to by the label
+BUILDER_LABEL_MANIFEST=$(docker manifest inspect ${BUILDERLABEL} | jq  -c '.manifests')
+
 
 # these two files should be identical
 echo "builder label: ${BUILDERLABEL}"
 echo "builder file: ${FILECONTENTS}"
 echo "builder tag: ${BUILDER}"
-echo "builder tag sha256: ${sumtag}"
-echo "builder label sha256: ${sumlabel}"
 
 # check that the label and file contents match
 if [ "${BUILDERLABEL}" != "${FILECONTENTS}" ]; then
     echo "label vs file contents mismatch"
     exit 1
 fi
-# check that the tag actually points to the manifest
-if [ "${sumtag}" != "${sumlabel}" ]; then
-	echo "tag ${BUILDER} and label ${BUILDERLABEL} have mismatched contents"
-	exit 1
-fi
 
+# Check that for each architecture we have the kernel for builder and the builder label points to the same thing
+for ARCH in ${KERNEL_ARCHES}; do
+    BUILDER_ARCH_DIGEST=$(echo ${BUILDER_MANIFEST} | jq -r --arg ARCH "$ARCH" '.[] | select (.platform.architecture == $ARCH) | .digest')
+    BUILDER_LABEL_ARCH_DIGEST=$(echo ${BUILDER_LABEL_MANIFEST} | jq -r --arg ARCH "$ARCH" '.[] | select (.platform.architecture == $ARCH) | .digest')
+
+    if [ -z "${BUILDER_ARCH_DIGEST}" ]; then
+        echo "No Builder for ${ARCH} in manifest ${BUILDER}"
+        exit 1
+    fi
+    if [ -z "${BUILDER_LABEL_ARCH_DIGEST}" ]; then
+        echo "No Builder for ${ARCH} in manifest ${BUILDERLABEL}"
+        exit 1
+    fi
+
+    if [ "${BUILDER_ARCH_DIGEST}" != "${BUILDER_LABEL_ARCH_DIGEST}" ]; then
+        echo "Builder digests for kernel ${KERNEL} arch ${ARCH} do not match ${BUILDER_ARCH_DIGEST} != ${BUILDER_LABEL_ARCH_DIGEST}"
+        exit 1
+    fi
+
+    echo "Builder tags/labels for kernel ${KERNEL} arch ${ARCH} match: ${BUILDER_ARCH_DIGEST} == ${BUILDER_LABEL_ARCH_DIGEST}"
+done
 
 exit 0

test/cases/030_security/000_docker-bench/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/030_security/010_ports/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/002_binfmt/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/002_bpftrace/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/003_ca-certificates/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/003_containerd/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/004_dhcpcd/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/004_dm-crypt/000_simple/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/004_dm-crypt/001_luks/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/004_dm-crypt/002_key/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/000_ext4/test-create.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/000_ext4/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/001_btrfs/test-create.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/001_btrfs/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/002_xfs/test-create.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/002_xfs/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/003_gpt/test-create.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/005_extend/003_gpt/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/006_format_mount/000_auto/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/006_format_mount/001_by_label/test.yml

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6

test/cases/040_packages/006_format_mount/002_by_name/test.yml.in

@@ -1,5 +1,5 @@
 kernel:
-  image: linuxkit/kernel:5.10.34
+  image: linuxkit/kernel:5.10.39
   cmdline: "console=ttyS0 console=ttyAMA0"
 init:
   - linuxkit/init:78fb57c7da07c4e43c3a37b27755581da087a3b6