# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Pinned dependency versions for the openshell-driver-vm runtime.
#
# This file is sourced by VM runtime packaging scripts. It centralises version
# pins so that builds are reproducible and auditable.
#
# Environment variables override these defaults — CI and local dev workflows
# can still set the runtime dependency versions below.
#
# To update a dependency:
#   1. Change the version/digest below.
#   2. Run the relevant build script to verify.
#   3. Commit pins.env alongside any script changes.

# SERVER_IMAGE is intentionally NOT pinned here — it changes frequently
# during local development. Override via IMAGE_REPO_BASE and IMAGE_TAG
# environment variables (defaults: openshell/gateway:dev).

# ── umoci (guest OCI unpacker) ───────────────────────────────────────
# Repo: https://github.com/opencontainers/umoci
UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"

# ── libkrunfw upstream (commit-pinned) ────────────────────────────────
# Repo: https://github.com/libkrun/libkrunfw
# Pinned: v5.6.1 (Linux 6.12.109, 2026-09-16)
LIBKRUNFW_REF="${LIBKRUNFW_REF:-617938cf2ae9a3a0e5696d23a5d6252cd7a1ef4f}"

# ── libkrun upstream (commit-pinned) ─────────────────────────────────
# Repo: https://github.com/libkrun/libkrun
# Pinned: v1.19.4 (2026-09-16)
LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"