siderolabs · talos-bot · Aug 3, 2026 · Aug 3, 2026
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,7 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2023-11-02T12:25:12Z by kres a0777d5-dirty.
+# Generated on 2026-08-03T16:58:42Z by kres 93d28ca.
 
 _out
+*.local.md
+*.override.md
diff --git a/.kres.yaml b/.kres.yaml
@@ -19,6 +19,12 @@ spec:
     - tools-zlib-ng
     - tools-zstd
   reproducibleTargetName: reproducibility
+  extraBuildArgs:
+    - GNU_MIRROR_URL
+  makefile:
+    extraVariables:
+      - name: GNU_MIRROR_URL
+        defaultValue: https://mirrors.kernel.org
 ---
 kind: common.Renovate
 spec:

diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-07-08T07:53:40Z by kres 14a38a3.
+# Generated on 2026-08-03T16:59:21Z by kres 93d28ca.
 
 # common variables
 
@@ -40,13 +40,18 @@ PUSH ?= false
 CI_ARGS ?=
 WITH_BUILD_DEBUG ?=
 BUILD_ARGS = --build-arg=SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH)
+BUILD_ARGS += --build-arg=GNU_MIRROR_URL="$(GNU_MIRROR_URL)"
 COMMON_ARGS = --file=Pkgfile
 COMMON_ARGS += --provenance=false
 COMMON_ARGS += --sbom=false
 COMMON_ARGS += --progress=$(PROGRESS)
 COMMON_ARGS += --platform=$(PLATFORM)
 COMMON_ARGS += $(BUILD_ARGS)
 
+# extra variables
+
+GNU_MIRROR_URL ?= https://mirrors.kernel.org
+
 # targets defines all the available targets
 
 TARGETS = tools

diff --git a/autoconf/pkg.yaml b/autoconf/pkg.yaml
@@ -8,7 +8,7 @@ dependencies:
     runtime: yes
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/autoconf/autoconf-{{ .autoconf_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/autoconf/autoconf-{{ .autoconf_version }}.tar.xz"
         destination: autoconf.tar.xz
         sha256: "{{ .autoconf_sha256 }}"
         sha512: "{{ .autoconf_sha512 }}"

diff --git a/automake/pkg.yaml b/automake/pkg.yaml
@@ -7,7 +7,7 @@ dependencies:
   - stage: autoconf
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/automake/automake-{{ .automake_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/automake/automake-{{ .automake_version }}.tar.xz"
         destination: automake.tar.xz
         sha256: "{{ .automake_sha256 }}"
         sha512: "{{ .automake_sha512 }}"

diff --git a/bash/pkg.yaml b/bash/pkg.yaml
@@ -8,7 +8,7 @@ dependencies:
     runtime: true
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bash/bash-{{ .bash_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bash/bash-{{ .bash_version }}.tar.gz"
         destination: bash.tar.gz
         sha256: "{{ .bash_sha256 }}"
         sha512: "{{ .bash_sha512 }}"

diff --git a/bc/pkg.yaml b/bc/pkg.yaml
@@ -7,10 +7,10 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bc/bc-{{ .bc_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bc/bc-{{ .bc_version }}.tar.gz"
         destination: bc.tar.gz
-        sha256: {{ .bc_sha256 }}
-        sha512: {{ .bc_sha512 }}
+        sha256: "{{ .bc_sha256 }}"
+        sha512: "{{ .bc_sha512 }}"
     prepare:
       - |
         tar -xzf bc.tar.gz --strip-components=1

diff --git a/bison/pkg.yaml b/bison/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/bison/bison-{{ .bison_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/bison/bison-{{ .bison_version }}.tar.xz"
         destination: bison.tar.xz
         sha256: "{{ .bison_sha256 }}"
         sha512: "{{ .bison_sha512 }}"

diff --git a/coreutils/pkg.yaml b/coreutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/coreutils/coreutils-{{ .coreutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/coreutils/coreutils-{{ .coreutils_version }}.tar.xz"
         destination: coreutils.tar.xz
         sha256: "{{ .coreutils_sha256 }}"
         sha512: "{{ .coreutils_sha512 }}"

diff --git a/diffutils/pkg.yaml b/diffutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/diffutils/diffutils-{{ .diffutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/diffutils/diffutils-{{ .diffutils_version }}.tar.xz"
         destination: diffutils.tar.xz
         sha256: "{{ .diffutils_sha256 }}"
         sha512: "{{ .diffutils_sha512 }}"

diff --git a/dwarfutils/pkg.yaml b/dwarfutils/pkg.yaml
@@ -10,7 +10,7 @@ steps:
         sha256: "{{ .dwarfutils_sha256 }}"
         sha512: "{{ .dwarfutils_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xvf dwarfutils.tar.xz --strip-components=1

diff --git a/findutils/pkg.yaml b/findutils/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/findutils/findutils-{{ .findutils_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/findutils/findutils-{{ .findutils_version }}.tar.xz"
         destination: findutils.tar.gz
         sha256: "{{ .findutils_sha256 }}"
         sha512: "{{ .findutils_sha512 }}"

diff --git a/gawk/pkg.yaml b/gawk/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gawk/gawk-{{ .gawk_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gawk/gawk-{{ .gawk_version }}.tar.xz"
         destination: gawk.tar.xz
         sha256: "{{ .gawk_sha256 }}"
         sha512: "{{ .gawk_sha512 }}"

diff --git a/gmp/pkg.yaml b/gmp/pkg.yaml
@@ -9,7 +9,7 @@ dependencies:
   - stage: m4
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gmp/gmp-{{ .gmp_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gmp/gmp-{{ .gmp_version }}.tar.xz"
         destination: gmp.tar.xz
         sha256: "{{ .gmp_sha256 }}"
         sha512: "{{ .gmp_sha512 }}"

diff --git a/gperf/pkg.yaml b/gperf/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: http://ftpmirror.gnu.org/gnu/gperf/gperf-{{ .gperf_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gperf/gperf-{{ .gperf_version }}.tar.gz"
         destination: gperf.tar.gz
         sha256: "{{ .gperf_sha256 }}"
         sha512: "{{ .gperf_sha512 }}"

diff --git a/grep/pkg.yaml b/grep/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/grep/grep-{{ .grep_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/grep/grep-{{ .grep_version }}.tar.xz"
         destination: grep.tar.xz
         sha256: "{{ .grep_sha256 }}"
         sha512: "{{ .grep_sha512 }}"

diff --git a/gzip/pkg.yaml b/gzip/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/gzip/gzip-{{ .gzip_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/gzip/gzip-{{ .gzip_version }}.tar.xz"
         destination: gzip.tar.xz
         sha256: "{{ .gzip_sha256 }}"
         sha512: "{{ .gzip_sha512 }}"

diff --git a/libtasn1/pkg.yaml b/libtasn1/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-{{ .libtasn1_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libtasn1/libtasn1-{{ .libtasn1_version }}.tar.gz"
         destination: libtasn1.tar.gz
         sha256: "{{ .libtasn1_sha256 }}"
         sha512: "{{ .libtasn1_sha512 }}"

diff --git a/libtool/pkg.yaml b/libtool/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
     runtime: true
 steps:
   - sources:
-      - url: http://ftpmirror.gnu.org/libtool/libtool-{{ .libtool_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libtool/libtool-{{ .libtool_version }}.tar.gz"
         destination: libtool.tar.gz
         sha256: "{{ .libtool_sha256 }}"
         sha512: "{{ .libtool_sha512 }}"

diff --git a/libunistring/pkg.yaml b/libunistring/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/libunistring/libunistring-{{ .libunistring_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/libunistring/libunistring-{{ .libunistring_version }}.tar.xz"
         destination: libunistring.tar.xz
         sha256: "{{ .libunistring_sha256 }}"
         sha512: "{{ .libunistring_sha512 }}"

diff --git a/m4/pkg.yaml b/m4/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/m4/m4-{{ .m4_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/m4/m4-{{ .m4_version }}.tar.xz"
         destination: m4.tar.xz
         sha256: "{{ .m4_sha256 }}"
         sha512: "{{ .m4_sha512 }}"

diff --git a/mpc/pkg.yaml b/mpc/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: mpfr
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/mpc/mpc-{{ .mpc_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/mpc/mpc-{{ .mpc_version }}.tar.xz"
         destination: mpc.tar.xz
         sha256: "{{ .mpc_sha256 }}"
         sha512: "{{ .mpc_sha512 }}"

diff --git a/mpfr/pkg.yaml b/mpfr/pkg.yaml
@@ -5,7 +5,7 @@ dependencies:
   - stage: gmp
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/mpfr/mpfr-{{ .mpfr_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/mpfr/mpfr-{{ .mpfr_version }}.tar.xz"
         destination: mpfr.tar.xz
         sha256: "{{ .mpfr_sha256 }}"
         sha512: "{{ .mpfr_sha512 }}"

diff --git a/ncurses/pkg.yaml b/ncurses/pkg.yaml
@@ -5,12 +5,12 @@ dependencies:
   - stage: patch
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/ncurses/ncurses-{{ .ncurses_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/ncurses/ncurses-{{ .ncurses_version }}.tar.gz"
         destination: ncurses.tar.gz
         sha256: "{{ .ncurses_sha256 }}"
         sha512: "{{ .ncurses_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xzf ncurses.tar.gz --strip-components=1

diff --git a/nettle/pkg.yaml b/nettle/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: gmp
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/nettle/nettle-{{ .nettle_version }}.tar.gz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/nettle/nettle-{{ .nettle_version }}.tar.gz"
         destination: nettle.tar.gz
         sha256: "{{ .nettle_sha256 }}"
         sha512: "{{ .nettle_sha512 }}"

diff --git a/patch/pkg.yaml b/patch/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/patch/patch-{{ .patch_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/patch/patch-{{ .patch_version }}.tar.xz"
         destination: patch.tar.xz
         sha256: "{{ .patch_sha256 }}"
         sha512: "{{ .patch_sha512 }}"

diff --git a/perl/pkg.yaml b/perl/pkg.yaml
@@ -10,7 +10,7 @@ steps:
       sha256: "{{ .perl_sha256 }}"
       sha512: "{{ .perl_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xJf perl.tar.xz --strip-components=1

diff --git a/python3/pkg.yaml b/python3/pkg.yaml
@@ -14,7 +14,7 @@ steps:
         sha256: "{{ .python_sha256 }}"
         sha512: "{{ .python_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         tar -xJf python.tar.xz --strip-components=1

diff --git a/sed/pkg.yaml b/sed/pkg.yaml
@@ -4,7 +4,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/sed/sed-{{ .sed_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/sed/sed-{{ .sed_version }}.tar.xz"
         destination: sed.tar.xz
         sha256: "{{ .sed_sha256 }}"
         sha512: "{{ .sed_sha512 }}"

diff --git a/texinfo/pkg.yaml b/texinfo/pkg.yaml
@@ -5,7 +5,7 @@ dependencies:
   - stage: perl
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/texinfo/texinfo-{{ .texinfo_version }}.tar.xz
+      - url: "{{ .GNU_MIRROR_URL }}/gnu/texinfo/texinfo-{{ .texinfo_version }}.tar.xz"
         destination: texinfo.tar.xz
         sha256: "{{ .texinfo_sha256 }}"
         sha512: "{{ .texinfo_sha512 }}"

diff --git a/tools-ca-certificates/pkg.yaml b/tools-ca-certificates/pkg.yaml
@@ -6,8 +6,8 @@ steps:
   - sources:
       - url: https://curl.se/ca/cacert-{{ .ca_certificates_version }}.pem
         destination: cacert.pem
-        sha256: {{ .ca_certificates_sha256 }}
-        sha512: {{ .ca_certificates_sha512 }}
+        sha256: "{{ .ca_certificates_sha256 }}"
+        sha512: "{{ .ca_certificates_sha512 }}"
     install:
       - |
         install -m644 -D cacert.pem /rootfs/etc/ssl/certs/ca-certificates

diff --git a/tools-cpio/pkg.yaml b/tools-cpio/pkg.yaml
@@ -6,7 +6,7 @@ dependencies:
   - stage: patch
 steps:
   - sources:
-      - url: https://ftpmirror.gnu.org/gnu/cpio/cpio-{{ .cpio_version | replace "_" "." }}.tar.gz
+      - url: '{{ .GNU_MIRROR_URL }}/gnu/cpio/cpio-{{ .cpio_version | replace "_" "." }}.tar.gz'
         destination: cpio.tar.gz
         sha256: "{{ .cpio_sha256 }}"
         sha512: "{{ .cpio_sha512 }}"

diff --git a/tools-kmod/pkg.yaml b/tools-kmod/pkg.yaml
@@ -41,7 +41,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/kmod.spdx.json
       name: kmod
-      version: {{ .kmod_version }}
+      version: "{{ .kmod_version }}"
       cpes:
         - cpe:2.3:a:kernel:kmod:{{ .kmod_version }}:*:*:*:*:*:*:*
       licenses:

diff --git a/tools-libcap/pkg.yaml b/tools-libcap/pkg.yaml
@@ -26,7 +26,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libcap.spdx.json
       name: libcap
-      version: {{ .libcap_version }}
+      version: "{{ .libcap_version }}"
       cpes:
         - cpe:2.3:a:libcap_project:libcap:{{ .libcap_version }}:*:*:*:*:*:*:*
       licenses:

diff --git a/tools-libselinux/pkg.yaml b/tools-libselinux/pkg.yaml
@@ -32,7 +32,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libselinux.spdx.json
       name: libselinux
-      version: {{ .selinux_version }}
+      version: "{{ .selinux_version }}"
       cpes:
         - cpe:2.3:a:selinuxproject:libselinux:{{ .selinux_version }}:*:*:*:*:*:*:*
       licenses:

diff --git a/tools-libsepol/pkg.yaml b/tools-libsepol/pkg.yaml
@@ -29,7 +29,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/libsepol.spdx.json
       name: libsepol
-      version: {{ .selinux_version }}
+      version: "{{ .selinux_version }}"
       cpes:
         - cpe:2.3:a:selinuxproject:libsepol:{{ .selinux_version }}:*:*:*:*:*:*:*
       licenses:

diff --git a/tools-openssl/pkg.yaml b/tools-openssl/pkg.yaml
@@ -10,7 +10,7 @@ steps:
         sha256: "{{ .openssl_sha256 }}"
         sha512: "{{ .openssl_sha512 }}"
     env:
-      SOURCE_DATE_EPOCH: {{ .BUILD_ARG_SOURCE_DATE_EPOCH }}
+      SOURCE_DATE_EPOCH: "{{ .BUILD_ARG_SOURCE_DATE_EPOCH }}"
     prepare:
       - |
         mkdir openssl
@@ -51,7 +51,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/openssl.spdx.json
       name: openssl
-      version: {{ .openssl_version }}
+      version: "{{ .openssl_version }}"
       cpes:
         - cpe:2.3:a:openssl:openssl:{{ .openssl_version }}:*:*:*:*:*:*:*
       licenses:

diff --git a/tools-pcre2/pkg.yaml b/tools-pcre2/pkg.yaml
@@ -38,7 +38,7 @@ steps:
     sbom:
       outputPath: /rootfs/usr/share/spdx/pcre2.spdx.json
       name: pcre2
-      version: {{ .pcre2_version }}
+      version: "{{ .pcre2_version }}"
       cpes:
         - cpe:2.3:a:pcre:pcre2:{{ .pcre2_version }}:*:*:*:*:*:*:*
       licenses: