From 03296fe6b25c6dd94619c8f980449003fe657077 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 09:13:50 +0000
Subject: [PATCH 1/2] chore(deps): bump ubuntu

Bumps the run-stack-images group with 1 update in the /stack/run directory: ubuntu.


Updates `ubuntu` from `da6fc2b` to `f144425`

---
updated-dependencies:
- dependency-name: ubuntu
  dependency-version: '26.04'
  dependency-type: direct:production
  dependency-group: run-stack-images
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 stack/run/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack/run/Dockerfile b/stack/run/Dockerfile
index 501f931..a64cc7b 100644
--- a/stack/run/Dockerfile
+++ b/stack/run/Dockerfile
@@ -13,7 +13,7 @@
 # delete the dead-weight files, and hand /rootfs to the scratch stage below.
 FROM gcr.io/distroless/cc:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS distroless-src
 # hadolint ignore=DL3006
-FROM ubuntu:26.04@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78 AS cc-trimmer
+FROM ubuntu:26.04@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7 AS cc-trimmer
 
 ARG CNB_USER_ID=1002
 ARG CNB_GROUP_ID=1000

From ac1d06c6c0e0c81b2b9e187debbc75ce939357c1 Mon Sep 17 00:00:00 2001
From: Patrick Baumgartner <contact@patbaumgartner.com>
Date: Wed, 7 Oct 2026 12:17:45 +0200
Subject: [PATCH 2/2] fix: use /bin/bash shebang so trim-rootfs survives qemu
 emulation

Ubuntu 26.04 ships rust-coreutils 0.10 whose env self-check compares
/proc/self/exe against the requested utility. Under BuildKit's embedded
qemu emulator (/dev/.buildkit_qemu_emulator), /proc/self/exe resolves to
the script itself, so #!/usr/bin/env bash aborts with:

  Security violation: Requested utility `env` does not match
  executable name: /usr/local/bin/trim-rootfs

Invoke bash directly via #!/bin/bash; the script is only executed inside
the ubuntu:26.04 helper stage where /bin/bash is guaranteed.
---
 stack/run/trim-rootfs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stack/run/trim-rootfs.sh b/stack/run/trim-rootfs.sh
index 26c1cb5..cc79dd7 100755
--- a/stack/run/trim-rootfs.sh
+++ b/stack/run/trim-rootfs.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 #
 # Trims the Google Distroless `cc` filesystem staged at /rootfs down to what a
 # JVM or GraalVM Native Image workload actually needs, and installs the CNB user.