2026.9.0

Release Highlights

  • Shrinkwrap is now packaged as an installed Python tool using a src layout, with updated installation and packaging documentation.

  • Architecture coverage is extended through Armv9.7.

  • Git revisions may use abbreviated commit SHAs during repository sync.

  • Buildroot, Linux, devicetree rebasing, kvmtool, the Arm GNU bare-metal toolchains, and the Base RevC AEM FVP are updated.

  • EDK2 is updated to edk2-stable202608.

  • FVP configuration defaults are updated to avoid actionable MTE and empty optional-flash warnings.

Component Versions

Base Distribution

The container images use Debian 13.7 (Trixie), including:

  • base-files 13.8+deb13u7

  • libc6 2.41-12+deb13u4

Toolchains

The base-slim container image includes:

  • aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0

  • aarch64-none-elf-gcc (Arm GNU Toolchain 15.3.Rel1 (Build arm-15.149)) 15.3.1 20260627

The base-full container image additionally includes:

  • arm-linux-gnueabihf-gcc (Debian 14.2.0-19) 14.2.0

  • arm-none-eabi-gcc (Arm GNU Toolchain 15.3.Rel1 (Build arm-15.149)) 15.3.1 20260627

  • Debian clang version 20.1.8 (++20250809043815+87f0227cb601-1~exp1~20250809163919.3)

FVP

The base-slim and base-full container images both include:

  • FVP_Base_RevC-2xAEMvA [11.32+19 (Jul 29 2026)]

Software Components

A full list of every software component, its source repository, and its revision is provided for each config that Shrinkwrap ships with. See Config Store for the list of configs. Ensure that the selected documentation version corresponds to this release.

The general quarterly component refresh deliberately leaves the CCA-specific component set unchanged. Compatible CCA stacks and Realm guest coverage are maintained in the dedicated tooling/shrinkwrap-cca repository. TF-A and TF-RMM also remain at the revisions inherited from the previous release under their component maintainer’s ownership.

OP-TEE remains at 4.9.0 to match the OP-TEE client, test, and example packages provided by Buildroot 2026.08. DTC remains at v1.8.1, the latest upstream release.

Git Shortlog

  • Ryan Roberts (1):

    • version: Start 2026.9.0 development cycle

  • Saul Romero D (16):

    • refactor: move shrinkwrap package code under src

    • refactor: move bundled configs under src

    • build: package shrinkwrap as an installed tool

    • docs: update packaging and installation guidance

    • config: Disable TF-A feature detection

    • test: Extend architecture coverage to v9.7

    • config: Support abbreviated git SHAs during sync

    • ci: trust GlobalSign Root R46 in Kaniko

    • cli: preserve non-verbose error handling for console entrypoint

    • style: format source and tests with ruff

    • lint: apply automatic ruff fixes

    • lint: resolve remaining ruff findings

    • ci: add ruff checks for source and tests

    • lint: document local ruff workflow

    • config: update components for 2026.9.0

    • config: fix actionable FVP warnings

  • Varshit Pandya (1):

    • config: Update EDK2 to edk2-stable202608

Test Report Summary

Unit Tests

All 19 automated unit tests pass locally:

  • test/test_commands.py::test_version

  • test/test_commands.py::test_inspect_ns_edk2_base

  • test/test_commands.py::test_build_overlay_dry_run_ns_edk2_top_level_comments

  • test/test_commands.py::test_run_dry_run_comments

  • test/test_commands.py::test_process_merge_overlay_ns_edk2

  • test/test_commands.py::test_cli_suppresses_traceback_when_not_verbose

  • test/test_commands.py::test_cli_reraises_traceback_when_verbose

  • test/test_commands_blackbox.py::test_version_blackbox

  • test/test_commands_blackbox.py::test_inspect_ns_edk2_base_blackbox

  • test/test_commands_blackbox.py::test_build_overlay_dry_run_ns_edk2_top_level_comments_blackbox

  • test/test_commands_blackbox.py::test_run_dry_run_comments_blackbox

  • test/test_commands_blackbox.py::test_process_merge_overlay_ns_edk2_blackbox

  • test/test_commands_blackbox.py::test_build_error_non_verbose_suppresses_traceback_blackbox

  • test/test_commands_blackbox.py::test_build_error_verbose_shows_traceback_blackbox

  • test/test_config.py::test_short_git_sha_detection

  • test/test_config.py::test_build_graph_fetches_all_refs_for_short_git_sha

  • test/test_config.py::test_build_graph_fetches_named_revision_directly

  • test/test_config.py::test_edk2_optional_flash_has_warning_free_default

  • test/test_config.py::test_hafnium_uses_mte4_from_armv8_9

System Tests

The full release test inventory contains 296 build, boot, and repository-sync tests. It covers every supported architecture level through Armv9.7 and runs on both arm64 and x86_64 hosts. Publication of this release is gated on the full, non-smoke GitLab pipeline passing this complete inventory.

Local release-candidate validation rebuilt all eight amd64 and arm64 container variants and passed the ns-edk2.yaml Armv9.7 firmware build, Device Tree boot, and ACPI boot tests. Additional local validation passed the OP-TEE and FF-A Armv9.7 smoke inventory.