Exact Git package provenance for Ubuntu runner image 20260927.320.1

[LukeMason1989]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Actions Runner Image

Discussion Details

For actions/runner-images release ubuntu24/20260927.320, the published internal.ubuntu24.json reports Git 2.55.0, while install-git.sh installs Git from ppa:git-core/ppa without an exact version pin.

Could you provide a publisher-issued build-time package manifest, image-specific SBOM or equivalent record identifying:

• The exact installed Git Debian package version, including epoch and revision.
• Its architecture, archive source and SHA-256.
• The evidence binding that package to image 20260927.320.1.

Release:
https://github.com/actions/runner-images/releases/tag/ubuntu24/20260927.320

We need existing published build evidence without launching a runner. A current PPA package or git --version output alone would not establish the exact image-to-package binding.

Thank you.

[Flpvoigt]

This is exactly the kind of question that git --version or the current PPA metadata cannot answer. The useful artifact would be an immutable, image-specific manifest/SBOM containing the dpkg-query version (including epoch and Debian revision), architecture, repository URI, package SHA-256, and the image digest or build identifier that binds it to ubuntu24/20260927.320.1. If the package is installed from a moving PPA, the build should also retain the relevant InRelease metadata and the downloaded .deb hash, or publish a signed snapshot reference. Until that evidence is available, the release JSON should be treated as an expected version rather than proof of the exact image contents.