What changed, and why it matters
This commit updates the Debian Linux version used inside the Windows build container from Debian 12 (bookworm) to Debian 13 (trixie). It also refreshes the pinned package snapshot date, swaps a couple of installed utility packages, and removes an explicit vkd3d library pin because that package is no longer needed/split the same way in the newer Debian release. There is no indication in the commit or supplied references that this fixes or introduces a security vulnerability; it reads as routine build-system maintenance.
No security action required. Treat as normal dependency/maintenance update; verify the new container builds reproducibly and that Windows release artifacts pass existing QA/signing checks.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is purely build-infrastructure housekeeping for the Windows (Wine) build environment. It changes the Dockerfile base image from debian:bookworm to debian:trixie with a new SHA256 digest, updates the snapshot.debian.org timestamp in apt.sources.list from 20250530 to 20260227, updates freeze_containers_distro.sh’s DEBIAN_WINE_DISTRO variable to trixie, replaces python3-software-properties/software-properties-common with python3 and lsb-release, and drops explicit libvkd3d1:amd64/i386 package pins. No application code, cryptographic logic, or network handling is modified.
Changed components
contrib/build-wine/Dockerfilecontrib/build-wine/apt.sources.listcontrib/freeze_containers_distro.shInspect captured patch +6 / −8
diff --git a/contrib/build-wine/Dockerfile b/contrib/build-wine/Dockerfile
index 4a7022b..7c6d967 100644
--- a/contrib/build-wine/Dockerfile
+++ b/contrib/build-wine/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:bookworm@sha256:b37bc259c67238d814516548c17ad912f26c3eed48dd9bb54893eafec8739c89
+FROM debian:trixie@sha256:13f29b6806e531c3ff3b565bb6eed73f2132506c8c9d41bb996065ca20fb27f2
# need ca-certificates before using snapshot packages
RUN apt update -qq > /dev/null && apt install -qq --yes --no-install-recommends \
@@ -14,11 +14,11 @@ ENV DEBIAN_FRONTEND=noninteractive
RUN dpkg --add-architecture i386 && \
apt-get update -q && \
apt-get install -qy --allow-downgrades \
+ lsb-release \
wget \
gnupg2 \
dirmngr \
- python3-software-properties \
- software-properties-common \
+ python3 \
git \
p7zip-full \
make \
@@ -49,8 +49,6 @@ RUN DEBIAN_CODENAME=$(lsb_release --codename --short) && \
wine-stable-i386:i386=${WINEVERSION} \
wine-stable:amd64=${WINEVERSION} \
winehq-stable:amd64=${WINEVERSION} \
- libvkd3d1:amd64=1.3~${DEBIAN_CODENAME}-1 \
- libvkd3d1:i386=1.3~${DEBIAN_CODENAME}-1 \
&& \
rm -rf /var/lib/apt/lists/* && \
apt-get autoremove -y && \
diff --git a/contrib/build-wine/apt.sources.list b/contrib/build-wine/apt.sources.list
index b1a8f89..dd5bd46 100644
--- a/contrib/build-wine/apt.sources.list
+++ b/contrib/build-wine/apt.sources.list
@@ -1,2 +1,2 @@
-deb https://snapshot.debian.org/archive/debian/20250530T143637Z/ bookworm main
-deb-src https://snapshot.debian.org/archive/debian/20250530T143637Z/ bookworm main
+deb https://snapshot.debian.org/archive/debian/20260227T144551Z/ trixie main
+deb-src https://snapshot.debian.org/archive/debian/20260227T144551Z/ trixie main
diff --git a/contrib/freeze_containers_distro.sh b/contrib/freeze_containers_distro.sh
index cc19f7d..bc60ae7 100755
--- a/contrib/freeze_containers_distro.sh
+++ b/contrib/freeze_containers_distro.sh
@@ -6,7 +6,7 @@ set -e
DEBIAN_SNAPSHOT_BASE="https://snapshot.debian.org/archive/debian/"
DEBIAN_APPIMAGE_DISTRO="bullseye" # should match build-linux/appimage Dockerfile base
-DEBIAN_WINE_DISTRO="bookworm" # should match build-wine Dockerfile base
+DEBIAN_WINE_DISTRO="trixie" # should match build-wine Dockerfile base
DEBIAN_ANDROID_DISTRO="trixie" # should match android Dockerfile base
contrib="$(dirname "$0")"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.