# ctrl/versions.env

## Pinned toolchain

The single manifest `ctrl/deps.sh` installs from. Every entry is a single binary; none of them needs an apt repo.

- kubectl — fully static
- kind — libc only
- tilt — libc + libstdc++ + libgcc (present in base Debian)
- jq — upstream static build (Debian's is linked against libjq/libonig)

Checksums are the upstream-published SHA256 of the linux/amd64 artifact.

## Bumping a pin

Change the version, then take the checksum from the release's own published list — never hand-edit or hand-copy one from a download you did. For anything hosted on GitHub releases that is:

```
curl -sSL https://github.com/<org>/<repo>/releases/download/<tag>/checksums.txt \
  | grep linux.x86_64
```

(kubectl publishes its own instead: `<KUBECTL_URL>.sha256`.)

There was a `ctrl/versions-refresh.sh` named here that has never existed. If bumping stops being rare enough to do by hand, write it — but a comment pointing at a missing script is worse than no comment.

## ctlptl

Creates a kind cluster WITH a local registry wired in, which is what keeps images off docker.io (an unqualified name means `docker.io/library/<name>`). Same publisher and same archive shape as tilt: binary at the archive root, so `fetch_tgz` handles it with strip=0 and no special case.

## docker compose

The distro docker packages ship the daemon and the CLI but frequently not this, so `docker compose up` fails with "unknown command" on an otherwise working Docker. It is a CLI plugin, found by NAME in a plugin directory, so a copy in the bin dir alone only gives you the retired `docker-compose` v1 spelling; deps.sh links it into `~/.docker/cli-plugins`.

## Node images

Node images shipped with `KIND_VERSION`, pinned by digest so a kind upgrade can never silently move the k8s version. Profiles select one via `K8S_VERSION`. Older entries are kept deliberately: running a trailing-edge control plane is part of simulating a legacy estate.

## Cabinets

Public services dropped in as-is, the upstream image unmodified. The same declaration installs on compose or in the cluster, so a dependency is named once and works either way. Pinned by tag rather than digest because they are ordinary upstream images with no supply chain claim attached — bump freely, and preload them for the offline profile.