update

Reviewed-on: #332
Reviewed-by: p4u1 <133+p4u1@noreply.git.coopcloud.tech>
Co-authored-by: maren <maren@bunk.computer>

docs/federation/membership.md

@@ -4,27 +4,26 @@ title: Membership
 
 > Are you also interested in joining the federation? Please check [our process](/federation/join/) on how to join. If you have any questions, [drop us a line](/intro/contact/) or come for a chat.
 
-| Name      | Dues Paid | Notes    | Contact |
-| --------- | --------- | -------- |-------- |
-| [Agaric](https://agaric.coop/) | ⭕ | - | `@wolcen:matrix.org` |
-| [Autonomic](https://autonomic.zone) | ⭕ | - | `@3wc`, `@cas`, `@knoflook`, `@travvy`, `@aadil` |
-| [Bonfire](https://bonfirenetworks.org) | ✅ | - | `@mayel:matrix.org` + Ivan (`@cambriale:matrix.org`) |
-| [Bunk Computer Cooperative](https://bunk.computer) | ✅ | - | `@maren@bunk.computer` + `@sorrel@bunk.computer` |
-| [CoQuest - IT Coop Stuttgart](https://coquest.coop/en) | ✅ | voting rights waived | `hallo@coquest.coop` |
-| [Democratic Tech Fund](https://democratictech.fund/) | ✅ | - | `@wtebbens` + `@mikemh` |
-| [Doop.coop](https://doop.coop) | ⭕ | - | `@yusf:gottsnack.net` |
-| [eCommons](https://ecommons.nl) | ✅ | - | `@dannygroenewegen:matrix.org` |
-| [EOTL](https://eotl.supply) | ✅ | - | `@basebuilder:pub.solar` |
-| [Karrot](https://karrot.world) | ⭕ | - | `@nicksellen:matrix.org` |
-| [Klasse & Methode](https://klasse-methode.it) | Waiver | - | `@p4u1_f4u1:matrix.org` |
-| [Local IT](https://local-it.org/)  | ✅ | - | `@moritz:matrix.local-it.org` + `@simon_sth:matrix.org`|
-| [Merri-bek tech](https://www.merri-bek.tech/) | ✅ | - | `coop-cloud-delegate@merri-bek.tech`|
-| [MIR](https://mirnet.org/) | ✅ | - | `@sixsmith:matrix.org` |
-| [Red Abya Yala](https://abyayala.sutty.nl/) | ⭕ | - | `@fauno:sutty.nl` |
-| [RTM](https://resisttechmonopolies.online) | ✅ | - | `@ammaratef45:matrix.org` + `@linnealovespie:matrix.org`|
-| [ruangrupa](https://ruangrupa.id) | ⭕ | - | Henry `@babystepper:matrix.org` |
-| [UTAW](https://utaw.tech) | ⭕  | - | `@javielico:matrix.org` |
-| Amras | Waiver | - | `coop-cloud@joinmeonmy.quest` |
-| `@decentral1se` | Waiver | - | `@decentral1se` |
-| Mirsal ™  | ✅ | - | `@mirsal:1312.media` |
+| Name      | Dues Paid | Notes    | Contact | Status   |
+| --------- | --------- | -------- |-------- | -------- |
+| [Agaric](https://agaric.coop/) | ⭕ | - | `@wolcen:matrix.org` | Paused  |
+| [Autonomic](https://autonomic.zone) | ⭕ | - | `@kawaiipunk:autonomic.zone` | Active  |
+| [Bonfire](https://bonfirenetworks.org) | ✅ | - | `@mayel:matrix.org`) | Active  |
+| [Bunk Computer Cooperative](https://bunk.computer) | ✅ | - | `@maren@bunk.computer` | Active  |
+| [CoQuest - IT Coop Stuttgart](https://coquest.coop/en) | ✅ | voting rights waived | `hallo@coquest.coop` | Active  |
+| [Democratic Tech Fund](https://democratictech.fund/) | ✅ | - | `@mike_hales:matrix.org` | Active  |
+| [Doop.coop](https://doop.coop) | ⭕ | - | `@yusf:gottsnack.net` | Active  |
+| [eCommons](https://ecommons.nl) | ✅ | - | `@dannygroenewegen:matrix.org` | Active  |
+| [EOTL](https://eotl.supply) | ✅ | - | `@basebuilder:pub.solar` | Paused  |
+| [Karrot](https://karrot.world) | ⭕ | - | `@nicksellen:matrix.org` | Active  |
+| [Klasse & Methode](https://klasse-methode.it) | Waiver | - | `@p4u1_f4u1:matrix.org` | Active  |
+| [Local IT](https://local-it.org/)  | ✅ | - | `@simon_sth:matrix.org`| Active  |
+| [Merri-bek tech](https://www.merri-bek.tech/) | ✅ | - | `@sarah@merri-bek.tech`| Active  |
+| [MIR](https://mirnet.org/) | ✅ | - | `@sixsmith:matrix.org` | Active  |
+| [Red Abya Yala](https://abyayala.sutty.nl/) | ⭕ | - | `@fauno:sutty.nl` | Active  |
+| [RTM](https://resisttechmonopolies.online) | ✅ | - | `@ammaratef45:matrix.org`| Active  |
+| [ruangrupa](https://ruangrupa.id) | ⭕ | - | `@babystepper:matrix.org` | Paused  |
+| [UTAW](https://utaw.tech) | ⭕  | - | `@javielico:matrix.org` | Paused  |
+| Amras | Waiver | - | `coop-cloud@joinmeonmy.quest` | Active  |
+| Mirsal ™  | ✅ | - | `@mirsal:1312.media` | Active  |
 

docs/federation/resolutions/in-progress/046.md

@@ -0,0 +1,18 @@
+---
+title: "Resolution 046: 3wc to join the federation as an individual member"
+---
+
+- Topic: Resolution 046: 3wc to join the federation as an individual member
+- Date: 2026-09-30
+- Deadline: 2026-10-15
+- Size: large
+
+## Summary
+
+3wc to join the federation as an individual member
+
+## Details
+
+@3wc:autonomic.zone is an active member of our community and supports with some of the ongoing work. they were a member of one of our cooperative members (autonomic) but they are no longer part of the cooperative but would like to stay in the cooperative as an individual member.
+
+@ammaratef45:matrix.org from [RTM](https://resisttechmonopolies.online/) is happy to vouch.

docs/federation/resolutions/in-progress/047.md

@@ -0,0 +1,28 @@
+---
+title: "Resolution 047: Kolektivo Sennacieca Cifereca to join the federation as a member"
+---
+
+- Topic: Resolution 047: Kolektivo Sennacieca Cifereca to join the federation as a member
+- Date: 2026-10-06
+- Deadline: 2026-10-20
+- Size: large
+
+## Summary
+
+[Kolektivo Sennacieca Cifereca](https://sekuro.nl) is a security and organizational consultancy responsible for the proof of concept  [Hestia](https://git.coopcloud.tech/hex/hestia) build quality and security analyzer and [CCSATool](https://git.coopcloud.tech/hex/CCSATool) security advisory tool. KSC is focused on the improving the security of the platform. 
+
+## Details
+
+At Kolektivo Sennacieca Cifereca we provide security consulting, security reviews, security program guidance, and penetration testing services. We would like to use and recommend services provided by Co-op Cloud member organizations, and thus have a vested interest in driving security improvements within the federation.
+
+We have worked closely with eCommons, providing security guidance and identifying opportunities for improvement at the federation level (recipe scanning via Hestia, and security advisory announcement via CCSATool).
+
+We agree with eCommon's assessment:
+
+> Co-op Cloud's federated model, tooling maintained collectively by the co-ops that use it, matches how we think infrastructure should be built and sustained. 
+
+Further, we believe that distributed systems may present additional challenges related to pushing forward security initiatives, but they provide increased resilience against state-level threat actors with the goal of shutting down infrastructure by geographical region or ideological alignment. 
+
+@dannygroenewegen:matrix.org from eCommons has agreed to vouch for this organization. 
+
+Kolektivo Sennacieca Cifereca's representative to the federation will be hex. He can be reached at `@hex:matrix.org` on Matrix or `biz@sekuro.nl` by email.

docs/maintainers/handbook.md

@@ -365,39 +365,42 @@ If we run `abra recipe upgrade wordpress` (at time of running), we end up with a
 
 ```
 $ abra recipe upgrade wordpress
-? upgrade to which tag? (service: app, image: wordpress, tag: 6.9.0) 6.9.1
-? upgrade to which tag? (service: db, image: mariadb, tag: 12.1) 12.2
-WARN unable to read tag for image atmoz/sftp, is it missing? skipping upgrade for ftp
+? upgrade to which tag? (service: app, image: wordpress, tag: 7.1.2) 7.1.3
+INFO tag upgraded and pinned from 7.1.2 to 7.1.3@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f for wordpress
+INFO no new versions available for mariadb, assuming 13.0 is the latest (use -a/--all-tags to see all anyway)
+INFO tag upgraded and pinned from 13.0 to 13.0@sha256:f1bba652ba57bea3099ca2fe1af692af537c27d96e0bcde39dce29e2ba1ec4f3 for mariadb
+WARN unable to parse atmoz/sftp, error was: version alpine is not supported (matched: ^[a-zA-Z]+$), skipping upgrade for ftp
 INFO wordpress currently has these unstaged changes 👇
 diff --git a/compose.yml b/compose.yml
-index b3c3871..07d0a54 100644
+index 591d157..99d5eb0 100644
 --- a/compose.yml
 +++ b/compose.yml
 @@ -3,7 +3,7 @@ version: "3.8"
  
  services:
    app:
--    image: "wordpress:6.9.0"
-+    image: "wordpress:6.9.1"
+-    image: "wordpress:7.1.2"
++    image: "wordpress:7.1.3@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f"
      volumes:
        - "wordpress_content:/var/www/html/wp-content/"
      networks:
-@@ -65,7 +65,7 @@ services:
-         - "coop-cloud.${STACK_NAME}.version=2.17.0+6.9.0"
+@@ -66,7 +66,7 @@ services:
+         - "coop-cloud.${STACK_NAME}.version=4.1.0+7.1.2"
  
    db:
--    image: "mariadb:12.1"
-+    image: "mariadb:12.2"
+-    image: "mariadb:13.0"
++    image: "mariadb:13.0@sha256:f1bba652ba57bea3099ca2fe1af692af537c27d96e0bcde39dce29e2ba1ec4f3"
      volumes:
        - "mariadb:/var/lib/mysql"
      networks:
-? commit changes? Yes
+? commit changes? (Y/n) 
 INFO committed changes as 'chore: update image tags'
 ```
 
 Here is a rundown of what happened:
 
 - `abra` queried the upstream container repositories of all the images listed in the Wordpress recipe configuration and checked if there are new tags available
+- `abra` also pulled the current manifest sha256 digest of the images at the new tags for that container
 - Once you make some choices on the prompt, `abra` will update the recipe configurations and show you the diff
 - If you choose to, a new commit containing the changes will be created
 

docs/maintainers/upgrade.md

@@ -74,6 +74,24 @@ version.
 `abra` will also warn Co-op Cloud operators about missing environment variables
 that are present in the recipe `.env.sample` but not in their app `.env` file.
 
+## Upstream versioning
+
+When upgrading a recipe automatically, abra will attempt to pin to a specific version
+of an upstream container image. The versions is a multi-architecture digest that is
+essentially immutable: if the upstream publishes a new image to that semantic version,
+abra won't use it until the recipe is upgraded again. This is a security feature: if a 
+maintainer publishes a new image with new contents, recipes won't use it unless 
+explicitly requested.
+
+Manifest images can be inspected manually:
+```
+docker buildx imagetools inspect 'gitlab/gitlab-ce:19.4.0-ce.0'
+
+Name: ...
+MediaType: ...
+Digest: sha256:...  <- This should go after gitlab-ce:19.4.0-ce.0@...
+```
+
 ## Creating new release notes
 
 Help other Co-op Cloud operators understand what they need to take care of when

mkdocs.yml

@@ -149,6 +149,8 @@ nav:
               - federation/resolutions/stalled/030.md
           - "In Progress":
               - federation/resolutions/in-progress/045.md
+              - federation/resolutions/in-progress/046.md
+              - federation/resolutions/in-progress/047.md
               - federation/resolutions/index.md
       - "Minutes":
           - federation/minutes/index.md