From 72ea5cbd59c98507c2de8451928495aaa31a7805 Mon Sep 17 00:00:00 2001
From: Matt Schwager <matt.schwager@trailofbits.com>
Date: Mon, 23 Feb 2026 08:48:49 -0500
Subject: [PATCH] Update to Debian Trixie and LLVM 22

---
 .github/workflows/test.yml |  5 +++--
 Dockerfile                 | 12 ++++++------
 Dockerfile.LibAFL          | 14 +++++++-------
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index be42f31..afb7979 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        # https://apt.llvm.org/bookworm/dists/
+        # https://apt.llvm.org/trixie/dists/
         llvm-version:
           # TODO: add 14 to ensure support for Ubuntu 22.04. LLVM doesn't build
-          # 14 for Bookworm, so we could switch to Bullseye, or use some other
+          # 14 for Trixie, so we could switch to Bullseye, or use some other
           # means of testing against LLVM 14. We've manually confirmed 14 works,
           # but having automated tests would ensure compatibility as development
           # continues. Tracking upstream request here:
@@ -27,6 +27,7 @@ jobs:
           - "19"
           - "20"
           - "21"
+          - "22"
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
diff --git a/Dockerfile b/Dockerfile
index 1333c2f..d4c68cf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,19 +1,19 @@
 # https://hub.docker.com/_/ruby
 ARG RUBY_VERSION=4.0
 
-FROM ruby:$RUBY_VERSION-slim-bookworm
+FROM ruby:$RUBY_VERSION-slim-trixie
 
 RUN apt update && apt install -y \
     ca-certificates \
     wget \
     && rm -rf /var/lib/apt/lists/*
 
-# LLVM builds version 15-21 for Debian 12 (Bookworm)
-# https://apt.llvm.org/bookworm/dists/
-ARG LLVM_VERSION=21
+# LLVM builds version 15-22 for Debian 13 (Trixie)
+# https://apt.llvm.org/trixie/dists/
+ARG LLVM_VERSION=22
 
-RUN echo "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list
-RUN echo "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list
+RUN echo "deb http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list
+RUN echo "deb-src http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list
 RUN wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc
 
 RUN apt update && apt install -y \
diff --git a/Dockerfile.LibAFL b/Dockerfile.LibAFL
index 9c0bb91..8ec3b50 100644
--- a/Dockerfile.LibAFL
+++ b/Dockerfile.LibAFL
@@ -1,8 +1,8 @@
 # Stage 1: Build LibAFL's libFuzzer compatibility library
 ARG RUBY_VERSION=4.0
-ARG LLVM_VERSION=21
+ARG LLVM_VERSION=22
 
-FROM debian:bookworm-slim AS libafl-builder
+FROM debian:trixie-slim AS libafl-builder
 
 ARG LLVM_VERSION
 
@@ -14,8 +14,8 @@ RUN apt update && apt install -y \
     && rm -rf /var/lib/apt/lists/*
 
 # Install LLVM (needed for clang linker during Rust build)
-RUN echo "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list \
-    && echo "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list \
+RUN echo "deb http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list \
+    && echo "deb-src http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list \
     && wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc \
     && apt update && apt install -y \
     clang-$LLVM_VERSION \
@@ -41,7 +41,7 @@ ENV LLVM_CONFIG="llvm-config-${LLVM_VERSION}"
 RUN bash build.sh
 
 # Stage 2: Build ruzzy with LibAFL's libFuzzer
-FROM ruby:$RUBY_VERSION-slim-bookworm
+FROM ruby:$RUBY_VERSION-slim-trixie
 
 RUN apt update && apt install -y \
     ca-certificates \
@@ -50,8 +50,8 @@ RUN apt update && apt install -y \
 
 ARG LLVM_VERSION
 
-RUN echo "deb http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list \
-    && echo "deb-src http://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list \
+RUN echo "deb http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" > /etc/apt/sources.list.d/llvm.list \
+    && echo "deb-src http://apt.llvm.org/trixie/ llvm-toolchain-trixie-$LLVM_VERSION main" >> /etc/apt/sources.list.d/llvm.list \
     && wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key > /etc/apt/trusted.gpg.d/apt.llvm.org.asc
 
 # Install lld alongside clang. LibAFL's libFuzzer.a contains a .preinit_array