{"slug":"ghost","tag":"v6.72.0-CE-ubuntu24.04-r5","current":true,"account":false,"tarball":"ReadyStack-ghost-v6.72.0-CE-ubuntu24.04-r5.tar.gz","tarball_sha256":"f57c9799aaeb04f92f722ebb608566d11e1f7df9b7b8112a883e407168aaba1b","generated_at":"2026-10-29T21:10:30Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/TryGhost/Ghost","ref":"v6.72.0","commit":"412dff5a21cc8ffbfec0b15554eebcb53194ad15","url":"https://github.com/TryGhost/Ghost/tree/412dff5a21cc8ffbfec0b15554eebcb53194ad15"},"bases":[{"image":"ubuntu:24.04","digest":"sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0"},"build_method":"source-rebuild-node","source_date_epoch":1792508615,"source_date_epoch_utc":"2026-10-20T15:03:35Z","target":{"image":"readystack/ghost:v6.72.0-CE-ubuntu24.04-r5","image_manifest_digest":"sha256:b422fae270bccd74981a0f440947f379ad365b01ba7eae4e11fa95ca53a3489f","config_digest":"sha256:7114b96f8fb5ce70d8404f1803fe46f6c8e198d6e600285574ee85797cbb53d4"},"checksummed_files":9156},"files":[{"path":"BASES.tsv","size":121,"sha256":"63822800fc2b89e7b38d1fbaaad6f0c80c9a91a0176ebe7d935c08b0cdd6b4fa","public":"full","lines":1,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/BASES.tsv","text":"ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852\tbases/ubuntu_24.04_fe81560990fa.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":1405670,"sha256":"8c5a4b2a2f97f8f0ccadaf0c31970c6476a755acd2624e69788338d50190608e","public":"account","lines":9156},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":2689,"sha256":"2b31e446c1b644c4cd46e3a59765373226847f9d4d587909f1263437a976955f","public":"account","lines":41},{"path":"Dockerfile.offline","size":1803,"sha256":"6c38fdcff84c71479520052ecf96fc3ac0e847c0912626ff420ccb2cf002704e","public":"account","lines":30},{"path":"Dockerfile.offline.pinned","size":3621,"sha256":"b65a0f5cb9204acfd0953ac9cd84fc0da4154169193a0c8713caa925cd0f424b","public":"preview","lines":53,"preview":{"text":"# =====================================================================\n# Ghost 6.72.0 (MIT) HERMETIC OFFLINE BUILD. --network=none.\n# Reassembles the vendored built filesystem onto the PINNED ubuntu:24.04 base — the same digest\n# Dockerfile.vendor built the runtime on. Node (the nodejs.org 22.23.4 build, sha256-pinned in\n# Dockerfile.vendor) arrives inside the vendored system.tar.gz, without npm/npx/corepack.\n# =====================================================================\nFROM ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852\nARG SOURCE_DATE_EPOCH=1784302522\nENV NODE_ENV=production \\\n    GHOST_CONTENT=/var/lib/ghost/content \\\n    paths__contentPath=/var/lib/ghost/content \\\n    server__host=:: \\\n    logging__transports='[\"file\",\"stdout\"]'\nADD vendored/ghost-src/system.tar.gz /\nADD vendored/ghost-src/ghost.tar.gz /\n# system.tar.gz carries /etc/passwd with `node` at uid 1000 in place of the base's `ubuntu`\n# user (see Dockerfile.vendor); /home is not in the tarball, so give node its home here and drop\n# the now-ownerless /home/ubuntu.\nRUN chown -R node:node /var/lib/ghost && chmod 755 /usr/local/bin/entrypoint.sh && \\\n    rm -rf /home/ubuntu && mkdir -p /home/node && chown node:node /home/node && chmod 750 /home/node\nWORKDIR /var/lib/ghost/current\nEXPOSE 2368\n# npm/npx/corepack: Dockerfile.vendor never puts them in the runtime (on the old node:* base they\n# carried ghost's last fixable CVEs, inside npm's own bundled dependencies). The rm stays as a guard","lines_shown":24,"lines_total":53}},{"path":"Dockerfile.vendor","size":17977,"sha256":"30f643b638c283d83a8bc37c699b4448dc2affdc725218f5001bf7837a9425c5","public":"account","lines":183},{"path":"MANIFEST.txt","size":783092,"sha256":"3da7dc3ead15edf86028dffdf8493db902efc392e03779dd1319e0fe5e50b33b","public":"account","lines":9158},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"3f75bc30c3cba4af825cfb4ec5b6f9d4e2f6ac88690f542fb242f7dac39d4173","public":"full","lines":1,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/SOURCE_DATE_EPOCH.txt","text":"1792508615\n"},{"path":"TARGET_DIGEST.txt","size":442,"sha256":"ba11504cfe510f24ee5cdb58fedf0696e237fd5538f4cdd5678c946e62223349","public":"full","lines":8,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:b422fae270bccd74981a0f440947f379ad365b01ba7eae4e11fa95ca53a3489f\nconfig_digest=sha256:7114b96f8fb5ce70d8404f1803fe46f6c8e198d6e600285574ee85797cbb53d4\ntag=readystack/ghost:v6.72.0-CE-ubuntu24.04-r5\nprobe_port=2368\nprobe_path=/ghost/api/admin/site/\nprobe_timeout=300\nverify_boot=skip\nverify_boot_reason=this image needs db (not part of this archive); boot it with your own services as the admin handbook describes\n"},{"path":"VERIFY_OFFLINE.sh","size":10153,"sha256":"3e8184ea230cfd8f41f977e26be6bf7bd03112c396c517837ce0c7de4f7399dd","public":"account","lines":165},{"path":"docs/PROVENANCE.md","size":2079,"sha256":"ec631d45fe840326be2e25791ef911b9fba1a7e03bfc3f814ca95525d6c82ce7","public":"account","lines":29},{"path":"docs/REBUILD.md","size":5175,"sha256":"46179d0eab5d0da1dacd8d68a87caa48a7d629f62df4c86ae1badc0a47c3eaee","public":"account","lines":59},{"path":"docs/VERIFY.md","size":1950,"sha256":"f79a1eb41a84bb9d9df9f3a6758c27ad7b34a6eb35ceda9fee581935a2bf6a73","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":48,"sha256":"ff0edcb8bee3dcef8fff878ad283157696873e21112b2204eb5f471e8cfccf8b","public":"full","lines":2,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for ghost (resolve at build_kit)\n\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":2401,"sha256":"b2cbccf6516ac97ecf38594f5ec2dc7290c5f6a6ff786c1a0f37bc24efdae78f","public":"account","lines":24},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":645,"sha256":"bacef487a8f17fce69d0c5cd3f1006777631b24c73310859704ab16939af83f0","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":313351,"sha256":"b4c9912f94c06989646841e648079eface22307a5f6d2bc9179dc8368fb9af20","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":303,"sha256":"d4f42ca64f6961eb441a9ce27de0b83e0c41d522e204941fb05a6e0e02461b15","public":"full","lines":9,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"ghost\",\n  \"repo\": \"https://github.com/TryGhost/Ghost\",\n  \"ref\": \"v6.72.0\",\n  \"commit\": \"412dff5a21cc8ffbfec0b15554eebcb53194ad15\",\n  \"tree_listing_sha256\": \"ec2242813e55523813c26d07a19b76d9b6b4ecd1e9dbaeffdc0aa2c11d5eee83\",\n  \"file_count\": 9073\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":1,"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","public":"account","lines":1},{"path":"docs/provenance/TOOLCHAIN.lock","size":1185,"sha256":"3bc359a03ed2d1c1a6fd5aa32bbdddf71694fa79e428165c7e9a16bebad86068","public":"account","lines":31},{"path":"entrypoint.sh","size":1058,"sha256":"541b3faeb9473ef6e2312f614660ce7ee05117e18ba5c089392e56e72dc60275","public":"account","lines":21},{"path":"rebuild.json","size":1212,"sha256":"45f41ff7a9778442e0201d9824e5c7beb0496edee4067baec0c7f4d0bdf139e3","public":"account","lines":31},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/ghost/v6.72.0-CE-ubuntu24.04-r5/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":5,"bytes":29771169},"docs":{"files":9125,"bytes":93845200},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":2,"bytes":288832958}},"links":{"page":"https://readystack.dev/products/ghost/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fghost%2Frecipe","kit":"https://readystack.dev/buy.html?product=ghost"}}