{"slug":"keycloak","tag":"26.8.1-CE-ubuntu24.04-r1","current":true,"account":false,"tarball":"ReadyStack-keycloak-26.8.1-CE-ubuntu24.04-r1.tar.gz","tarball_sha256":"0ad5f49ae4d09c1e8b451fd39b45c3d21528b7360991b786fff76495dd47c08c","generated_at":"2026-10-29T19:39:14Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/keycloak/keycloak","ref":"26.8.1","commit":"24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b","url":"https://github.com/keycloak/keycloak/tree/24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b"},"fetches":[{"kind":"git","url":"https://github.com/keycloak/keycloak","ref":"26.8.1"}],"bases":[{"image":"eclipse-temurin:21-jre-noble","digest":"sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c"},{"image":"maven:3.9.8-eclipse-temurin-21","digest":"sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["eclipse-temurin:21-jre-noble@sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c","maven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d"]},"build_method":"source-rebuild-java","source_date_epoch":1791878921,"source_date_epoch_utc":"2026-10-13T08:08:41Z","target":{"image":"readystack/keycloak:26.8.1-CE-ubuntu24.04-r1","image_manifest_digest":"sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1","config_digest":"sha256:74b446fde42e3334aad7386e06473733c70b10dbfe14728b4d4e9741f370e7c2"},"checksummed_files":119473},"files":[{"path":"BASES.tsv","size":310,"sha256":"a16d81840456b4eb9a4c91ebb43eab5de05f36d88247d5debba6d3409f49de16","public":"full","lines":2,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/BASES.tsv","text":"eclipse-temurin:21-jre-noble@sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c\tbases/eclipse-temurin_21-jre-noble_35501d3f9317.oci\nmaven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d\tbases/maven_3.9.8-eclipse-temurin-21_de18e4e51396.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":24648277,"sha256":"6a57d0fd42b2f18dba4725876216c8b85677e3f0ee2cba5132ff0dbfd723ce06","public":"account","lines":119473},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":5515,"sha256":"6c41294a9d3652d0e7f1c77282d756882b24a7aecc632fdd306fa80fa426c66c","public":"account","lines":49},{"path":"Dockerfile.offline","size":5515,"sha256":"6c41294a9d3652d0e7f1c77282d756882b24a7aecc632fdd306fa80fa426c66c","public":"account","lines":49},{"path":"Dockerfile.offline.pinned","size":5515,"sha256":"6c41294a9d3652d0e7f1c77282d756882b24a7aecc632fdd306fa80fa426c66c","public":"preview","lines":49,"preview":{"text":"# GENERATED L-009 hermetic Java build (--network=none, SBOM+SLSA-attestation-producing).\n# Pinned bases; vendored source + maven cache(s) + toolchain/runtime debs from Dockerfile.vendor.\nFROM maven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d AS jbuild\n# dpkg-install the vendored build toolchain (git/unzip) — no apt, fully offline.\nCOPY vendored/build-debs/ /tmp/bdebs/\nRUN dpkg -i /tmp/bdebs/*.deb 2>/dev/null || true; \\\n    dpkg -i /tmp/bdebs/*.deb 2>/dev/null || true; \\\n    dpkg --configure -a; rm -rf /tmp/bdebs\nWORKDIR /src\nCOPY vendored/keycloak-src/ .\nCOPY vendored/caches/m2/ /m2/\nCOPY vendored/caches/pnpm-store/ /pnpm-store/\nCOPY vendored/caches/pnpm-cache/ /pnpm-cache/\nENV MAVEN_OPTS=\"-Xmx3g\"\nENV npm_config_store_dir=\"/pnpm-store\"\nENV npm_config_cache=\"/pnpm-cache\"\nENV MAVEN_ARGS=\"-Dproject.build.outputTimestamp=2026-10-13T08:08:41Z\"\nRUN cd /src && KC_BUILD_TIME=\"$(printf '%s\\n' $MAVEN_ARGS | sed -n 's/^-Dproject\\.build\\.outputTimestamp=\\([0-9]\\{4\\}-[0-9][0-9]-[0-9][0-9]\\)T\\([0-9][0-9]:[0-9][0-9]\\):[0-9][0-9]Z$/\\1 \\2/p')\" && test -n \"$KC_BUILD_TIME\" && echo \"keycloak-version.properties build-time=$KC_BUILD_TIME\" && npm_config_store_dir=/pnpm-store npm_config_cache=/pnpm-cache MAVEN_OPTS=-Xmx3g mvn \"-Dtimestamp=$KC_BUILD_TIME\" -o -B -pl quarkus/deployment,quarkus/dist -am -DskipTests -DskipProtoLock=true -Dmaven.build.cache.enabled=false -Dmaven.repo.local=/m2 clean install\nRUN tar -xzf quarkus/dist/target/keycloak-*.tar.gz -C /opt --strip-components=0 && mv /opt/keycloak-* /opt/keycloak && mkdir -p /opt/keycloak/data\nRUN mkdir -p /tmp/rs-canon && printf '%s\\n' 'import java.io.*;' 'import java.nio.file.*;' '' '// Re-serializes the Quarkus lib/deployment/appmodel.dat with every String interned, so a value that occurs twice is' '// always written as one TC_STRING plus back-references. ObjectOutputStream otherwise shares a String only when the' '// in-memory model happened to hold the same instance, which varies from build to build.' 'public class AppModelCanon {' '    public static void main(String[] args) throws Exception {' '        Path in = Path.of(args[0]), out = Path.of(args.length > 1 ? args[1] : args[0]);' '        byte[] original = Files.readAllBytes(in);' '        Object model;' '        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(original))) {' '            model = ois.readObject();' '            if (ois.read() != -1) throw new IllegalStateException(\"trailing data after the model in \" + in);' '        }' '        ByteArrayOutputStream bytes = new ByteArrayOutputStream();' '        try (ObjectOutputStream oos = new ObjectOutputStream(bytes) {' '            { enableReplaceObject(true); }' '            @Override protected Object replaceObject(Object o) { return o instanceof String s ? s.intern() : o; }' '        }) {' '            oos.writeObject(model);' '        }' '        Files.write(out, bytes.toByteArray());' '        System.out.println(\"canonicalized \" + in + \" -> \" + out + \" (\" + original.length + \" -> \" + bytes.size() + \" bytes)\");' '    }' '}' > /tmp/rs-canon/AppModelCanon.java && java -cp '/opt/keycloak/lib/lib/deployment/*:/opt/keycloak/lib/lib/boot/*:/opt/keycloak/lib/lib/main/*' /tmp/rs-canon/AppModelCanon.java /opt/keycloak/lib/lib/deployment/appmodel.dat && rm -rf /tmp/rs-canon\nFROM eclipse-temurin:21-jre-noble@sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c\nENV DEBIAN_FRONTEND=noninteractive LANG=en_US.UTF-8 KC_RUN_IN_CONTAINER=true KC_DB=postgres KC_HEALTH_ENABLED=true KC_METRICS_ENABLED=true KC_HTTP_ENABLED=true\nCOPY vendored/debs/ /tmp/debs/\nRUN dpkg -i /tmp/debs/*.deb 2>/dev/null || true; \\","lines_shown":24,"lines_total":49}},{"path":"Dockerfile.vendor","size":6784,"sha256":"2a72e5ccb9d8feb730aec2bbd87fb4b2163951acf9c9d076c4093cfdcfc9b74e","public":"account","lines":34},{"path":"MANIFEST.txt","size":16524143,"sha256":"d365ceab63d191196280b2e0b2a6aedd96f2a17d94ce1bd63ac05d0df6373276","public":"account","lines":119475},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"0d4cb1e30a6e13196863f0fc1196fa99c58a5d93d44dbcaa0dfe4d4dc4bc85a1","public":"full","lines":1,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/SOURCE_DATE_EPOCH.txt","text":"1791878921\n"},{"path":"TARGET_DIGEST.txt","size":435,"sha256":"1de021b05a290d9a72a6bb955a97db0dc5f67bd71c5bd17d4f956294dcfb2efc","public":"full","lines":8,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1\nconfig_digest=sha256:74b446fde42e3334aad7386e06473733c70b10dbfe14728b4d4e9741f370e7c2\ntag=readystack/keycloak:26.8.1-CE-ubuntu24.04-r1\nprobe_port=9000\nprobe_path=/health/ready\nprobe_timeout=180\nverify_boot=skip\nverify_boot_reason=this image needs pg (not part of this archive); boot it with your own services as the admin handbook describes\n"},{"path":"VERIFY_OFFLINE.sh","size":7000,"sha256":"520705cb939e05a308da29feea6f4f320ccd06f5bca6939b4195c0e27e15ff01","public":"account","lines":123},{"path":"docs/PROVENANCE.md","size":1720,"sha256":"22baf88174d8544c264e33939b1c1ef8f3f4f4d7f863f8a633a083db7622e13b","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5173,"sha256":"405db6779beefa6e46920a183c5b787164fb67cdd1a2dcbf643a7551dbedcc84","public":"account","lines":59},{"path":"docs/VERIFY.md","size":1964,"sha256":"4dc1049890f2b25e1e69b5c9bdee7548de760db84a3a0207cf16b28ebb2f18bd","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":79,"sha256":"d8333cbb49c2555142558276dd5591ad0e87ae0b54ab893c24bbab56680f0cb9","public":"full","lines":2,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for keycloak (resolve at build_kit)\neclipse-temurin:21-jre-noble\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":16638,"sha256":"2449b7752805408d9f7c545f36195fb20019b71a9e2c30fa2f5ef02683adf1e3","public":"account","lines":76,"redactions":[{"line":58,"kind":"internal host"}],"kit_sha256":"8f95876f4ff991a9e0fb9d34433a9f4d1257008f3203abaa8940f643263633e7"},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":650,"sha256":"afce7f110e034ad158101a6ee14f6d966ce0eaa0d929c6b40d550af286ca1feb","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":401562,"sha256":"396a3dbf2fa517c3bc2423aa01220be98ff2249ac47a974028af14235679ec20","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":309,"sha256":"44fe67ccbedad5e33c4562cd8fcf37f5141558d2e091f9ae3d17a2b8735f1d9c","public":"full","lines":9,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"keycloak\",\n  \"repo\": \"https://github.com/keycloak/keycloak\",\n  \"ref\": \"26.8.1\",\n  \"commit\": \"24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b\",\n  \"tree_listing_sha256\": \"4787a735c31b3e1067f077e18be438cdfee9609504b302855f5cb8e82d46183b\",\n  \"file_count\": 13489\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":28,"sha256":"fa091140511e85f86057bf9f05d5bd9e073f13c04af3de77559c304bd4b38227","public":"account","lines":3},{"path":"docs/provenance/TOOLCHAIN.lock","size":11301,"sha256":"a2ce8d4c88c3422c02471e244f1037773f1b2ba35c435065104daf3d654c0284","public":"account","lines":90},{"path":"rebuild.json","size":1541,"sha256":"be791b511c7e6e3ae4acd2c43335ac93601ca8279c492b3f332a38ae227b8f89","public":"account","lines":36},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/keycloak/26.8.1-CE-ubuntu24.04-r1/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":23,"bytes":338703696},"docs":{"files":13530,"bytes":129917850},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":91075,"bytes":2375968699}},"links":{"page":"https://readystack.dev/products/keycloak/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fkeycloak%2Frecipe","kit":"https://readystack.dev/buy.html?product=keycloak"}}