{"slug":"opensearch","tag":"3.9.0-CE-ubuntu24.04-r3","current":true,"account":false,"tarball":"ReadyStack-opensearch-3.9.0-CE-ubuntu24.04-r3.tar.gz","tarball_sha256":"54c3c08eabb7e29b46567b59a74e69533b057a24beb5a02142e7d3196582b421","generated_at":"2026-10-29T19:18:54Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/opensearch-project/OpenSearch","ref":"3.9.0","commit":"4ee42a94e87f66fbf1e62a9871b1b87f91e02472","url":"https://github.com/opensearch-project/OpenSearch/tree/4ee42a94e87f66fbf1e62a9871b1b87f91e02472"},"bases":[{"image":"ubuntu:24.04","digest":"sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0"},"build_method":"kit-prebuilt-tarball","source_date_epoch":1790105837,"source_date_epoch_utc":"2026-09-22T19:37:17Z","target":{"image":"readystack/opensearch:3.9.0-CE-ubuntu24.04-r3","image_manifest_digest":"sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b","config_digest":"sha256:81887ba4288417edf42d9bcef3d060654399b4180bb273edc31c1a9a30ce6742"},"checksummed_files":19357},"files":[{"path":"BASES.tsv","size":121,"sha256":"0da49a3ea98fcaa345080b1a4230d2c798b395f71854063c2af657eb53a8a2e0","public":"full","lines":1,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/BASES.tsv","text":"ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\tbases/ubuntu_24.04_24737cef17f4.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":3589188,"sha256":"c5a83ba5efa0a8911cf4927a6cf4e6e794ff533130431b5b045edaa7a12c91ae","public":"account","lines":19357},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":6023,"sha256":"643f4175744daeab0b84e6c95d631dc1a213a2caea3bf87baa09e4d84ca5ade9","public":"account","lines":84},{"path":"Dockerfile.offline","size":5860,"sha256":"93d538bd26e5a67536ce5093c10d84c9a054d188f0ee03f6de8c7ecaf29d5883","public":"account","lines":84},{"path":"Dockerfile.offline.pinned","size":6173,"sha256":"8dc9e82e86b4e623b12479784176cb335d66211b2eb20f1fb54f1f349a6c9ebe","public":"preview","lines":88,"preview":{"text":"# =====================================================================\n# L-009 HERMETIC OFFLINE BUILD (opensearch, repackage of the official\n# Apache-2.0 tarball). Run by build_kit's L-009 buildx:\n#   docker buildx build --builder readystack-builder-max --network=none\n#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>\n#\n# Pinned-public-base + fully-vendored model (no network at build):\n#   - ubuntu pinned BY DIGEST (cache-warm; RUN steps --network=none hermetic)\n#   - vendored/debs               : apt CVE dist-upgrade closure + system\n#                                   OpenJDK 21 + runtime pkgs, dpkg offline\n#   - vendored/opensearch-src/... : the ALREADY-PATCHED OpenSearch tree\n#                                   (patch-tree.sh: bundled JDK dropped, unused\n#                                   security plugins removed, vulnerable jars\n#                                   raised to version floors)\n# The proven 0-fixable recipe is docs/OPENSEARCH_BUILDOUT.md.\n# =====================================================================\nFROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\nARG SOURCE_DATE_EPOCH=1790105837\nENV DEBIAN_FRONTEND=noninteractive TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8\n\n# Offline apt: dpkg-install the vendored closure (CVE dist-upgrade + OpenJDK 21\n# + curl/tzdata). Two passes + configure-a resolve inter-deb ordering, no network.\n# The passes hide dpkg's errors, so every vendored deb is then checked installed at\n# its vendored version: one that did not land would ship the base's older package.","lines_shown":24,"lines_total":88}},{"path":"Dockerfile.vendor","size":3413,"sha256":"72d7f454286974adbc6d19b9b3b7c03c3797433f37077754282076bb734e29c4","public":"account","lines":51},{"path":"MANIFEST.txt","size":2272942,"sha256":"d5cb95cc86fbcb4c54121bd71a95416f9105c941f1e3d7df0909f33141dd2c9e","public":"account","lines":19359},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"ca04888e1408f4dd3a6e1e1db2dbd50a5ee6bcd7acb19f938d0470ffbb3e1c5c","public":"full","lines":1,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/SOURCE_DATE_EPOCH.txt","text":"1790105837\n"},{"path":"TARGET_DIGEST.txt","size":292,"sha256":"2d93d232b1b4c9b9b095470bcb66c8b14d71d1a2086e74bfb4b069757da5e0fe","public":"full","lines":6,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b\nconfig_digest=sha256:81887ba4288417edf42d9bcef3d060654399b4180bb273edc31c1a9a30ce6742\ntag=readystack/opensearch:3.9.0-CE-ubuntu24.04-r3\nprobe_port=9200\nprobe_path=/_cluster/health\nprobe_timeout=180\n"},{"path":"VERIFY_OFFLINE.sh","size":7331,"sha256":"8b036b1f9a7f7deb4dbab14ef6b7c40622d2820904e891b8845ba3580e924506","public":"account","lines":128},{"path":"docs/PROVENANCE.md","size":2203,"sha256":"bda9a76e41f40e23febdfba36e634dc5873b2ba7cd56656c6bd4e7a92f2042d3","public":"account","lines":29},{"path":"docs/REBUILD.md","size":5208,"sha256":"ad5db626c3038436ff1977e99868673ec0e9ad0ff2f0bdbd9968edd158a6c0da","public":"account","lines":57},{"path":"docs/VERIFY.md","size":1971,"sha256":"9710203b564ebab6f2c382e9bba9a0ae83a3eabba913e1827d891d270252b362","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":53,"sha256":"79ac4273d7fe36ddb6435a7f2449797ecdeeaed1d01e6ea0612cff300bae924d","public":"full","lines":2,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for opensearch (resolve at build_kit)\n\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":1181,"sha256":"ab720d24a1947a075acd06ce4f353255c5424f5410e0fbd55b2a7b3c6f533b74","public":"account","lines":21},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":663,"sha256":"315be99a05379ed4af8cfeee263c0b25f55d3d249eb97e8ff387f90389b870d2","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":464657,"sha256":"9fa22841de5ab3c8d1d7059b5b835d11c12ef65343b68875b4c81ced6f618cca","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":322,"sha256":"979bf36d89aad30b184707639fc643d818cbc98c6e3ed12a7bdb4f0a6458c567","public":"full","lines":9,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"opensearch\",\n  \"repo\": \"https://github.com/opensearch-project/OpenSearch\",\n  \"ref\": \"3.9.0\",\n  \"commit\": \"4ee42a94e87f66fbf1e62a9871b1b87f91e02472\",\n  \"tree_listing_sha256\": \"2ae217a7cfe15e67871dcb85116f6032694851802f619e60e9921326333b0902\",\n  \"file_count\": 19243\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":52,"sha256":"f516a236c6e338e79e4553d40e97f75d756ff57ec3945daab835a3d17d4b5f8c","public":"account","lines":4},{"path":"docs/provenance/TOOLCHAIN.lock","size":983,"sha256":"73eac27f6935a0fd955457ff29bffbd951db57d05ac8b9eff4ecbc9ecd85a3eb","public":"account","lines":30},{"path":"kitforge-jks-sde.java","size":3415,"sha256":"a7fe3b0a32d8f9f60d2df12289e5657cf0efbba46ea10006da975de63ba37236","public":"account","lines":56},{"path":"patch-tree.sh","size":7780,"sha256":"7afc58f80d42a545fed03f0f6c8981c29974bb16fd7ef8c65650c928690515b4","public":"account","lines":125},{"path":"rebuild.json","size":1166,"sha256":"c42bd48b0c56559176b6419dd5e1fd947bce2d90fc0f56bf5d046b8d31b7b48e","public":"account","lines":33},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/opensearch/3.9.0-CE-ubuntu24.04-r3/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":5,"bytes":29771169},"docs":{"files":19297,"bytes":165258263},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":30,"bytes":976711567}},"links":{"page":"https://readystack.dev/products/opensearch/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fopensearch%2Frecipe","kit":"https://readystack.dev/buy.html?product=opensearch"}}