{"slug":"pause","tag":"3.10.2-CE-scratch-r1","current":true,"account":false,"tarball":"ReadyStack-pause-3.10.2-CE-scratch-r1.tar.gz","tarball_sha256":"0f4136289261762f48aa7f53e81cca7e76a79faaaa6dd3c5bc978c9c6d56d798","generated_at":"2026-10-29T19:19:52Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/kubernetes/kubernetes","ref":"v1.36.6","commit":"1b2171b110bb2a2542e1322035c6583ec86eb976","url":"https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976"},"fetches":[{"kind":"git","url":"https://github.com/kubernetes/kubernetes.git","ref":"v1.36.6"}],"bases":[{"image":"golang:1.26.10-bookworm","digest":"sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"]},"build_method":"source-rebuild-c","source_date_epoch":1793102572,"source_date_epoch_utc":"2026-10-27T12:02:52Z","target":{"image":"readystack/pause:3.10.2-CE-scratch-r1","image_manifest_digest":"sha256:6b74cfa71db2c51e1a21e3342402d3993573ea02a0c85063897eda87958dca26","config_digest":"sha256:a08577913f860cca67c84dd79abf66673b6c3a10ef17ce5ecbc89b187ce3c337"},"checksummed_files":29302},"files":[{"path":"BASES.tsv","size":143,"sha256":"2723d349204e265669d4d19e2e96fc49d3c481b7b964999bae66afcba2519644","public":"full","lines":1,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/BASES.tsv","text":"golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af\tbases/golang_1.26.10-bookworm_632dff735179.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":4875003,"sha256":"bf5d8af353c9e91f9a3bb7b55b1a4647ef5fdb9f3b2ff08e2d9d4d96e3b32659","public":"account","lines":29302},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":4007,"sha256":"f553e1e38a155a3d8e7764a475a9f1f9bf18c98b35bfabfc518cfa374cd28d58","public":"account","lines":52},{"path":"Dockerfile.offline","size":4007,"sha256":"f553e1e38a155a3d8e7764a475a9f1f9bf18c98b35bfabfc518cfa374cd28d58","public":"account","lines":52},{"path":"Dockerfile.offline.pinned","size":4007,"sha256":"f553e1e38a155a3d8e7764a475a9f1f9bf18c98b35bfabfc518cfa374cd28d58","public":"preview","lines":52,"preview":{"text":"# =====================================================================\n# pause 3.10.2 L-009 HERMETIC OFFLINE BUILD — the canonical, attestation-producing build. build_kit runs\n#   docker buildx build --builder readystack-builder-max --network=none\n#     --attest type=provenance,mode=max --attest type=sbom --push <context>\n# Pinned-public-base + vendored model: golang 1.26.10-bookworm (its gcc 12.2, Debian bookworm) pinned BY DIGEST\n# (BASE_IMAGE_DIGESTS.lock) compiles; vendored/pause-src is build/pause/ of kubernetes v1.36.6. The image is FROM scratch.\n# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).\n#\n# SHAPE (upstream build/pause/Dockerfile + Makefile at v1.36.6): FROM scratch, the static /pause, compiled from\n# linux/pause.c with the Makefile's CFLAGS (-Os -Wall -Werror -static -DVERSION=v$(TAG)-$(REV), TAG ?= 3.10.2) and\n# stripped as the Makefile strips it; USER 65535:65535 and ENTRYPOINT [\"/pause\"] as upstream. REV is empty, as in\n# upstream's published build: registry.k8s.io/pause:3.10.2 (sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4)\n# answers `/pause -v` with \"pause.c v3.10.2-\" (measured 2026-10-28), and so does this one.\n# =====================================================================\nFROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS build\nARG SOURCE_DATE_EPOCH=1793102572\nWORKDIR /src\nCOPY vendored/pause-src/ .\nCOPY static-sbom.py /usr/local/bin/static-sbom.py\n# TAG is read from build/pause/Makefile and must be 3.10.2 (the pin manifest's pause, kubeadm v1.36.6's PauseVersion);\n# the binary must then report exactly pause.c v$(TAG)-. gcc -static copies glibc (libc6-dev's libc.a) and libgcc\n# (libgcc-12-dev) into it, which no scanner can see in a binary: static-sbom.py declares both, at the builder's exact\n# package versions, in an SPDX document the image ships under /usr/local/share/readystack/sbom/ (owner rule 2026-10-28:\n# make linked code visible; chain 781 found the image read as 0 packages).","lines_shown":24,"lines_total":52}},{"path":"Dockerfile.vendor","size":1307,"sha256":"6d3e4553f6fe28e183205c2334d61210d879987380bc7e2330b125263bd1f8b3","public":"account","lines":18},{"path":"MANIFEST.txt","size":2882484,"sha256":"24ce19b937491295c54d45f6c9cb119573e366e4383e1f6a4b417c9fd5a39a12","public":"account","lines":29303},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"1baf07802daf74bb53895a5dc126efadea088eaec3460ac65cf3d9b9ca460a3c","public":"full","lines":1,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/SOURCE_DATE_EPOCH.txt","text":"1793102572\n"},{"path":"TARGET_DIGEST.txt","size":394,"sha256":"6111e9901ebe37ce2fbfb9e6859479482aff4968aed095d8144b96d909714374","public":"full","lines":10,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:6b74cfa71db2c51e1a21e3342402d3993573ea02a0c85063897eda87958dca26\nconfig_digest=sha256:a08577913f860cca67c84dd79abf66673b6c3a10ef17ce5ecbc89b187ce3c337\ntag=readystack/pause:3.10.2-CE-scratch-r1\nprobe_port=80\nprobe_path=/\nprobe_timeout=180\nprobe_exec=test \"$(cat /proc/1/comm)\" = pause\nverify_boot=oneshot\nverify_oneshot_arg=-v\nverify_oneshot_expect=pause.c v3.10.2-\n"},{"path":"VERIFY_OFFLINE.sh","size":10153,"sha256":"3e8184ea230cfd8f41f977e26be6bf7bd03112c396c517837ce0c7de4f7399dd","public":"account","lines":165},{"path":"docs/PROVENANCE.md","size":1680,"sha256":"1ca49cb840e45901b46ee588bea7c23f7aadd3bf2f4313e95b6050428a3bfb2a","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5291,"sha256":"97b89e7e256c2689b5259074e46c78d20b7a7a3a13e26e90806e18762f66a259","public":"account","lines":59},{"path":"docs/VERIFY.md","size":1932,"sha256":"193ceb9f265fc3fd427b52da1e3b010dcaece16da6ff30c230b31623d2f7ef14","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":71,"sha256":"095ce71fac93812e9d0e74a1a5f246240c2df4170a9439c6af00c1e7d13fdfe0","public":"full","lines":2,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for pause (resolve at build_kit)\ngolang:1.26.10-bookworm\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":1540,"sha256":"52a398bac22e8369dce1ed6a086f2ca69439ef0d2e1d35063558693982bc02a0","public":"account","lines":36},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":652,"sha256":"6e7ec9b7429b40384fb55c94d664fa5167347b0998368655ed25b86addb46a6e","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":262249,"sha256":"3162e9029ebd18eb492d3061d3a0c223f3c8d937ef723a944c6cba366c31ac26","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":311,"sha256":"3cde6bbc716dfaa4b1a8442ab14ccf06bebe3027f46df8a3781021f9b14973d2","public":"full","lines":9,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"pause\",\n  \"repo\": \"https://github.com/kubernetes/kubernetes\",\n  \"ref\": \"v1.36.6\",\n  \"commit\": \"1b2171b110bb2a2542e1322035c6583ec86eb976\",\n  \"tree_listing_sha256\": \"803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004\",\n  \"file_count\": 29206\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":1,"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","public":"account","lines":1},{"path":"docs/provenance/TOOLCHAIN.lock","size":1888,"sha256":"68276873eee5d77ceb9cf6781433c93841031a3f008d09dc59b5d9012cbbe098","public":"account","lines":57},{"path":"rebuild.json","size":1200,"sha256":"4a6f71734eb42ebb205f4cc07a3a75cc5bcf92b8c33ce51923eab7e1eb0bba27","public":"account","lines":36},{"path":"static-sbom.py","size":6054,"sha256":"37be8271209a99f67c7740085195b62c1e4f5efdc9644362089885b9c78a6705","public":"account","lines":102},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/pause/3.10.2-CE-scratch-r1/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":11,"bytes":296811899},"docs":{"files":29255,"bytes":248024965},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":12,"bytes":29311}},"links":{"page":"https://readystack.dev/products/pause/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fpause%2Frecipe","kit":"https://readystack.dev/buy.html?product=pause"}}