{"slug":"wireguard","tag":"0.0.20250522-CE-ubuntu24.04-r1","current":true,"account":false,"tarball":"ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz","tarball_sha256":"d5834b19c1c3598e5cb7175dde33b3a2db00e1de986be75cd749b79553140bfb","generated_at":"2026-10-29T19:29:06Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://git.zx2c4.com/wireguard-go","ref":"0.0.20250522","commit":"f333402bd9cbe0f3eeb02507bd14e23d7d639280","url":"https://git.zx2c4.com/wireguard-go"},"fetches":[{"kind":"git","url":"https://git.zx2c4.com/wireguard-go","ref":"0.0.20250522"}],"bases":[{"image":"golang:1.27.3-bookworm","digest":"sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5"},{"image":"ubuntu:24.04","digest":"sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5"]},"build_method":"source-rebuild-go","source_date_epoch":1747871102,"source_date_epoch_utc":"2025-05-21T23:45:02Z","target":{"image":"readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1","image_manifest_digest":"sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9","config_digest":"sha256:bb21104411c1e0a49d8445a247eb800aa5688f09693b021a592f159b61a99191"},"checksummed_files":1368},"files":[{"path":"BASES.tsv","size":262,"sha256":"203db39d31165cdf0ef7de9050461c107d9b50e5f22ecc1739a0ecbc33f89b79","public":"full","lines":2,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/BASES.tsv","text":"golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5\tbases/golang_1.27.3-bookworm_972b4110ba0f.oci\nubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\tbases/ubuntu_24.04_24737cef17f4.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":187224,"sha256":"6cf46d691182671e58435f22bbf0a9e7885f2702cc1e9218e5fd1909f0cda648","public":"account","lines":1368},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":3719,"sha256":"868fc005c43637d3f86839a1be24468c70922e1f61c66fc9b9bfbad7a94ee353","public":"account","lines":38},{"path":"Dockerfile.offline","size":3719,"sha256":"868fc005c43637d3f86839a1be24468c70922e1f61c66fc9b9bfbad7a94ee353","public":"account","lines":38},{"path":"Dockerfile.offline.pinned","size":3719,"sha256":"868fc005c43637d3f86839a1be24468c70922e1f61c66fc9b9bfbad7a94ee353","public":"preview","lines":38,"preview":{"text":"# GENERATED L-009 hermetic build (--network=none, SBOM+SLSA-attestation-producing).\n# Pinned bases from BASE_IMAGE_DIGESTS.lock; vendored Go tree + debs from Dockerfile.vendor.\nFROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS build_wireguard-go\nWORKDIR /src\nCOPY vendored/wireguard-src/ .\nENV CGO_ENABLED=0 GOTOOLCHAIN=local GOWORK=off GOFLAGS=\"-mod=vendor -buildvcs=false\" GOPROXY=off SOURCE_DATE_EPOCH=1747871102\nRUN go build -trimpath -ldflags='' -o /wireguard-go . && /wireguard-go --version > /tmp/wireguard-go.version 2>&1; cat /tmp/wireguard-go.version; grep -qF 'wireguard-go v0.0.20250522' /tmp/wireguard-go.version || { echo 'wireguard-go --version does not report wireguard-go v0.0.20250522'; exit 1; }\nFROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\nENV DEBIAN_FRONTEND=noninteractive\nRUN --mount=type=bind,source=vendored/debs,target=/tmp/debs \\\n    set --; for f in /tmp/debs/*.deb; do [ -e \"$f\" ] && set -- \"$@\" \"$f\"; done; \\\n    for pass in 1 2 3 4 5; do [ $# -eq 0 ] || dpkg -i --skip-same-version \"$@\" >/dev/null 2>&1 && break; done; \\\n    dpkg --configure -a && bad= && for d in \"$@\"; do p=$(dpkg-deb -f \"$d\" Package) v=$(dpkg-deb -f \"$d\" Version); \\\n      case \"$(dpkg-query -W -f='${Version} ${db:Status-Abbrev}' \"$p\" 2>/dev/null)\" in \"$v ii\"*) ;; *) bad=\"$bad $p=$v\" ;; esac; done && \\\n    { [ -z \"$bad\" ] || { echo \"vendored debs not installed at their vendored version:$bad\" >&2; false; }; } && \\\n    rm -rf /var/lib/apt/lists/* \\\n           /var/log/dpkg.log /var/log/alternatives.log /var/log/apt /var/cache/ldconfig/aux-cache /var/cache/fontconfig\nARG SOURCE_DATE_EPOCH=1747871102\nRUN groupadd -r wireguard && useradd -r -g wireguard -d /var/lib/wireguard -m wireguard && \\\n    mkdir -p /config /var/run/wireguard && chown -R wireguard:wireguard /config /var/run/wireguard && \\\n    : \"${SOURCE_DATE_EPOCH:?SOURCE_DATE_EPOCH must be set for a reproducible build}\" && \\\n    sed -ri \"s/^([^:]*:[^:]*):[0-9]*:/\\1:$((SOURCE_DATE_EPOCH/86400)):/\" /etc/shadow && \\\n    rm -f /etc/passwd- /etc/shadow- /etc/group- /etc/gshadow-\nCOPY --from=build_wireguard-go /wireguard-go /usr/local/bin/wireguard-go","lines_shown":24,"lines_total":38}},{"path":"Dockerfile.vendor","size":1700,"sha256":"6e2964f05325b5e5de497230fe245e1be08e6d01b0e75b0af6cd763d50fea4e8","public":"account","lines":20},{"path":"MANIFEST.txt","size":94230,"sha256":"7076729d8ef0c180a33cb1f9048db63e7b5acc0a9ce77470ef290041a7093005","public":"account","lines":1370},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"2c02a29ebd33afec20e947fdf72adf66c7c69c053c82a3baab289ea7718ee642","public":"full","lines":1,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/SOURCE_DATE_EPOCH.txt","text":"1747871102\n"},{"path":"TARGET_DIGEST.txt","size":378,"sha256":"35abfef42c61941dc276f067b6d4cec9722dadec764c18ef034d947c61fbd7f0","public":"full","lines":9,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9\nconfig_digest=sha256:bb21104411c1e0a49d8445a247eb800aa5688f09693b021a592f159b61a99191\ntag=readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1\nprobe_port=51820\nprobe_path=/\nprobe_timeout=180\nprobe_exec=wg show interfaces | grep -q .\nverify_cap_add=NET_ADMIN\nverify_device=/dev/net/tun\n"},{"path":"VERIFY_OFFLINE.sh","size":10153,"sha256":"3e8184ea230cfd8f41f977e26be6bf7bd03112c396c517837ce0c7de4f7399dd","public":"account","lines":165},{"path":"docs/PROVENANCE.md","size":1725,"sha256":"a8edf1c47c5242f7765b2f1cc96f226bbd158d6f4b6bea4260ab5e19ff7aa4b7","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5155,"sha256":"76f62657ed71f455f356e1880f9605703045cb107b79c81a0c426f54ea093b32","public":"account","lines":57},{"path":"docs/VERIFY.md","size":2000,"sha256":"7c98ff6da9f0f1bf2b54780d1a8bf4b8212d065593951ee66db126b2e0920057","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":74,"sha256":"2438669402e1ac282ac2427e010e5a2ba4d48ea6a23792cf7b061ba9be131e7f","public":"full","lines":2,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for wireguard (resolve at build_kit)\ngolang:1.27.3-bookworm\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":1350,"sha256":"7c3b6009d7f5fb6f693d16522079805e2ff1e0a3f953d32f83d4feae2125da59","public":"account","lines":43},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":655,"sha256":"52ad8f24cb032344f7bd6508cb7c5ad3a1796cd1f028f9d7c04b4159080c1e27","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":3087,"sha256":"c4bbf20b868e4c4eefe603bfcecbf7648c03b8a8d9ac48c0964d9e9db4552583","public":"account","lines":114},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":312,"sha256":"24e629f34e562624ba093045c836c785a9577e97828b3511b2d3f161fd6d53ae","public":"full","lines":9,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"wireguard\",\n  \"repo\": \"https://git.zx2c4.com/wireguard-go\",\n  \"ref\": \"0.0.20250522\",\n  \"commit\": \"f333402bd9cbe0f3eeb02507bd14e23d7d639280\",\n  \"tree_listing_sha256\": \"2e29cb47cf21a63d63f493a69e65e0a53adc975d58337280681e571fb728dcd3\",\n  \"file_count\": 107\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":73,"sha256":"841a12bde79b947a52dafc358fee9bff0e7dd320c29bbee348bac3b3fddf9004","public":"account","lines":6},{"path":"docs/provenance/TOOLCHAIN.lock","size":2242,"sha256":"40ca03401c2dc1d378a956636896cbb00f195ad2045a84ee33d2774c1e56e712","public":"account","lines":80},{"path":"netadmin","size":802,"sha256":"9da086672eb73eabcc4b049f9914516ec54a75627a855781f27770b8e67dcc60","public":"account","lines":11},{"path":"rebuild.json","size":1461,"sha256":"32f9b74a02a157af29ea7f95e3fb3a4fbc471be56c325a624e050df5bda692f1","public":"account","lines":38},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/wireguard/0.0.20250522-CE-ubuntu24.04-r1/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"},{"path":"wireguard-entrypoint.sh","size":4151,"sha256":"a1323616932373611dd98f99a611008c992832b3c9fe7c97f5db5cd14a3cc4f3","public":"account","lines":67}],"skipped":[],"kit_adds":{"bases":{"files":16,"bytes":330381419},"docs":{"files":161,"bytes":3398942},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":1166,"bytes":15652733}},"links":{"page":"https://readystack.dev/products/wireguard/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fwireguard%2Frecipe","kit":"https://readystack.dev/buy.html?product=wireguard"}}