{"slug":"zitadel","tag":"v4.20.0-CE-ubuntu24.04-r1","current":true,"account":false,"tarball":"ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz","tarball_sha256":"f47b1bc331276f3763e32da1fdf22e29a390b794904cedc9d0454fc06d5a885f","generated_at":"2026-10-29T20:02:25Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/zitadel/zitadel","ref":"v4.20.0","commit":"8afa5dd37a8e723efb9eace8d09fd5c1cccef694","url":"https://github.com/zitadel/zitadel/tree/8afa5dd37a8e723efb9eace8d09fd5c1cccef694"},"fetches":[{"kind":"git","url":"https://github.com/zitadel/zitadel","ref":"v4.20.0"},{"kind":"http","url":"https://deb.nodesource.com/setup_22.x"}],"bases":[{"image":"golang:1.26.10-bookworm","digest":"sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"},{"image":"ubuntu:24.04","digest":"sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"]},"build_method":"source-rebuild-go","source_date_epoch":1792652744,"source_date_epoch_utc":"2026-10-22T07:05:44Z","target":{"image":"readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1","image_manifest_digest":"sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8","config_digest":"sha256:18f0de6c891bc1b1fcf23ecf1dbffa078166bee7142213f3c4e72b7f665fcf13"},"checksummed_files":37464},"files":[{"path":"BASES.tsv","size":264,"sha256":"8d72027e2bc448d0c7ff3a900bfe648f1e4c9ec92a2beaa3f623ccffc48641b5","public":"full","lines":2,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/BASES.tsv","text":"golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af\tbases/golang_1.26.10-bookworm_632dff735179.oci\nubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\tbases/ubuntu_24.04_24737cef17f4.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":5742047,"sha256":"5bf2ca0d5691d47475ec3087fa0081302e9210a118dbb9fb99b638509ea43938","public":"account","lines":37464},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":3497,"sha256":"0defbc8e82c3a9ef342d121b4455503bc38b27f87b1975be1bacc56da654f1a9","public":"account","lines":37},{"path":"Dockerfile.offline","size":3497,"sha256":"0defbc8e82c3a9ef342d121b4455503bc38b27f87b1975be1bacc56da654f1a9","public":"account","lines":37},{"path":"Dockerfile.offline.pinned","size":3497,"sha256":"0defbc8e82c3a9ef342d121b4455503bc38b27f87b1975be1bacc56da654f1a9","public":"preview","lines":37,"preview":{"text":"# GENERATED L-009 hermetic build (--network=none, SBOM+SLSA-attestation-producing).\n# Pinned bases from BASE_IMAGE_DIGESTS.lock; vendored Go tree + debs from Dockerfile.vendor.\nFROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS build_zitadel\nWORKDIR /src\nCOPY vendored/zitadel-src/ .\nENV CGO_ENABLED=0 GOTOOLCHAIN=local GOWORK=off GOFLAGS=\"-mod=vendor -buildvcs=false\" GOPROXY=off SOURCE_DATE_EPOCH=1792652744\nRUN go build -trimpath -ldflags='-s -w -X github.com/zitadel/zitadel/cmd/build.version=v4.20.0' -o /zitadel . && /zitadel --version\nFROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\nENV DEBIAN_FRONTEND=noninteractive ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED=false\nRUN --mount=type=bind,source=vendored/debs,target=/tmp/debs \\\n    set --; for f in /tmp/debs/*.deb; do [ -e \"$f\" ] && set -- \"$@\" \"$f\"; done; \\\n    for pass in 1 2 3 4 5; do [ $# -eq 0 ] || dpkg -i --skip-same-version \"$@\" >/dev/null 2>&1 && break; done; \\\n    dpkg --configure -a && bad= && for d in \"$@\"; do p=$(dpkg-deb -f \"$d\" Package) v=$(dpkg-deb -f \"$d\" Version); \\\n      case \"$(dpkg-query -W -f='${Version} ${db:Status-Abbrev}' \"$p\" 2>/dev/null)\" in \"$v ii\"*) ;; *) bad=\"$bad $p=$v\" ;; esac; done && \\\n    { [ -z \"$bad\" ] || { echo \"vendored debs not installed at their vendored version:$bad\" >&2; false; }; } && \\\n    rm -rf /var/lib/apt/lists/* \\\n           /var/log/dpkg.log /var/log/alternatives.log /var/log/apt /var/cache/ldconfig/aux-cache /var/cache/fontconfig\nARG SOURCE_DATE_EPOCH=1792652744\nRUN groupadd -r zitadel && useradd -r -g zitadel -d /home/zitadel -m zitadel && \\\n    mkdir -p /home/zitadel && chown -R zitadel:zitadel /home/zitadel && \\\n    : \"${SOURCE_DATE_EPOCH:?SOURCE_DATE_EPOCH must be set for a reproducible build}\" && \\\n    sed -ri \"s/^([^:]*:[^:]*):[0-9]*:/\\1:$((SOURCE_DATE_EPOCH/86400)):/\" /etc/shadow && \\\n    rm -f /etc/passwd- /etc/shadow- /etc/group- /etc/gshadow-\nCOPY --from=build_zitadel /zitadel /usr/local/bin/zitadel","lines_shown":24,"lines_total":37}},{"path":"Dockerfile.vendor","size":4693,"sha256":"b8868a8ef4a15c875c8896d78e3ed56cae3e312dd7c3f24c629eed22abce77ba","public":"account","lines":50},{"path":"MANIFEST.txt","size":3194525,"sha256":"3dd5f65bb8f5050601f0fd84cb734896f8463a06296469b550285d0248933279","public":"account","lines":37466},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"5ade3913cf2c9de9f9c1d9408b7bb007493d54d018348152bd9ab4dd91bd3c45","public":"full","lines":1,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/SOURCE_DATE_EPOCH.txt","text":"1792652744\n"},{"path":"TARGET_DIGEST.txt","size":436,"sha256":"2bbaffb602e0a55a321dd147d1ce5da399aa46ae1eefec0118fecd3d40d53881","public":"full","lines":8,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8\nconfig_digest=sha256:18f0de6c891bc1b1fcf23ecf1dbffa078166bee7142213f3c4e72b7f665fcf13\ntag=readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1\nprobe_port=8080\nprobe_path=/debug/healthz\nprobe_timeout=180\nverify_boot=skip\nverify_boot_reason=this image needs pg (not part of this archive); boot it with your own services as the admin handbook describes\n"},{"path":"VERIFY_OFFLINE.sh","size":10153,"sha256":"3e8184ea230cfd8f41f977e26be6bf7bd03112c396c517837ce0c7de4f7399dd","public":"account","lines":165},{"path":"docs/PROVENANCE.md","size":1700,"sha256":"27bc796c41b76537b0310b08c794a8afcdebda7e5ceb3c1879cc8bd1c197a594","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5131,"sha256":"91eaa6781294d1cbeba81ee5c9a73eef0b05bf52070ee9f2b3edaad8b7726c7a","public":"account","lines":59},{"path":"docs/VERIFY.md","size":1963,"sha256":"03b0f8fd09231b6a24220df9361e83ce0e869f68d3032bac8bbdcd3f111722aa","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":73,"sha256":"ed03d51691009b5319fdd5e77a2b1760015a11c68bc823f23ac6a450911cbae2","public":"full","lines":2,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for zitadel (resolve at build_kit)\ngolang:1.26.10-bookworm\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":7801,"sha256":"e081943f8ac439672777e45efb6ca014d65c49f9166b8598f9b9cddd298b718e","public":"account","lines":71,"redactions":[{"line":63,"kind":"internal host"}],"kit_sha256":"d2df626ce1ddc3c5714fccbfae1ca7d6729a6dab84ffc350935fbf0ed85ebf7d"},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":648,"sha256":"5a63215ac94d690ce7cc67b8080706210f64f8f941aadb20a0883f0bff917371","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":326565,"sha256":"05eb10b250021b269f88ebe7271983899bbad2dfc93bf08dcd0ad9d3976f0414","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":306,"sha256":"ee8b7004158022694403f263a435fd1bb8cf3544b63f9f33811e70e91ee5a343","public":"full","lines":9,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"zitadel\",\n  \"repo\": \"https://github.com/zitadel/zitadel\",\n  \"ref\": \"v4.20.0\",\n  \"commit\": \"8afa5dd37a8e723efb9eace8d09fd5c1cccef694\",\n  \"tree_listing_sha256\": \"cd883d5d3de2c513ae9c97140769940baca0ebd6d469f78e3b378ec04acd7e44\",\n  \"file_count\": 9603\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":28,"sha256":"fa091140511e85f86057bf9f05d5bd9e073f13c04af3de77559c304bd4b38227","public":"account","lines":3},{"path":"docs/provenance/TOOLCHAIN.lock","size":6723,"sha256":"ca5384336ac15e60987a80dffc0007b7ddf9c43e39a638f7d53c8fcf458a853a","public":"account","lines":132},{"path":"readystack-entrypoint.sh","size":819,"sha256":"9da024fbbeaa3611f9f12af589fb7631576aebf0be2022022c3edd8e116e6bbf","public":"account","lines":14},{"path":"rebuild.json","size":1495,"sha256":"35ca34a09f4bc11be59ac0b3872133ee57ef5585ecf1d0c92a60c361fdde8d6c","public":"account","lines":36},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/zitadel/v4.20.0-CE-ubuntu24.04-r1/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":16,"bytes":326583068},"docs":{"files":9658,"bytes":265045746},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":27766,"bytes":908772329}},"links":{"page":"https://readystack.dev/products/zitadel/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fzitadel%2Frecipe","kit":"https://readystack.dev/buy.html?product=zitadel"}}