Caddy v2.11.7 build recipe

github.com/caddyserver/caddy (v2.11.7) at 72dd0fb067f6d7826c7f79907670ba4a713bfe37

• Base imagegolang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c
• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1791003978 (2026-10-03T05:06:18Z)
• Target digest (linux/amd64)sha256:23e269346861a0eb7932c84a1abf48a96b06c4b929518ad66a835b1efc7ae044
• Target config digestsha256:c190cd45ed75d2b1acc48707dc79cd016bd8fb3c1c96dfb6d52e114018350f51
• Checksummed kit files6,578 (CHECKSUMS.sha256)

# =====================================================================
# L-009 HERMETIC OFFLINE BUILD (canonical, attestation-producing).
# Built by `docker buildx build --builder readystack-builder-max
#   --network=none --attest type=provenance,mode=max --attest type=sbom
#   --push <git-context>` — the command that CREATES the DockerHub image
# WITH SBOM + SLSA-max provenance attestations (Scout 20-pt policy).
#
# Pinned-public-base + vendored-.deb model: the container builder cannot
# see host-built images, so everything is vendored —
#   - golang + ubuntu pinned BY DIGEST (buildkit pulls; RUN steps are
#     --network=none hermetic)
#   - vendored/caddy-src : fully-vendored Go module tree (GOPROXY=off)
#   - vendored/debs      : apt CVE-upgrade closure + runtime packages,
#                          installed offline via dpkg (no apt network)
# =====================================================================
FROM golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c AS build
WORKDIR /src
COPY vendored/caddy-src/ .
ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOFLAGS="-mod=vendor -buildvcs=false" GOPROXY=off
RUN go build -trimpath -ldflags='-s -w' -o /caddy .
RUN /caddy version | tee /tmp/caddy.version && grep -Eq '^v2\.11\.7( |$)' /tmp/caddy.version || \
    { echo "built caddy does not report v2.11.7" >&2; exit 1; }

FROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c

Continues: 41 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.