DocuSeal 3.3.3 build recipe

github.com/docusealco/docuseal (3.3.3) at 8f8f69f0bc6ac2e59746cd6efac54a852289bec3

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/docusealco/docuseal 3.3.3
• https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf
• https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Bold.ttf
• https://github.com/impallari/DancingScript/raw/master/fonts/DancingScript-Regular.otf
• https://raw.githubusercontent.com/impallari/DancingScript/master/OFL.txt
• https://raw.githubusercontent.com/notofonts/noto-fonts/refs/heads/main/LICENSE
• https://github.com/docusealco/fields-detection/releases/download/2.0.0/model_704_int8.onnx
• https://dl-cdn.alpinelinux.org/alpine/edge/main

• Base imageruby:4.0.5-alpine@sha256:f48938e9ae72a4d32e728b03c306e7a7ff21f0cb6c2ed33f44a078c700b2aea6
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-ruby
• SOURCE_DATE_EPOCH1792411032 (2026-10-19T11:57:12Z)
• Target digest (linux/amd64)sha256:170e4c988261fc9c066f02094fb0060885450920ba28aa8f78ad7cd81d257c5a
• Target config digestsha256:11344a9835a7ab69a554ed81eb51ff0d661fc1c97b6520b56369fd232fa1b880
• Checksummed kit files1,230 (CHECKSUMS.sha256)

# =====================================================================
# L-009 HERMETIC OFFLINE BUILD (DocuSeal 3.3.3, AGPL-3.0). Run by build_kit's
# L-009 buildx:  docker buildx build --network=none --attest ... --push <ctx>
#
# Pinned-public-base + fully-vendored (no network at build). ALPINE build: instead
# of an offline apk repo (which hits a local-repo version quirk), we overlay the
# RUNTIME SYSTEM DIRS captured online from the vendor build stage onto the identical
# pinned base — version-consistent by construction, no apk at build.
#   - ruby:4.0.5-alpine pinned BY DIGEST (musl base; REQUIRED — DocuSeal's patched
#     PDFium exists only for musl; onnxruntime + leptonica are apk packages)
#   - runtime-rootfs.tar.gz : /usr /lib /etc /var /sbin /bin from the online build,
#     AFTER `apk upgrade` (Alpine's security fixes) + the runtime libs (libpq/vips/
#     redis/onnxruntime/leptonica/jemalloc/fonts/fontconfig) + libpdfium + the docuseal user +
#     openssl_legacy.cnf + apk db — NO /usr/local
#   - bundle/rubygems/app/fonts.tar.gz : the ALREADY-BUILT gems (native-compiled),
#     the PURGED default gems (json 2.18.0 / net-imap 0.6.2 removed), the app
#     (Vue/Tailwind packs, bootsnap cache, onnx model), and the font files.
# Dockerfile and Dockerfile.offline are copies of Dockerfile.offline.pinned.
# =====================================================================
FROM ruby:4.0.5-alpine@sha256:f48938e9ae72a4d32e728b03c306e7a7ff21f0cb6c2ed33f44a078c700b2aea6
ARG SOURCE_DATE_EPOCH=1792411032
ENV RAILS_ENV=production \
    BUNDLE_WITHOUT="development:test" \
    OPENSSL_CONF=/etc/openssl_legacy.cnf \

Continues: 50 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.