flannel v0.28.10 build recipe

github.com/flannel-io/flannel (v0.28.10) at 0f70536f15f281279dab39fb9d575c646c7eea34

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/flannel-io/flannel v0.28.10
• https://github.com/kubernetes-sigs/iptables-wrappers

• Base imagegolang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af
• Base imageubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1791471824 (2026-10-08T15:03:44Z)
• Target digest (linux/amd64)sha256:6d3fb1140502d71df92ae2b107532acaf809aa42a94e2e6b9eec291fab4b8856
• Target config digestsha256:5b82632df69bb60c07454007291520843b134dffd8918b0d53167852a6a99d3b
• Checksummed kit files7,208 (CHECKSUMS.sha256)

# =====================================================================
# L-009 HERMETIC OFFLINE BUILD (flannel v0.28.10) — the canonical,
# attestation-producing build (build_kit: buildx --network=none --attest ...).
# Follows upstream's images/Dockerfile at the pinned commit:
#   /opt/bin/flanneld        make dist/flanneld: CGO_ENABLED=1 on amd64 (the UDP
#                            backend's C proxy), -X pkg/version.Version=<tag>
#   /opt/bin/install-conf    CGO_ENABLED=0 go build ./cmd/install_conf/
#   /opt/bin/mk-docker-opts.sh  dist/mk-docker-opts.sh
#   /usr/sbin/iptables-wrapper  kubernetes-sigs/iptables-wrappers `make build`,
#                            then `iptables-wrapper install` (iptables legacy or
#                            nft picked at first use, matching the host)
#   ENTRYPOINT ["/opt/bin/flanneld"]
# Runtime userland from Ubuntu 24.04 packages in place of upstream's Alpine ones.
# flanneld links glibc dynamically (upstream links musl statically): it runs
# only inside this image, whose glibc it is built against.
# Default user is the unprivileged flannel (owner 2026-10-28); kube-flannel's
# pod gives root (runAsUser: 0, NET_ADMIN, NET_RAW), product-kits/kubevirt-stack/
# install/network/kube-flannel.yml.
# =====================================================================
FROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS build_flanneld
WORKDIR /src
COPY vendored/flannel-src/ .
ENV CGO_ENABLED=1 GOTOOLCHAIN=local GOWORK=off GOFLAGS="-mod=vendor -buildvcs=false" GOPROXY=off SOURCE_DATE_EPOCH=1791471824
RUN go build -trimpath -ldflags='-s -w -X github.com/flannel-io/flannel/pkg/version.Version=v0.28.10' -o /flanneld . && \

Continues: 67 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.