Ghost v6.72.0 build recipe

github.com/TryGhost/Ghost (v6.72.0) at 412dff5a21cc8ffbfec0b15554eebcb53194ad15

• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-node
• SOURCE_DATE_EPOCH1792508615 (2026-10-20T15:03:35Z)
• Target digest (linux/amd64)sha256:2c1ec7dc13a59ae85e2a08b8da999913600d9298d521da6bff5826cc78882640
• Target config digestsha256:e52a3b75328dbe229817fe3278b320edd653f04ce1ea65b97145d8db41749436
• Checksummed kit files9,157 (CHECKSUMS.sha256)

# =====================================================================
# Ghost 6.72.0 (MIT) HERMETIC OFFLINE BUILD. --network=none.
# Reassembles the vendored built filesystem onto the PINNED ubuntu:24.04 base — the same digest
# Dockerfile.vendor built the runtime on. Node (the nodejs.org 22.23.3 build, sha256-pinned in
# Dockerfile.vendor) arrives inside the vendored system.tar.gz, without npm/npx/corepack.
# =====================================================================
FROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
ARG SOURCE_DATE_EPOCH=1784302522
ENV NODE_ENV=production \
    GHOST_CONTENT=/var/lib/ghost/content \
    paths__contentPath=/var/lib/ghost/content \
    server__host=:: \
    logging__transports='["file","stdout"]'
ADD vendored/ghost-src/system.tar.gz /
ADD vendored/ghost-src/ghost.tar.gz /
# system.tar.gz carries /etc/passwd with `node` at uid 1000 in place of the base's `ubuntu`
# user (see Dockerfile.vendor); /home is not in the tarball, so give node its home here and drop
# the now-ownerless /home/ubuntu.
RUN chown -R node:node /var/lib/ghost && chmod 755 /usr/local/bin/entrypoint.sh && \
    rm -rf /home/ubuntu && mkdir -p /home/node && chown node:node /home/node && chmod 750 /home/node
WORKDIR /var/lib/ghost/current
EXPOSE 2368
# npm/npx/corepack: Dockerfile.vendor never puts them in the runtime (on the old node:* base they
# carried ghost's last fixable CVEs, inside npm's own bundled dependencies). The rm stays as a guard

Continues: 29 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.