Gitea v28.2.0 build recipe

github.com/go-gitea/gitea (v28.2.0) at 829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/git-lfs/git-lfs.git v3.8.0
• git https://github.com/go-gitea/gitea.git v28.2.0
• https://deb.nodesource.com/setup_22.x

• Base imagegolang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-go
• SOURCE_DATE_EPOCH1792345836 (2026-10-18T17:50:36Z)
• Target digest (linux/amd64)sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45
• Target config digestsha256:ddc94b1b535e15fcb0291012ed0023fc532984bc4c7c00d71abd7c4dcb930361
• Checksummed kit files24,330 (CHECKSUMS.sha256)

# =====================================================================
# L-009 HERMETIC OFFLINE BUILD (gitea) — the canonical, attestation-
# producing build, run by build_kit's L-009 buildx:
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>
#
# Pinned-public-base + vendored model (self-contained; no FROM gitea-base:offline):
#   - golang + ubuntu pinned BY DIGEST (same digests as caddy/traefik — warm in the
#     builder cache; RUN steps are --network=none hermetic)
#   - vendored/git-lfs-src + vendored/gitea-src : fully-vendored Go trees + the prebuilt
#     gitea frontend (materialized by `make build` in the vendor stage), GOPROXY=off
#   - vendored/debs : apt CVE-upgrade closure + gitea runtime pkgs, dpkg offline
# Two binaries: git-lfs (CGO off) + gitea (CGO on for sqlite, tags bindata+sqlite).
# =====================================================================
FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS lfs
WORKDIR /lfs
COPY vendored/git-lfs-src/ .
ENV CGO_ENABLED=0 GOTOOLCHAIN=local GOFLAGS="-buildvcs=false -mod=vendor" GOPROXY=off
RUN go build -trimpath -ldflags="-s -w -X github.com/git-lfs/git-lfs/v3/config.Version=3.8.0" -o /git-lfs . && /git-lfs version

FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 AS gitea
WORKDIR /src
COPY vendored/gitea-src/ .
ENV CGO_ENABLED=1 GOTOOLCHAIN=local GOFLAGS="-mod=vendor" GOPROXY=off

Continues: 32 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.