Keycloak 26.8.1 build recipe

github.com/keycloak/keycloak (26.8.1) at 24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b

Fetched once, with the network on, by the vendor step (Dockerfile.vendor) when the kit was made; the offline build uses the kit's vendored copies:

• git https://github.com/keycloak/keycloak 26.8.1

• Base imageeclipse-temurin:21-jre-noble@sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c
• Base imagemaven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodsource-rebuild-java
• SOURCE_DATE_EPOCH1791878921 (2026-10-13T08:08:41Z)
• Target digest (linux/amd64)sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1
• Target config digestsha256:74b446fde42e3334aad7386e06473733c70b10dbfe14728b4d4e9741f370e7c2
• Checksummed kit files119,473 (CHECKSUMS.sha256)

# GENERATED L-009 hermetic Java build (--network=none, SBOM+SLSA-attestation-producing).
# Pinned bases; vendored source + maven cache(s) + toolchain/runtime debs from Dockerfile.vendor.
FROM maven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d AS jbuild
# dpkg-install the vendored build toolchain (git/unzip) — no apt, fully offline.
COPY vendored/build-debs/ /tmp/bdebs/
RUN dpkg -i /tmp/bdebs/*.deb 2>/dev/null || true; \
    dpkg -i /tmp/bdebs/*.deb 2>/dev/null || true; \
    dpkg --configure -a; rm -rf /tmp/bdebs
WORKDIR /src
COPY vendored/keycloak-src/ .
COPY vendored/caches/m2/ /m2/
COPY vendored/caches/pnpm-store/ /pnpm-store/
COPY vendored/caches/pnpm-cache/ /pnpm-cache/
ENV MAVEN_OPTS="-Xmx3g"
ENV npm_config_store_dir="/pnpm-store"
ENV npm_config_cache="/pnpm-cache"
ENV MAVEN_ARGS="-Dproject.build.outputTimestamp=2026-10-13T08:08:41Z"
RUN cd /src && KC_BUILD_TIME="$(printf '%s\n' $MAVEN_ARGS | sed -n 's/^-Dproject\.build\.outputTimestamp=\([0-9]\{4\}-[0-9][0-9]-[0-9][0-9]\)T\([0-9][0-9]:[0-9][0-9]\):[0-9][0-9]Z$/\1 \2/p')" && test -n "$KC_BUILD_TIME" && echo "keycloak-version.properties build-time=$KC_BUILD_TIME" && npm_config_store_dir=/pnpm-store npm_config_cache=/pnpm-cache MAVEN_OPTS=-Xmx3g mvn "-Dtimestamp=$KC_BUILD_TIME" -o -B -pl quarkus/deployment,quarkus/dist -am -DskipTests -DskipProtoLock=true -Dmaven.build.cache.enabled=false -Dmaven.repo.local=/m2 clean install
RUN tar -xzf quarkus/dist/target/keycloak-*.tar.gz -C /opt --strip-components=0 && mv /opt/keycloak-* /opt/keycloak && mkdir -p /opt/keycloak/data
RUN mkdir -p /tmp/rs-canon && printf '%s\n' 'import java.io.*;' 'import java.nio.file.*;' '' '// Re-serializes the Quarkus lib/deployment/appmodel.dat with every String interned, so a value that occurs twice is' '// always written as one TC_STRING plus back-references. ObjectOutputStream otherwise shares a String only when the' '// in-memory model happened to hold the same instance, which varies from build to build.' 'public class AppModelCanon {' '    public static void main(String[] args) throws Exception {' '        Path in = Path.of(args[0]), out = Path.of(args.length > 1 ? args[1] : args[0]);' '        byte[] original = Files.readAllBytes(in);' '        Object model;' '        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(original))) {' '            model = ois.readObject();' '            if (ois.read() != -1) throw new IllegalStateException("trailing data after the model in " + in);' '        }' '        ByteArrayOutputStream bytes = new ByteArrayOutputStream();' '        try (ObjectOutputStream oos = new ObjectOutputStream(bytes) {' '            { enableReplaceObject(true); }' '            @Override protected Object replaceObject(Object o) { return o instanceof String s ? s.intern() : o; }' '        }) {' '            oos.writeObject(model);' '        }' '        Files.write(out, bytes.toByteArray());' '        System.out.println("canonicalized " + in + " -> " + out + " (" + original.length + " -> " + bytes.size() + " bytes)");' '    }' '}' > /tmp/rs-canon/AppModelCanon.java && java -cp '/opt/keycloak/lib/lib/deployment/*:/opt/keycloak/lib/lib/boot/*:/opt/keycloak/lib/lib/main/*' /tmp/rs-canon/AppModelCanon.java /opt/keycloak/lib/lib/deployment/appmodel.dat && rm -rf /tmp/rs-canon
FROM eclipse-temurin:21-jre-noble@sha256:35501d3f93173b420ac9001658eb68157e813316b865087e345c187fca422c4c
ENV DEBIAN_FRONTEND=noninteractive LANG=en_US.UTF-8 KC_RUN_IN_CONTAINER=true KC_DB=postgres KC_HEALTH_ENABLED=true KC_METRICS_ENABLED=true KC_HTTP_ENABLED=true
COPY vendored/debs/ /tmp/debs/
RUN dpkg -i /tmp/debs/*.deb 2>/dev/null || true; \

Continues: 25 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.