OpenSearch 3.9.0 build recipe

github.com/opensearch-project/OpenSearch (3.9.0) at 4ee42a94e87f66fbf1e62a9871b1b87f91e02472

• Base imageubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
• BuildKitmoby/buildkit:v0.31.2
  sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0
• Build methodkit-prebuilt-tarball
• SOURCE_DATE_EPOCH1790105837 (2026-09-22T19:37:17Z)
• Target digest (linux/amd64)sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b
• Target config digestsha256:81887ba4288417edf42d9bcef3d060654399b4180bb273edc31c1a9a30ce6742
• Checksummed kit files19,357 (CHECKSUMS.sha256)

# =====================================================================
# L-009 HERMETIC OFFLINE BUILD (opensearch, repackage of the official
# Apache-2.0 tarball). Run by build_kit's L-009 buildx:
#   docker buildx build --builder readystack-builder-max --network=none
#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>
#
# Pinned-public-base + fully-vendored model (no network at build):
#   - ubuntu pinned BY DIGEST (cache-warm; RUN steps --network=none hermetic)
#   - vendored/debs               : apt CVE dist-upgrade closure + system
#                                   OpenJDK 21 + runtime pkgs, dpkg offline
#   - vendored/opensearch-src/... : the ALREADY-PATCHED OpenSearch tree
#                                   (patch-tree.sh: bundled JDK dropped, unused
#                                   security plugins removed, vulnerable jars
#                                   raised to version floors)
# The proven 0-fixable recipe is docs/OPENSEARCH_BUILDOUT.md.
# =====================================================================
FROM ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c
ARG SOURCE_DATE_EPOCH=1790105837
ENV DEBIAN_FRONTEND=noninteractive TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8

# Offline apt: dpkg-install the vendored closure (CVE dist-upgrade + OpenJDK 21
# + curl/tzdata). Two passes + configure-a resolve inter-deb ordering, no network.
# The passes hide dpkg's errors, so every vendored deb is then checked installed at
# its vendored version: one that did not land would ship the base's older package.

Continues: 64 more lines. Create a free account to read the rest, or sign in.

#!/usr/bin/env bash
# =============================================================================
# ReadyStack — offline reproducible rebuild.
#
# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access
# of any kind, and prints the resulting linux/amd64 image-manifest digest.
# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.
#
# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.
# No git, no registry access, no additional tooling.
#
#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)
#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI
#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,
#                                     isolated build platform and sign that provenance with a key the build cannot
#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image
#                                     digest is the same either way.
# =============================================================================
set -euo pipefail
PROVENANCE=0
for arg in "$@"; do
  case "$arg" in
    --provenance) PROVENANCE=1 ;;
    -h|--help) sed -n '2,20p' "$0"; exit 0 ;;

Continues: 101 more lines. Create a free account to read the rest, or sign in.