[VS-NfD] Make the build reproducible without network access #219

New Issue

fable-5 · 2026-07-30T01:43:50+02:00

fable-5 commented

2026-07-30 01:43:50 +02:00

Plan reference: 20-massnahmenplan.md -> P1-3
ADR: ADR 0024
Effort: M (2–3 AT)
Depends on: #203

Context

"Builds fine offline" is a claim; a documented offline build is evidence.
The plan explicitly allows the cheaper answer — prebuilt images only — as
long as it is a stated decision.

Current state

pnpm workspace with a committed lockfile; CI installs with
pnpm install --frozen-lockfile (.gitea/workflows/ci.yml).
Images are built in CI with network access; there is no offline store or
vendored dependency set.
Note for whoever implements: a new workspace dependency also requires
touching the api Dockerfile (COPY packages/<x> + build).

Acceptance criteria

Either a pnpm offline store / vendored dependency set makes
pnpm install and pnpm build succeed with networking disabled,
or the decision "prebuilt images only, no customer-side build" is
documented with its consequences (no local patching).
Whichever path: reproduced twice from a clean checkout with identical
results, and the procedure written down.
Toolchain versions (node, pnpm, base images) are pinned and stated.
Documented in #229; the decision recorded in ADR 0024.

Out of scope

Bit-for-bit reproducible builds as a formal property, and mirroring
(#218).

**Plan reference:** `20-massnahmenplan.md` -> P1-3 **ADR:** ADR 0024 **Effort:** M (2–3 AT) **Depends on:** #203 ## Context "Builds fine offline" is a claim; a documented offline build is evidence. The plan explicitly allows the cheaper answer — prebuilt images only — as long as it is a stated decision. ## Current state - pnpm workspace with a committed lockfile; CI installs with `pnpm install --frozen-lockfile` (`.gitea/workflows/ci.yml`). - Images are built in CI with network access; there is no offline store or vendored dependency set. - Note for whoever implements: a new workspace dependency also requires touching the api Dockerfile (`COPY packages/<x>` + build). ## Acceptance criteria - [ ] Either a pnpm offline store / vendored dependency set makes `pnpm install` and `pnpm build` succeed with networking disabled, **or** the decision "prebuilt images only, no customer-side build" is documented with its consequences (no local patching). - [ ] Whichever path: reproduced twice from a clean checkout with identical results, and the procedure written down. - [ ] Toolchain versions (node, pnpm, base images) are pinned and stated. - [ ] Documented in #229; the decision recorded in ADR 0024. ## Out of scope Bit-for-bit reproducible builds as a formal property, and mirroring (#218).

fable-5 added this to the M28 — VS-NfD: offline/airgap deployment milestone 2026-07-30 01:43:50 +02:00

fable-5 added the

effort:M

area:supply-chain

vs-nfd

labels 2026-07-30 01:43:50 +02:00

fable-5 referenced this issue

2026-07-30 01:43:50 +02:00

[VS-NfD] Run and document a deployment in a network-isolated environment #220

fable-5 referenced this issue

2026-07-30 01:44:02 +02:00

[VS-NfD] Pin the Node version #236

fable-5 referenced this issue from a commit

2026-07-31 04:14:56 +02:00

#236: pin the Node version

fable-5 referenced this issue

2026-07-31 04:15:07 +02:00

#236: pin the Node version #257

fable-5 referenced this issue

2026-07-31 14:40:09 +02:00

#219: verified reproducible build without network access #287

fable-5 referenced this issue from a commit

2026-07-31 14:40:11 +02:00

#219: verified reproducible build without network access

fable-5 commented

2026-07-31 15:01:48 +02:00

Implemented in PR #287 (commit a758c9d), merged fast-forward (run 612 green; rerun 613 failed only on the known corrupted-action-cache runner signature); CD 616 green, readyz test+int ok. ADR 0024 par.4 decision taken explicitly and both ways: operation runs prebuilt digest-pinned images (no customer-side build); additionally the workspace build is verified offline - pnpm install --offline --frozen-lockfile plus pnpm build under docker run --network none with the pinned toolchain (node:22.15.1-alpine, pnpm 11.9.0), reproduced twice from clean checkouts with identical results. Offline kit = pnpm store (~870 MB) + build-user ~/.cache (~460 MB, prisma engines). The one network dependency found and bounded: the drawio plugin ZIP vendor tarball (deploy images contain no plugin ZIPs; CI=1 skips; offline ZIP builds pre-seed vendor/). Protocol: docs/vs-nfd/96-offline-build-protokoll.md; operations manual updated (also caught up the scheduler table to 10 jobs, missed in #224).

Implemented in PR #287 (commit a758c9d), merged fast-forward (run 612 green; rerun 613 failed only on the known corrupted-action-cache runner signature); CD 616 green, readyz test+int ok. ADR 0024 par.4 decision taken explicitly and both ways: operation runs prebuilt digest-pinned images (no customer-side build); additionally the workspace build is verified offline - pnpm install --offline --frozen-lockfile plus pnpm build under docker run --network none with the pinned toolchain (node:22.15.1-alpine, pnpm 11.9.0), reproduced twice from clean checkouts with identical results. Offline kit = pnpm store (~870 MB) + build-user ~/.cache (~460 MB, prisma engines). The one network dependency found and bounded: the drawio plugin ZIP vendor tarball (deploy images contain no plugin ZIPs; CI=1 skips; offline ZIP builds pre-seed vendor/). Protocol: docs/vs-nfd/96-offline-build-protokoll.md; operations manual updated (also caught up the scheduler table to 10 jobs, missed in #224).

fable-5 closed this issue

2026-07-31 15:01:48 +02:00

Sign in to join this conversation.