#219: verified reproducible build without network access #287

fable-5 · 2026-07-31T14:40:09+02:00

fable-5 commented

2026-07-31 14:40:09 +02:00

ADR 0024 §4 decision taken both ways: prebuilt digest-pinned images for operation; additionally the workspace build verified offline (pnpm store + ~/.cache as the offline kit; prisma engines from the cache), reproduced twice from clean checkouts under docker run --network none with the pinned toolchain (node:22.15.1-alpine, pnpm 11.9.0). One network dependency found and bounded: the drawio plugin ZIP vendor tarball (deploy images contain no plugin ZIPs; CI=1 skips; offline ZIP builds pre-seed vendor/). Evidence: docs/vs-nfd/96-offline-build-protokoll.md. Also catches up the operations manual scheduler table to 10 jobs (missed in #224). Stacked on #218. Refs #219

fable-5 added 2 commits 2026-07-31 14:40:10 +02:00

#218 : mirror procedure into an internal registry

CI / Lint, typecheck, test (pull_request) Successful in 6m11s

Details

CI / Build container images (pull_request) Successful in 1m24s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Auth e2e pack (pull_request) Successful in 8m49s

Details

CD / Build and push images (push) Successful in 20s

Details

CD / Deploy to Test (push) Successful in 13s

Details

CD / Smoke tests against Test (push) Successful in 1m25s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 6m24s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Has been cancelled

Details

2f7ba65eef

Airgapped sites pull from their own registry (ADR 0024). The image list
is GENERATED (deploy/scripts/list-images.sh resolves the compose file
incl. the caddy profile) so a mirror can never silently miss a service;
third-party images gain a configurable ${REGISTRY_PREFIX:-} in the
compose file (digest pins unchanged - Docker verifies the same sha256
regardless of which registry serves it), own images keep IMAGE_PREFIX;
no image reference is ever edited per site.

Step-by-step procedure in deploy/stages.md 5b: generate list, copy
digest-preservingly (docker buildx imagetools create; plain
pull/tag/push as the documented fallback - the digest comparison closes
the loop either way), verify the digest in the mirror against the pin,
point the deployment via REGISTRY_PREFIX/IMAGE_PREFIX.

Executed once end-to-end and recorded as assessor-facing evidence
(docs/vs-nfd/95-mirror-protokoll.md): all four third-party images
mirrored digest-identically into a local registry:2, plus
dorfteich-api:v0.12.0 (sha256:576f1646... identical on both sides; the
imagetools stall against the Gitea registry is recorded with its
workaround). Operations manual's airgap section now lists the mirror
part as available.

Refs #218.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

#219 : verified reproducible build without network access

CI / Lint, typecheck, test (pull_request) Successful in 6m45s

Details

CI / Build container images (pull_request) Successful in 1m14s

Details

CI / Auth e2e pack (pull_request) Successful in 8m37s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CD / Build and push images (push) Successful in 21s

Details

CD / Deploy to Test (push) Successful in 12s

Details

CD / Smoke tests against Test (push) Successful in 1m16s

Details

CD / Promote to Int (push) Successful in 28s

Details

CI / Lint, typecheck, test (push) Successful in 6m19s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 8m12s

Details

CI / Import/export fidelity gate (push) Successful in 58s

Details

a758c9d78b

The ADR 0024 §4 decision, taken explicitly and both ways: customers
OPERATE prebuilt digest-pinned images (no customer-side build), and
ADDITIONALLY the workspace build is verified to work with networking
disabled - so site-local patching stays possible without internet.

Evidence (docs/vs-nfd/96-offline-build-protokoll.md): pnpm install
--offline --frozen-lockfile plus pnpm build under docker run
--network none (node:22.15.1-alpine + pnpm 11.9.0, the pinned
toolchain), reproduced twice from clean checkouts with identical
results. The offline kit is the pnpm store (~870 MB) plus the build
user's ~/.cache (~460 MB - the prisma engines live there; without the
cache the prisma postinstall fails offline).

The one network dependency found and bounded: the drawio plugin's
installable ZIP fetches its pinned vendor tarball on first build.
Deploy images contain no plugin ZIPs, so the delivery-relevant build is
fully offline (CI=1 skips the fetch, as in CI); an offline ZIP build
pre-seeds the tarball into packages/plugins/drawio/vendor/.

Also catches up the operations manual's scheduler-job table to 10
(read-trail-maintenance was added in #224 without the row here).

Refs #219.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit a758c9d78b into main

2026-07-31 14:58:17 +02:00

fable-5 referenced this pull request

2026-07-31 15:01:48 +02:00

[VS-NfD] Make the build reproducible without network access #219

Sign in to join this conversation.

No reviewers