- Base image pinned by digest resolved directly from Docker Hub
(.gitea/scripts/resolve-base-image.sh); registry mirror only when pinned.
- Probe the cache over TLS with the pinned CA; without it, builds use the
upstream repositories and Docker Hub exactly as before.
- Dockerfile: ARG BASE_IMAGE / PKG_CACHE; package RUN rewrites repos via
scripts/pkg-cache-repos.sh (canonical copy from cloud-apache-container),
installs epel-release with GPG-verified release-install, restores repo
files before the RUN ends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
root