shadowdaoandClaude Opus 5.5 517a091539 ci: build through the internal package cache; pin almalinux base by digest ...

- BASE_IMAGE: CI resolves almalinux:10-minimal to almalinux@sha256:<digest>
  directly at registry-1.docker.io; the pkg-cache registry mirror is only
  used for a digest-pinned base. Both builds (smoke + push) get the same
  BASE_IMAGE / PKG_CACHE build-args.
- PKG_CACHE: the package RUN rewrites the AlmaLinux repos (pkg-cache-repos.sh
  rpm) before microdnf, installs epel-release + remi-release via
  `release-install epel remi` (signature-checked against keys/pkg-cache/,
  replacing microdnf epel-release + `dnf install https://...remi-release`),
  rewrites the new repo files, and restores everything before the RUN ends.
  Without PKG_CACHE the build uses the upstream repositories as before.
- scripts/pkg-cache-repos.sh, .gitea/scripts/resolve-base-image.sh and
  keys/pkg-cache/ are byte-identical copies from cloud-apache-container.

freshclam / SaneSecurity rsync build-time downloads are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 07:47:03 -07:00

..

pkg-cache

ci: build through the internal package cache; pin almalinux base by digest

2026-10-22 07:47:03 -07:00