- BASE_IMAGE: CI resolves almalinux:10-minimal to almalinux@sha256:<digest>
directly at registry-1.docker.io; the pkg-cache registry mirror is only
used for a digest-pinned base. Both builds (smoke + push) get the same
BASE_IMAGE / PKG_CACHE build-args.
- PKG_CACHE: the package RUN rewrites the AlmaLinux repos (pkg-cache-repos.sh
rpm) before microdnf, installs epel-release + remi-release via
`release-install epel remi` (signature-checked against keys/pkg-cache/,
replacing microdnf epel-release + `dnf install https://...remi-release`),
rewrites the new repo files, and restores everything before the RUN ends.
Without PKG_CACHE the build uses the upstream repositories as before.
- scripts/pkg-cache-repos.sh, .gitea/scripts/resolve-base-image.sh and
keys/pkg-cache/ are byte-identical copies from cloud-apache-container.
freshclam / SaneSecurity rsync build-time downloads are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
517a091539