mirror-base-image.yaml pulled the upstream index digest on an amd64 runner and
re-pushed it, publishing only the amd64 manifest; the python/golang mirrors
had no arm64 variant. Replace pull/tag/push with a registry-to-registry
`imagetools create` of the digest-pinned index via .gitea/scripts/
mirror-index-copy.sh: copy to <tag>-staging, assert linux/amd64+linux/arm64
are listed and the index digest equals the Docker Hub digest, then move the
real tag and re-assert. A failed assertion never touches the real tag.
Adds a local-registry test (.gitea/scripts/test-mirror-index-copy.sh).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
- Dockerfile: optional ARG PKG_CACHE; the apt RUN (dist-upgrade + pinned
haproxy) rewrites sources via scripts/pkg-cache-repos.sh apt and restores
them before the RUN ends. Without PKG_CACHE: upstream Debian, as before.
- coraza-spoa/Dockerfile: same for the build stage's apt RUN; go mod
download / go build (build + catalog stages) use go-env (GOPROXY via the
cache with proxy.golang.org fallback; GOSUMDB unchanged) and restore.
Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh
and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones.
- build-push.yaml / build-push-coraza.yaml: "Probe package cache" step
(TLS with the pinned CA), PKG_CACHE build-arg. Bases come from
repo.anhonesthost.net / gcr.io, not docker.io: registry mirror not used.
- mirror-base-image.yaml: resolve the tag's digest directly at Docker Hub
(.gitea/scripts/resolve-base-image.sh) and pull docker.io/library/<img>@sha256
so the mirrored content is exactly the digest Docker Hub reported; same
destination tags. Values reach run: via env only.
- Canonical copies (byte-identical) of scripts/pkg-cache-repos.sh,
.gitea/scripts/resolve-base-image.sh and keys/pkg-cache/ from
cloud-apache-container.
- VERSION 2026.10.7 so the rebuild does not overwrite the 2026.10.6 tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Sonnet 5.5