- Dockerfile: optional ARG PKG_CACHE; the apt RUN (dist-upgrade + pinned
haproxy) rewrites sources via scripts/pkg-cache-repos.sh apt and restores
them before the RUN ends. Without PKG_CACHE: upstream Debian, as before.
- coraza-spoa/Dockerfile: same for the build stage's apt RUN; go mod
download / go build (build + catalog stages) use go-env (GOPROXY via the
cache with proxy.golang.org fallback; GOSUMDB unchanged) and restore.
Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh
and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones.
- build-push.yaml / build-push-coraza.yaml: "Probe package cache" step
(TLS with the pinned CA), PKG_CACHE build-arg. Bases come from
repo.anhonesthost.net / gcr.io, not docker.io: registry mirror not used.
- mirror-base-image.yaml: resolve the tag's digest directly at Docker Hub
(.gitea/scripts/resolve-base-image.sh) and pull docker.io/library/<img>@sha256
so the mirrored content is exactly the digest Docker Hub reported; same
destination tags. Values reach run: via env only.
- Canonical copies (byte-identical) of scripts/pkg-cache-repos.sh,
.gitea/scripts/resolve-base-image.sh and keys/pkg-cache/ from
cloud-apache-container.
- VERSION 2026.10.7 so the rebuild does not overwrite the 2026.10.6 tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
dc1cbeb12a