# alertmanager rebuild recipe

Upstream release: [v0.34.1](https://github.com/prometheus/alertmanager/releases/tag/v0.34.1), commit
`73c6bfe7393929211294c1954f30d8ed78e4d0ad`. Application license: Apache-2.0;
LICENSE and NOTICE are retained in the runtime and source export.

The digest-pinned Go 1.27.2 builder compiles both `alertmanager` and `amtool` for
linux/amd64 with CGO disabled. Commit source and official release UI archives
are checked by SHA256 before extraction. UI checksums were independently matched
against upstream `sha256sums.txt` and the GitHub release asset digest. The Go
source archive is pinned from official download metadata in `source-inputs.json`.

Alertmanager is compiled with the upstream `netgo` build tag. The verified
release UI is extracted into `ui/app/dist` and embedded by upstream `ui/web.go`.
The precompressed gzip/Brotli files remain intact. `GOWORK=off` keeps the source
and dependency records scoped to the runtime module.

Both binaries use upstream version/revision build variables and retain their
individual embedded module records. Default source bumps:
`golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0 google.golang.org/grpc@v1.83.2 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0`. Apply bumps jointly to preserve the
net/crypto dependency requirement. The baseline dual scan identifies
CVE-2026-84445 in grpc 1.83.1 and CVE-2026-81870 in four OTel 1.44.0
modules; the defaults include the listed fixes (grpc 1.83.2 and OTel 1.45.0). Override `GO_BUMPS` only with reviewed scan
evidence and retain the final module graph with the corresponding-source offer.

The scratch runtime retains the upstream entrypoint, default command, writable
`/alertmanager` data directory and volume, configuration, CA roots and identity/NSS
files. It runs as `65534:65534`; only the static server and companion tool are
installed in `/bin`. Unused BusyBox and shell applets are omitted, following the
exporter slice's evidence of unfixed BusyBox HIGH findings. The upstream CLI and
Helm server probes use HTTP/exec of the retained tools; any custom shell probes
must be changed to HTTP or direct exec when adopting this image.

Build on the existing on-prem runner:

```sh
podman build --platform linux/amd64 --layers -t localhost/hardened/alertmanager:v0.34.1-tpio.1 remediate/helm/alertmanager
podman run --rm --network none localhost/hardened/alertmanager:v0.34.1-tpio.1 --version
podman run --rm --network none --entrypoint /bin/amtool localhost/hardened/alertmanager:v0.34.1-tpio.1 --version
```

Recipe preparation and CLI checks do not establish functional validation. Fresh
Trivy and Grype must both meet 0 CRITICAL / 0 HIGH; MEDIUM/LOW fixes are
best-effort. The pending observability phase must still validate real exporter
series, a firing alert received by Alertmanager, and all remaining integrated
stack checks with exact candidate digests and official upstream Helm charts.
Nothing in this recipe authorizes signing, publication or deployment.

## Corresponding source

The prepared offer binds `v0.34.1-tpio.1` to the unchanged candidate digest
`sha256:013d96b7a3738f1dc1f083dd61916ef7793d57c442767685f83ef8cdbb2ae9c9`.
`archives.json` declares seven bounded, checksum-pinned archives and planned source
URLs. The source artifacts and source page are not live yet. Source readiness
provides no release approval; fresh security and functional-validation gates
remain mandatory. Historical scanner counts remain prior evidence.

Every file in all seven OCI layers is inventoried in `image-layers.json` and
`candidate-source-audit.json`. Alertmanager and amtool are the only ELF objects;
there are no inherited executables, links, shell or libc. Five editable runtime
inputs preserve the exact CA roots, identity/NSS data and default configuration,
including ownership and modes. The configuration matches
`examples/ha/alertmanager.yml` in the pinned upstream source. Original records,
LICENSE and NOTICE match the actual runtime layers.

The source offer includes original upstream source, the 127-module vendor export,
Go 1.27.2 source, exact verified module-cache inputs and runtime data. The server
links 115 modules and amtool 110; their union is 117 path/version/checksum inputs.
All 117 full module ZIPs and required graph metadata are retained. The original
Go dependency bumps, build tags and version variables remain unchanged.

`rebuild-offline.sh` reproduces both Go executables with fresh extracted source,
module/build caches and networking disabled. It uses the exact compiled release
UI and preserves all precompressed gzip/Brotli files. `offline-proof.json` records
byte-identical outputs, matching build metadata except the output path, and
matching linked-module sets. Independent extraction from hashed original OCI
layers verifies both comparisons. The proof's initial partial-source fields
refer to its Go-only audit; `ui-source-closure.json` records subsequent UI
preferred-source completion. No original image, timestamp/compression or OCI
manifest reproduction is claimed.

The current carried UI is `ui/app/dist`, built from the Elm application. The
upstream Mantine proposal source tree is included in the upstream archive but
is not a carried release asset. `UI-asset-audit.json` records all 17 release
files and their 10 logical uncompressed files. All seven gzip/Brotli pairs decode
to identical bytes. The favicon matches the original upstream input.

UI inputs retain all 15 application Elm dependencies, complete application and
kernel sources/notices, exact npm distributions and preferred source repositories.
The npm lock's integrity pins and registry checksums verify all nine selected
style/peer/generator inputs. The original entrypoint imports Bootstrap CSS and
Font Awesome CSS; jquery/Popper are retained lock peers and are not imported as
JavaScript by that entrypoint. Official source snapshots retain Bootstrap SCSS,
font styles and all generator code. The Elm compiler source is the official
0.19.1 compiler tag, separate from the npm installer wrapper 0.19.1-6.
Vite 8.0.0, its Elm/compression plugins and Rolldown source are pinned separately.
Original application sources, lockfiles, configuration and relative-base setting
remain intact.

The Elm package endpoints returned HTTP 404. Each exact application dependency
was recovered from its official same-version Git tag, resolved and peeled
to a commit; its archived `elm.json` independently matches name and version.
Archive SHA256 and tag receipts are retained. An official package-server archive
checksum is not claimed for this recovery. No version substitution or source
endpoint/infrastructure change was made.

All five Font Awesome formats (WOFF2, WOFF, EOT, TTF and SVG) match both the exact
font-awesome 4.7.0 npm release and its publisher repository bytes. Editable OTF
and SVG font forms, the 707 SVG glyphs, original SCSS inputs and all license
notices are supplied. Compressed fonts decode to those same exact bytes. Font,
whole UI and compression regeneration are not claimed. The full source offer
preserves preferred inputs and provenance independently from Go reproduction.

To replay the Go executables, place recorded metadata and all declared archives
in one private input directory and verify its `SHA256SUMS`. Use an existing empty
output directory:

```sh
podman run --rm --pull=never --network=none --user 0:0 \
  -v "$ALERTMANAGER_SOURCE_DIR:/offer:ro,Z" -v "$ALERTMANAGER_REPLAY_DIR:/out:Z" \
  docker.io/library/golang@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 \
  sh /offer/rebuild-offline.sh /offer /out/replay
```

For a UI rebuild, extract the original upstream tree and preferred inputs and
follow `ui/app/package.json`, `elm.json`, `package-lock.json` and
`vite.config.mjs`. Preserve both gzip and Brotli representations and all fonts.
Build tools not cached here can be fetched using their exact locked integrity
pins. A hermetic whole-UI build and bit-identical compressed UI output are not
claimed by this source offer.

The original `source` target remains available when intentionally rebuilding a
candidate. Resuming this handoff reuses its existing checked export. The image's
old pending-source label is historical; recorded source completion is separate
evidence. Live source publication, current 0 CRITICAL / 0 HIGH gates, an actual
firing alert through the official-chart validation flow, cooldown policy and
post-publish pulls/signature checks remain required before normal release.