# alertmanager v0.34.1-tpio.2 corresponding source

This source offer corresponds to candidate tag `v0.34.1-tpio.2`, manifest
`sha256:4cad78c82e4a428827cd982e1c89cd913f2ff24819024aa5ba5c3f628ad3c8c8`.
Publishing this source offer does not publish the image tag. Never retag
`v0.34.1-tpio.1`.

`Containerfile` is the recipe that built this candidate. The image toolchain
label is `go1.27.3`. Go 1.27.3 includes the
`crypto/x509` fix for CVE-2026-111943 / GO-2026-6809. The image's
`go version -m` record begins `/out/bin/alertmanager: go1.27.3`.

Download every archive named in `archives.json` and verify `SHA256SUMS`.
The pinned source commit is `73c6bfe7393929211294c1954f30d8ed78e4d0ad`. Recorded module overrides (`bumps`):
`golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0 google.golang.org/grpc@v1.83.2 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0`.

`build-records/` is the `/usr/share/tp-hardened/alertmanager` tree copied
from this image. `go list -m -json` output is stored as `modules.json.txt`
because it is a stream of JSON objects; the image recorded that stream as
`modules.json`. `build-record.json` binds this offer to the candidate
manifest and copies the image labels, including the historical
`io.thepeoples.hardened.source-status` value.

Rebuild from these pins:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/alertmanager:v0.34.1-tpio.2 .
```

This reproduces the source and build configuration. It does not claim a
byte-for-byte image. Image publication still requires a live HTTP 200 source
page that names this digest, fresh unsuppressed zero critical/high scans, and
the observability validation for this digest.