# Argo CD v3.5.6 corresponding source and rebuild recipe

Image identity: `oci.thepeoples.io/hardened/argocd:v3.5.6-tpio.1` at
`sha256:14c6db861d099f19c712f075313bfe22400460eeba0aa9ed784a8c598a94caea`.

This source offer names the exact candidate built by harden run 703. Consult the
catalog for publication and validation status; a source offer alone is not a
release approval.

The upstream release tarball is Argo CD v3.5.6, commit
`c2b1e3017e2cec86b122172e861dcd026453ae44`, SHA-256
`6a0af11b2bce7f72719b8669617d5ef1f2ae9389f95f7c13bb8720d336a9f513`.
`archives.json` also pins the Helm, Kustomize and Git LFS release sources.
Upstream licenses remain in those archives.

The retained Containerfile and go-min-bump.sh are the exact recipe/helper used
for this candidate. Go 1.27.3 fixes CVE-2026-111943; the Argo CD compress module
floor v1.18.7 fixes CVE-2026-63209. Module changes are made by the helper; no application-code patch or VEX is applied.
The source commit and package versions were checked against the resulting image
and SBOM, respectively; see build-records/versions.json.

Download the files and archives, then verify `sha256sum -c SHA256SUMS`.
For a rebuild from this directory, restore the helper executable bit with
`chmod +x go-min-bump.sh`, then run
`podman build --platform linux/amd64 -t argocd-source-rebuild .`. The pinned Containerfile fetches upstream sources and
uses the recorded same-major module floors. Build within existing storage;
this recipe's measured source-build entry floor is 32 GiB. Full functional
validation and fresh scanner gates remain separate requirements.