# Authentik proxy outpost 2026.8.4 corresponding source

This source offer corresponds to candidate tag `2026.8.4-tpio.1`, manifest
`sha256:5360554b2cb487e80674ea274f631b41daa148c45bec1a4d510beed1e5e3a3f3`.
Publishing this source offer does not publish the image tag.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. The source commit is
`410f46e5cf18f97a1f0056b30984a145242df55d`. The archive retains its upstream
licences; `build-records/LICENSE` is the exact image's application licence.

`Containerfile` is the exact recipe used for this candidate. Authentik's proxy
outpost is Rust in this release. It builds package `authentik` with default
features disabled and `proxy` enabled using digest-pinned Rust 1.97.1 on
linux/amd64. The recipe vendors the locked crates before the offline build;
its source target also retains a vendor archive. This public offer contains
the official release archive plus our recipe and exact-image build records,
under the upstream-release-plus-patches source policy. The included upstream
and effective Cargo.lock files match; no crate override was applied.

The scratch runtime contains the compiled proxy, its collected glibc/NSS
libraries, CA certificates, and UID/GID 65532. `build-records/` contains the
actual toolchain versions, Cargo lockfiles, modified rust-toolchain.toml,
upstream commit, licence, and `ldd` output extracted from this exact image.

Rebuild with the pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/authentik-proxy:2026.8.4-tpio.1 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds the offer to the
candidate manifest and actual image labels. Image publication requires fresh
unsuppressed zero critical/high scans, all eight real official-chart checks,
and this source offer live before any registry tag is written.