# cert-manager-webhook-linode v0.4.1 corresponding source

This source offer corresponds to candidate tag `v0.4.1-tpio.1`, manifest
`sha256:233234900b5ae3809291ea0f8a33c3940d9a14e5bf3b195e45d3f0ba3ed69d32`.
Publishing this source offer does not publish the image tag.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. There is no upstream vendor
directory. It retains the upstream Apache-2.0 licence (`LICENSE`). The
pinned source commit is `444640b7724c69f6f3031a2096e255dcf91678e8`.

`Containerfile` is the exact build recipe used for this candidate. It builds
cert-manager-webhook-linode with Go 1.27.2 for linux/amd64, CGO disabled, the
standard `golang.org/x/net@v0.60.0` and `golang.org/x/crypto@v0.57.0` bumps,
`google.golang.org/grpc@v1.83.2`, `github.com/google/cel-go@v0.29.0`, a
consistent OpenTelemetry 1.45.0 family, and a nonroot scratch runtime
(UID/GID 65532). Build records were extracted from this exact image:
original/effective go.mod and go.sum, vendor/modules.txt, binary Go build
information, upstream commit, licence and module overrides. The `bumps`
file records those GO_BUMPS.

Rebuild using the digest-pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/cert-manager-webhook-linode:v0.4.1-tpio.1 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. `validation.json` is a sanitized
export of the actual passing official-chart functional result for that same
digest. The test used chart v0.4.1, verified UID 65532, `/healthz` over HTTPS
on `--secure-port=8443`, the aggregated APIService, serving cert from the
chart SelfSigned->CA path, solver group `acme.slicen.me`, and a
ChallengePayload POST that the webhook Present() handled. Image publication
requires fresh unsuppressed zero critical/high scans and all eight real
Kubernetes checks to pass.