# external-dns v0.23.0 corresponding source

This source offer corresponds to candidate tag `v0.23.0-tpio.1`, manifest
`sha256:de0e5484b88efce284532ee015e03bfcc79952d687fbac7199d50b14738d6a1a`.
Publishing this source offer does not publish the image tag.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. There is no upstream vendor
directory. It retains the upstream Apache-2.0 licence (`LICENSE.md`). The
pinned source commit is `a10c5665a5bc30e7163eb17e853e317964500e99`.

`Containerfile` is the exact build recipe used for this candidate. It builds
external-dns with Go 1.27.2 for linux/amd64, CGO disabled, the standard
`golang.org/x/net@v0.60.0` bump, and a nonroot scratch runtime (UID/GID 65532).
Build records were extracted from this exact image: original/effective go.mod
and go.sum, vendor/modules.txt, binary Go build information, upstream commit,
licence and module overrides. The `bumps` file records `golang.org/x/net@v0.60.0`.

Rebuild using the digest-pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/external-dns:v0.23.0-tpio.1 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. `validation.json` is a sanitized
export of the actual passing official-chart functional result for that same
digest. The test used chart 1.23.0, verified UID 65532, `/healthz`, Prometheus
metrics, discovered source endpoints, CREATE of an annotated hostname, and
registry/source gauge sync. Image publication requires fresh unsuppressed
zero critical/high scans and all eight real Kubernetes checks to pass.