# external-dns v0.23.0 corresponding source

This source offer corresponds to candidate tag `v0.23.0-tpio.2`, manifest
`sha256:a817b14db71e882f9fa440608502dc323c5421132f5d6f2e2a211820698a2dee`.
Publishing this source offer does not publish the image tag. Never retag
`v0.23.0-tpio.1`.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. There is no upstream vendor
directory. It retains the upstream Apache-2.0 licence (`LICENSE.md`). The
pinned source commit is `a10c5665a5bc30e7163eb17e853e317964500e99`.

`Containerfile` is the exact build recipe used for this candidate. It builds
external-dns with Go 1.27.3 for linux/amd64, CGO disabled, the standard
`golang.org/x/net@v0.60.0` bump, and a nonroot scratch runtime (UID/GID 65532).
Go 1.27.3 includes the `crypto/x509` fix for CVE-2026-111943 / GO-2026-6809.
Build records were extracted from this exact image: original/effective go.mod
and go.sum, vendor/modules.txt, binary Go build information (`go1.27.3`),
upstream commit, licence and module overrides. The `bumps` file records
`golang.org/x/net@v0.60.0`.

Rebuild using the digest-pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/external-dns:v0.23.0-tpio.2 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. Image publication requires a live
HTTP 200 source page that names this digest, fresh unsuppressed zero
critical/high scans, and all eight real Kubernetes checks to pass for this
digest.