# loki rebuild recipe

Upstream [3.7.8](https://github.com/grafana/loki/releases/tag/v3.7.8), commit
`09e6ce2ff1bdc19763a10265b870c86f51c98655`; application license AGPL-3.0-only.
The digest-pinned Go 1.27.2 builder checks the commit archive SHA256 before
extraction and compiles the complete Loki server for linux/amd64 with CGO off
and the upstream `netgo` tag. The upstream Makefile uses the same static Go
build and version variable package. No Loki server components are removed.

The default dependency updates are net 0.60.0, crypto 0.57.0, the three OTLP
trace exporter modules 1.45.0, OTel SDK 1.45.0, both OTLP log exporters and
logging SDK and stdout log exporter 0.21.0. These logging modules must move
together because the log API changed. Updates are applied jointly; the final
module graph and exact binary build metadata are retained. The local
`pkg/push` module replacement stays within the verified source tree. A newer
dependency alone does not establish a passing security gate.

The scratch runtime preserves upstream UID 10001, direct server entrypoint,
default local configuration, writable `/loki`, CA roots, timezone and identity
files. `/tmp` has mode 1777. It contains the static server and source records;
shell-based probes require HTTP or direct executable alternatives.

```sh
podman build --platform linux/amd64 --layers -t localhost/hardened/loki:3.7.8-tpio.1 remediate/helm/loki
podman run --rm --network none localhost/hardened/loki:3.7.8-tpio.1 -version
podman run --rm --network none localhost/hardened/loki:3.7.8-tpio.1 -config.file=/etc/loki/local-config.yaml -verify-config=true
```

The preserved local configuration disables tenant authentication and uses
single-process filesystem storage. It is a development default. Production
must supply a reviewed configuration, persistent storage, resource limits,
retention and an authenticated ingress or proxy; Loki does not include an
authentication layer. Set `analytics.reporting_enabled: false` for isolated
validation so it does not send usage statistics outside the test environment.
See [Loki authentication](https://grafana.com/docs/loki/latest/operations/authentication/)
and [configuration](https://grafana.com/docs/loki/latest/configure/).

Keep free space on the WAL filesystem and alert before it fills: this release
[throttles writes at 90% disk usage](https://github.com/grafana/loki/blob/09e6ce2ff1bdc19763a10265b870c86f51c98655/pkg/ingester/wal.go).
Validation preserves that safeguard; build caches must be cleaned before using
the shared runner filesystem for ingestion.

Use the pinned community chart 18.15.1 in `Monolithic` mode for the integrated
test, with MinIO disabled. Real Alloy pod-log ingestion and LogQL retrieval,
the Grafana datasource/dashboard and exact digest coverage remain required on
the existing official-chart k3s validation flow. An isolated push/query smoke
supplements that validation. Keep the observability phase pending until all
stack checks are implemented and pass.

## Current private candidate validation

The exact candidate manifest is
`sha256:dcd7ff876fa5283fdbb6e4763b2f2b562f29cece939a7ebf83c09e8e69054f2b`,
config `sha256:d49e690deac62b55e99fd319a2139d774eef66e6d27af6cfcdb3942056a8130e`.
The normal package helper gates this digest at C/H/M/L **0/0/0/0**, UNKNOWN=1,
without VEX or ignored Grype matches. Trivy 0.75.0 DB UpdatedAt is
2026-10-13T01:09:18.36500669Z; Grype 0.120.1 DB built is
2026-10-12T06:45:22Z. A first private pass with the older logging modules left
two medium findings and is retained separately as superseded.

CLI/config checks and a network-none, read-only-root smoke pass: readiness,
version/commit, metrics, push HTTP 204, exact timestamp/log line through LogQL,
and retrieval after a restart using persistent `/loki` storage. Upstream's
build-info endpoint leaves `goVersion` empty; CLI and embedded binary metadata
confirm Go 1.27.2. The smoke disables analytics and preserves the WAL disk
safeguard. These checks supplement the pending integrated k3s validation and
do not establish release eligibility.

## Corresponding-source preparation

`source-inputs.json` is incomplete and cannot replace a full `archives.json`
offer. The `source` target exports the verified upstream archive, final vendor
archive with dependency notices, all final module manifests (including local
modules), upstream/final root manifests, module/package graphs, executable
metadata, license notices, commit/bump records and SHA256SUMS. Export with the
same build arguments and verify every checksum.

```sh
podman build --platform linux/amd64 --layers --target source -t localhost/hardened-source/loki:3.7.8-tpio.1 remediate/helm/loki
```

Before publication, finish the corresponding-source inventory for retained
distroless CA/timezone/identity/config assets, toolchain and Go dependencies,
publish its live source page, pass fresh Trivy/Grype at 0 CRITICAL / 0 HIGH,
complete integrated validation and use the normal publication guards. This
recipe does not authorize signing or publishing.