# oauth2-proxy v7.15.5 corresponding source

This source offer corresponds to candidate tag `v7.15.5-tpio.1`, manifest
`sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82`.
Publishing this source offer does not publish the image tag.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. The release archive contains the
embedded sign-in, error, robots, logo and `/static` assets. There is no
upstream vendor directory. It retains the upstream MIT licence. The pinned
source commit is `bea3f04bf87b93f5354f392fe2216a88e6031350`.

`Containerfile` is the exact build recipe used for this candidate. It builds
oauth2-proxy with Go 1.27.2 for linux/amd64, CGO disabled, the standard
`golang.org/x/net@v0.60.0` bump, and a nonroot scratch runtime (UID/GID 65532).
Build records were extracted from this exact image: original/effective go.mod
and go.sum, vendor/modules.txt, binary Go build information, upstream commit,
licence and module overrides. The `bumps` file records `golang.org/x/net@v0.60.0`.

Rebuild using the digest-pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/oauth2-proxy:v7.15.5-tpio.1 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. `validation.json` is a sanitized
export of the actual passing official-chart functional result for that same
digest. The test used chart 10.7.1, verified UID 65532, `/ping`, `/ready`,
unauthenticated `/oauth2/auth` 401, a real OIDC login through in-cluster Dex,
and authenticated `/oauth2/auth` 202. Image publication requires fresh
unsuppressed zero critical/high scans and all eight real Kubernetes checks
to pass.