# prometheus rebuild recipe

Upstream release: [v3.15.0](https://github.com/prometheus/prometheus/releases/tag/v3.15.0), commit
`5241a27fe3c6983549fccc32f6e65917408c63cd`. Application license: Apache-2.0;
LICENSE and NOTICE are retained in the runtime and source export.

The digest-pinned Go 1.27.2 builder compiles both `prometheus` and `promtool` for
linux/amd64 with CGO disabled. Commit source and official release UI archives
are checked by SHA256 before extraction. UI checksums were independently matched
against upstream `sha256sums.txt` and the GitHub release asset digest. The Go
source archive is pinned from official download metadata in `source-inputs.json`.

Prometheus is compiled with the upstream `netgo,builtinassets` build tags.
The verified release UI is extracted into `web/ui/static`, compressed with
deterministic gzip headers, and embedded using the upstream template and sorted
asset paths. `GOWORK=off` restricts dependency/vendor records to the runtime root
module. Both the React and Mantine interfaces remain available.

Both binaries use upstream version/revision build variables and retain their
individual embedded module records. Default source bumps:
`golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0`. Apply bumps jointly to preserve the
net/crypto dependency requirement. Override `GO_BUMPS` only with reviewed scan
evidence and retain the final module graph with the corresponding-source offer.

The scratch runtime retains the upstream entrypoint, default command, writable
`/prometheus` data directory and volume, configuration, CA roots and identity/NSS
files. It runs as `65534:65534`; only the static server and companion tool are
installed in `/bin`. Unused BusyBox and shell applets are omitted, following the
exporter slice's evidence of unfixed BusyBox HIGH findings. The upstream CLI and
Helm server probes use HTTP/exec of the retained tools; any custom shell probes
must be changed to HTTP or direct exec when adopting this image.

Build on the existing on-prem runner:

```sh
podman build --platform linux/amd64 --layers -t localhost/hardened/prometheus:v3.15.0-tpio.1 remediate/helm/prometheus
podman run --rm --network none localhost/hardened/prometheus:v3.15.0-tpio.1 --version
podman run --rm --network none --entrypoint /bin/promtool localhost/hardened/prometheus:v3.15.0-tpio.1 --version
```

Recipe preparation and CLI checks do not establish functional validation. Fresh
Trivy and Grype must both meet 0 CRITICAL / 0 HIGH; MEDIUM/LOW fixes are
best-effort. The pending observability phase must still validate real exporter
series, a firing alert received by Alertmanager, and all remaining integrated
stack checks with exact candidate digests and official upstream Helm charts.
Nothing in this recipe authorizes signing, publication or deployment.

## Corresponding source

The prepared source offer binds `v3.15.0-tpio.1` to the unchanged candidate digest
`sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279`.
`archives.json` declares checksum-pinned bounded archives and planned source URLs.
The source artifacts and source page are not published yet. Source readiness
provides no security or functional-validation approval. Historical scanner counts
remain prior evidence; the normal publisher still requires current release gates.

The original Containerfile, OCI, payload and previously reproduced Go binaries
remain unchanged. All seven OCI layers contain regular files/directories;
`prometheus` and `promtool` are the only ELF objects. Five editable CA/identity/NSS/
configuration inputs retain exact bytes/modes/owners. The configuration matches
`documentation/examples/prometheus.yml` in the upstream commit archive.

Go inputs include the original upstream source, 249-module vendor export,
Go 1.27.2 source, recorded manifests/checksums and all 240 linked module ZIPs.
The server links 239 modules and promtool links 196. `offline-proof.json` is the retained
Go/runtime proof: both executables reproduced byte for byte using the exact
compiled release UI, with fresh caches and networking disabled. Its old partial
source flags describe that earlier audit; `ui-source-closure.json` supplies the
subsequent UI preferred-source completion. No original Go replay needs repeating
when resuming source publication.

The UI source archives retain verified npm distributions and their exact metadata,
full publisher-commit or same-version official repository sources, all notices,
original workspace sources/configuration/lockfiles and generation inputs. Each
npm tar matches the relevant lock integrity and registry checksum. Plain authored
JavaScript in launder, sanitize-html and Popper retains its editable input form;
compiled distributions elsewhere have separate preferred repository sources.
`ui-source-closure.json` accounts for 144 observed dependency identities, four
carried-code generators and one font identity. Additional historical candidates
in the archive are diagnostics; they are not alternate runtime versions or advisory
waivers. Actual package versions remain the advisory identities.

`ui-asset-input-bindings.json` binds all 518 React JS/CSS source-map entries to
exact copied package/upstream bytes or retained preferred generation inputs.
The nine generated Webpack runtime entries, generated Lezer parser, SVG loader
output and CSS module export retain their original source/generator inputs and
locked build configuration. They have not been independently regenerated.
Mantine's 79 component/version/license entries resolve to the same verified
package/source inventory. The compiled release assets and all runtime notices
remain available with the offer.

Both 61,024-byte font copies match the published `vscode-codicons` 0.0.7 font
exactly. Its publisher commit `3ab659fb3b15acd5989cc24051f04cec98babe14` supplies
325 SVG inputs, codepoint mapping and the original generation settings/scripts.
Font regeneration is not claimed. Source archive checksums and the font byte
comparison are recorded separately from version labels.

Two npm publisher commits are unavailable publicly: `react-remove-scroll-bar`
2.3.8 and `react-style-singleton`2.2.3. The source offer supplies exact public
TypeScript snapshots whose package manifests name2.3.7/2.2.2 respectively;
**all 24 distributed JavaScript files** (12 per package across es5/es2015/es2019)
reproduce byte for byte from those eight preferred TypeScript files. The npm
versions remain 2.3.8/2.2.3. The replay uses checksum-pinned TypeScript 4.9.5 and
its official preferred source; it performs per-file transpilation, with no whole
package type check or original-publisher-compiler claim. VM 140 independently
compared source/output hashes in a network-disabled namespace. The replay script,
options, source commits and individual hashes are in `ui-ts-replay.json` and the
UI archives. This byte correspondence justifies the supplied preferred inputs;
an unavailable commit alone is never treated as source coverage.

`rebuild-offline.sh` reproduces the Go executables with original compiled UI
assets, original build/version flags, deterministic gzip and sorted embed paths.
To prepare its input directory, copy the recorded source metadata and all declared
archives into one private directory, then verify the recorded `SHA256SUMS`.
Use an existing empty output directory:

```sh
podman run --rm --pull=never --network=none --user 0:0 \
  -v "$PROMETHEUS_SOURCE_DIR:/offer:ro,Z" -v "$PROMETHEUS_REPLAY_DIR:/out:Z" \
  docker.io/library/golang@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673 \
  sh /offer/rebuild-offline.sh /offer /out/replay
```

For a UI rebuild, extract the original upstream source and supplied preferred
inputs; follow its `web/ui/build_ui.sh --all` module/React/Mantine order and exact
workspace and React lockfiles, using upstream Node/pnpm requirements. Build tools
not cached here can be fetched using those locked integrity pins. Both UIs and
all their notices must remain present. The source offer does not claim a hermetic
whole-UI build or byte-identical compiled UI output. Do not replace dependencies
with newly resolved versions to make a source inventory pass.

Live corresponding-source publication, fresh security gates, exact-digest official
chart functional validation, cooldown policy and post-publish pulls/signature
verification remain required. The original build label referring to pending source
work is historical; recorded source completion is separate evidence. The first
publication cooldown waiver changes none of these requirements.