# VictoriaMetrics v1.154.0 corresponding source

This source offer corresponds to candidate tag `v1.154.0-tpio.2`, manifest
`sha256:f8bdff5c1c00d0a02941b47aa29e352a40bec5b84ff4a32815ace2c5dfed7a3c`.
Publishing this source offer does not publish the image tag. Never retag
`v1.154.0-tpio.1`.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. The release archive contains the
upstream vendored dependencies and embedded VMUI sources/assets. It retains
the upstream Apache-2.0 licence. The pinned source commit is
`29c43cd2fee05409499a4d1b38e950e1b7f13bd4`.

`Containerfile` is the exact build recipe used for this candidate. It builds
only vmsingle with Go 1.27.3 for linux/amd64, CGO disabled, and a nonroot
scratch runtime (UID/GID 65532). Go 1.27.3 includes the `crypto/x509` fix for
CVE-2026-111943 / GO-2026-6809. Build records were extracted from this exact
image: original/effective go.mod and go.sum, vendor/modules.txt, binary Go
build information (`go1.27.3`), upstream commit, licence and module overrides.
The `bumps` file is empty: no dependency overrides or source patches were applied.

Rebuild using the digest-pinned SDK and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/victoria-metrics:v1.154.0-tpio.2 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. Image publication requires a live
HTTP 200 source page that names this digest, fresh unsuppressed zero
critical/high scans, and all eight real Kubernetes checks to pass for this
digest.