What comes in through the gate¶

Before the move, the code was Golem Trust’s and the registry it was built from was not. The firm runs its own GitLab with its own runners, so no pipeline job runs on GitLab.com’s shared machines, which is the part most firms leave undone. Underneath that, Harbor pulled base images from Docker Hub, and a Gitea instance mirrored two hundred and thirty-seven packages against upstream registries. Every build, however sovereign the forge on top, reached a US registry at the bottom. The scraps for this layer say: owning the forge is not owning the supply, and the supply is where a designation arrives without ever touching an account.

The gate¶

The inventory of what a build pulls came back with the forge clean and the floor foreign. GitLab and its runners are Golem Trust’s own. Harbor is its own registry, but it is a mirror, and what it mirrors is Docker Hub, run by Docker, Inc. of the United States. The Gitea mirror holds the packages Ludmilla has copied against indexes she does not run, on her standing principle that anything worth depending on is worth a copy nobody can ask back. So the trusted computing base of a Golem Trust build is a European forge sitting on a US image registry and a set of upstream package indexes, and the second and third of those were the ones nobody had drawn.

Mirror, pin, sign¶

The move was not to stop using Docker Hub or the indexes. Nobody rebuilds those in the basement. It was to stop a build depending on them being reachable, or unchanged, tomorrow morning. Base images are pinned by digest rather than by a tag that can move, pulled once into Harbor and served from there, so a build reads its own copy and not the internet’s. The internal mirror that was partial is made complete, one job’s worth of packages at a time. Artefacts are signed and carry SLSA provenance, so what came out of the pipeline can be told apart from what was slipped into it. The technical detail is in Golem Trust’s own mirroring runbook and, package class by package class, in the dependency reference and the software-composition notes.

Upstream is not the provider¶

The provider of the source and the provider of the software the source is built with are two different companies, and the second is the one nobody chose. A European forge and European runners still produce a chain that ends at Docker Hub and PyPI, the way Purple Lantern’s Swedish host still built from an American index. Pinned, mirrored and signed, that dependency becomes a delay when it breaks rather than a stoppage, which is the most a firm that is not rebuilding the world’s registries can honestly buy.

Pinned¶

   GitLab (self-hosted) + own runners        its own
        │
   Harbor  ◄── pinned by digest, served from the mirror
        │
   Docker Hub (US), PyPI, upstream indexes    mirrored, not depended on live
        │
   artefacts: signed, SLSA provenance

The forge and its runners Golem Trust’s own, base images pinned by digest and served from its own mirror, the package mirror completed, artefacts signed and provenanced, and the US registries at the bottom named, mirrored and reduced to a convenience rather than a live dependency.

What could go wrong?

• Docker Hub tightens anonymous pulls or removes an image, and builds keep running from the digest-pinned copies in Harbor, because nothing is fetched live.

• An upstream index is unreachable, and an existing build reproduces from the internal mirror, while a genuinely new dependency waits until it is mirrored.

• The mirror is treated as complete when it is not, and a build fails on the one package nobody copied, which the “complete it one job at a time” work exists to close.

• A signing key leaks, and unsigned or wrongly signed artefacts have to be caught by the provenance checks the pipeline now runs.

Magrat labels every jar in her stillroom, on the grounds that a remedy she cannot name is a poison she has not yet been introduced to.