HH-500: add reproducible production dist bundle (#111)

* HH-500: add reproducible production dist bundle

* HH-500: make production bundle builds reproducible

* HH-500: lock complete runtime APK closure

---------

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/Dockerfile

@@ -61,12 +61,24 @@ FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d650
 ARG VERSION=dev
 ARG COMMIT_SHA=unknown
 ARG BUILD_DATE=unknown
+ARG SOURCE_DATE_EPOCH=0
 LABEL org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.revision="${COMMIT_SHA}" \
       org.opencontainers.image.created="${BUILD_DATE}"
 
-# Install runtime and recovery dependencies.
-RUN apk --no-cache add bash ca-certificates tzdata curl openssl postgresql16-client && \
+# Install and verify the complete pinned runtime dependency closure.
+COPY deploy/docker/gochat-runtime-apks.txt /tmp/gochat-runtime-apks.txt
+RUN apk --no-cache add bash=5.2.37-r0 brotli-libs=1.1.0-r2 busybox=1.37.0-r14 \
+    busybox-binsh=1.37.0-r14 c-ares=1.34.8-r0 ca-certificates=20260413-r0 \
+    ca-certificates-bundle=20260413-r0 curl=8.14.1-r2 libcrypto3=3.3.7-r0 \
+    libcurl=8.14.1-r2 libidn2=2.3.7-r0 libssl3=3.3.7-r0 \
+    libncursesw=6.5_p20241006-r3 libpq=17.11-r0 libpsl=0.21.5-r3 libunistring=1.2-r0 \
+    lz4-libs=1.10.0-r0 musl=1.2.5-r11 ncurses-terminfo-base=6.5_p20241006-r3 \
+    nghttp2-libs=1.69.0-r0 \
+    openssl=3.3.7-r0 postgresql-common=1.2-r1 postgresql16-client=16.15-r0 \
+    readline=8.2.13-r0 tzdata=2026c-r0 zlib=1.3.2-r0 zstd-libs=1.5.6-r2 && \
+    apk info -vv | sed 's/ .*//' | sort | diff -u /tmp/gochat-runtime-apks.txt - && \
+    rm /tmp/gochat-runtime-apks.txt && \
     addgroup -S gochat && adduser -S gochat -G gochat
 
 WORKDIR /app

deploy/docker/README.dist.md

@@ -0,0 +1,27 @@
+# GoChat production bundle
+
+This directory is a source-free delivery package. It contains the GoChat and
+Shangwutong images plus every repository file referenced by the production
+Compose configuration.
+
+```bash
+sha256sum -c SHA256SUMS
+docker load --input images/gochat-*-images.tgz
+cp .env.example .env
+# Replace every CHANGE_ME value and create the external secret/mount paths.
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml config --quiet
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml --profile ops run --rm migrate
+docker compose --env-file .env -f deploy/docker/docker-compose.prod.yml up -d --wait
+```
+
+The bundle uses source-versioned local image tags so it can start immediately
+after `docker load`; `SHA256SUMS` protects the handoff. Before registry-based
+production promotion, push both images, replace the two image references in
+`.env` with immutable `@sha256:` references, then run:
+
+```bash
+deploy/docker/preflight.sh .env
+```
+
+See `docs/ops/02-production-operations.md` for TLS, backup, rollback, and drill
+requirements.

deploy/docker/gochat-runtime-apks.txt

@@ -0,0 +1,35 @@
+alpine-baselayout-3.6.8-r1
+alpine-baselayout-data-3.6.8-r1
+alpine-keys-2.5-r0
+alpine-release-3.21.7-r0
+apk-tools-2.14.6-r3
+bash-5.2.37-r0
+brotli-libs-1.1.0-r2
+busybox-1.37.0-r14
+busybox-binsh-1.37.0-r14
+c-ares-1.34.8-r0
+ca-certificates-20260413-r0
+ca-certificates-bundle-20260413-r0
+curl-8.14.1-r2
+libcrypto3-3.3.7-r0
+libcurl-8.14.1-r2
+libidn2-2.3.7-r0
+libncursesw-6.5_p20241006-r3
+libpq-17.11-r0
+libpsl-0.21.5-r3
+libssl3-3.3.7-r0
+libunistring-1.2-r0
+lz4-libs-1.10.0-r0
+musl-1.2.5-r11
+musl-utils-1.2.5-r11
+ncurses-terminfo-base-6.5_p20241006-r3
+nghttp2-libs-1.69.0-r0
+openssl-3.3.7-r0
+postgresql-common-1.2-r1
+postgresql16-client-16.15-r0
+readline-8.2.13-r0
+scanelf-1.3.8-r1
+ssl_client-1.37.0-r14
+tzdata-2026c-r0
+zlib-1.3.2-r0
+zstd-libs-1.5.6-r2