From 8756cee76c06facccb38cbbb7d0ee9cb7a0e5369 Mon Sep 17 00:00:00 2001
From: Aryan Puttur <putturaryan@gmail.com>
Date: Fri, 14 Aug 2026 14:52:36 -0400
Subject: [PATCH 1/5] Add skupper-source OCI image for downstream build
 contexts

Fixes #2559
---
 Dockerfile.source | 11 +++++++++++
 Makefile          | 14 ++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 Dockerfile.source

diff --git a/Dockerfile.source b/Dockerfile.source
new file mode 100644
index 000000000..39d063004
--- /dev/null
+++ b/Dockerfile.source
@@ -0,0 +1,11 @@
+# OCI image that packages the Skupper source tree for reproducible downstream builds.
+# Not intended to be run; publish to quay.io/skupper/skupper-source:<version> and
+# consume via build context / additional build contexts instead of git clone.
+FROM scratch
+
+LABEL \
+  org.opencontainers.image.title="Skupper source" \
+  org.opencontainers.image.description="Skupper source tree at a fixed release for downstream container builds"
+
+# Match upstream Dockerfile.* builder layout (WORKDIR /go/src/app).
+COPY . /go/src/app
diff --git a/Makefile b/Makefile
index e7f1ddfc0..017b9fa81 100644
--- a/Makefile
+++ b/Makefile
@@ -6,6 +6,7 @@ GOARCH ?= amd64
 
 REGISTRY := quay.io/skupper
 IMAGE_TAG := v2-dev
+SOURCE_IMAGE := skupper-source
 ROUTER_IMAGE_TAG := main
 PLATFORMS ?= linux/amd64,linux/arm64
 CONTAINERFILES := Dockerfile.cli Dockerfile.kube-adaptor Dockerfile.controller Dockerfile.network-observer Dockerfile.system-controller
@@ -120,6 +121,19 @@ podman-build-must-gather:
 podman-push-must-gather:
 	${PODMAN} push "${REGISTRY}/skupper-must-gather:${IMAGE_TAG}"
 
+## Source tree OCI image for downstream build contexts (see Dockerfile.source).
+docker-build-source:
+	${DOCKER} build $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+
+docker-push-source: docker-build-source
+	${DOCKER} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
+
+podman-build-source:
+	${PODMAN} build $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+
+podman-push-source: podman-build-source
+	${PODMAN} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
+
 ## Print fully qualified image names by arch
 describe-multiarch-oci:
 	@scripts/oci-index-archive-info.sh amd64 arm64

From a64f312d19abea9f5a670bccb1616f2fb9c9cd0d Mon Sep 17 00:00:00 2001
From: Aryan Puttur <putturaryan@gmail.com>
Date: Fri, 14 Aug 2026 15:18:36 -0400
Subject: [PATCH 2/5] Exclude .git from source image and publish on release
 tags

---
 .circleci/config.yml | 21 +++++++++++++++++++++
 .dockerignore        |  1 +
 2 files changed, 22 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8ca947b88..f15e63b08 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -173,6 +173,13 @@ workflows:
             - publish-oci-images
           context:
             - skupper-org
+      - publish-source-image:
+          <<: *run_for_numeric_tags
+          image_tag: << pipeline.git.tag >>
+          requires:
+            - publish-oci-images
+          context:
+            - skupper-org
   build:
     jobs:
       - build-all:
@@ -376,6 +383,20 @@ jobs:
           command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
       - run: make docker-build-must-gather IMAGE_TAG="<< parameters.image_tag >>"
       - run: make docker-push-must-gather IMAGE_TAG="<< parameters.image_tag >>"
+  publish-source-image:
+    executor:
+      name: go_cimg
+    parameters:
+      image_tag:
+        type: string
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run:
+          name: Docker login
+          command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
+      - run: make docker-build-source IMAGE_TAG="<< parameters.image_tag >>"
+      - run: make docker-push-source IMAGE_TAG="<< parameters.image_tag >>"
   generate-operator-bundle:
     executor:
       name: go_cimg
diff --git a/.dockerignore b/.dockerignore
index f3bfc2862..050cb6ccb 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,6 +2,7 @@
 .circleci
 .github
 .codespellrc
+.git/
 
 # Documentation
 README.md

From 1c89803e74a84cae362c04b52f3068d6886dca74 Mon Sep 17 00:00:00 2001
From: Aryan Puttur <putturaryan@gmail.com>
Date: Fri, 14 Aug 2026 15:28:24 -0400
Subject: [PATCH 3/5] Only run docker-push-source in release CI

---
 .circleci/config.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index f15e63b08..050c13d77 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -395,7 +395,6 @@ jobs:
       - run:
           name: Docker login
           command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
-      - run: make docker-build-source IMAGE_TAG="<< parameters.image_tag >>"
       - run: make docker-push-source IMAGE_TAG="<< parameters.image_tag >>"
   generate-operator-bundle:
     executor:

From 235fabfc8dec81592f21b20fd82e4c5a5a245ae9 Mon Sep 17 00:00:00 2001
From: Aryan Puttur <putturaryan@gmail.com>
Date: Wed, 2 Sep 2026 15:43:38 -0400
Subject: [PATCH 4/5] Vendor Go modules in skupper-source image

---
 .dockerignore     |  1 +
 Dockerfile.source | 12 +++++++++++-
 Makefile          |  4 ++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 050cb6ccb..28feaa9ea 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 .github
 .codespellrc
 .git/
+vendor/
 
 # Documentation
 README.md
diff --git a/Dockerfile.source b/Dockerfile.source
index 39d063004..893638515 100644
--- a/Dockerfile.source
+++ b/Dockerfile.source
@@ -1,6 +1,16 @@
 # OCI image that packages the Skupper source tree for reproducible downstream builds.
 # Not intended to be run; publish to quay.io/skupper/skupper-source:<version> and
 # consume via build context / additional build contexts instead of git clone.
+ARG GO_IMAGE_BASE_TAG=1.25
+FROM golang:${GO_IMAGE_BASE_TAG} AS vendor
+
+WORKDIR /go/src/app
+COPY go.mod go.sum .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+COPY . .
+RUN go mod vendor
+
 FROM scratch
 
 LABEL \
@@ -8,4 +18,4 @@ LABEL \
   org.opencontainers.image.description="Skupper source tree at a fixed release for downstream container builds"
 
 # Match upstream Dockerfile.* builder layout (WORKDIR /go/src/app).
-COPY . /go/src/app
+COPY --from=vendor /go/src/app /go/src/app
diff --git a/Makefile b/Makefile
index 017b9fa81..7f671cb0b 100644
--- a/Makefile
+++ b/Makefile
@@ -123,13 +123,13 @@ podman-push-must-gather:
 
 ## Source tree OCI image for downstream build contexts (see Dockerfile.source).
 docker-build-source:
-	${DOCKER} build $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+	${DOCKER} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
 
 docker-push-source: docker-build-source
 	${DOCKER} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
 
 podman-build-source:
-	${PODMAN} build $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+	${PODMAN} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
 
 podman-push-source: podman-build-source
 	${PODMAN} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"

From 4c69b990f1fcf427f3aa9b08d21a6703865fed05 Mon Sep 17 00:00:00 2001
From: Aryan Puttur <putturaryan@gmail.com>
Date: Wed, 2 Sep 2026 15:49:02 -0400
Subject: [PATCH 5/5] Fix COPY destination in Dockerfile.source

---
 Dockerfile.source | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile.source b/Dockerfile.source
index 893638515..da92c90a6 100644
--- a/Dockerfile.source
+++ b/Dockerfile.source
@@ -5,7 +5,7 @@ ARG GO_IMAGE_BASE_TAG=1.25
 FROM golang:${GO_IMAGE_BASE_TAG} AS vendor
 
 WORKDIR /go/src/app
-COPY go.mod go.sum .
+COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod \
     go mod download
 COPY . .