timothyswan/hugo-source repository overview

Hugo⁠ static site generator with the extended build flag enabled (libsass via the bep/golibsass package, WebP image processing). Built from source on hi/go:latest-builder rather than consuming the upstream-shipped binary. Drop-in alternative to the Tier 2 hugo image with one key supply-chain advantage: we control the Go stdlib version.

⁠Why a separate image (vs Tier 2 hugo binary)

The Tier 2 binary hugo image is built from the upstream-published hugo_extended_<version>_linux-amd64.tar.gz tarball. That binary's Go stdlib version is whatever Go shipped when the hugo maintainers cut the release — and there's no way for us to change it. When a Go stdlib CVE drops (e.g., CVE-2026-27143, fixed in go1.25.9 / 1.26.2), the upstream binary stays vulnerable until hugo maintainers cut a NEW release rebuilt on patched Go. Multi-week lag in the worst case.

hugo-source builds Hugo from source on hi/go:latest-builder — whose Go version we control via the monthly RHHI rebuild cadence. When a Go stdlib patch ships, the next monthly rebuild picks it up and Hugo rebuilds against the patched Go automatically. Cuts the CVE-lag to the order of the rebuild cadence.

⁠Versions history

• v1.57.0 introduced this image as the non-extended variant (CGO disabled; css.Sass unavailable). Limited utility — the only known in-tree Hugo consumer is DefectDojo's docs build, and the Doks/Thulite theme requires libsass-coupled Sass resolution.
• v1.58.6 promoted to extended (current state). CGO + libsass-via-bundled-source + static link. Drop-in functional parity with the Tier 2 hugo binary, with the supply-chain win retained.

⁠Build details

Mirror of the vale-source pattern (Tier 1 + CGO + static link):

• Builder stage installs gcc-c++ + glibc-static + libstdc++-static via microdnf so the bundled libsass C++ source can compile (hi/go's repos don't include libsass-devel as a system package; we rely on bep/golibsass bundling its own libsass).
• CGO_ENABLED=1 + -tags extended + -linkmode=external -extldflags=-static produces a ~57 MB fully-static binary.
• Runtime: hi/core-runtime distroless — no glibc / libstdc++ needed at runtime because of the static link.

⁠Usage

# Render a site mounted at /src — identical CLI to the Tier 2 hugo image
podman run --rm -v "$(pwd):/src:Z" hugo-source:<version>-rhhi

⁠Supply chain

• Base images: registry.access.redhat.com/hi/go:latest-builder (build) → registry.access.redhat.com/hi/core-runtime (runtime — distroless)
• Built from: upstream github.com/gohugoio/hugo.git at v0.161.1 (commit ea8f66a7ce988664dcc84c052fc96757042e2e4a)
• Tier: 1 (Go from source, CGO_ENABLED=1 with static link) — vs the sibling hugo image which is Tier 2 (upstream binary release)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation

⁠Companion

The Tier 2 hugo image stays as the canonical upstream-binary build with SCAN_FAIL_SEVERITY: "none" (warn-only) on its grype gate because the upstream binary embeds vulnerable Go stdlib. Once hugo-source extended is proved in production for the docs path, the Tier 2 build can be retired (sweep item #7 in the v1.58 series).