From 2cbcaa93f79dfaebec182e511e8510a10a63c77b Mon Sep 17 00:00:00 2001
From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:23:02 -0400
Subject: [PATCH 1/2] Page: install a build cache on an air-gapped network
---
air-gapped-build-cache-install/index.html | 134 ++++++++++++++++++++++
sitemap.xml | 4 +
2 files changed, 138 insertions(+)
create mode 100644 air-gapped-build-cache-install/index.html
diff --git a/air-gapped-build-cache-install/index.html b/air-gapped-build-cache-install/index.html
new file mode 100644
index 0000000..01d5f75
--- /dev/null
+++ b/air-gapped-build-cache-install/index.html
@@ -0,0 +1,134 @@
+
+
+
+
+
+Install a build cache on an air-gapped network
+
+
+
+
+
+
+
+
+
+
fosterstack
+
Infrastructure worth keeping — and kept patched.
+
+
+
Install a build cache on an air-gapped network
+
The server is one static program with nothing to download at install time and nothing it reaches out for at startup. So an air-gapped install is short: move the files across, verify them, run.
+
+
What to bring across
+
On a machine with internet access, download these from the release page:
+
+
The archive for your platform, for example fscache_X.Y.Z_linux_amd64.tar.gz.
+
checksums.txt and checksums.txt.bundle, which is the signature over the checksums.
+
cosign, the signature checker. It is one static binary and will not be on a fresh isolated machine.
+
If you run containers: the image as a tar file, for example crane pull ghcr.io/fosterstack/cache:X.Y.Z fscache-X.Y.Z.tar. Images are published for both linux/amd64 and linux/arm64. Across a gap you pick one by hand, so pull on a machine of the destination type, or add --platform.
+
+
+
Verify before you cross the gap
+
Do this on the connected side, where the signature check can reach its public log:
+
# 1. Prove the checksums file is ours
+cosign verify-blob \
+ --bundle checksums.txt.bundle \
+ --certificate-identity-regexp='^https://github.com/fosterstack/cache/' \
+ --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
+ checksums.txt
+
+# 2. Prove your archive matches it
+sha256sum -c <(grep "fscache_X.Y.Z_linux_amd64.tar.gz" checksums.txt)
+
Both steps matter. The checksum alone only shows the archive matches a file you carried beside it. The signature is what ties that file to us.
+
+
Install on the isolated side
+
For the binary: unpack the archive and follow the install guide from the unpack step, including the systemd service. There is no separate offline procedure.
Put an HTTPS proxy in front of it before other machines use it. The offline install guide has the full detail, including what to do for later upgrades.
+
+
It does not call out
+
The server sends no telemetry and has no update or licence check, so it behaves the same with no route to the internet.
The archive for your platform, for example fscache_X.Y.Z_linux_amd64.tar.gz.
checksums.txt and checksums.txt.bundle, which is the signature over the checksums.
cosign, the signature checker. It is one static binary and will not be on a fresh isolated machine.
-
If you run containers: the image as a tar file, for example crane pull ghcr.io/fosterstack/cache:X.Y.Z fscache-X.Y.Z.tar. Images are published for both linux/amd64 and linux/arm64. Across a gap you pick one by hand, so pull on a machine of the destination type, or add --platform.
+
If you run containers: the image as a tar file, for example crane pull ghcr.io/fosterstack/cache:X.Y.Z fscache-X.Y.Z.tar. Verify the image with cosign verify before you export it, while you still have registry access (the image verification guide has the command). Images are published for both linux/amd64 and linux/arm64. Across a gap you pick one by hand, so pull on a machine of the destination type, or add --platform.
Put an HTTPS proxy in front of it before other machines use it. The offline install guide has the full detail, including what to do for later upgrades.
+
Real deployments terminate HTTPS at a proxy in front of the server, because Gradle sends the password with every request. The offline install guide has the full detail, including what to do for later upgrades.
It does not call out
The server sends no telemetry and has no update or licence check, so it behaves the same with no route to the internet.