[kvinwang]

Cloning with umask 0002 gives copied scripts and text files different permissions from the release checkout, changing image layers and digests even when their contents match. Set explicit COPY permissions in Gateway, KMS, Verifier, and Bun auth-eth. Pin Bun release BuildKit and normalize exported timestamps using the commit timestamp. Document local reproduction and the clone-time umask requirement for older tags.

Validation:

• Six shared build-orchestration tests, prek checks, and git diff --check pass.
• Independent public-tag clones reproduce all three published 0.6.3 digests with umask 0022: Gateway 86de97186adeccc625cbda00f1d7a189d62555c56cf0463814abb75f5733d122, KMS e68766063cb3e792a85919ad500d16805b57f8d8b7424b71ff46a3c8cf5709fd, and Verifier 22aeb6808e38a56115f843d4d66f4852407e72f6080d5f8781fd82d9f819db41 (all SHA-256). Package-list checks pass and checkouts remain clean. At fixed commit 0cd3bfe34c, Gateway independently cloned under umask 0002 and 0022 produces the same digest: sha256:dc6d7fbb89d8ce6608ca3bb067eec0244c25ad1257ec64bd72d7a8e19484fb6d. Both runs rebuild the binary (about 11 minutes each), validate package lists, and leave clean checkouts. OCI metadata and the actual manifest hash agree; copied scripts are 0755 and text files 0644. KMS at the same fixed commit also passes both independent clone-time umasks (0002 and 0022), with identical digest sha256:4b387426808848431fa141d9975f4e59282fc095bf46a562f34153b34fc8a481. Both runs exit zero, leave clean checkouts, verify the OCI manifest hash and metadata digest, and retain builder/runtime pins matching HEAD. Scripts are 0755 and text files 0644; both runs execute compilation (about 10 minutes each). Paired evidence is retained in fixed/kms/comparison.json, with per-run verification, pins, logs, metadata, and OCI exports. Fixed-commit builds use an 8-CPU/64-GiB builder with shared cache and NO_CACHE unset; changed input modes invalidate the compilation cache. Verifier also passes both clone-time umasks at the same fixed commit, with identical digest sha256:f2c03a005feb81729665117ca94751777f32274acc3f8767c14999060119a8b7. Both runs exit zero, leave clean checkouts, verify manifest/metadata digests and unchanged builder/runtime pins, and actually compile Rust. The script is 0755; pins and configuration are 0644. All three paired comparisons now pass (six full builds, twelve unchanged pins files).
• Full-image experiment conditions: Ubuntu 24.04.4 x86_64, Linux 6.8.0-1028-intel, Docker 29.5.3, buildx 0.34.1, pinned BuildKit 0.20.2, linux/amd64, Rust x86_64-unknown-linux-musl; builder limited to 8 CPUs/64 GiB with max-parallelism 2, sequential builds, shared isolated cache without registry cache imports and NO_CACHE unset. IMAGE_VERSION=0.6.3, explicit source revision, commit-derived SOURCE_DATE_EPOCH (1793591245 for the fixed revision), no push. All six fixed builds execute compilation; subsequent validation/export reuses each run's cache. Total fixed sequence: about 63 minutes. Conditions, commands, logs, metadata, pins checks, and comparisons are retained locally; large OCI exports are retained separately. The tested three-component build inputs are unchanged by the subsequent Bun-only changes and cluster-test merge.
• Bun auth-eth: x86_64, Docker 29.5.3, buildx 0.34.1, OCI export, fixed source/commit epoch, reused cache. Context files with 0664 versus 0644 permissions yield the same digest with explicit COPY modes and rewrite-timestamp=true. Without timestamp rewriting, /app directory mtimes differ. This is a local permission/timestamp comparison, not a claim of matching an existing Bun release digest.

Published 0.6.3 tags and images are unchanged.