sneak
4720c40cfa
script/bootstrap did `pkg_install hugo hugo hugo hugo`, so the tool that produces the published artifact was whatever the base image's package repo happened to serve: alpine 3.21 gives hugo 0.139.0, about two years behind upstream, chosen by nobody, and liable to change silently on any base image digest bump. Hugo's version is a property of the site's output, not of the build environment, so it now gets pinned like every other external reference in this repo. It is installed with `go install github.com/gohugoio/hugo@v0.164.0`, which verifies the module against the sum.golang.org checksum database. That is genuine hash verification rather than bare version pinning, it is the mechanism REPO_POLICIES.md already names for Go, and it needs no hand-maintained sha256. It also keeps a single pinned base image: a digest-pinned Hugo container would have reintroduced the second base image that #7 deliberately removed. Two constants carry the decision, each with the canonical `# name version, YYYY-MM-DD` comment: - HUGO_VERSION=v0.164.0, the current stable release. - HUGO_GOTOOLCHAIN=go1.26.5. hugo v0.164.0's go.mod requires go >= 1.26.0 and alpine 3.21's go package is 1.23.9 built with GOTOOLCHAIN=local, so a bare `go install` refuses to run at all. Naming the toolchain makes Go fetch it through the module proxy and verify it against sum.golang.org like any other module, so the chain stays hash-verified end to end and the compiler is deliberate too. CGO_ENABLED=0 is deliberate: standard Hugo, not extended. Verified that this site uses nothing extended provides - no .scss/.sass, no resources.ToCSS, no PostCSS, and no image processing; the CSS is plain and inlined by readFile in baseof.html. The `+extended` on the apk build this replaces was incidental, and the script says so, so a later change does not assume extended is required. The binary is placed in /usr/local/bin rather than left in a GOPATH bin directory, because it has to be on the default PATH of a *fresh* shell: the Dockerfile's `RUN make check` and deploy.yml's `script/test` step each start their own shell. The location is overridable via HUGO_BIN_DIR for unprivileged installs, and `go install` itself runs as the invoking user so a workstation's module cache is not populated as root. The idempotency guard is version-aware instead of `missing hugo`: an older hugo already on PATH must be replaced, not accepted, or the pin means nothing. A same-version build that happens to be `+extended` is accepted, since it renders this site identically. After installing, the script re-checks what `hugo` on PATH actually resolves to and fails loudly if something else shadows it. Rendered output was compared three ways in a container carrying both binaries - apk 0.139.0 against 0.164.0 on identical sources. Across the whole public/ tree the only byte that differs is the generator meta tag's version string, which is the change describing itself. The RSS <language> element and the html lang attribute are unchanged. Cold `script/cibuild` is 2m36s, within the five-minute budget: 52.6s of it is the bootstrap layer (apk go, toolchain fetch, compile) and 100s is image export. The check image grows to 683 MB because the Go toolchain and module cache stay in the bootstrap layer; that image is only ever built to run checks, never published or deployed.
lora.vegas
Las Vegas Meshtastic and LoRa community website.
About
This site provides information about the Las Vegas mesh networking community, including:
- Mesh channel configurations
- Community coordination (Discord, Signal)
- Meetup information
- Local resources
Contributing
To contribute to this site, contact sneak@sneak.berlin for git repository access.
Technical Details
This is a static site built with Hugo. The site is deployed automatically via GitHub Actions.
Local Development
hugo server
Visit http://localhost:1313 to preview.
Build
hugo
Output will be in the public/ directory.
Entrypoints
This repository adheres to the
Scripts to Rule Them All
standard: normalized scripts in script/ are the entrypoints for the
development workflow, and the Makefile targets are thin shims that call them. We
provide:
script/bootstrap— install all build dependencies (git, make, go, hugo, node/npm) idempotently. Hugo is pinned to an exact version and installed withgo install, which verifies it againstsum.golang.org; the version is theHUGO_VERSIONconstant at the top of the scriptscript/setup— prepare a fresh clone: runscript/bootstrapand install the git pre-commit hookscript/test— the correctness check: a cleanhugo --minifyproduction buildscript/lint— a clean build that surfaces broken links and path collisionsscript/fmt— format the repo's own top-level markdown docs with prettierscript/fmt-check— check that formatting (read-only)script/check— runscript/test,script/lint, thenscript/fmt-check; modifies no tracked filesscript/docker— build the Docker image tagged with the project namescript/cibuild— the CI build (docker build .); the Dockerfile runsmake checkscript/install-precommit— install the git pre-commit hook that runsscript/check
A convenience make serve target runs hugo server for local preview.
License
Content is provided as-is for community use.