rpm2img: use package version, release, and epoch #384
Conversation
When building application inventory, use a package's actual version and use the <timestamp>.<commit>.br1 for all packages, not just first party packages. Additionally, expose a package's Epoch - set to 0 if "(none)". Signed-off-by: Gavin Inglis <[email protected]>
ginglis13
force-pushed
the
app-inventory-pkg-version
branch
from
d1f98f6 to
44a2623
Compare
There was a problem hiding this comment.
LGTM.
I'd love to find a way to remove the special-casing around core-kit here, though. I wonder if "the right way" is to provide some generic preprocessor which removes the %{_cross_os} macro expansion for each kit?
Another option could be to allow kits to expose an arbitrary preprocessor somehow.
We could have a "remove vendor prefix" option somewhere, maybe in the kit metadata? Or alternatively - just accept that the inventory will list I'm contemplating shifting the kernels into a kernel kit, and this would be a factor there. Either we'd have to add another special case for "packages from the kernel kit", or we'd end up switching the package name from "kernel-6.1" to "bottlerocket-kernel-6.1" as part of the move. |
I somewhat favor this, rather than trying to elevate what is currently just a convention into a system of options and metadata based on that convention. If we were to do this, I think it would just mean committing to changing the advisories to include the full name ( @ginglis13 is this something that we could realistically chase down now? |
That sounds like a realistic approach to me - the timing is very important, but the version-locking that #387 buys us would make that timing clear:
I don't think this is a problem that needs to be solved immediately, however, and I'd still like to spend time thinking about some of the options we have and what are the risks involved - @bcressey if you have an inkling of roughly when you'd like to see a kernels-specific kit, please let me know and I'll think harder and faster :) If you're both aligned with a separate, more focused change regarding package naming, I'll keep this change as is and create an issue in this repo. |
I am comfortable deferring this until some time which is soon but not right now. |
When building application inventory, use a package's actual version and use the ..br1 for all packages, not just first party packages. Additionally, expose a package's Epoch - set to 0 if "(none)".
Issue number:
Closes #364
Description of changes:
When building application inventory, use a package's actual version
and use the
<timestamp>.<commit>.br1for all packages, not justfirst party packages. Additionally, expose a package's Epoch -
set to 0 if "(none)".
Epoch: 1to all package spec defns for which the package version is < any core kit release versions.Testing done:
make testBuild a Bottlerocket k8s-1.29 variant with these changes; in the local Bottlerocket repo, I modified the first party packages to have an
Epoch: 1to ensure this is passed properly.results in an application inventory file below:
Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.