Bump the Kit metadata label version, bundle krane with Twoliter #387
Conversation
cbgbt
force-pushed
the
bundle-krane
branch
2 times, most recently
from
569115f to
b64a8f2
Compare
| @@ -0,0 +1 @@ | |||
| SHA512 (go-containerregistry-v0.20.1.tar.gz) = c323c5b78c35fb7af67641fa4ef1802b944f8bd908163ff40a952a0c190e2dd210100efba1fbc2064495cff28a60d5bc7ee98e510ec116522c7897539b02fad8 | |||
There was a problem hiding this comment.
It'd be nice to have a URL in a comment above this, so it's easy to double-check hashes. Also in this case, there's both the GitHub-generated archive and a release artifact of the sources, so the URL would help indicate which one is used.
|
^ force push to address comment from @bcressey |
|
^ force push to rebase |
With support for krane bundled with twoliter, these codepaths are at risk of succumbing to bitrot. We will remove them in favor of providing the functionality ourselves.
Co-authored-by: Jarrett Tierney <[email protected]>
There was a problem hiding this comment.
Nice, this looks good!
Now that krane is bundled in to twoliter, there's some cleanup that we can do on oci-cli-wrapper (or maybe we can just eliminate it) because we needed to provide an interface that worked for both docker and krane and they didn't play nice in some cases. Not a problem for this PR though, we can just open an issue.
I was thinking about this too. For now I've opted to keep the interface in case we regret the decision to use krane or want to shop around, or re-introduce the ability to override it at runtime. I'm definitely open to removing it or favoring a more pleasant API in the future though! |
Issue number:
Closes #362
Closes #352
Description of changes:
The Kit metadata version bump is motivated by #384, which will begin to introduce application inventory that includes an RPM packages "Epoch" value and refrain from special-casing
bottlerocket-core-kit. This change will cause unexpected advisory evaluation behavior for downstream workspaces which depend on core-kit but use an older version of Twoliter when core-kit bumps the epoch of all packages.When introducing the version bump, Twoliter's integration tests began to fail because they depend on existing published kits, so this PR additionally:
kranetool with Twoliter, obviating the need to use system-provided OCI toolingTesting done:
bottlerocket-os/bottlerocketwith this change directly, I get the following message:Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.